SUSE-SU-2026:5091-1

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
• CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
• CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
• CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
• CVE-2026-80879: ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (bsc#1279494).
• CVE-2026-80881: ocfs2: fix buffer head management in ocfs2_read_blocks() (bsc#1279496).
• CVE-2026-80978: ip6_gre: fix hardware header length for NBMA tunnels (bsc#1280253).
• CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (bsc#1280472).
• CVE-2026-89494: ocfs2: validate lengths in dlm_mig_lockres_handler (bsc#1280520).
• CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler (bsc#1280569).
• CVE-2026-89537: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (bsc#1280713).
• CVE-2026-89560: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (bsc#1280806).
• CVE-2026-89595: fsnotify: Fix stale object mask after concurrent mark updates (bsc#1280834).
• CVE-2026-89608: ecryptfs: pass packet set buffer size to parser (bsc#1280826).
• CVE-2026-89637: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (bsc#1280492).
• CVE-2026-89649: ceph: bound xattr value length in __build_xattrs() (bsc#1280434).
• CVE-2026-89654: ceph: fix UAF in check_new_map() on session freed during unlock (bsc#1280415).
• CVE-2026-89655: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (bsc#1280398).
• CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids (bsc#1280563).
• CVE-2026-89657: libceph: validate OSD extent maps before cursor advance (bsc#1280545).
• CVE-2026-89751: x86/tdx: Fix off-by-one in port I/O handling (bsc#1280822).
• CVE-2026-89761: apparmor: fix out-of-bounds write when null terminating a label vec (bsc#1280745).
• CVE-2026-89786: ext4: fix out-of-bounds read in ext4_read_inline_dir() (bsc#1280976).
• CVE-2026-89787: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (bsc#1280977).
• CVE-2026-90042: ceph: properly decrypt filenames in vmalloc() buffers (bsc#1280948).
• CVE-2026-90092: Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (bsc#1281384).
• CVE-2026-90128: vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (bsc#1281577).
• CVE-2026-90148: NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (bsc#1281551).
• CVE-2026-90227: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (bsc#1281705).
• CVE-2026-90393: bpf: Fix potential UAF in bpf_netns_link_update_prog (bsc#1282289).
• CVE-2026-93054: uio: Fix stale info pointer in failed registration path (bsc#1282276).
• CVE-2026-93228: svcrdma: Reject Write/Reply chunks with segcount 0 (bsc#1282697).
• CVE-2026-93262: md/raid5-ppl: fix use-after-free in ppl_do_flush() (bsc#1283004).
• CVE-2026-93795: blk-cgroup: fix leaks and online flag on radix_tree_insert failure (bsc#1283155).
• CVE-2026-93798: btrfs: fix reloc root cleanup in merge_reloc_roots() (bsc#1282769).
• CVE-2026-93817: perf: Fix addr_filter_ranges lifetime (bsc#1283017).
• CVE-2026-97575: media: v4l2-ctrls: validate AV1 tile counts (bsc#1283337).
• CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).
• CVE-2026-97926: ufs: validate cylinder group metadata before caching it (bsc#1283887).
• CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
• CVE-2026-98086: ALSA: ump: do not touch legacy_rmidi before it exists (bsc#1283785).
• CVE-2026-98264: ALSA: virtio: reset device before deleting virtqueues (bsc#1284363).
• CVE-2026-98306: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (bsc#1284505).
• CVE-2026-98368: esp: downgrade zerocopy managed frags before mutating skb frags (bsc#1284498).
• CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (bsc#1284740).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
• CVE-2026-98471: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (bsc#1286240).

The following non security issues were fixed:

• accel/qaic: reject BO sizes that overflow page count (git-fixes).
• ACPI: CPPC: Validate the _CPC package header (git-fixes).
• ACPI: extlog: Validate elog record length before walking sections (git-fixes).
• ACPI: PCI: pci_link: clear driver_data before free (git-fixes).
• ACPI: pfr_update: zero-initialize capability query result (git-fixes).
• ACPI: PM: Drop parent state update from acpi_device_get_power() (git-fixes).
• ACPI: tables: handle failed initrd override mappings (git-fixes).
• ACPI: TAD: Rearrange RT data validation checking (stable-fixes).
• ACPI: video: Fix backlight unregistration ordering (git-fixes).
• ACPICA: Fix memory leak in acpi_ds_create_field() (git-fixes).
• ACPICA: Fix PCC OperationRegion command offsets (git-fixes).
• ALSA: 6fire: take stream_mutex in the Digital Thru control (git-fixes).
• ALSA: aloop: Keep the timer source alive until card release (git-fixes).
• ALSA: caiaq: Allow zero-length packet handling for EP1 (git-fixes).
• ALSA: caiaq: Fix races at MIDI URB and trigger accesses (git-fixes).
• ALSA: caiaq: Fix the Kore controller key map (git-fixes).
• ALSA: caiaq: Register card at the final step (git-fixes).
• ALSA: caiaq: Serialize access to the EP1 command buffer (git-fixes).
• ALSA: compress: add missing OPEN-state gate to SET_METADATA (git-fixes).
• ALSA: compress: fix buffer leak on failed SET_PARAMS (git-fixes).
• ALSA: compress: reject buffer geometry change on gapless next_track (git-fixes).
• ALSA: control: Fix virtual master creation reference in kernel-doc (git-fixes).
• ALSA: cs46xx: fix unit mismatch in DSP code area bounds check (git-fixes).
• ALSA: hda/hdmi: clamp num_cvts against cvt_nids in hdmi_read_pin_conn (git-fixes).
• ALSA: hda/hdmi: clamp sad_count in ELD proc write handler (git-fixes).
• ALSA: hda: Add NULL check for the driver pointer at unsol event work (git-fixes).
• ALSA: hda: Avoid non-operational GPU warning at regular device removal (git-fixes).
• ALSA: hda: Fix potential UAF for gating jack (git-fixes).
