SUSE-SU-2026:24651-1

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-53288: arm64: Reserve an extra page for early kernel mapping (bsc#1269813).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
• CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
• CVE-2026-68140: net/iucv: fix use-after-free of a severed iucv_path (bsc#1275581).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68337: bpf: Reject redirect helpers without a bpf_net_context (bsc#1274635).
• CVE-2026-68383: drm/xe/guc: Keep scheduler timeline name alive (bsc#1274816).
• CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-68449: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning (bsc#1274839).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
• CVE-2026-74466: s390/ap/zcrypt: Rework AP message buffer allocation (bsc#1277810).
• CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74690: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() (bsc#1276929).
• CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80584: s390/qeth: validate user buffer length in SNMP and ARP query (bsc#1277341).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
• CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
• CVE-2026-80710: s390/dasd: Fix undersized format-check buffer (bsc#1278167).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
• CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
• CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
• CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
• CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (bsc#1279494).
• CVE-2026-80881: ocfs2: fix buffer head management in ocfs2_read_blocks() (bsc#1279496).
• CVE-2026-80978: ip6_gre: fix hardware header length for NBMA tunnels (bsc#1280253).
• CVE-2026-80988: NTB: ntb_transport: Fail TX enqueue when the QP link is down (bsc#1280266).
• CVE-2026-89456: s390/dasd: Propagate partial completion length across ERP (bsc#1280326).
• CVE-2026-89487: openvswitch: only skb_tx_error() a packet we are about to drop (bsc#1280510).
• CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (bsc#1280472).
• CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler (bsc#1280520).
• CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler (bsc#1280569).
• CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (bsc#1280713).
• CVE-2026-89554: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (bsc#1280736).
• CVE-2026-89559: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (bsc#1280554).
• CVE-2026-89560: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (bsc#1280806).
• CVE-2026-89595: fsnotify: Fix stale object mask after concurrent mark updates (bsc#1280834).
• CVE-2026-89602: erofs: skip sufficiently large global buffers when resizing (bsc#1280827).
• CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826).
• CVE-2026-89633: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (bsc#1280867).
• CVE-2026-89637: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (bsc#1280492).
• CVE-2026-89648: ceph: cap delegated inode count in ceph_parse_deleg_inos() (bsc#1280427).
• CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563).
• CVE-2026-89657: libceph: validate OSD extent maps before cursor advance (bsc#1280545).
• CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling (bsc#1280822).
• CVE-2026-89757: mm/mglru: fix and remove redundant unevictable folio handling (bsc#1280763).
• CVE-2026-89761: apparmor: fix out-of-bounds write when null terminating a label vec (bsc#1280745).
• CVE-2026-89762: apparmor: fix cred UAF caused by begin_current_label_crit_section() (bsc#1280749).
• CVE-2026-89786: ext4: fix out-of-bounds read in ext4_read_inline_dir() (bsc#1280976).
• CVE-2026-89787: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (bsc#1280977).
• CVE-2026-89812: drm/amdgpu: force complete the MES ring fences on reset (bsc#1281146).
• CVE-2026-89813: drm/amdgpu: force complete the KIQ ring fences on reset (bsc#1281147).
• CVE-2026-89924: KVM: s390: Fix old_data leak in guest debug error path (bsc#1281347).
• CVE-2026-90042: ceph: properly decrypt filenames in vmalloc() buffers (bsc#1280948).
• CVE-2026-90057: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (bsc#1281650).
• CVE-2026-90081: net/rds: use wq_has_sleeper() in rds_cong_map_updated() (bsc#1281490).
• CVE-2026-90092: Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (bsc#1281384).
• CVE-2026-90103: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (bsc#1281538).
• CVE-2026-90107: net/smc: free pending qentry in smc_llc_flow_stop() before memset (bsc#1281510).
• CVE-2026-90111: ip6mr: do not clone dst in ip6mr_cache_report() (bsc#1281505).
• CVE-2026-90114: net: bridge: Reject descending VLAN tunnel ranges (bsc#1281509).
• CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (bsc#1281577).
• CVE-2026-90138: vsock: don't check the listener's sk_err in vsock_accept() (bsc#1281535).
• CVE-2026-90148: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (bsc#1281551).
• CVE-2026-90227: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (bsc#1281705).
• CVE-2026-90230: nvme: Add the DHCHAP maximum HD IDs (bsc#1281715).
• CVE-2026-90315: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (bsc#1281865).
• CVE-2026-90393: bpf: Fix potential UAF in bpf_netns_link_update_prog (bsc#1282289).
• CVE-2026-90434: isofs: release zisofs block pointer buffer head (bsc#1281993).
• CVE-2026-93181: perf/x86/intel/uncore: Fix uncore_box ref/unref ordering (bsc#1281817).
• CVE-2026-93211: nfsd: initialize DRC hash table before registering shrinker (bsc#1282740).
• CVE-2026-93228: svcrdma: Reject Write/Reply chunks with segcount 0 (bsc#1282697).
• CVE-2026-93231: lockd: fix swapped arguments in nlmsvc_match_ip() (bsc#1282778).
• CVE-2026-93250: vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() (bsc#1282677).
• CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush() (bsc#1283004).
• CVE-2026-93269: ext4: fix circular lock dependency in ext4_ext_migrate (bsc#1282810).
• CVE-2026-93795: blk-cgroup: fix leaks and online flag on radix_tree_insert failure (bsc#1283155).
• CVE-2026-93817: perf: Fix addr_filter_ranges lifetime (bsc#1283017).
• CVE-2026-93828: exfat: fix handling of damaged volume in exfat_create_upcase_table() (bsc#1282890).
• CVE-2026-93830: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (bsc#1282889).
• CVE-2026-97410: netconsole: take target_cleanup_list_lock in drop_netconsole_target() (bsc#1283082).
• CVE-2026-97596: ipvs: reject invalid states in connection template sync records (bsc#1283941).
• CVE-2026-97603: idpf: disable DIM work before freeing q_vectors (bsc#1283782).
• CVE-2026-97612: net: mpls: clear inner_protocol when the last label is popped (bsc#1283967).
• CVE-2026-97954: net/rds: fix tcp stream corruption with large pages (bsc#1283113).
• CVE-2026-97963: net: stmmac: initialize ptp_lock at probe time (bsc#1282984).
• CVE-2026-97964: ppp_synctty: ensure a writeable skb header (bsc#1282962).
• CVE-2026-97965: vxlan: initialize _md in vxlan_xmit_one() (bsc#1282963).
• CVE-2026-97988: vhost: invalidate vring access on IOTLB transitions (bsc#1283397).
• CVE-2026-97991: vdpa_sim_blk: reject out-of-range sector starts (bsc#1283356).
• CVE-2026-97993: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx (bsc#1283339).
• CVE-2026-98014: net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (bsc#1283668).
• CVE-2026-98022: net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (bsc#1283810).
• CVE-2026-98023: vxlan: reject dynamic fdb entries that reference a nexthop id (bsc#1283960).
• CVE-2026-98027: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size (bsc#1283803).
• CVE-2026-98031: nexthop: Initialize extack in remove_nh_grp_entry() (bsc#1283662).
• CVE-2026-98039: bpf: Require MEM_PERCPU for percpu kptr stores (bsc#1284063).
• CVE-2026-98047: bpf: Check ancestor frames for rbtree callbacks (bsc#1284068).
• CVE-2026-98058: bpf: Mark syscall helpers as sleepable (bsc#1283848).
• CVE-2026-98068: net/rds: don't let rds_conn_shutdown() consume a concurrent drop (bsc#1283903).
• CVE-2026-98069: net/rds: acquire the fastpath locks in rds_conn_shutdown() (bsc#1283863).
• CVE-2026-98070: net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() (bsc#1283916).
• CVE-2026-98071: net/rds: clear cp_flags bits individually in rds_conn_path_reset() (bsc#1283842).
• CVE-2026-98074: bonding: do not clear curr_active_slave prematurely when releasing all slaves (bsc#1283871).
• CVE-2026-98078: ipvs: fix reversed sequence option serialization (bsc#1284150).
• CVE-2026-98086: ALSA: ump: do not touch legacy_rmidi before it exists (bsc#1283785).
• CVE-2026-98095: af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header() (bsc#1283921).
• CVE-2026-98122: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() (bsc#1283886).
• CVE-2026-98154: nvme-rdma: fix -EIO cleanup order in queue_rq (bsc#1283418).
• CVE-2026-98158: ppp_async: drop the errored frame instead of resetting its headroom (bsc#1283933).
• CVE-2026-98257: rds: ib: use rds_conn_drop() on protocol version mismatch (bsc#1284346).
• CVE-2026-98258: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list (bsc#1284584).
• CVE-2026-98282: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (bsc#1284360).
• CVE-2026-98283: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() (bsc#1284595).
• CVE-2026-98306: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (bsc#1284505).
• CVE-2026-98368: esp: downgrade zerocopy managed frags before mutating skb frags (bsc#1284498).
• CVE-2026-98373: mm/hugetlb: preserve mremap address delta when skipping page tables (bsc#1284742).
• CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (bsc#1284740).
• CVE-2026-98375: xen/netfront: drop RX packets with a short Ethernet header (bsc#1284944).
• CVE-2026-98376: bpf: Use array_map_meta_equal for percpu array inner map replacement (bsc#1284945).
• CVE-2026-98466: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (bsc#1286218).
• CVE-2026-98471: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (bsc#1286240).
• CVE-2026-98503: packet: use ubuf_info completion for TX_RING packets (bsc#1286020).
• CVE-2026-98507: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish (bsc#1286430).
• CVE-2026-98555: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (bsc#1286769).
• CVE-2026-98631: xsk: Use a 32-bit compare in xsk_map_gen_lookup (bsc#1286233).
• CVE-2026-98713: KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT (bsc#1286779).
• CVE-2026-98720: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified (bsc#1286743).
• CVE-2026-98895: net/mlx5: HWS, Handle destroying table that has a miss table (bsc#1288009).
• CVE-2026-99131: xfs: fix capability check in xfs (bsc#1288668).
• CVE-2026-99176: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (bsc#1288703).
• CVE-2026-99178: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (bsc#1288713).
• CVE-2026-100071: net: hsr: free learned nodes on device setup failure (bsc#1282870).

The following non security issues were fixed:

• accel/qaic: reject BO sizes that overflow page count (git-fixes).
• ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length (git-fixes).
• ACPI: CPPC: Validate the _CPC package header (git-fixes).
• ACPI: extlog: Validate elog record length before walking sections (git-fixes).
• ACPI: fan: Fix memory leak due to leftover devm_kcalloc() argument (git-fixes).
• ACPI: HMAT: preserve hmat_adist_nb notifier block (git-fixes).
• ACPI: PCI: pci_link: clear driver_data before free (git-fixes).
• ACPI: pfr_update: zero-initialize capability query result (git-fixes).
• ACPI: PM: Drop parent state update from acpi_device_get_power() (git-fixes).
• ACPI: tables: handle failed initrd override mappings (git-fixes).
• ACPI: video: Fix backlight unregistration ordering (git-fixes).
• ACPICA: Fix memory leak in acpi_ds_create_field() (git-fixes).
• ACPICA: Fix PCC OperationRegion command offsets (git-fixes).
• ACPICA: Initialize parser_state.aml_end in acpi_install_method() (git-fixes).
• ALSA: 6fire: take stream_mutex in the Digital Thru control (git-fixes).
• ALSA: aloop: Keep the timer source alive until card release (git-fixes).
• ALSA: aloop: Update the PCM Slave controls for a matching playback (git-fixes).
• ALSA: caiaq: Allow zero-length packet handling for EP1 (git-fixes).
• ALSA: caiaq: Fix races at MIDI URB and trigger accesses (git-fixes).
• ALSA: caiaq: Register card at the final step (git-fixes).
• ALSA: caiaq: Serialize access to the EP1 command buffer (git-fixes).