• ALSA: hda: intel: Cancel delayed work at shutdown, too (git-fixes).
• ALSA: info: Fix memory leak at card removal (git-fixes).
• ALSA: jack: Fix kctl free at error in snd_jack_kctl_new() (git-fixes).
• ALSA: jack: Remove debugfs before freeing unregistered jacks (git-fixes).
• ALSA: line6: Clear prev_fbuf on capture buffer release (git-fixes).
• ALSA: line6: Fix potential OOB write in line6_capture_copy() (git-fixes).
• ALSA: line6: Reject too small max packet sizes (git-fixes).
• ALSA: line6: Use kzalloc() for PCM buffer allocation (git-fixes).
• ALSA: pcm: Fix driver_tstamp value reporting (git-fixes).
• ALSA: pcm: Protect channel-map reads against runtime detach (git-fixes).
• ALSA: pcm: Protect delay DMA sync against concurrent HW_FREE (git-fixes).
• ALSA: pcm: Protect delay DMA sync in forward and rewind, too (git-fixes).
• ALSA: pcm: Protect the unregister notifier traversal (git-fixes).
• ALSA: pcm: Remove channel-map controls before freeing substreams (git-fixes).
• ALSA: pcm: Unlink substreams before releasing them (git-fixes).
• ALSA: rawmidi: Drain input work before freeing the runtime (git-fixes).
• ALSA: seq: Fix missing direction and ump_group handling in 32bit compat ioctl (git-fixes).
• ALSA: seq: oss: Skip events until fully initialized (git-fixes).
• ALSA: ump: Avoid dereference with max_src_size=0 (git-fixes).
• ALSA: ump: Correct return size of fill_rpn() (git-fixes).
• ALSA: usb-audio: Use fixed control index for us16x08 mixer elements (git-fixes).
• ALSA: via82xx: use helper to activate DXS controls (git-fixes).
• ALSA: vmaster: Protect follower lookup and setup (git-fixes).
• ASoC: adau17x1: return cache sync errors from resume (git-fixes).
• ASoC: ak4642: return cache sync errors from resume (git-fixes).
• ASoC: amd: acp: Fix .close() being skipped on rollback (git-fixes).
• ASoC: amd: ps: Fix acp63_pdm_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: ps: Fix acp63_sdw_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: raven: Fix acp3x_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: renoir: Fix acp_pdm_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: vangogh: Fix acp5x_dma_close() being skipped on rollback (git-fixes).
• ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) (stable-fixes).
• ASoC: amd: yc: Fix acp6x_pdm_dma_close() being skipped on rollback (git-fixes).
• ASoC: arizona-jack: Fix runtime PM imbalance in arizona_start_hpdet_acc_id() (git-fixes).
• ASoC: atmel-i2s: fix MCK generator error handling (git-fixes).
• ASoC: atmel-i2s: use optional API for gclk (git-fixes).
• ASoC: atmel-i2s: use optional API for muxclk (git-fixes).
• ASoC: atmel: atmel-pcm-pdc: Fix atmel_pcm_close() being skipped on rollback (git-fixes).
• ASoC: codecs: da732x: Fix definition of ADC2 EQ Overall Volume control (git-fixes).
• ASoC: codecs: lpass-wsa-macro: use v2.5 Compander1 addresses on v2.5+ (git-fixes).
• ASoC: codecs: rt5659: propagate GPIO errors (git-fixes).
• ASoC: codecs: rt5682s: disable jack detection work on shutdown (git-fixes).
• ASoC: codecs: sta32x: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).
• ASoC: codecs: sta32x: Fix definition of limiter threshold controls (git-fixes).
• ASoC: codecs: sta350: Fix definition of Ch2 and Ch3 Volume Bypass controls (git-fixes).
• ASoC: codecs: sta350: Fix definition of limiter threshold controls (git-fixes).
• ASoC: codecs: tlv320adc3xxx: Fix definition of AGC Target Level control (git-fixes).
• ASoC: codecs: wcd9335: Fix SLIM interface device leak in wcd9335_slim_status() (git-fixes).
• ASoC: codecs: wm5100: Fix definition of EQ3 Band 1 Volume control (git-fixes).
• ASoC: codecs: wm8510: Fix definition of ADC Inversion Switch control (git-fixes).
• ASoC: codecs: wm8737: Fix definition of zero cross switches (git-fixes).
• ASoC: codecs: wm8750: Fix definition of ALC Capture NG Type control (git-fixes).
• ASoC: codecs: wm8955: Fix definition of Treble Cutoff control (git-fixes).
• ASoC: codecs: wm8983: Fix definition of ADC 128x Oversampling control (git-fixes).
• ASoC: codecs: wm8985: Fix definition of ADC 128x Oversampling control (git-fixes).
• ASoC: codecs: wm8990: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).
• ASoC: codecs: wm8990: Fix definition of right input PGA controls (git-fixes).
• ASoC: codecs: wm8991: Fix definition of LOMIX AINLMUX Bypass Volume control (git-fixes).
• ASoC: codecs: wm8991: Fix definition of right input PGA controls (git-fixes).
• ASoC: codecs: wm8994: Fix definition of WM8958 noise gate hold time controls (git-fixes).
• ASoC: codecs: wm8994: Fix runtime PM leak in wm8994_mic_detect() (git-fixes).
• ASoC: codecs: wm_hubs: Fix definition of MIXINR to MIXOUTR volume control (git-fixes).
• ASoC: dwc: Use OF match data again for StarFive JH7110 (git-fixes).
• ASoC: es8316: return cache sync errors from resume (git-fixes).
• ASoC: es8326: report resume restore errors (git-fixes).
• ASoC: fsl_asrc: check the second front-end DMA channel (git-fixes).
• ASoC: fsl_asrc: use regmap_write_bits to update clock source registers (git-fixes).
• ASoC: imx-pcm-rpmsg: Fix imx_rpmsg_pcm_close() being skipped on rollback (git-fixes).
• ASoC: intel: atom: Fix .shutdown() being skipped on rollback (git-fixes).
• ASoC: Intel: atom: Fix platform device leak on probe failure (git-fixes).
• ASoC: Intel: avs: Prevent module info underflow (git-fixes).
• ASoC: Intel: avs: Unprepare a stream when recovery occurs (git-fixes).
• ASoC: mediatek: common: Handle constraint return value in FE startup (git-fixes).
• ASoC: mediatek: common: Keep codec references until the card is bound (git-fixes).
• ASoC: mediatek: mt6797: fix wrong unwind order and error code in enable_clock (git-fixes).
• ASoC: mediatek: mt8183: Fix APLL enable error handling (git-fixes).
• ASoC: mediatek: mt8183: Fix clock handling in mux disable path (git-fixes).
• ASoC: mediatek: mt8183: Fix wrong clock cleanup on clk_set_parent() failure (git-fixes).
• ASoC: mediatek: mt8186: Fix AFE clock error handling (git-fixes).
• ASoC: mediatek: mt8186: Fix APLL enable error handling (git-fixes).
• ASoC: mediatek: mt8186: Fix APLL mux setting error handling (git-fixes).
• ASoC: mediatek: mt8186: Fix clock handling in mux disable path (git-fixes).
• ASoC: mediatek: mt8186: Fix MCK error handling (git-fixes).
• ASoC: mediatek: mt8188: Handle constraint return value in FE startup (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-clk: Handle clock enable errors (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-clk: Handle tuner clock enable errors (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-clk: Propagate regmap update errors (git-fixes).
• ASoC: mediatek: mt8188: mt8188-afe-pcm: Handle runtime resume errors (git-fixes).
• ASoC: mediatek: mt8192-mt6359: Fix error handling in MTKAIF calibration (git-fixes).
• ASoC: mediatek: mt8192: check return values in mt8192_afe_gpio_init() (git-fixes).
• ASoC: mediatek: mt8192: fix AFE clock error handling (git-fixes).
• ASoC: mediatek: mt8192: fix APLL mux error handling (git-fixes).
• ASoC: mediatek: mt8192: fix error handling in APLL enable functions (git-fixes).
• ASoC: mediatek: mt8192: fix MCK clock error handling (git-fixes).
• ASoC: mediatek: mt8192: Handle regcache_sync() failure in runtime resume (git-fixes).
• ASoC: mediatek: mt8192: Propagate errors in I2S DAI DAPM event handlers (git-fixes).
• ASoC: mediatek: mt8192: Propagate errors in TDM DAI DAPM event handlers (git-fixes).
• ASoC: mediatek: mt8192: Propagate mt8192_afe_gpio_request() errors in ADDA DAI (git-fixes).
• ASoC: mediatek: mt8192: switch to devm_clk_get_optional() (git-fixes).
• ASoC: mediatek: mt8195: Check paired MEMIF clock enable in FE trigger (git-fixes).
• ASoC: mediatek: mt8195: Fix ETDM MCLK error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix ETDM probe error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix ETDM startup error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix FE startup error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix HDMI TX startup error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix main clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix paired memif clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix register access clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix runtime resume error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix timing system clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Fix tuner clock error handling (git-fixes).
• ASoC: mediatek: mt8195: Propagate IRQ lookup errors (git-fixes).
• ASoC: mt6359-accdet: manage private workqueues with devres (git-fixes).
• ASoC: nau8540: return cache sync errors from resume (git-fixes).
• ASoC: ops: Fix return value in snd_soc_limit_volume() (git-fixes).
• ASoC: qcom: q6apm: clear g_apm on driver removal (git-fixes).
• ASoC: qcom: q6apm: reset the hw pointer with the fragment queue (git-fixes).
• ASoC: rockchip: rockchip_i2s: Handle runtime PM resume failures in set_fmt (git-fixes).
• ASoC: rt711-sdca: always cancel jack work on remove (git-fixes).
• ASoC: rt711-sdw: always cancel jack work on remove (git-fixes).
• ASoC: rt712-sdca-dmic: fix drvdata type in the gain controls (git-fixes).
• ASoC: rt712-sdca: always cancel jack work on remove (git-fixes).
• ASoC: rt722-sdca: always cancel jack work on remove (git-fixes).
• ASoC: rt1011: return cache sync errors from resume (git-fixes).
• ASoC: rt1016: return cache sync errors from resume (git-fixes).
• ASoC: rt1305: return cache sync errors from resume (git-fixes).
• ASoC: rt1308: return cache sync errors from resume (git-fixes).
• ASoC: rt5616: return cache sync errors from resume (git-fixes).
• ASoC: rt5659: return cache sync errors from resume (git-fixes).
• ASoC: rt5660: return cache sync errors from resume (git-fixes).
• ASoC: rt5665: return cache sync errors from resume (git-fixes).
• ASoC: rt5682-sdw: always cancel jack work on remove (git-fixes).
• ASoC: soc-ac97: Fix error handling in snd_soc_new_ac97_component() (git-fixes).
• ASoC: soc-component: Fix return type of snd_soc_pcm_component_pointer() (git-fixes).
• ASoC: soc-topology-test: Check return value of kunit_device_register() (git-fixes).
• ASoC: SOF: amd: fix amd_sof_acp_remove() teardown ordering (git-fixes).
• ASoC: SOF: imx: Prevent stack OOB read in DSP panic dump (git-fixes).
• ASoC: ti: davinci-mcasp: Fix runtime PM imbalance in __davinci_mcasp_set_clkdiv() (git-fixes).
• ASoC: wcd9335: Fix device reference leak in wcd9335_slim_status() (git-fixes).
• ASoC: wcd-mbhc-v2: Fix incorrect properties names and typos (git-fixes).