• ALSA: compress: add missing OPEN-state gate to SET_METADATA (git-fixes).
• ALSA: compress: fix buffer leak on failed SET_PARAMS (git-fixes).
• ALSA: compress: reject buffer geometry change on gapless next_track (git-fixes).
• ALSA: control: Fix virtual master creation reference in kernel-doc (git-fixes).
• ALSA: cs46xx: fix unit mismatch in DSP code area bounds check (git-fixes).
• ALSA: hda/hdmi: clamp num_cvts against cvt_nids in hdmi_read_pin_conn (git-fixes).
• ALSA: hda/hdmi: clamp sad_count in ELD proc write handler (git-fixes).
• ALSA: hda: Add NULL check for the driver pointer at unsol event work (git-fixes).
• ALSA: hda: Avoid non-operational GPU warning at regular device removal (git-fixes).
• ALSA: hda: Fix potential UAF for gating jack (git-fixes).
• ALSA: hda: intel: Cancel delayed work at shutdown, too (git-fixes).
• ALSA: hda: Reject codec reset on ASoC (ext_ops) buses (git-fixes).
• ALSA: info: Fix memory leak at card removal (git-fixes).
• ALSA: jack: Fix kctl free at error in snd_jack_kctl_new() (git-fixes).
• ALSA: jack: Protect the index scan against control removal (git-fixes).
• ALSA: jack: Remove debugfs before freeing unregistered jacks (git-fixes).
• ALSA: line6: Clear prev_fbuf on capture buffer release (git-fixes).
• ALSA: line6: Fix potential OOB write in line6_capture_copy() (git-fixes).
• ALSA: line6: Reject too small max packet sizes (git-fixes).
• ALSA: line6: Use kzalloc() for PCM buffer allocation (git-fixes).
• ALSA: pcm: Fix driver_tstamp value reporting (git-fixes).
• ALSA: pcm: Protect channel-map reads against runtime detach (git-fixes).
• ALSA: pcm: Protect delay DMA sync against concurrent HW_FREE (git-fixes).
• ALSA: pcm: Protect delay DMA sync in forward and rewind, too (git-fixes).
• ALSA: pcm: Protect the unregister notifier traversal (git-fixes).
• ALSA: pcm: Remove channel-map controls before freeing substreams (git-fixes).
• ALSA: pcm: Unlink substreams before releasing them (git-fixes).
• ALSA: pcmtest: Fix a bogus pointer read in snd_pcmtst_pcm_pointer() (git-fixes).
• ALSA: pcmtest: handle multiple wraps in random capture fill (git-fixes).
• ALSA: pcmtest: Honor the enable parameter (git-fixes).
• ALSA: pcmtest: Pin the module while pattern files are open (git-fixes).
• ALSA: pcmtest: Reject invalid fill_mode values (git-fixes).
• ALSA: rawmidi: Drain input work before freeing the runtime (git-fixes).
• ALSA: seq: Fix missing direction and ump_group handling in 32bit compat ioctl (git-fixes).
• ALSA: seq: oss: Skip events until fully initialized (git-fixes).
• ALSA: sh: aica: Fix spu_memset() stride (git-fixes).
• ALSA: ump: Avoid dereference with max_src_size=0 (git-fixes).
• ALSA: ump: Correct return size of fill_rpn() (git-fixes).
• ALSA: usb-audio: Use fixed control index for us16x08 mixer elements (git-fixes).
• ALSA: via82xx: use helper to activate DXS controls (git-fixes).
• ALSA: virtio: reset I/O message fill level on prepare (git-fixes).
• ALSA: vmaster: Protect follower lookup and setup (git-fixes).
• ASoC: adau17x1: return cache sync errors from resume (git-fixes).
• ASoC: ak4642: return cache sync errors from resume (git-fixes).
• ASoC: amd: acp: Fix .close() being skipped on rollback (git-fixes).
• ASoC: amd: ps: Fix acp63_pdm_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: ps: Fix acp63_sdw_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: raven: Fix acp3x_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: raven: Fix memory leak in acp3x_dma_close() (git-fixes).
• ASoC: amd: renoir: Fix acp_pdm_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: vangogh: Fix acp5x_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: yc: Fix acp6x_pdm_dma_close() being skipped on rollback (git-fixes).
• ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() (git-fixes).
• ASoC: atmel-i2s: fix MCK generator error handling (git-fixes).
• ASoC: atmel-i2s: use optional API for gclk (git-fixes).
• ASoC: atmel-i2s: use optional API for muxclk (git-fixes).
• ASoC: atmel: atmel-pcm-pdc: Fix atmel_pcm_close() being skipped on rollback (git-fixes).
• ASoC: codecs: da732x: Fix definition of ADC2 EQ Overall Volume control (git-fixes).
• ASoC: codecs: es*: Modify the registers related to ALC RECOVERY (git-fixes).
• ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ (git-fixes).
• ASoC: codecs: rt5659: propagate GPIO errors (git-fixes).
• ASoC: codecs: rt5682s: disable jack detection work on shutdown (git-fixes).
• ASoC: codecs: sta32x: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).
• ASoC: codecs: sta32x: Fix definition of limiter threshold controls (git-fixes).
• ASoC: codecs: sta350: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).
• ASoC: codecs: sta350: Fix definition of limiter threshold controls (git-fixes).
• ASoC: codecs: tlv320adc3xxx: Fix definition of AGC Target Level control (git-fixes).
• ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() (git-fixes).
• ASoC: codecs: wm5100: Fix definition of EQ3 Band 1 Volume control (git-fixes).
• ASoC: codecs: wm8510: Fix definition of ADC Inversion Switch control (git-fixes).
• ASoC: codecs: wm8737: Fix definition of zero cross switches (git-fixes).
• ASoC: codecs: wm8750: Fix definition of ALC Capture NG Type control (git-fixes).
• ASoC: codecs: wm8955: Fix definition of Treble Cutoff control (git-fixes).
• ASoC: codecs: wm8983: Fix definition of ADC 128x Oversampling control (git-fixes).
• ASoC: codecs: wm8985: Fix definition of ADC 128x Oversampling control (git-fixes).
• ASoC: codecs: wm8990: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).
• ASoC: codecs: wm8990: Fix definition of right input PGA controls (git-fixes).
• ASoC: codecs: wm8991: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).
• ASoC: codecs: wm8991: Fix definition of right input PGA controls (git-fixes).
• ASoC: codecs: wm8994: Fix definition of WM8958 noise gate hold time controls (git-fixes).
• ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() (git-fixes).
• ASoC: codecs: wm_hubs: Fix definition of MIXINR to MIXOUTR volume control (git-fixes).
• ASoC: codecs: wsa883x: disable runtime PM on unbind (git-fixes).
• ASoC: codecs: wsa883x: Fix VI sense port channel count (git-fixes).
• ASoC: codecs: wsa884x: Accept temperatures across the full trim range (git-fixes).
• ASoC: codecs: wsa884x: disable runtime PM on unbind (git-fixes).
• ASoC: codecs: wsa884x: Fix VI sense port channel count (git-fixes).
• ASoC: cs42l56: Remove the ADC Mute Switch control (git-fixes).
• ASoC: dwc: Use OF match data again for StarFive JH7110 (git-fixes).
• ASoC: es8316: return cache sync errors from resume (git-fixes).
• ASoC: es8326: report resume restore errors (git-fixes).
• ASoC: fsl_asrc: check the second front-end DMA channel (git-fixes).
• ASoC: fsl_asrc: use regmap_write_bits to update clock source registers (git-fixes).
• ASoC: hdac_hda: Allocate the private data at codec driver bind (git-fixes).
• ASoC: hdac_hda: Balance the runtime PM disable in codec remove (git-fixes).
• ASoC: hdac_hda: Keep runtime PM state in sync across codec remove/probe (git-fixes).
• ASoC: hdac_hda: Restore the codec device type on unbind (git-fixes).
• ASoC: imx-pcm-rpmsg: Fix imx_rpmsg_pcm_close() being skipped on rollback (git-fixes).
• ASoC: intel: atom: Fix .shutdown() being skipped on rollback (git-fixes).
• ASoC: Intel: atom: Fix platform device leak on probe failure (git-fixes).
• ASoC: Intel: avs: Prevent module info underflow (git-fixes).
• ASoC: Intel: avs: Unprepare a stream when recovery occurs (git-fixes).
• ASoC: mediatek: common: Handle constraint return value in FE startup (git-fixes).
• ASoC: mediatek: common: Keep codec references until the card is bound (git-fixes).
• ASoC: mediatek: mt6797: fix wrong unwind order and error code in enable_clock (git-fixes).
• ASoC: mediatek: mt8183: Fix APLL enable error handling (git-fixes).
• ASoC: mediatek: mt8183: Fix clock handling in mux disable path (git-fixes).
• ASoC: mediatek: mt8183: Fix wrong clock cleanup on clk_set_parent() failure (git-fixes).
• ASoC: mediatek: mt8186: Fix AFE clock error handling (git-fixes).
• ASoC: mediatek: mt8186: Fix APLL enable error handling (git-fixes).
• ASoC: mediatek: mt8186: Fix APLL mux setting error handling (git-fixes).
• ASoC: mediatek: mt8186: Fix clock handling in mux disable path (git-fixes).
• ASoC: mediatek: mt8186: Fix MCK error handling (git-fixes).
• ASoC: mediatek: mt8188: Handle constraint return value in FE startup (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-clk: Handle clock enable errors (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-clk: Handle tuner clock enable errors (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-clk: Propagate regmap update errors (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-pcm: Handle runtime resume errors (git-fixes).
• ASoC: mediatek: mt8192-mt6359: Fix error handling in MTKAIF calibration (git-fixes).
• ASoC: mediatek: mt8192: check return values in mt8192_afe_gpio_init() (git-fixes).
• ASoC: mediatek: mt8192: fix AFE clock error handling (git-fixes).
• ASoC: mediatek: mt8192: fix APLL mux error handling (git-fixes).
• ASoC: mediatek: mt8192: fix error handling in APLL enable functions (git-fixes).
• ASoC: mediatek: mt8192: fix MCK clock error handling (git-fixes).
• ASoC: mediatek: mt8192: Handle regcache_sync() failure in runtime resume (git-fixes).
• ASoC: mediatek: mt8192: Propagate errors in I2S DAI DAPM event handlers (git-fixes).
• ASoC: mediatek: mt8192: Propagate errors in TDM DAI DAPM event handlers (git-fixes).
• ASoC: mediatek: mt8192: Propagate mt8192_afe_gpio_request() errors in ADDA DAI (git-fixes).
• ASoC: mediatek: mt8192: switch to devm_clk_get_optional() (git-fixes).
• ASoC: mediatek: mt8195: Check paired MEMIF clock enable in FE trigger (git-fixes).
• ASoC: mediatek: mt8195: Fix ETDM MCLK error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix ETDM probe error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix ETDM startup error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix FE startup error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix HDMI TX startup error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix main clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix paired memif clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix register access clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix runtime resume error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix timing system clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix tuner clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Propagate IRQ lookup errors (git-fixes).
• ASoC: mediatek: mt8365: Fix out-of-bounds read in get_iir_coef() (git-fixes).
• ASoC: mediatek: mt8365: Handle constraint return value in FE startup (git-fixes).
• ASoC: mt6359-accdet: manage private workqueues with devres (git-fixes).
• ASoC: nau8540: return cache sync errors from resume (git-fixes).
• ASoC: ops: Fix return value in snd_soc_limit_volume() (git-fixes).
• ASoC: pcm6240: do not free an unrequested IRQ (git-fixes).
• ASoC: qcom: q6apm: clear g_apm on driver removal (git-fixes).
• ASoC: qcom: q6apm: reset the hw pointer with the fragment queue (git-fixes).
• ASoC: qcom: qdsp6: q6afe: fix clk vote response type mismatch (git-fixes).
• ASoC: rockchip: rockchip_i2s: Handle runtime PM resume failures in set_fmt (git-fixes).