• ASoC: wm8994: Fix runtime PM imbalance in wm8994_component_probe() (git-fixes).
• asymmetric_keys: reject trust keys without IDs (git-fixes).
• ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0 (git-fixes).
• ata: libata-scsi: Fix ata_scsi_hotplug() reference in kernel-doc (git-fixes).
• ata: pata_parport: fix parport attach idr_alloc for (git-fixes).
• ata: pata_parport: Fix use-after-free in new_device_store (git-fixes).
• ata: sata_fsl: Fix use-after-free of host_priv on probe() failure (git-fixes).
• backlight: lm3630a: Cancel delayed work before destroying workqueue (git-fixes).
• backlight: qcom-wled: Fix NULL pointer dereference in wled_remove() (git-fixes).
• backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe (git-fixes).
• backlight: qcom-wled: Fix WLED3 brightness register stride (git-fixes).
• Bluetooth: 6lowpan: Drain RCU readers on registration failure (git-fixes).
• Bluetooth: 6lowpan: Pin module for 6lowpan_control debugfs file (git-fixes).
• Bluetooth: 6LoWPAN: Use RCU-safe device list removal (git-fixes).
• Bluetooth: Add missing newline to bt_dev_{err,warn}_ratelimited() (git-fixes).
• Bluetooth: btintel: fix buffer over-read in btintel_hw_error() (git-fixes).
• Bluetooth: btintel: validate DDC record lengths (git-fixes).
• Bluetooth: btmtk: fix skb double free on ISO padding failure (git-fixes).
• Bluetooth: btqcomsmd: Convert to platform remove callback returning void (stable-fixes).
• Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).
• Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table (stable-fixes).
• Bluetooth: hci_conn: Lock parent access during enhanced SCO setup (git-fixes).
• Bluetooth: hci_core: free the HCI ID if naming fails (git-fixes).
• Bluetooth: hci_core: Keep RCU protection through LTK filtering (git-fixes).
• Bluetooth: hci_debugfs: Pin module for debugfs file operations (git-fixes).
• Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister (git-fixes).
• Bluetooth: hci_sync: Fix inquiry cache use-after-free (git-fixes).
• Bluetooth: hci_sync: fix mesh adv timeout units (git-fixes).
• Bluetooth: hci_sync: Protect IRK identity reads with RCU (git-fixes).
• Bluetooth: hci_sync: Serialize devcoredump reset during device open (git-fixes).
• Bluetooth: hci_vhci: Pin module for debugfs file operations (git-fixes).
• Bluetooth: ISO: Hold the listener during disconnect notification (git-fixes).
• Bluetooth: L2CAP: hold chan in l2cap_ecred_conn_rsp() (git-fixes).
• Bluetooth: L2CAP: hold l2cap_conn::lock in l2cap_connect_cfm() (git-fixes).
• Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn (git-fixes).
• Bluetooth: L2CAP: Reject invalid TxWindow in configuration requests (git-fixes).
• Bluetooth: L2CAP: Reject mode changes on connected channels (git-fixes).
• Bluetooth: L2CAP: Use default TxWindow for zero socket option (git-fixes).
• Bluetooth: MGMT: Fix leaking instance on Add Extended Advertising Parameters (git-fixes).
• Bluetooth: MGMT: Fix pending state of instances added without HCI traffic (git-fixes).
• Bluetooth: MGMT: Reject quality report requests during unregister (git-fixes).
• Bluetooth: msft: Lock failed probe cleanup against feature readers (git-fixes).
• Bluetooth: MSFT: Serialize handle map cleanup with event processing (git-fixes).
• Bluetooth: RFCOMM: Fix initial port reference race (git-fixes).
• Bluetooth: selftest: Pin module for selftest debugfs file operations (git-fixes).
• bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port() (git-fixes).
• bus: arm-cci: Drop CPU node reference in cci_ace_init_ports() (git-fixes).
• bus: fsl-mc: register the object drivers after misc_class exists (git-fixes).
• char: scx200_gpio: check cdev_add() return value (git-fixes).
• comedi: comedi_parport: validate the IRQ supplied by userspace (git-fixes).
• comedi: dmm32at: validate the IRQ supplied by userspace (git-fixes).
• comedi: dt2811: fix shift-out-of-bounds in IRQ check (git-fixes).
• comedi: dt2814: validate the IRQ supplied by userspace (git-fixes).
• comedi: ni_atmio16d: validate the IRQ supplied by userspace (git-fixes).
• comedi: pcmmio: validate the IRQ supplied by userspace (git-fixes).
• comedi: pcmuio: validate the IRQs supplied by userspace (git-fixes).
• crypto: amlogic - Fix DMA memory leak in cipher error path (git-fixes).
• crypto: amlogic - Fix IRQ handler return value and fallthrough logic (git-fixes).
• crypto: asymmetric_keys - fix OOB read in pefile_parse_binary (git-fixes).
• crypto: atmel - handle authenc requests without plaintext (git-fixes).
• crypto: atmel-aes - fix AADLENR for standalone GHASH (git-fixes).
• crypto: atmel-sha - reject initialization without a device (git-fixes).
• crypto: atmel-tdes - sync output bounce buffer before DMA (git-fixes).
• crypto: atmel-tdes - zero-initialize device state (git-fixes).
• crypto: caam - fix double-free in caam_rsa_set_priv_key_form() (git-fixes).
• crypto: ccp - kill v3 IRQ tasklet during teardown (git-fixes).
• crypto: ccp - kill v5 IRQ tasklet during teardown (git-fixes).
• crypto: hisilicon/hpre - fix ECDH destination DMA mapping (git-fixes).
• crypto: hisilicon/hpre - fix GFP flags for dma_alloc_coherent (git-fixes).
• crypto: hisilicon/hpre - fix pointer dereference before length check (git-fixes).
• crypto: hisilicon/hpre - remove dma_free_coherent on NULL req->dst in ECDH (git-fixes).
• crypto: hisilicon/hpre - return -EOVERFLOW for small ECDH output buffer (git-fixes).
• crypto: qat - avoid OOB read when stripping RSA leading zeros (git-fixes).
• crypto: qat - fix active_devs leak on crypto alg registration failure (git-fixes).
• crypto: qat - fix use of destroyed vf2pf_lock on VF restart (git-fixes).
• crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() (git-fixes).
• crypto: qat - release instance on DH fallback allocation failure (git-fixes).
• crypto: qat - zero the VF migration state buffer on save (git-fixes).
• crypto: tcrypt - Avoid reading req->base after submission (git-fixes).
• Documentation: rs485: Pull uart_get_rs485_mode() from serial_core.c (git-fixes).
• Documentation: virt: Fix the struct snp_guest_request_ioctl name in sev-guest.rst (git-fixes).
• drivers/base/node: fix UAF on device_register() failure (git-fixes).
• Drivers: hv: vmbus: add VTL2 redirect connection ID (git-fixes).
• drm/amd/display: assign missing trace entry in amdgpu_dm_dc_clocks_state (git-fixes).
• drm/amd/display: disable replay when crc source is enabled (stable-fixes).
• drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs (stable-fixes).
• drm/amd/display: fix vready offset assignment in dcn_optc_lock_unlock_state (git-fixes).
• drm/amd/display: Force GAMCOR for subsampled surfaces with PQ/Gamma22/HLG (git-fixes).
• drm/amd/display: remove duplicated prev_p_state_change_support assignment (git-fixes).
• drm/amd/display: Use kcalloc() instead of kzalloc() (stable-fixes).
• drm/amd/display: use right type for amdgpu_dc_performance event entries (git-fixes).
• drm/amd/pm: bound SCLK FCW range entries to the table size (git-fixes).
• drm/amdgpu/atombios: drop empty function (stable-fixes).
• drm/amdgpu/gfx6: fix firmware leak on teardown (stable-fixes).
• drm/amdgpu: Check for multiplication overflow in checkpoint stack (bsc#1276280).
• drm/amdgpu: make Mac FB workaround generic (stable-fixes).
• drm/amdgpu: Remove unused amdgpu_i2c functions (stable-fixes).
• drm/amdgpu: reset VI ASIC on MacBookPro14,3 (stable-fixes).
• drm/amdgpu: reset VI ASIC on MacBookPro15,1 (stable-fixes).
• drm/amdgpu: rework i2c init and fini (stable-fixes).
• drm/amdgpu: serialize vblank counter reads against GPU reset (stable-fixes).
• drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support (stable-fixes).
• drm/amdgpu: Use dbg level for VBIOS check messages (stable-fixes).
• drm/amdkfd: Fix checkpoint-restore on multi-xcc (bsc#1276280).
• drm/amdkfd: Fix partial migrate issue (stable-fixes).
• drm/bridge: analogix_dp: Restore mandatory samsung DP DT properties (git-fixes).
• drm/exynos/fimd: fix register offset type in fimd_trigger() (git-fixes).
• drm/i915/display: convert I915_STATE_WARN() to struct intel_display (stable-fixes).
• drm/i915/gmbus: convert to struct intel_display (stable-fixes).
• drm/i915/vga: Convert VGA code to intel_display (stable-fixes).
• drm/i915: document range_overflows() and range_end_overflows() macros (stable-fixes).
• drm/i915: rename range_overflows_end() to range_end_overflows() (stable-fixes).
• drm/imx/lcdc: avoid duplicate clk_per enable (git-fixes).
• drm/komeda: Fix bits parsing of GLB_CORE_ID (git-fixes).
• drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable() (git-fixes).
• drm/msm/a6xx: Fix secondary rail vote in ARC votes (git-fixes).
• drm/msm/a6xx: fix use-after-free of OPP in a6xx_pm_resume (git-fixes).
• drm/msm/dp: don't report link training success after a reinit (git-fixes).
• drm/msm/dpu: disable the slave encoder before the master (git-fixes).
• drm/msm/hdmi_phy: Cleanup after msm_hdmi_phy_resource_enable() failure (git-fixes).
• drm/msm/mdp5: drop cursor pipe for msm8x76 (git-fixes).
• drm/msm: Properly handle msm_ioremap() without name (git-fixes).
• drm/nouveau/svm: drain fault handler before freeing svmm (git-fixes).
• drm/nouveau: cancel the DP IRQ work before freeing the connector (git-fixes).
• drm/nouveau: disable the fence uevent work instead of just cancelling it (git-fixes).
• drm/nouveau: don't dereference outp before checking it in nouveau_dp_irq (git-fixes).
• drm/nouveau: reject zero-size notifier object allocation (git-fixes).
• drm/omap: dsi: avoid sending bta sync all the time in writes (git-fixes).
• drm/panel: ebbg-ft8719: Set prepare_prev_first (git-fixes).
• drm/panfrost: Explicitly enable MMU interrupts at device init (git-fixes).
• drm/panfrost: Prevent division by 0 (git-fixes).
• drm/panthor: Fix TOCTOU race between GROUP_REGISTERED check and erase (git-fixes).
• drm/panthor: Take reqs_lock in soft_reset for clearing pending_reqs (git-fixes).
• drm/tegra: Don't pass an ERR_PTR to drm_syncobj_replace_fence() (git-fixes).
• drm/tegra: Drop reference on postfence (git-fixes).
• drm/tegra: Fix syncobj_in wait return value check (git-fixes).
• drm/ttm: return an error when kmapping a BO without pages (git-fixes).
• drm/vc4: Fix firmware reference leak in vc4_drm_bind() (git-fixes).
• drm/vc4: Use video aperture helpers (stable-fixes).
• drm/virtio: Add a helper to map and note the dma addrs and lengths (stable-fixes).
• drm/virtio: Use drm_gem_plane_helper_prepare_fb() (stable-fixes).