• ASoC: rt711-sdca: always cancel jack work on remove (git-fixes).
• ASoC: rt711-sdw: always cancel jack work on remove (git-fixes).
• ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls (git-fixes).
• ASoC: rt712-sdca: always cancel jack work on remove (git-fixes).
• ASoC: rt712: avoid duplicate reset in io_init (git-fixes).
• ASoC: rt722-sdca: always cancel jack work on remove (git-fixes).
• ASoC: rt1011: return cache sync errors from resume (git-fixes).
• ASoC: rt1016: return cache sync errors from resume (git-fixes).
• ASoC: rt1305: return cache sync errors from resume (git-fixes).
• ASoC: rt1308: return cache sync errors from resume (git-fixes).
• ASoC: rt1318: return cache sync errors from resume (git-fixes).
• ASoC: rt5616: return cache sync errors from resume (git-fixes).
• ASoC: rt5659: return cache sync errors from resume (git-fixes).
• ASoC: rt5660: return cache sync errors from resume (git-fixes).
• ASoC: rt5665: return cache sync errors from resume (git-fixes).
• ASoC: rt5682-sdw: always cancel jack work on remove (git-fixes).
• ASoC: samsung: midas_wm1811: run FLL1 at the AIF1 configured rate when idle (git-fixes).
• ASoC: sdw_utils: clear stale RT711 device reference on exit (git-fixes).
• ASoC: soc-ac97: Fix error handling in snd_soc_new_ac97_component() (git-fixes).
• ASoC: soc-card-test: Check return value of kunit_device_register() (git-fixes).
• ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer() (git-fixes).
• ASoC: soc-topology-test: Check return value of kunit_device_register() (git-fixes).
• ASoC: SOF: amd: fix amd_sof_acp_remove() teardown ordering (git-fixes).
• ASoC: SOF: imx: Prevent stack OOB read in DSP panic dump (git-fixes).
• ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).
• ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).
• ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() (git-fixes).
• ASoC: tlv320aic32x4: Prevent division by zero in divider callbacks (git-fixes).
• ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() (git-fixes).
• ASoC: wcd-mbhc-v2: Fix incorrect properties names and typos (git-fixes).
• ASoC: wm8994: don't lose the AIF clock ratio when staying at 32kHz SYSCLK (git-fixes).
• ASoC: wm8994: fix MCLK gating for AIF clocks sourced from MCLK2 (git-fixes).
• ASoC: wm8994: fix MCLK index used for setting MCLK rate (git-fixes).
• ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() (git-fixes).
• ASoC: wm8994: follow AIF clock source changes in MCLK gating (git-fixes).
• ASoC: xilinx: formatter_pcm: Fix read-modify-write of AUD_CTRL in hw_params (git-fixes).
• asymmetric_keys: reject trust keys without IDs (git-fixes).
• ata: ahci_st: Do not ignore errors when getting the reset controls (git-fixes).
• ata: libahci: Free the IRQs when activating a multi-IRQ host fails (git-fixes).
• ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 (git-fixes).
• ata: libata-scsi: Fix ata_scsi_hotplug() reference in kernel-doc (git-fixes).
• ata: pata_parport: fix parport attach idr_alloc for (git-fixes).
• ata: pata_parport: Fix use-after-free in new_device_store (git-fixes).
• ata: sata_dwc_460ex: Don't enable interrupt if libATA core registration fails (git-fixes).
• ata: sata_fsl: Fix use-after-free of host_priv on probe() failure (git-fixes).
• backlight: lm3630a: Cancel delayed work before destroying workqueue (git-fixes).
• backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() (git-fixes).
• backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe (git-fixes).
• backlight: qcom-wled: Fix WLED3 brightness register stride (git-fixes).
• Bluetooth: 6lowpan: Drain RCU readers on registration failure (git-fixes).
• Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file (git-fixes).
• Bluetooth: 6LoWPAN: Use RCU-safe device list removal (git-fixes).
• Bluetooth: Add missing newline to bt_dev_{err,warn}_ratelimited() (git-fixes).
• Bluetooth: btmtk: fix skb double free on ISO padding failure (git-fixes).
• Bluetooth: hci_core: Keep RCU protection through LTK filtering (git-fixes).
• Bluetooth: hci_debugfs: Pin module for debugfs file operations (git-fixes).
• Bluetooth: hci_sync: fix mesh adv timeout units (git-fixes).
• Bluetooth: hci_sync: Protect IRK identity reads with RCU (git-fixes).
• Bluetooth: hci_sync: Serialize devcoredump reset during device open (git-fixes).
• Bluetooth: hci_vhci: Pin module for debugfs file operations (git-fixes).
• Bluetooth: ISO: Hold the listener during disconnect notification (git-fixes).
• Bluetooth: L2CAP: hold chan in l2cap_ecred_conn_rsp() (git-fixes).
• Bluetooth: L2CAP: hold l2cap_conn::lock in l2cap_connect_cfm() (git-fixes).
• Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn (git-fixes).
• Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests (git-fixes).
• Bluetooth: L2CAP: Reject mode changes on connected channels (git-fixes).
• Bluetooth: L2CAP: Use default TxWindow for zero socket option (git-fixes).
• Bluetooth: MGMT: Fix leaking instance on Add Extended Advertising Parameters (git-fixes).
• Bluetooth: MGMT: Fix pending state of instances added without HCI traffic (git-fixes).
• Bluetooth: MGMT: Reject quality report requests during unregister (git-fixes).
• Bluetooth: msft: Lock failed probe cleanup against feature readers (git-fixes).
• Bluetooth: MSFT: Serialize handle map cleanup with event processing (git-fixes).
• Bluetooth: selftest: Pin module for selftest debugfs file operations (git-fixes).
• bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port() (git-fixes).
• bus: arm-cci: Drop CPU node reference in cci_ace_init_ports() (git-fixes).
• bus: fsl-mc: register the object drivers after misc_class exists (git-fixes).
• char: scx200_gpio: check cdev_add() return value (git-fixes).
• comedi: comedi_parport: validate the IRQ supplied by userspace (git-fixes).
• comedi: dmm32at: validate the IRQ supplied by userspace (git-fixes).
• comedi: dt2811: fix shift-out-of-bounds in IRQ check (git-fixes).
• comedi: dt2814: validate the IRQ supplied by userspace (git-fixes).
• comedi: ni_atmio16d: validate the IRQ supplied by userspace (git-fixes).
• comedi: pcmmio: validate the IRQ supplied by userspace (git-fixes).
• comedi: pcmuio: validate the IRQs supplied by userspace (git-fixes).
• crypto: algif_skcipher - rewind rounded output bytes (git-fixes).
• crypto: amlogic - Fix DMA memory leak in cipher error path (git-fixes).
• crypto: amlogic - Fix IRQ handler return value and fallthrough logic (git-fixes).
• crypto: asymmetric_keys - fix OOB read in pefile_parse_binary (git-fixes).
• crypto: atmel - handle authenc requests without plaintext (git-fixes).
• crypto: atmel-aes - fix AADLENR for standalone GHASH (git-fixes).
• crypto: atmel-sha - reject initialization without a device (git-fixes).
• crypto: atmel-tdes - sync output bounce buffer before DMA (git-fixes).
• crypto: atmel-tdes - zero-initialize device state (git-fixes).
• crypto: caam - fix double-free in caam_rsa_set_priv_key_form() (git-fixes).
• crypto: ccp - Initialize DBC ioctl mutex before registering device (git-fixes).
• crypto: ccp - kill v3 IRQ tasklet during teardown (git-fixes).
• crypto: ccp - kill v5 IRQ tasklet during teardown (git-fixes).
• crypto: hisilicon/hpre - enable all clusters clock gating (stable-fixes).
• crypto: hisilicon/hpre - fix ECDH destination DMA mapping (git-fixes).
• crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent (git-fixes).
• crypto: hisilicon/hpre - fix pointer dereference before length check (git-fixes).
• crypto: hisilicon/hpre - remove dma_free_coherent on NULL req->dst in ECDH (git-fixes).
• crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer (git-fixes).
• crypto: lskcipher - preserve state across unaligned chunks (git-fixes).
• crypto: mxs-dcp - handle zero-length skcipher requests (git-fixes).
• crypto: qat - avoid OOB read when stripping RSA leading zeros (git-fixes).
• crypto: qat - fix active_devs leak on crypto alg registration failure (git-fixes).
• crypto: qat - fix error source for QAT GEN6 transmit interface faults (git-fixes).
• crypto: qat - fix use of destroyed vf2pf_lock on VF restart (git-fixes).
• crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() (git-fixes).
• crypto: qat - release instance on DH fallback allocation failure (git-fixes).
• crypto: qat - zero the VF migration state buffer on save (git-fixes).
• crypto: tcrypt - Avoid reading req->base after submission (git-fixes).
• dmaengine: altera-msgdma: initialize state before requesting IRQ (git-fixes).
• dmaengine: at_hdmac: Fix use-after-free by proper tasklet cleanup (git-fixes).
• dmaengine: dw-axi-dmac: convert clock handling to clk_bulk API (git-fixes).
• dmaengine: dw-axi-dmac: Fix AXI burst length encoding (git-fixes).
• dmaengine: dw-axi-dmac: Fix CH_CFG2 channel priority position (git-fixes).
• dmaengine: dw-axi-dmac: Fix LLI dump out-of-bounds access (git-fixes).
• dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources (git-fixes).
• dmaengine: fsl_raid: don't invoke client callback under desc_lock (git-fixes).
• dmaengine: fsl_raid: zero CF descriptor pool allocations (git-fixes).
• dmaengine: img-mdc: Fix runtime PM usage counter leak (git-fixes).
• dmaengine: ioat: disable relaxed ordering before registering the device (git-fixes).
• dmaengine: mediatek: hsdma: fix runtime PM leak on init failure (git-fixes).
• dmaengine: mv_xor: kill tasklet on channel add error path (git-fixes).
• dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr() (git-fixes).
• dmaengine: qcom: bam_dma: Defer IRQ trigger type to device tree (git-fixes).
• dmaengine: qcom: bam_dma: free interrupt before the clock in error path (git-fixes).
• dmaengine: sprd: use clk_bulk API to fix clock imbalance (git-fixes).
• dmaengine: sun6i-dma: Fix use-after-free in error handling paths (git-fixes).
• dmaengine: xilinx_dma: Fix MCDMA descriptor fields based on DMA direction (git-fixes).
• dmaengine: xilinx_dma: Move descriptors to done list based on completion bit (git-fixes).
• Documentation: devres: Remove non-existent SPI register helpers (git-fixes).
• Documentation: RAS: Use the real EDAC PCI parity control names (git-fixes).
• Documentation: rs485: Pull uart_get_rs485_mode() from serial_core.c (git-fixes).
• Documentation: virt: Fix the struct snp_guest_request_ioctl name in sev-guest.rst (git-fixes).
• driver core: Limit the messages on a refused uevent (git-fixes).
• drivers/base/node: fix UAF on device_register() failure (git-fixes).
• drm/amd/display: assign missing trace entry in amdgpu_dm_dc_clocks_state (git-fixes).
• drm/amd/display: copy function name into dcn_fpu trace event (git-fixes).
• drm/amd/display: copy function name into dcn_optc_lock_unlock_state trace event (git-fixes).
• drm/amd/display: disable replay when crc source is enabled (stable-fixes).
• drm/amd/display: Fix swap in median3() for DSC rate control (git-fixes).
• drm/amd/display: fix vready offset assignment in dcn_optc_lock_unlock_state (git-fixes).
• drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG (git-fixes).
• drm/amd/display: remove duplicated prev_p_state_change_support assignment (git-fixes).
• drm/amd/display: take a runtime PM reference only when a CRTC turns on (git-fixes).
• drm/amd/display: use right type for amdgpu_dc_performance event entries (git-fixes).
• drm/amd/pm: bound SCLK FCW range entries to the table size (git-fixes).