• drm/vmwgfx: Stop using dev_private to store driver data (stable-fixes).
• drm: of: Fix drm_of_get_data_lanes_count_ep() return value documentation (git-fixes).
• fbdev: atmel_lcdfb: Prevent FIFO work after removal (git-fixes).
• fbdev: gxt4500: Release WC setup on probe failure (git-fixes).
• fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error (git-fixes).
• fbdev: smscufx: check for fb_deferred_io_init() error (git-fixes).
• fbdev: ssd1307fb: check for fb_deferred_io_init() error (git-fixes).
• fbdev: udlfb: check for fb_deferred_io_init() error (git-fixes).
• fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use (git-fixes).
• fbdev: xen-fbfront: check for fb_deferred_io_init() error (git-fixes).
• firewire: cdev: Fix FW_CDEV_IOC_CREATE_ISO_CONTEXT references in kernel-doc (git-fixes).
• firmware: cs_dsp: clear dsp->running on the cs_dsp_run() error path (git-fixes).
• firmware: imx: dsp: fix mailbox channel leak on kasprintf failure (git-fixes).
• fpga: Fix of_fpga_mgr_get() reference in fpga_mgr_lock() docs (git-fixes).
• gpio: crystalcove: add missing MODULE_ALIAS() (git-fixes).
• gpio: davinci: Clear interrupt status in every bank on suspend (git-fixes).
• gpio: pca953x: Preserve wakeup accounting on parent IRQ failure (git-fixes).
• HID: alps: unregister DualPoint Stick input device on remove (git-fixes).
• HID: amd_sfh: Remove unsupported motion-state field from accelerometer report (git-fixes).
• HID: amd_sfh: Use report type from request node (git-fixes).
• HID: core: Add reserved item tag for main items (stable-fixes).
• HID: core: Fix out-of-bounds left shift by 32 in s32ton() (git-fixes).
• HID: cougar: reject short special-key reports (git-fixes).
• HID: cp2112: validate response report lengths (git-fixes).
• HID: elo: reject short touchscreen reports (git-fixes).
• HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).
• HID: hid-steam: Make client_opened a counter (stable-fixes).
• HID: logitech-dj: validate unnumbered keyboard reports (git-fixes).
• HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).
• HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).
• HID: mcp2221: validate response report length (git-fixes).
• HID: picoLCD: check for fb_deferred_io_init() error (git-fixes).
• HID: pxrc: reject short input reports (git-fixes).
• HID: rate-limit hid_warn to prevent log flooding (stable-fixes).
• HID: roccat: isku: reject short button reports (git-fixes).
• HID: roccat: koneplus: reject short button reports (git-fixes).
• HID: roccat: konepure: reject short button reports (git-fixes).
• HID: roccat: kovaplus: reject short button reports (git-fixes).
• HID: roccat: pyra: reject short button reports (git-fixes).
• HID: roccat: ryos: reject short special reports (git-fixes).
• HID: roccat: savu: reject short special reports (git-fixes).
• HID: wacom: fix wacom_intuos_irq NULL pen_input deref (git-fixes).
• HID: zydacron: validate key report length (git-fixes).
• hostfs: fix dev_t handling (git-fixes).
• hwmon: (coretemp) Refresh the temperature on the first read (git-fixes).
• hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe (git-fixes).
• hwmon: (lm70) Fix rounding of negative temperatures (git-fixes).
• hwmon: (lm95245) Fix negative temperature conversion (git-fixes).
• hwmon: (sht3x) Return the consumed count for heater writes (git-fixes).
• hwrng: amd - report partial reads in non-blocking mode (git-fixes).
• hwrng: ba431 - fix reported byte count (git-fixes).
• hwrng: cctrng - Fix runtime PM usage counter leak (git-fixes).
• hwrng: core - reject unknown RNG names (git-fixes).
• hwrng: intel - return -ENOMEM when ioremap() fails (git-fixes).
• hwrng: intel - return -ENOMEM when kmalloc_obj() fails (git-fixes).
• hwrng: starfive - propagate clock and reset errors (git-fixes).
• i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode() (git-fixes).
• i2c: at91: release DMA channels when probe defers (git-fixes).
• i2c: designware: queue only one read command for block reads (git-fixes).
• i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len (git-fixes).
• i2c: xiic: don't clobber msg->len to signal block-read completion (git-fixes).
• i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode (stable-fixes).
• iio: accel: adis16201: fix channel order for buffer mode (git-fixes).
• iio: accel: kionix-kx022a: Fix IPOL macro name (git-fixes).
• iio: accel: kxcjk-1013: Disable autosuspend on remove (git-fixes).
• iio: accel: mma9551: disable autosuspend on remove (git-fixes).
• iio: accel: mma9553: disable autosuspend on remove (git-fixes).
• iio: adc: aspeed: propagate reset deassert errors (git-fixes).
• iio: adc: aspeed: Simplify with dev_err_probe (stable-fixes).
• iio: adc: at91-sama5d2: disable autosuspend on remove (git-fixes).
• iio: adc: stm32: fix minimum sampling time values (git-fixes).
• iio: adc: ti-adc128s052: validate SPI match data (git-fixes).
• iio: core: add accessors 'masklength' (stable-fixes).
• iio: dac: ad5758: Fix alignment for DMA safety (git-fixes).
• iio: dac: ad5758: Fix the offset calculation (git-fixes).
• iio: dac: ad5758: Reject out-of-range raw values (git-fixes).
• iio: humidity: hts221: report available values via read_avail() (git-fixes).
• iio: imu: adis16400: Check return value of spi_setup() (git-fixes).
• iio: light: ltrf216a: Return floating point values (stable-fixes).
• iio: pressure: dps310: fix CFG_REG bit definitions (git-fixes).
• iio: temperature: tmp117: fix calibbias cache update on I2C write failure (git-fixes).
• Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 (stable-fixes).
• Input: da7280 - fix input device parent assignment (git-fixes).
• Input: drv2665 - fix input device parent assignment (git-fixes).
• Input: drv2667 - fix input device parent assignment (git-fixes).
• Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 (stable-fixes).
• Input: lkkbd - disable pending work before freeing device (stable-fixes).
• Input: maple_keyb - fix key press detection (git-fixes).
• Input: maplecontrol - emit EV_SYN report after reporting events (git-fixes).
• Input: matrix-keymap - reject keycodes above KEY_MAX (git-fixes).
• Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 (stable-fixes).
• Input: tps6507x-ts - fix input device parent assignment (git-fixes).
• Input: xpad - add support for Corsair Novablade Pro (stable-fixes).
• kobject: fix out-of-bounds access in kobject_action_type() (git-fixes).
• kobject: Fix the kobj_set_name reference in kset_register() kernel-doc (git-fixes).
• KVM: SEV: Do cache maintenance on the source VM before clearing SEV state (git-fixes).
• landlock: Always allow signals between threads of the same process (git-fixes).
• landlock: Fix cosmetic change (git-fixes).
• landlock: Fix non-TCP sockets restriction (git-fixes).
• landlock: Fix TCP handling of short AF_UNSPEC addresses (git-fixes).
• landlock: Fix unmarked concurrent access to socket family (git-fixes).
• leds: flash: Prevent using uninitialized variable in flash_fault_show() (git-fixes).
• leds: lm3692x: Fix regulator/gpio leak and wrong enabled state on last write failure (git-fixes).
• leds: lp8860: Fix device_node leak in lp8860_probe() (git-fixes).
• leds: pca9532: Check i2c_smbus_read_byte_data() return value (git-fixes).
• mac80211: tx: Use info->flags in ieee80211_tx_h_select_key() (git-fixes).
• media: adv748x: Fix endpoint reference leaks on probe failure (git-fixes).
• media: adv7180: Initialize mutex before ancillary clients (git-fixes).
• media: adv7604: avoid negative array index in log_status when cp_read fails (git-fixes).
• media: amphion: fix runtime PM imbalance on probe failure (git-fixes).
• media: amphion: prevent unbind while video instances are open (git-fixes).
• media: atmel-isi: release unregistered video device on remove (git-fixes).
• media: au0828: Fix media device leak in au0828_usb_probe() (git-fixes).
• media: au0828: fix use-after-free in bulk_timeout timer on disconnect (git-fixes).
• media: au0828: Free URBs when starting DVB streaming fails (git-fixes).
• media: cx18: Disable PCI device on probe failure (git-fixes).
• media: cx88: Disable PCI device on MPEG initialization failure (git-fixes).
• media: cx231xx-audio: drain wq_trigger before audio fini (git-fixes).
• media: cx231xx: Fix cleanup path on failure (git-fixes).
• media: cx23885: Fix use-after-free in cx23885_finidev due to race condition (git-fixes).
• media: cx23885: unregister DVB bus when SP2 CI setup fails (git-fixes).
• media: em28xx: fix double free in em28xx_alloc_urbs (git-fixes).
• media: em28xx: reject audio endpoint with zero packet size (git-fixes).
• media: exynos4-is: Fix a race between s_stream(0) and the interrupt handler (git-fixes).
• media: go7007: bound EZ-USB I2C transfers to the usb_buf size (git-fixes).
• media: go7007: unregister the I2C adapter on USB probe failure (git-fixes).
• media: gspca: use vb2_video_unregister_device() on disconnect (git-fixes).
• media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path (git-fixes).
• media: hantro: Disable multicore support (stable-fixes).
• media: hantro: disable runtime PM before hardware teardown (git-fixes).
• media: hantro: Harden MPEG-2 control access against NULL (git-fixes).
• media: i2c: ar0521: remove duplicate media entity cleanup (git-fixes).
• media: i2c: ov5648: Fix a data race on state->streaming (git-fixes).
• media: i2c: ov8856: fix debug message to report actual CSI-2 lane count (git-fixes).
• media: i2c: tc358743: add missing color-space strings (git-fixes).
• media: imon: fix use-after-free in display_close via dev_dbg (git-fixes).
• media: imx-jpeg: cancel timeout worker when streaming stops (git-fixes).
• media: imx-jpeg: finish the job on device_run() error paths (git-fixes).
• media: ir-hix5hd2: Ensure rdev is setup before interrupts are enabled (git-fixes).
• media: ir_toy: Validate the maximum tx carrier (git-fixes).
• media: m2m-deinterlace: fix default capture field (git-fixes).
• media: marvell-cam: fix unmet dependency for VIDEO_MMP_CAMERA (git-fixes).
• media: marvell: manage the MMP camera clock provider (git-fixes).
• media: mediatek: jpeg: Avoid context access after job finish (git-fixes).
• media: mediatek: jpeg: retry HW selection after successful wait (git-fixes).
• media: mediatek: vpu: free IRQ before destroying watchdog workqueue (git-fixes).
• media: mediatek: vpu: release reserved memory on remove (git-fixes).
• media: meson-ir-tx: Ensure clock is disabled on unbind (git-fixes).
• media: meson-ir-tx: Ensure probe error is propagated (git-fixes).
• media: meson-ir-tx: Prevent divide by zero in meson_irtx_prepare_pulse() (git-fixes).
• media: meson: vdec: size capture planes from the aligned canvas (git-fixes).
• media: microchip-csi2dc: fix async notifier leak on probe error path (git-fixes).
• media: microchip-isc: disable histogram and flush AWB work on teardown (git-fixes).
• media: microchip-isc: do not touch WB registers when not streaming (git-fixes).
• media: microchip-isc: fix PM runtime leak in AWB work handler (git-fixes).
• media: microchip-isc: synchronize the IRQ before disabling clocks on stop (git-fixes).