• drm/amdgpu/atombios: drop empty function (stable-fixes).
• drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang (stable-fixes).
• drm/amdgpu: Check for multiplication overflow in checkpoint stack (bsc#1276280).
• drm/amdgpu: re-enable GFXOFF for compute on GFX12 (git-fixes).
• drm/amdgpu: reject ANONONLY userptrs that span multiple VMAs (git-fixes).
• drm/amdgpu: Remove unused amdgpu_i2c functions (stable-fixes).
• drm/amdgpu: rework i2c init and fini (stable-fixes).
• drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support (stable-fixes).
• drm/amdgpu: Use dbg level for VBIOS check messages (stable-fixes).
• drm/amdkfd: don't drop an SVM CWSR reference that was never taken (git-fixes).
• drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO (git-fixes).
• drm/amdkfd: Fix checkpoint-restore on multi-xcc (bsc#1276280).
• drm/amdkfd: fix doorbell allocation race creating duplicate allocations (git-fixes).
• drm/amdkfd: Fix partial migrate issue (stable-fixes).
• drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping (git-fixes).
• drm/amdkfd: validate SRAT subtables before parsing (git-fixes).
• drm/amdkfd: wait for a GPU reset before freeing a BO (git-fixes).
• drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties (git-fixes).
• drm/exynos/fimd: fix register offset type in fimd_trigger() (git-fixes).
• drm/i915/crt: convert to struct intel_display (stable-fixes).
• drm/i915/display: convert I915_STATE_WARN() to struct intel_display (stable-fixes).
• drm/i915/display: pass display to intel_crtc_for_pipe() (stable-fixes).
• drm/i915/gmbus: convert to struct intel_display (stable-fixes).
• drm/i915/vga: Convert VGA code to intel_display (stable-fixes).
• drm/i915: document range_overflows() and range_end_overflows() macros (stable-fixes).
• drm/i915: rename range_overflows_end() to range_end_overflows() (stable-fixes).
• drm/imx/lcdc: avoid duplicate clk_per enable (git-fixes).
• drm/komeda: Fix bits parsing of GLB_CORE_ID (git-fixes).
• drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() (git-fixes).
• drm/msm/a6xx: Fix secondary rail vote in ARC votes (git-fixes).
• drm/msm/a6xx: fix use-after-free of OPP in a6xx_pm_resume (git-fixes).
• drm/msm/dp: don't report link training success after a reinit (git-fixes).
• drm/msm/dp: Initialize the debugfs connector pointer (git-fixes).
• drm/msm/dpu: disable the slave encoder before the master (git-fixes).
• drm/msm/dpu: round up the compressed INTF width (git-fixes).
• drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure (git-fixes).
• drm/msm/mdp5: drop cursor pipe for msm8x76 (git-fixes).
• drm/msm: Properly handle msm_ioremap() without name (git-fixes).
• drm/nouveau/svm: drain fault handler before freeing svmm (git-fixes).
• drm/nouveau: cancel the DP IRQ work before freeing the connector (git-fixes).
• drm/nouveau: disable the fence uevent work instead of just cancelling it (git-fixes).
• drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq (git-fixes).
• drm/nouveau: reject zero-size notifier object allocation (git-fixes).
• drm/omap: dsi: avoid sending bta sync all the time in writes (git-fixes).
• drm/panel: ebbg-ft8719: Set prepare_prev_first (git-fixes).
• drm/panfrost: Explicitly enable MMU interrupts at device init (git-fixes).
• drm/panfrost: Prevent division by 0 (git-fixes).
• drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase (git-fixes).
• drm/panthor: Take reqs_lock in soft_reset for clearing pending_reqs (git-fixes).
• drm/tegra: Don't pass an ERR_PTR to drm_syncobj_replace_fence() (git-fixes).
• drm/tegra: Drop reference on postfence (git-fixes).
• drm/tegra: Fix syncobj_in wait return value check (git-fixes).
• drm/ttm: return an error when kmapping a BO without pages (git-fixes).
• drm/vc4: Fix firmware reference leak in vc4_drm_bind() (git-fixes).
• drm/vc4: Use video aperture helpers (stable-fixes).
• drm/virtio: Add a helper to map and note the dma addrs and lengths (stable-fixes).
• drm/virtio: Use drm_gem_plane_helper_prepare_fb() (stable-fixes).
• drm/vmwgfx: Stop using dev_private to store driver data (stable-fixes).
• drm: of: Fix drm_of_get_data_lanes_count_ep() return value documentation (git-fixes).
• fbdev: atmel_lcdfb: Prevent FIFO work after removal (git-fixes).
• fbdev: gxt4500: Release WC setup on probe failure (git-fixes).
• fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error (git-fixes).
• fbdev: smscufx: check for fb_deferred_io_init() error (git-fixes).
• fbdev: ssd1307fb: check for fb_deferred_io_init() error (git-fixes).
• fbdev: udlfb: check for fb_deferred_io_init() error (git-fixes).
• fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use (git-fixes).
• fbdev: xen-fbfront: check for fb_deferred_io_init() error (git-fixes).
• firewire: cdev: Fix FW_CDEV_IOC_CREATE_ISO_CONTEXT references in kernel-doc (git-fixes).
• firewire: core: fix source bus ID detection for AT context in big-endian systems (git-fixes).
• firmware: arm_scmi: Don't reuse raw xfers with async_done still armed (git-fixes).
• firmware: arm_scmi: Protect xfer->async_done with xfer->lock (git-fixes).
• firmware: cs_dsp: clear dsp->running on the cs_dsp_run() error path (git-fixes).
• firmware: imx: dsp: fix mailbox channel leak on kasprintf failure (git-fixes).
• fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs (git-fixes).
• gpio: crystalcove: add missing MODULE_ALIAS() (git-fixes).
• gpio: davinci: Clear interrupt status in every bank on suspend (git-fixes).
• gpio: mxc: fix both_edges bit operations (git-fixes).
• gpio: mxc: fix wakeup_pads bit operations (git-fixes).
• gpio: mxc: use BIT() macro (stable-fixes).
• gpio: mxc: use lock guards for the generic GPIO chip lock (stable-fixes).
• gpio: pca953x: Handle direction register read errors in IRQ paths (git-fixes).
• gpio: pca953x: Preserve wakeup accounting on parent IRQ failure (git-fixes).
• gpio: Respect valid_mask when requesting GPIOs (stable-fixes).
• gpiolib: clear requested flag if line is invalid (git-fixes).
• gpiolib: don't report -ENOMEM for a requested line without a label (git-fixes).
• gpiolib: Free chip resources when allocating the label fails (git-fixes).
• gpiolib: sanitize the return value of gpio_chip::request() (stable-fixes).
• HID: amd_sfh: Remove unsupported motion-state field from accelerometer report (git-fixes).
• HID: amd_sfh: Use report type from request node (git-fixes).
• HID: core: Fix out-of-bounds left shift by 32 in s32ton() (git-fixes).
• HID: cougar: reject short special-key reports (git-fixes).
• HID: cp2112: validate response report lengths (git-fixes).
• HID: elo: reject short touchscreen reports (git-fixes).
• HID: i2c-hid: Unfollow the panel on shutdown (git-fixes).
• HID: logitech-dj: validate unnumbered keyboard reports (git-fixes).
• HID: logitech-hidpp: cancel reset_hi_res_work on probe failure (git-fixes).
• HID: mcp2200: validate READ_ALL response length (git-fixes).
• HID: mcp2221: validate response report length (git-fixes).
• HID: picoLCD: check for fb_deferred_io_init() error (git-fixes).
• HID: prodikeys: validate fixed-format MIDI reports (git-fixes).
• HID: pxrc: reject short input reports (git-fixes).
• HID: quirks: Set ALWAYS_POLL for LOGITECH_BOLT_RECEIVER (bsc#1285891).
• HID: roccat: isku: reject short button reports (git-fixes).
• HID: roccat: koneplus: reject short button reports (git-fixes).
• HID: roccat: konepure: reject short button reports (git-fixes).
• HID: roccat: kovaplus: reject short button reports (git-fixes).
• HID: roccat: pyra: reject short button reports (git-fixes).
• HID: roccat: ryos: reject short special reports (git-fixes).
• HID: roccat: savu: reject short special reports (git-fixes).
• HID: wacom: fix wacom_intuos_irq NULL pen_input deref (git-fixes).
• HID: zydacron: validate key report length (git-fixes).
• hwmon: (asus_rog_ryujin) Add per-device configuration (stable-fixes).
• hwmon: (asus_rog_ryujin) Rely on subsystem locking (stable-fixes).
• hwmon: (coretemp) Fix handling of isolated SMT siblings (git-fixes).
• hwmon: (coretemp) Refresh the temperature on the first read (git-fixes).
• hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe (git-fixes).
• hwmon: (gigabyte_waterforce) reject short input reports (git-fixes).
• hwmon: (k10temp) Stop matching Hygon devices (git-fixes).
• hwmon: (lm70) Fix rounding of negative temperatures (git-fixes).
• hwmon: (lm95245) Fix negative temperature conversion (git-fixes).
• hwmon: (sht3x) Return the consumed count for heater writes (git-fixes).
• hwrng: amd - report partial reads in non-blocking mode (git-fixes).
• hwrng: ba431 - fix reported byte count (git-fixes).
• hwrng: cctrng - Fix runtime PM usage counter leak (git-fixes).
• hwrng: core - reject unknown RNG names (git-fixes).
• hwrng: intel - return -ENOMEM when ioremap() fails (git-fixes).
• hwrng: intel - return -ENOMEM when kmalloc_obj() fails (git-fixes).
• hwrng: starfive - propagate clock and reset errors (git-fixes).
• i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode() (git-fixes).
• i2c: designware: queue only one read command for block reads (git-fixes).
• i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len (git-fixes).
• i2c: qcom-cci: Fix HALT_ACK reset request being dropped (git-fixes).
• i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() (git-fixes).
• i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function (stable-fixes).
• ibmveth: check headers in the RX large send and checksum helpers (bsc#1285888).
• ibmveth: disable the reset work before unregister in remove (bsc#1285888).
• ibmveth: do not close twice after a failed reopen (bsc#1285888).
• ibmveth: fix netpoll races with RX replenish (bsc#1285888).
• ibmveth: fix TX LTB and filter unwind on open-fail (bsc#1285888).
• ibmveth: h_free logical LAN on open-fail after register (bsc#1285888).
• ibmveth: release the pool kobjects when probe fails (bsc#1285888).
• ibmveth: return the error when set_channels cannot add TX queues (bsc#1285888).
• ibmveth: step past bad RX correlators instead of spinning or oopsing (bsc#1285888).
• ibmveth: wait for in-flight transmits in ibmveth_close() (bsc#1285888).
• ibmveth: wait for the RX poll to return before freeing the RX queue (bsc#1285888).
• ice: add E835 device IDs (jsc#PED-14404 jsc#PED-15079 jsc#PED-16956).
• idpf: keep the netdev when a reset fails (bsc#1285391).
• iio: accel: adis16201: fix channel order for buffer mode (git-fixes).
• iio: accel: adxl313: reject devices without match data (git-fixes).
• iio: accel: adxl380: reject devices without match data (git-fixes).
• iio: accel: kionix-kx022a: Fix IPOL macro name (git-fixes).
• iio: accel: kxcjk-1013: Disable autosuspend on remove (git-fixes).
• iio: accel: mma9551: disable autosuspend on remove (git-fixes).
• iio: accel: mma9553: disable autosuspend on remove (git-fixes).
• iio: adc: ad7192: reject devices without match data (git-fixes).
• iio: adc: at91-sama5d2: disable autosuspend on remove (git-fixes).
• iio: adc: max11205: reject devices without match data (git-fixes).
• iio: adc: mcp3911: reject devices without match data (git-fixes).
• iio: adc: stm32: fix minimum sampling time values (git-fixes).
• iio: adc: ti-adc128s052: validate SPI match data (git-fixes).
• iio: dac: ad5755: validate SPI match data (git-fixes).
• iio: dac: ad5758: Fix alignment for DMA safety (git-fixes).
• iio: dac: ad5758: Fix the offset calculation (git-fixes).
• iio: dac: ad5758: Reject out-of-range raw values (git-fixes).
• iio: frequency: adf4377: reject devices without match data (git-fixes).
• iio: humidity: hts221: report available values via read_avail() (git-fixes).
• iio: imu: adis16400: Check return value of spi_setup() (git-fixes).
• iio: imu: inv_icm42600: fix odr change not caught in certain cases (git-fixes).
• iio: imu: inv_icm42600: force accel odr change when switching power mode (git-fixes).
• iio: light: apds9306: fix default sampling frequency definition (git-fixes).
• iio: potentiometer: x9250: reject devices without match data (git-fixes).
• iio: pressure: bmp280: validate SPI match data (git-fixes).
• iio: pressure: dps310: fix CFG_REG bit definitions (git-fixes).
• iio: pressure: rohm-bm1390: Fix AVE_NUM initialization (git-fixes).
• iio: temperature: tmp117: fix calibbias cache update on I2C write failure (git-fixes).
• inet: Avoid ehash lookup race in inet_ehash_insert() (bsc#1286554).
• inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (bsc#1286554).
• Input: da7280 - fix input device parent assignment (git-fixes).
• Input: drv2665 - fix input device parent assignment (git-fixes).
• Input: drv2667 - fix input device parent assignment (git-fixes).
• Input: maple_keyb - fix key press detection (git-fixes).
• Input: maplecontrol - emit EV_SYN report after reporting events (git-fixes).
• Input: matrix-keymap - reject keycodes above KEY_MAX (git-fixes).
• Input: matrix_keypad - propagate error code from matrix_keypad_build_keymap() (git-fixes).
• Input: tps6507x-ts - fix input device parent assignment (git-fixes).
• interconnect: qcom: icc-rpm: Handle icc_link_create() failures (git-fixes).
• kobject: fix out-of-bounds access in kobject_action_type() (git-fixes).
• kobject: Fix the kobj_set_name reference in kset_register() kernel-doc (git-fixes).
• KVM: s390: Limit adapter indicator access to mapped page (bsc#1268160).
• KVM: SEV: Do cache maintenance on the source VM before clearing SEV state (git-fixes).
• KVM: TDX: Check if there is valid exit infos based on vp_enter_ret (git-fixes).
• KVM: TDX: Enable Notify VM exit (git-fixes).
• KVM: x86/mmu: Fix NX page unaccounting for TDP MMU pages (git-fixes).
• KVM: x86/mmu: Reload MMU on every page pre-fault attempt/iteration (git-fixes).
• KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root (git-fixes).
• KVM: x86: Take SRCU in kvm_zap_gfn_range() (git-fixes).
• KVM: x86: Zero reserved synic flags when delivering message to avoid stack leak (git-fixes).
• leds: flash: Prevent using uninitialized variable in flash_fault_show() (git-fixes).
• leds: ktd2692: Pass context to regulator cleanup (git-fixes).
• leds: lm3692x: Fix regulator/gpio leak and wrong enabled state on last write failure (git-fixes).
• leds: lp8860: Fix device_node leak in lp8860_probe() (git-fixes).
• leds: pca9532: Check i2c_smbus_read_byte_data() return value (git-fixes).
• mac80211: tx: Use info->flags in ieee80211_tx_h_select_key() (git-fixes).
• media: adv748x: Fix endpoint reference leaks on probe failure (git-fixes).
• media: adv7180: Initialize mutex before ancillary clients (git-fixes).
• media: adv7604: avoid negative array index in log_status when cp_read fails (git-fixes).
• media: amphion: fix runtime PM imbalance on probe failure (git-fixes).
• media: amphion: prevent unbind while video instances are open (git-fixes).
• media: atmel-isi: release unregistered video device on remove (git-fixes).
• media: au0828: Fix media device leak in au0828_usb_probe() (git-fixes).
• media: au0828: fix use-after-free in bulk_timeout timer on disconnect (git-fixes).
• media: au0828: Free URBs when starting DVB streaming fails (git-fixes).
• media: cec: extron: clear response tail before dispatch (git-fixes).
• media: cx18: Disable PCI device on probe failure (git-fixes).
• media: cx88: Disable PCI device on MPEG initialization failure (git-fixes).
• media: cx231xx-audio: drain wq_trigger before audio fini (git-fixes).
• media: cx231xx: Fix cleanup path on failure (git-fixes).
• media: cx23885: Fix use-after-free in cx23885_finidev due to race condition (git-fixes).
• media: cx23885: unregister DVB bus when SP2 CI setup fails (git-fixes).
• media: em28xx: fix double free in em28xx_alloc_urbs (git-fixes).
• media: em28xx: reject audio endpoint with zero packet size (git-fixes).
• media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler (git-fixes).
• media: go7007: bound EZ-USB I2C transfers to the usb_buf size (git-fixes).
• media: go7007: unregister the I2C adapter on USB probe failure (git-fixes).
• media: gspca: use vb2_video_unregister_device() on disconnect (git-fixes).
• media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path (git-fixes).
• media: hantro: disable runtime PM before hardware teardown (git-fixes).
• media: hantro: Harden MPEG-2 control access against NULL (git-fixes).
• media: i2c: alvium-csi2: balance runtime PM usage count on remove (git-fixes).
• media: i2c: ar0521: remove duplicate media entity cleanup (git-fixes).
• media: i2c: ov5648: Fix a data race on state->streaming (git-fixes).
• media: i2c: ov8856: fix debug message to report actual CSI-2 lane count (git-fixes).
• media: i2c: tc358743: add missing color-space strings (git-fixes).
• media: imagination: Fix value clamping in calculate_qp_tables (git-fixes).
• media: imon: fix use-after-free in display_close via dev_dbg (git-fixes).
• media: imx-jpeg: cancel timeout worker when streaming stops (git-fixes).
• media: imx-jpeg: finish the job on device_run() error paths (git-fixes).
• media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled (git-fixes).
• media: ir_toy: Validate the maximum tx carrier (git-fixes).
• media: m2m-deinterlace: fix default capture field (git-fixes).
• media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA (git-fixes).
• media: marvell: manage the MMP camera clock provider (git-fixes).
• media: marvell: mcam: stop DMA and cancel s_bh_work before freeing DMA buffers (git-fixes).
• media: mediatek: jpeg: Avoid context access after job finish (git-fixes).
• media: mediatek: jpeg: retry HW selection after successful wait (git-fixes).
• media: mediatek: vcodec: destroy core workqueue on remove (git-fixes).
• media: mediatek: vpu: free IRQ before destroying watchdog workqueue (git-fixes).
• media: mediatek: vpu: release reserved memory on remove (git-fixes).
• media: meson-ir-tx: Ensure clock is disabled on unbind (git-fixes).
• media: meson-ir-tx: Ensure probe error is propagated (git-fixes).
• media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() (git-fixes).
• media: meson: vdec: size capture planes from the aligned canvas (git-fixes).
• media: microchip-csi2dc: fix async notifier leak on probe error path (git-fixes).
• media: microchip-isc: disable histogram and flush AWB work on teardown (git-fixes).
• media: microchip-isc: do not touch WB registers when not streaming (git-fixes).
• media: microchip-isc: don't sleep in the clk .is_enabled callback (git-fixes).
• media: microchip-isc: fix awb_mutex and lock lifecycle (git-fixes).
• media: microchip-isc: fix PM runtime leak in AWB work handler (git-fixes).
• media: microchip-isc: fix WB offset and gain register field masking (git-fixes).
• media: microchip-isc: synchronize the IRQ before disabling clocks on stop (git-fixes).
• media: microchip-isc: take a reference on the parsed endpoints (git-fixes).
• media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() (git-fixes).
• media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() (git-fixes).
• media: nuvoton: npcm-video: quiesce VCD IRQ before teardown (git-fixes).
• media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() (git-fixes).
• media: pvrusb2: Fix USB parent device leak in class_dev_create() (git-fixes).
• media: qcom: camss: vfe-17x: Fix write master buffer done being dropped (git-fixes).
• media: qcom: camss: vfe: Fix VFE reset while another line is streaming (git-fixes).
• media: rc: fintek-cir: process a full RX buffer instead of overflowing it (git-fixes).
• media: rc: mce_kbd: Fix inconsistent locking of keylock (git-fixes).
• media: redrat3: Ensure all urbs are suspended (git-fixes).
• media: redrat3: Ensure we don't read beyond the end of the packet (git-fixes).
• media: redrat3: fix UAF in probe error path leaving rc device registered (git-fixes).
• media: require two-byte Cypress type 04 records (git-fixes).
• media: rtl28xxu: fix SDR platform device leak (git-fixes).
• media: saa7146: Initialize interrupt lock before requesting IRQ (git-fixes).
• media: sti: delta: use unaligned accessors for MJPEG SOF fields (git-fixes).
• media: stm32: dcmipp: replace s_stream with enable/disable_streams (stable-fixes).
• media: stm32: dcmipp: use v4l2_subdev_is_streaming (stable-fixes).
• media: streamzap: Add missing rc_unregister_device() (git-fixes).
• media: stv090x: bound DiSEqC reply length to msg size (git-fixes).
• media: stv0900: bound DiSEqC reply length to msg size (git-fixes).
• media: tw68: balance PCI enable on cleanup (git-fixes).
• media: tw686x: fix V4L2 device lifetime on probe failure (git-fixes).
• media: uvcvideo: Fix NULL deref on events for uninitialized controls (git-fixes).
• media: v4l2-common: Fix P010 format info (git-fixes).
• media: v4l2-ctrls: do nothing if controls == NULL in cluster functions (git-fixes).
• media: venus: Drop session events without an instance (git-fixes).
• media: verisilicon: rockchip: Fix leaks in init (git-fixes).
• media: vicodec: fix NULL deref on oversized frame (git-fixes).
• media: vicodec: fix out-of-bounds write on under-rounded coded dimensions (git-fixes).
• media: vicodec: make encoder CAPTURE dimensions read-only (git-fixes).
• media: vicodec: zero-initialize stateful decoder heap buffers (git-fixes).
• media: vidtv: fix frontend reference leak on unbind (git-fixes).
• media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail (git-fixes).
• media: vim2m: keep transaction buffer count stable while streaming (git-fixes).
• media: vivid: cancel svid ctrl work on release (git-fixes).
• media: vivid: round the height down to the vertical subsampling factor (git-fixes).
• media: vpif_capture: Fix i2c adapter reference leak in vpif_probe() (git-fixes).
• media: vpif_display: Fix i2c adapter reference leak in vpif_probe() (git-fixes).
• mei: vsc-tp: initialize IRQ state before requesting interrupt (git-fixes).
• mei: vsc: Fix packet CRC computed over pointer size (git-fixes).
• memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT (git-fixes).
• memory: brcmstb_dpfe: Fix out-of-bounds access due to DCPU offset (git-fixes).
• memory: brcmstb_dpfe: validate firmware section sizes (git-fixes).
• memory: emif: fix device_node reference leak on np_ddr (git-fixes).
• memory: exynos5422-dmc: handle clock enable failures (git-fixes).
• mfd: ab8500: Fix child device leaks on probe failure (git-fixes).
• mfd: da903x: Cancel IRQ work during teardown (git-fixes).
• mfd: da9150: Balance IRQ wake on teardown (git-fixes).
• mfd: intel_quark_i2c_gpio: Manage the fixed-rate clock (git-fixes).
• mfd: rk8xx: Register poweroff handler in atomic phase (git-fixes).
• mfd: tps65217: Check return value when masking interrupt sources (git-fixes).
• mfd: tps65217: Fix NULL pointer dereference on IRQ init failure (git-fixes).
• mfd: tps65217: Use devres for IRQ domain and wake teardown (git-fixes).
• mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral (git-fixes).
• mfd: wcd934x: set DMA mask on parent to silence "DMA mask not set" (git-fixes).
• misc: enclosure: fix UAF on device_register() failure (git-fixes).
• misc: nsm: fix CBOR short-length decoding (git-fixes).
• misc: nsm: mark device ready before registering the hwrng and misc device (git-fixes).
• mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() (git-fixes).
• mtd: block: prevent reclaim I/O during request processing (git-fixes).
• mtd: Call get_wunit() on the master partition (git-fixes).
• mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device (git-fixes).
• mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() (git-fixes).
• mtd: maps: l440gx: Fix double put of the PM device in init_l440gx() (git-fixes).
• mtd: maps: pci: balance PCI enable on cleanup (git-fixes).
• mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() (git-fixes).
• mtd: parsers: qcom: fix offset/size overflow on large partitions (git-fixes).
• mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() (git-fixes).
• mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface() (git-fixes).
• mtd: rawnand: sunxi: reject ECC maximization on small pages (git-fixes).
• mtd: spi-nor: sfdp: check the length of the SCCR map (git-fixes).
• mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table (git-fixes).
• mtd: spi-nor: spansion: Remove s25fs256s0 (git-fixes).
• mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption (git-fixes).
• mtd: spinand: Fix spinand_manufacturer_ops kernel-doc (git-fixes).
• net-sysfs: release queue trackers before allowing reuse (bsc#1278140).
• net-sysfs: remove rtnl_trylock from device attributes (bsc#1278140).
• net-sysfs: remove rtnl_trylock from queue attributes (bsc#1278140).
• net-sysfs: restore behavior for not running devices (bsc#1278140).
• net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown (git-fixes).
• net/rds: use clear_bit_unlock() in release_refill() (git-fixes).
• net: ethernet: mtk_wed: Fix dma_unmap_single() size (git-fixes).
• net: phy: marvell: keep WOL_EIE across interrupt reconfiguration (git-fixes).
• net: phy: qca83xx: read resolved QCA8337 link status (git-fixes).
• net: usb: cdc_mbim: don't enable BHs in tx_fixup under netpoll (git-fixes).
• net: usb: cdc_ncm: don't enable BHs in tx_fixup under netpoll (git-fixes).
• net: usb: lan78xx: reject invalid EEPROM write requests (git-fixes).
• net: usb: pegasus: check rx pkt_len against the received length (git-fixes).
• net: usb: pegasus: do not advance rx_skb->data on dropped frames (git-fixes).
• net: usb: r8153_ecm: reject short register reads (git-fixes).
• net: usb: sierra_net: reject short firmware attribute reads (git-fixes).
• net: wwan: iosm: validate msg_head before indexing msg_ring (git-fixes).
• nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT (git-fixes).
• PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow (git-fixes).
• PCI/AER: Fix struct pci_dev reference leak in aer_process_err_devices() (git-fixes).
• PCI/P2PDMA: Gate the host bridge whitelist warning on verbose (git-fixes).
• PCI/P2PDMA: Safely terminate ACS redirect lists (git-fixes).
• PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible() (git-fixes).
• PCI/sysfs: Pass the device name length in UTF-16 code units (git-fixes).
• PCI/sysfs: Stop reporting _DSM failures as -EPERM (git-fixes).
• PCI/TPH: Validate the firmware Steering Tag response (git-fixes).
• PCI: aardvark: Disable PHY on probe failures (git-fixes).
• PCI: cadence: Preserve all error codes in cdns_plat_pcie_probe() (git-fixes).
• PCI: Disable MSI for ULi M1575 EHCI controller (git-fixes).
• PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV (git-fixes).
• PCI: dra7xx: Fix clock enable leak on probe failure (git-fixes).
• PCI: endpoint: pci-epf-vntb: Pass PF/VF number when BAR programming (git-fixes).
• PCI: endpoint: pci-epf-vntb: Serialize virtual PCI bus scan (git-fixes).
• PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr() (git-fixes).
• PCI: qcom-ep: Deinitialize endpoint on remove (git-fixes).
• PCI: qcom: Honor IOMMU provider's #iommu-cells in qcom_pcie_config_sid_1_9_0() (git-fixes).
• PCI: rcar-gen4: Add Application/Local register reset control (git-fixes).
• PCI: rockchip-host: Do not attempt 5.0 GT/s retraining (git-fixes).
• PCI: xgene: Use managed clock for PCIe controller (git-fixes).
• PCI: xilinx-xdma: Fix device node reference leak in xilinx_pl_dma_pcie_init_irq_domain() (git-fixes).
• peci: aspeed: Initialize state before requesting IRQ (git-fixes).
• peci: npcm: Initialize state before requesting IRQ (git-fixes).
• phy: cadence: Sierra: Do not modify register when getting parent clock (git-fixes).
• phy: core: Fix race-condition between _of_phy_get() and try_module_get() (git-fixes).
• phy: HiSilicon: Fix error handling in hi3670_pcie_allclk_ctrl() (git-fixes).
• phy: hisilicon: hi3670: Fix OF node and device reference leaks (git-fixes).
• phy: rockchip: usbdp: Do not lose USB3 PHY status (git-fixes).
• phy: rockchip: usbdp: Drop seamless DP takeover (git-fixes).
• phy: rockchip: usbdp: Fix devm_clk_bulk_get_all check (git-fixes).
• phy: rockchip: usbdp: Handle missing clock-names DT property gracefully (git-fixes).
• phy: rockchip: usbdp: Handle rk_udphy_reset_deassert errors (git-fixes).
• phy: rockchip: usbdp: Hold mutex in DP PHY configure (git-fixes).
• phy: rockchip: usbdp: Only enable USB3 when not in high-speed mode (git-fixes).
• phy: rockchip: usbdp: Update mode_change after error handling (git-fixes).
• pinctrl: mediatek: mt7629: fix the 2.4 GHz Wi-Fi pin mode array (git-fixes).
• pinctrl: mediatek: paris: don't double-check the GPIO number (stable-fixes).
• pinctrl: nuvoton: Fix clock reference leak in ma35_get_bank_data() (git-fixes).
• pinctrl: sprd: free maps on DT map failure (git-fixes).
• pinctrl: stm32: Fix clock reference leak in stm32_pctl_probe() (git-fixes).
• pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() (git-fixes).
• platform/chrome: cros_ec_proto: Fix deferred response (git-fixes).
• platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data (git-fixes).
• platform/olpc: Reserve space for a string terminator (git-fixes).
• platform/x86/amd/pmc: Fix RTC reference leak in amd_pmc_verify_czn_rtc() (git-fixes).
• platform/x86/amd/pmf: Fix power_supply refcount leak in amd_pmf_get_battery_prop() (git-fixes).
• platform/x86/amd/pmf: Validate the APTS state index (git-fixes).
• platform/x86/amd: Stop counting intermediate cycles with metrics table (git-fixes).
• platform/x86/intel-uncore-freq: Continue restoring limits on resume (git-fixes).
• platform/x86/intel/pmt: Block mmap when callback is present (git-fixes).
• platform/x86: asus-wmi: fix screenpad power state detection (git-fixes).
• platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming (git-fixes).
• platform/x86: asus-wmi: fix unclear usage of bd->props.power (git-fixes).
• platform/x86: asus-wmi: validate custom fan curves on enable (git-fixes).
• platform/x86: gpd pocket fan: Cancel work before releasing GPIOs (git-fixes).
• platform/x86: hp-bioscfg: allow clearing current_password (git-fixes).
• platform/x86: hp-bioscfg: fix 16-byte heap overflow for empty auth token (git-fixes).
• platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer() (git-fixes).
• platform/x86: hp-bioscfg: fix off-by-one in password length check (git-fixes).
• platform/x86: hp-bioscfg: fix OOB reads in hp_get_string_from_buffer() (git-fixes).
• platform/x86: hp-bioscfg: fix oops on short integer attribute buffer (git-fixes).
• platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str() (git-fixes).
• platform/x86: hp-bioscfg: NUL-terminate the SPM auth token (git-fixes).
• platform/x86: hp-bioscfg: return -E2BIG from validate_password_input() (git-fixes).
• platform/x86: hp-bioscfg: validate SPM state returned by firmware (git-fixes).
• platform/x86: hp-wmi: fix heap OOB read and memory corruption in hp_wmi_perform_query() (git-fixes).
• platform/x86: ibm_rtl: Fix potential OOB read at signature search (git-fixes).
• platform/x86: intel_telemetry: initialize default trace verbosity (git-fixes).
• platform/x86: msi-ec: Report valid charge thresholds when unset (git-fixes).
• platform/x86: simatic-ipc: fix platform device leak on registration failure (git-fixes).
• platform: cznic: turris-omnia-mcu: Add missing MODULE_DEVICE_TABLE() (git-fixes).
• PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() (git-fixes).
• power: supply: ab8500: Preserve battery termination current (git-fixes).
• power: supply: ab8500_btemp: Fix event temperature reporting (git-fixes).
• power: supply: ab8500_charger: Decode AB8505 USB status (git-fixes).
• power: supply: ab8500_charger: Fix AC charger re-enable (git-fixes).
• power: supply: ab8500_charger: Handle detection errors (git-fixes).
• power: supply: ab8500_charger: Recover inactive AB8505 charger (git-fixes).
• power: supply: ab8500_charger: Respect AB8505 register layout (git-fixes).
• power: supply: ab8500_charger: Retry AB8505 USB detection (git-fixes).
• power: supply: ab8500_charger: Skip absent AB8505 main charger (git-fixes).
• power: supply: ab8500_fg: Accept status from supplied power (git-fixes).
• power: supply: ab8500_fg: Avoid reserved AB8505 CCConf bit (git-fixes).
• power: supply: ab8500_fg: Finalize current measurements (git-fixes).
• power: supply: ab8500_fg: Report sub-percent charge changes (git-fixes).
• power: supply: bq27xxx: synchronize work cancellation on suspend (git-fixes).
• power: supply: bq2515x: Propagate charge-enable read errors (git-fixes).
• power: supply: generic-adc-battery: fix status with no supplier (git-fixes).
• power: supply: generic-adc-battery: Propagate charged GPIO errors (git-fixes).
• power: supply: gpio-charger: Report discharging without input power (git-fixes).
• power: supply: mm8013: Publish the OF module alias (git-fixes).
• power: supply: mp2629: Use the full batt_impedance_compensation name in the ABI document (git-fixes).
• power: supply: qcom_battmgr: report full batteries (git-fixes).
• power: supply: qcom_battmgr: report the USB type from USB_ADAP_TYPE (git-fixes).
• power: supply: sbs-battery: disable polling before supply teardown (git-fixes).
• pwm: lp3943: fix NULL pointer dereference for an unconfigured channel (git-fixes).
• pwm: mtk-disp: Fix period readback (git-fixes).
• pwm: renesas-tpu: Fix runtime PM reference leak (git-fixes).
• pwm: tiehrpwm: Clear period on disable to allow reconfiguration (git-fixes).
• rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (bsc#1286554).
• regulator: ab8500: Fix AB8505 VANA voltage selectors (git-fixes).
• regulator: ab8500: Handle AB8505 VINTCORE selector 7 (git-fixes).
• regulator: ab8500: Propagate mode enable read errors (git-fixes).
• regulator: ab8500: Test dedicated enable bits only (git-fixes).
• regulator: ab8500: Treat cut 1.0 VAUX3 as fixed (git-fixes).
• regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() (git-fixes).
• regulator: core: Fix coupled regulators reference leak on removal (git-fixes).
• regulator: core: Fix rdev reference leak in regulator_resolve_supply() (git-fixes).
• regulator: fixed: reject incompatible platform devices (git-fixes).
• regulator: mp886x: check get_voltage_sel() return value (git-fixes).
• regulator: mp886x: fix pontential division by zero (git-fixes).
• regulator: mp886x: fix vsel_mask (git-fixes).
• regulator: qcom-rpmh: Fix the return value in rpmh_regulator_vrm_get_optimum_mode() kernel-doc (git-fixes).
• regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() (git-fixes).
• Revert "Input: matrix_keypad - force switch rows to input mode" (git-fixes).
• Revert "mkspec: Exclude rt flavor from kernel-syms dependencies" (bsc#1244337).
• Revert "rpm/mkspec: Fix missing kernel-syms-rt creation" (bsc#1244337)
• Revert "wifi: mac80211: do not use old MBSSID elements" (git-fixes).
• Revert "wifi: rtw89: fix unable to receive probe responses under MLO connection" (stable-fixes).
• rtc: abx80x: fix error check after i2c_smbus_read in read_alarm() (git-fixes).
• rtc: abx80x: properly handle shared IRQs (git-fixes).
• rtc: cmos: Disable ACPI RTC event before handling it (git-fixes).
• rtc: ds1685: arm the wake-up alarm at power-off only if an alarm is set (git-fixes).
• rtc: ds1685: do not sleep in the power-off handler (git-fixes).
• rtc: ftrtc010: fix integer overflow in time calculation (git-fixes).
• rtc: mpfs: Fix alarm register word order (git-fixes).
• rtc: s35390a: Add missing newline to dev_err (git-fixes).
• rtc: s35390a: Fix alarm not disabling (git-fixes).
• s390/cio: Purge based on the cdev's online status (bsc#1284429).
• s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (bsc#1279778).
• s390/topology: Use zero-based numbering for containing (bsc#1275518).
• s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove (bsc#1287642).
• s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL (bsc#1287642).
• s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed (bsc#1287642).
• s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (bsc#1287642).
• s390/vfio-ap: Fix NULL deref in status_show() during queue probe (bsc#1287642).
• s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap (bsc#1287642).
• s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object (bsc#1287642).
• s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove (bsc#1287642).
• scsi: qla2xxx: Add 29xx extended logio IOCB support (bsc#1275737).
• scsi: qla2xxx: Add 29xx series PCI device ID support (bsc#1275737).
• scsi: qla2xxx: Add 29xx support in queue initialisation path (bsc#1275737).
• scsi: qla2xxx: Add 64G/128G port speed setting support (bsc#1275737).
• scsi: qla2xxx: Add 128-byte IOCB definitions for 29xx (bsc#1275737).
• scsi: qla2xxx: Add abort command handling for 29xx series (bsc#1275737).
• scsi: qla2xxx: Add BSG MPI firmware load/dump for 29xx (bsc#1275737).
• scsi: qla2xxx: Add build-time size check for VP config IOCB layout (bsc#1275737).
• scsi: qla2xxx: Add extended status continuation and marker IOCBs (bsc#1275737).
• scsi: qla2xxx: Add FC operational firmware load for 29xx (bsc#1275737).
• scsi: qla2xxx: Add flash block read/write BSG support for 29xx (bsc#1275737).
• scsi: qla2xxx: Add flash read/write interface for 29xx (bsc#1275737).
• scsi: qla2xxx: Add LS4 pass-through IOCB handling for 29xx series (bsc#1275737).
• scsi: qla2xxx: Add NVRAM config support for 29xx adapters (bsc#1275737).
• scsi: qla2xxx: Add size check for ELS status entry layout on 29xx (bsc#1275737).
• scsi: qla2xxx: Add size check for extended VP report ID entry (bsc#1275737).
• scsi: qla2xxx: Add support for QLA29XX in data rate functions (bsc#1275737).
• scsi: qla2xxx: Add support for QLA29XX in memory allocation (bsc#1275737).
• scsi: qla2xxx: Adjust feature gating in BSG paths for 29xx support (bsc#1275737).
• scsi: qla2xxx: Avoid double completion in async IOCB timeout (bsc#1275737).
• scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (bsc#1275737).
• scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (bsc#1275737).
• scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (bsc#1275737).
• scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (bsc#1275737).
• scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (bsc#1275737).
• scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() (bsc#1275737).
• scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity (bsc#1275737).
• scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (bsc#1275737).
• scsi: qla2xxx: Clarify MPI optrom address/length units (bsc#1275737).
• scsi: qla2xxx: Don't query firmware state while chip is down (bsc#1275737).
• scsi: qla2xxx: Drop vport reference under lock in report ID acquisition (bsc#1275737).
• scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (bsc#1275737).
• scsi: qla2xxx: Enable get_adapter_id mailbox for 29xx (bsc#1275737).
• scsi: qla2xxx: Enable get_firmware_state for 29xx (bsc#1275737).
• scsi: qla2xxx: Enable get_fw_version mailbox for 29xx (bsc#1275737).
• scsi: qla2xxx: Enable init_firmware mailbox for 29xx (bsc#1275737).
• scsi: qla2xxx: Enable qla2x00_shutdown for 29xx (bsc#1275737).
• scsi: qla2xxx: Enable serdes, resource count and FCE trace for 29xx (bsc#1275737).
• scsi: qla2xxx: Enable set_els_cmds and echo_test for 29xx (bsc#1275737).
• scsi: qla2xxx: Enhance ABTS processing for 29xx series (bsc#1275737).
• scsi: qla2xxx: Enhance ct_entry_24xx_ext iocb handling for 29xx series (bsc#1275737).
• scsi: qla2xxx: Enhance purex_entry handling for 29xx series (bsc#1275737).
• scsi: qla2xxx: Enhance task management IOCB handling for 29xx series (bsc#1275737).
• scsi: qla2xxx: Extend execute_fw mailbox to include 29xx (bsc#1275737).
• scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate (bsc#1275737).
• scsi: qla2xxx: Fix an error code in qla_get_tmf() (bsc#1275737).
• scsi: qla2xxx: Fix an loop timeout test (bsc#1275737).
• scsi: qla2xxx: Fix BSG job leak on validate flash image error path (bsc#1275737).
• scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (bsc#1275737).
• scsi: qla2xxx: Fix endianness annotations in vp_rpt_id_entry structures (bsc#1275737).
• scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (bsc#1275737).
• scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (bsc#1275737).
• scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters (bsc#1275737).
• scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort (bsc#1275737).
• scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (bsc#1275737).
• scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (bsc#1275737).
• scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (bsc#1275737).
• scsi: qla2xxx: Fix the ql2xfc2target parameter description (bsc#1275737).
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (bsc#1275737).
• scsi: qla2xxx: Handle INTx not connected while passing through (bsc#1275737).
• scsi: qla2xxx: Handle sts_cont_entry_ext_t for 29xx adapters (bsc#1275737).
• scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (bsc#1275737).
• scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (bsc#1275737).
• scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition (bsc#1275737).
• scsi: qla2xxx: Improve firmware dump data capture (bsc#1275737).
• scsi: qla2xxx: Initialize NVMe abort_work once at submission (bsc#1275737).
• scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path (bsc#1275737).
• scsi: qla2xxx: Quiesce response IRQ before freeing request queue (bsc#1275737).
• scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (bsc#1275737).
• scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (bsc#1275737).
• scsi: qla2xxx: Replace __le16 bitfields with scalar and accessors (bsc#1275737).
• scsi: qla2xxx: Serialize flash version read in reset handler (bsc#1275737).
• scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (bsc#1275737).
• scsi: qla2xxx: Skip image-set-valid attribute for 29xx (bsc#1275737).
• scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (bsc#1275737).
• scsi: qla2xxx: Skip unsupported sysfs attributes for 29xx (bsc#1275737).
• scsi: qla2xxx: Skip vport under deletion in report ID acquisition (bsc#1275737).
• scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (bsc#1275737).
• scsi: qla2xxx: Update handling of ELS IOCBs for 29xx series (bsc#1275737).
• scsi: qla2xxx: Update handling of status entries for 29xx series (bsc#1275737).
• scsi: qla2xxx: Update IO path to use 128-byte IOCBs for 29xx (bsc#1275737).
• scsi: qla2xxx: Update version to 12.00.00.2607b1 (bsc#1275737).
• scsi: qla2xxx: Update version to 12.00.00.2607b2 (bsc#1275737).
• scsi: qla2xxx: Update VP control IOCB handling for 29xx series (bsc#1275737).
• scsi: qla2xxx: Use 64-bit FPM word counters for 29xx host stats (bsc#1275737).
• scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics (bsc#1275737).
• scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot (bsc#1275737).
• scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs (bsc#1275737).
• scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd (bsc#1275737).
• scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (bsc#1275737).
• scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (bsc#1275737).
• scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (bsc#1275737).
• scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (bsc#1275737).
• selftests/alsa: Do not take another control's event as our own (git-fixes).
• selftests: ALSA: pcmtest: Check the frame count of each transfer (git-fixes).
• selftests: ALSA: pcmtest: Compare all captured bytes in ni_capture (git-fixes).
• selftests: ALSA: pcmtest: Make room for the longest fill pattern (git-fixes).
• serial: 8250_exar: store the GPIO platform device in struct exar8250 (git-fixes).
• serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() (git-fixes).
• serial: 8250_omap: set priv->line before enabling the IRQ (git-fixes).
• serial: 8250_uniphier: Use devm_clk_get_enabled() (git-fixes).
• serial: core: shut down initialized port on removal (git-fixes).
• serial: ma35d1: Do not force-enable an unselected console (git-fixes).
• serial: max310x: don't clobber the TX break bit in set_termios (git-fixes).
• serial: max310x: fix breaks not reaching the wire in RS485 mode (git-fixes).
• serial: msm: select PM_OPP (git-fixes).
• serial: pmac_zilog: push received data to the port that received it (git-fixes).
• serial: pmac_zilog: report received breaks (git-fixes).
• slimbus: messaging: fix leaked PM vote on tid allocation failure (git-fixes).
• smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).
• soc/tegra: flowctrl: Release OF node reference on error (git-fixes).
• soc/tegra: pmc: Add kerneldoc for wake-up variables (git-fixes).
• soc/tegra: pmc: Document tegra_pmc.syscore field (stable-fixes).
• soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() (git-fixes).
• soc: fsl: dpio: Fix cleanup on IRQ registration failure (git-fixes).
• soc: fsl: dpio: Free the IRQ before releasing the I/O object (git-fixes).
• soc: qcom: apr: clean up failed service registrations (git-fixes).
• soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove (git-fixes).
• soc: ti: k3-ringacc: Correct ring API kernel-doc (git-fixes).
• soc: ti: k3-ringacc: Fix DMA ring initialization kernel-doc (git-fixes).
• soundwire: intel: initialise quirk_mask before reading it (git-fixes).
• soundwire: intel_auxdevice: Fix system suspend/resume handling (git-fixes).
• spi: amd: fix len==0 underflow and FIFO overflow (git-fixes).
• spi: bcm63xx-hsspi: Disable runtime PM on remove (git-fixes).
• spi: bcm2835: fix device_node reference leak in bcm2835_spi_setup() (git-fixes).
• spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op (git-fixes).
• spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path (git-fixes).
• spi: ch341: fix devres lifetime (git-fixes).
• spi: ch341: handle transfers without a TX or RX buffer (git-fixes).
• spi: ch341: switch to use devm_spi_alloc_host() (stable-fixes).
• spi: Fix the return value in spi_new_ancillary_device() kernel-doc (git-fixes).
• spi: jcore: fix divide-by-zero when speed_hz is zero (git-fixes).
• spi: ljca: validate the response length before copying the data (git-fixes).
• spi: microchip-core-qspi: remove unused param from mchp_coreqspi_write_op() (stable-fixes).
• spi: microchip-core-qspi: set min_speed_hz during probe (stable-fixes).
• spi: mpc52xx: clean up interrupt handling (stable-fixes).
• spi: mtk-nor: fix runtime PM usage count leak in probe error path (git-fixes).
• spi: mxic: fix ps_clk leak in runtime resume (git-fixes).
• spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer (git-fixes).
• spi: omap2-mcspi: handle DMA setup failures (git-fixes).
• spi: omap2-mcspi: Remove unbalanced pm_runtime_put_sync() calls (git-fixes).
• spi: rspi: Fix DMA mode when the DMA controller is built as a module (git-fixes).
• spi: spi-sun4i: sun4i_spi_fill_fifo(): always apply A10 FIFO fill level workaround (git-fixes).
• spi: spi-sun4i: sun4i_spi_handler(): fix race condition between transfer completion and RX FIFO interrupt (git-fixes).
• spi: spi-sun4i: sun4i_spi_transfer_one(): fix setting of clock rate (git-fixes).
• spi: spi-sun4i: sun4i_spi_transfer_one(): fix transfers for SUN4I_FIFO_DEPTH (git-fixes).
• spi: tegra114: assert CS GPIO for every transfer in a message (git-fixes).
• spi: tegra114: initialize native chip selects inactive (git-fixes).
• spi: zynq-qspi: fix address buffer corruption and support 4-byte address (git-fixes).
• staging: iio: adc: ad7816: Fix DMA safety issues in SPI transfers (git-fixes).
• staging: media: av7110: fix corrupted BER reporting in sp8870 (git-fixes).
• staging: media: av7110: fix sp8870 initialization failure state (git-fixes).
• staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error (git-fixes).
• staging: rtl8723bs: fix RX buffer OOB write from device-reported length (git-fixes).
• staging: sm750fb: free cmap on framebuffer release (git-fixes).
• thermal/drivers/sprd: validate the sensor id from the device tree (git-fixes).
• thermal: Fix CPU mask truncation in power limit trace event (git-fixes).
• thermal: gov_power_allocator: Fix NULL pointer dereference in update_tz() (git-fixes).
• thermal: intel: int340x: Fix temperature selection around 0 C (git-fixes).
• thermal: intel: powerclamp: Reject invalid window_size values (git-fixes).
• thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc (git-fixes).
• thunderbolt: Do not RPM complete unrelated subtrees on unplug (git-fixes).
• tools/power turbostat: Fix add_counter issue if > 24 counters (git-fixes).
• tools/power turbostat: Fix fd_perf leak on reset (git-fixes).
• tools/thermal/tmon: Fix string truncation warning in optarg copy (git-fixes).
• tpm: fix zero-length read discarding the pending response (git-fixes).
• tpm: tpm_nsc: fix NULL pointer dereference on init failure (git-fixes).
• tpm: tpm_nsc: stop using the cleanup callback as dev.release (git-fixes).
• usb-storage: alauda: check the return value of alauda_read_map() (git-fixes).
• usb-storage: alauda: do not do DMA from the stack (git-fixes).
• usb-storage: alauda: fix out-of-bounds zone index (git-fixes).
• USB: cdc-acm: fix urb leak on disconnect (git-fixes).
• usb: fotg210: validate endpoint index in ep0 handlers (git-fixes).
• usb: gadget: composite: avoid warning on aborted delayed status (git-fixes).
• usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket (git-fixes).
• usb: gadget: dummy_hcd: prevent unbind via sysfs (git-fixes).
• usb: gadget: f_mass_storage: ignore class requests while inactive (git-fixes).
• USB: gadgetfs: do not WARN about excessively large memory allocations (git-fixes).
• usb: image: microtek: stop SG processing after transfer errors (git-fixes).
• usb: musb: da8xx: depopulate OF children on probe failure (git-fixes).
• usb: musb: da8xx: depopulate OF children on remove (git-fixes).
• USB: pci-quirks: Release EHCI device reference (git-fixes).
• USB: serial: sierra: fix urb leak on write completion (git-fixes).
• USB: serial: usb_wwan: fix urb leak on disconnect (git-fixes).
• usb: typec: ucsi_ccg: Add retry mechanism in ccg_read (git-fixes).
• USB: usbmon: fix null-ptr-deref in mon_bus_remove() when mon_bus_init() fails (git-fixes).
• usbnet: fix EVENT_RX_PAUSED race in usbnet_skb_return() (git-fixes).
• usbnet: fix smp_processor_id() use in preemptible context (git-fixes).
• watchdog: mediatek: Apply the driver's mode to a watchdog left running (git-fixes).
• wifi: ath6kl: don't take RTNL in del_virtual_intf (git-fixes).
• wifi: ath9k: delete channel-context timers on deinit (git-fixes).
• wifi: ath10k: avoid IDR mutation during TX cleanup (git-fixes).
• wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup (git-fixes).
• wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).
• wifi: ath11k: disable interrupts during firmware crash recovery (git-fixes).
• wifi: ath11k: fix locking problem in ath11k_dp_rx_tid_del_func() (git-fixes).
• wifi: ath11k: fix NULL dereference in ahb remove when QMI init incomplete (git-fixes).
• wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() (git-fixes).
• wifi: ath11k: fix sporadic WLAN initialization failures (git-fixes).
• wifi: ath11k: fix unbalanced IRQ enable/disable during suspend/resume (git-fixes).
• wifi: ath11k: modify null check logic in ath11k_ce_rx_post_pipe() (git-fixes).
• wifi: ath11k: unregister PM notifier on QMI init failure path (git-fixes).
• wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).
• wifi: ath12k: fix incorrect TID updation in DP monitor status path (stable-fixes).
• wifi: ath12k: Free allocated CE IRQs on request_irq() failure (git-fixes).
• wifi: ath12k: Reserve space for a string terminator (git-fixes).
• wifi: b43: don't pass unterminated string to sscanf() (git-fixes).
• wifi: b43: fix use-after-free in b43_bcma_remove() (git-fixes).
• wifi: b43legacy: debugfs: NUL terminate string in debugfs (git-fixes).
• wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz (git-fixes).
• wifi: carl9170: NUL terminate string in debugfs (git-fixes).
• wifi: cfg80211: allow zero HE OBSS PD offsets (git-fixes).
• wifi: cfg80211: reg: protect regdb pointer with RCU (git-fixes).
• wifi: cfg80211: track SSID regardless of country data (git-fixes).
• wifi: iwlwifi: dvm: pair transport op-mode enter/leave (stable-fixes).
• wifi: iwlwifi: simplify nested if checks (stable-fixes).
• wifi: mac80211: clear fragment cache entry 'is_protected' (git-fixes).
• wifi: mac80211: don't reset the TXQ scheduling round number (git-fixes).
• wifi: mac80211: don't send encap offload frames unencrypted (git-fixes).
• wifi: mac80211: drop encap offload frames with a tainted key (git-fixes).
• wifi: mac80211: Fix a race when expiring a mesh path (git-fixes).
• wifi: mac80211: fix encryption tailroom (git-fixes).
• wifi: mac80211: fix key selection for encap offload frames (git-fixes).
• wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (stable-fixes).
• wifi: mac80211: fix swapped fq_overlimit/fq_overmemory in aqm debugfs (git-fixes).
• wifi: mac80211: Fix the return value in mesh_path_add() kernel-doc (git-fixes).
• wifi: mac80211: fix typo in HE MCS check (stable-fixes).
• wifi: mac80211: fix unauthorised port check for encap offload (git-fixes).
• wifi: mac80211: init radiotap iter after length checks (git-fixes).
• wifi: mac80211: kill wake_txqs_tasklet on unregistration (git-fixes).
• wifi: mac80211: limit injected HT/VHT MCSes (git-fixes).
• wifi: mac80211: log link information in ieee80211_determine_chan_mode (stable-fixes).
• wifi: mac80211: mesh: use hlist_add_head_rcu() (git-fixes).
• wifi: mac80211: refactor populating mesh related fields in sinfo (stable-fixes).
• wifi: mac80211: reserve MME tailroom for protected beacons (git-fixes).
• wifi: mac80211: use link address as TA for non-MLO 4-addr station on MLD AP (git-fixes).
• wifi: mt76: feed the station RSSI average from the chain signals (git-fixes).
• wifi: mt76: fix memory leak in USB TX path (git-fixes).
• wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() (git-fixes).
• wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add() (git-fixes).
• wifi: mt76: fix wcid->pktid corruption in mt76_wcid_cleanup() (git-fixes).
• wifi: mt76: mt76x02: validate RX padding before use (git-fixes).
• wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff (git-fixes).
• wifi: mt76: mt792x: compute the assoc RSSI from the chain signals (git-fixes).
• wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory (git-fixes).
• wifi: mt76: mt7603: don't drop short frames looped back on PS entry (git-fixes).
• wifi: mt76: mt7615: cancel reset work during unregister (git-fixes).
• wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs (git-fixes).
• wifi: mt76: mt7615: read MT7663 temperature from the correct offset (git-fixes).
• wifi: mt76: mt7615: restore DBDC state after ext PHY failure (git-fixes).
• wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy (git-fixes).
• wifi: mt76: mt7615: validate MCU response lengths (git-fixes).
• wifi: mt76: mt7915: check default EEPROM firmware size before copying (git-fixes).
• wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump (git-fixes).
• wifi: mt76: mt7915: publish wcid before MCU add commands (git-fixes).
• wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure (git-fixes).
• wifi: mt76: mt7921: check drv_pmctrl return in the PCIe reset path (git-fixes).
• wifi: mt76: mt7921: fix lock inversion between dev->mutex and iflist_mtx (git-fixes).
• wifi: mt76: mt7921: fix the lock inversion in suspend and resume (git-fixes).
• wifi: mt76: mt7921: honour FIF_FCSFAIL instead of hardcoding drop_err (git-fixes).
• wifi: mt76: mt7921: keep the join ROC until the station is authorized (git-fixes).
• wifi: mt76: mt7925: check drv_pmctrl return in the PCIe reset path (git-fixes).
• wifi: mt76: mt7925: fix lock inversion between dev->mutex and iflist_mtx (git-fixes).
• wifi: mt76: mt7925: fix the lock inversion in suspend and resume (git-fixes).
• wifi: mt76: mt7925: honour mac80211's FIF_FCSFAIL instead of hardcoding drop_err (git-fixes).
• wifi: mt76: mt7925: keep the join ROC until the station is authorized (git-fixes).
• wifi: mt76: mt7925: restore the reset state when fw_pmctrl fails (git-fixes).
• wifi: mt76: mt7996: disable the RX NAPIs before the DMA cleanup (git-fixes).
• wifi: mt76: mt7996: fix PLE free page and AC queue register offsets (git-fixes).
• wifi: mt76: mt7996: validate firmware event lengths before parsing (git-fixes).
• wifi: mt76: usb: fix source overread in mt76u_copy (git-fixes).
• wifi: mwifiex: append hotfix number to firmware version string (git-fixes).
• wifi: nl80211: check link is beaconing for color change (stable-fixes).
• wifi: p54: validate firmware record lengths (stable-fixes).
• wifi: rtl8xxxu: free RX skb when URB submission fails (git-fixes).
• wifi: rtw88: debugfs: don't vzalloc(0) when rsvd_page is read unconfigured (git-fixes).
• wifi: rtw88: fix out-of-bounds CAM write when key table is full (git-fixes).
• wifi: rtw88: sdio: zero the padding added to a TX transfer (git-fixes).
• wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields (git-fixes).
• wifi: rtw89: cap firmware section_num before parsing (git-fixes).
• wifi: rtw89: fix IE length passed to cfg80211_find_ie() in WoW AKM (git-fixes).
• wifi: wfx: fix possible device hang during init (git-fixes).
• wifi: wfx: fix use-after-free of the cooling work on device removal (git-fixes).
• workqueue: Fix unbound pool lifetime for pending pwqs (bsc#1289119).
• workqueue: release pwq pools by pool type (bsc#1289119).
• wwan: wwan_hwsim: Pin module for debugfs file operations (git-fixes).
• x86/microcode/intel: Reject problematic loading on Granite Rapids systems (git-fixes).
• x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (git-fixes).
• xhci: dbc: lock the minor IDR on registration failure (git-fixes).