• media: mtk-jpeg: Fix runtime PM leak in mtk_jpegdec_worker() (git-fixes).
• media: mtk-jpeg: Fix runtime PM leak in mtk_jpegenc_worker() (git-fixes).
• media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() (git-fixes).
• media: pvrusb2: Fix USB parent device leak in class_dev_create() (git-fixes).
• media: rc: fintek-cir: process a full RX buffer instead of overflowing it (git-fixes).
• media: rc: mce_kbd: Fix inconsistent locking of keylock (git-fixes).
• media: redrat3: Ensure all urbs are suspended (git-fixes).
• media: redrat3: Ensure we don't read beyond the end of the packet (git-fixes).
• media: redrat3: fix UAF in probe error path leaving rc device registered (git-fixes).
• media: require two-byte Cypress type 04 records (git-fixes).
• media: rtl28xxu: fix SDR platform device leak (git-fixes).
• media: saa7146: Initialize interrupt lock before requesting IRQ (git-fixes).
• media: streamzap: Add missing rc_unregister_device() (git-fixes).
• media: stv090x: bound DiSEqC reply length to msg size (git-fixes).
• media: stv0900: bound DiSEqC reply length to msg size (git-fixes).
• media: tw68: balance PCI enable on cleanup (git-fixes).
• media: tw686x: fix V4L2 device lifetime on probe failure (git-fixes).
• media: uvcvideo: Fix NULL deref on events for uninitialized controls (git-fixes).
• media: v4l2-common: Fix P010 format info (git-fixes).
• media: v4l2-ctrls: do nothing if controls == NULL in cluster functions (git-fixes).
• media: venus: Drop session events without an instance (git-fixes).
• media: verisilicon: rockchip: Fix leaks in init (git-fixes).
• media: vicodec: fix NULL deref on oversized frame (git-fixes).
• media: vicodec: fix out-of-bounds write on under-rounded coded dimensions (git-fixes).
• media: vicodec: make encoder CAPTURE dimensions read-only (git-fixes).
• media: vicodec: zero-initialize stateful decoder heap buffers (git-fixes).
• media: vidtv: fix frontend reference leak on unbind (git-fixes).
• media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail (git-fixes).
• media: vim2m: keep transaction buffer count stable while streaming (git-fixes).
• media: vivid: round the height down to the vertical subsampling factor (git-fixes).
• media: vpif_display: Fix i2c adapter reference leak in vpif_probe() (git-fixes).
• mei: vsc-tp: initialize IRQ state before requesting interrupt (git-fixes).
• mei: vsc: Fix packet CRC computed over pointer size (git-fixes).
• mfd: ab8500: Fix child device leaks on probe failure (git-fixes).
• mfd: da9150: Balance IRQ wake on teardown (git-fixes).
• mfd: intel_quark_i2c_gpio: Manage the fixed-rate clock (git-fixes).
• mfd: tps65217: Check return value when masking interrupt sources (git-fixes).
• mfd: tps65217: Fix NULL pointer dereference on IRQ init failure (git-fixes).
• mfd: wcd934x: Fix NULL pointer dereference on IRQ probe deferral (git-fixes).
• mfd: wcd934x: set DMA mask on parent to silence 'DMA mask not set' (git-fixes).
• misc: enclosure: fix UAF on device_register() failure (git-fixes).
• mm, vmscan: flush tlb before large folio is freed (bsc#1250656).
• mm: introduce num_pages_contiguous() (bsc#1284243).
• mtd: amd76xrom: Fix PCI device reference leak in amd76xrom_init_one() (git-fixes).
• mtd: block: prevent reclaim I/O during request processing (git-fixes).
• mtd: Call get_wunit() on the master partition (git-fixes).
• mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device (git-fixes).
• mtd: maps: l440gx: Fix double put of the ISA bridge in init_l440gx() (git-fixes).
• mtd: maps: l440gx: Fix double put of the PM device in init_l440gx() (git-fixes).
• mtd: maps: pci: balance PCI enable on cleanup (git-fixes).
• mtd: parsers: qcom: fix offset/size overflow on large partitions (git-fixes).
• mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() (git-fixes).
• mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface() (git-fixes).
• mtd: rawnand: sunxi: reject ECC maximization on small pages (git-fixes).
• mtd: spi-nor: sfdp: check the length of the SCCR map (git-fixes).
• mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table (git-fixes).
• mtd: spi-nor: Unprepare legacy controllers upon RWW wait interruption (git-fixes).
• mtd: spinand: Fix spinand_manufacturer_ops kernel-doc (git-fixes).
• net: usb: lan78xx: reject invalid EEPROM write requests (git-fixes).
• net: usb: r8153_ecm: reject short register reads (git-fixes).
• net: usb: sierra_net: reject short firmware attribute reads (git-fixes).
• net: wwan: iosm: validate msg_head before indexing msg_ring (git-fixes).
• PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow (git-fixes).
• PCI/AER: Fix struct pci_dev reference leak in aer_process_err_devices() (git-fixes).
• PCI/P2PDMA: Gate the host bridge whitelist warning on verbose (git-fixes).
• PCI/P2PDMA: Safely terminate ACS redirect lists (git-fixes).
• PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible() (git-fixes).
• PCI/sysfs: Pass the device name length in UTF-16 code units (git-fixes).
• PCI/sysfs: Stop reporting _DSM failures as -EPERM (git-fixes).
• PCI: aardvark: Disable PHY on probe failures (git-fixes).
• PCI: cadence: Preserve all error codes in cdns_plat_pcie_probe() (git-fixes).
• PCI: Disable MSI for ULi M1575 EHCI controller (git-fixes).
• PCI: dra7xx: Fix clock enable leak on probe failure (git-fixes).
• PCI: endpoint: pci-epf-vntb: Pass PF/VF number when BAR programming (git-fixes).
• PCI: endpoint: pci-epf-vntb: Serialize virtual PCI bus scan (git-fixes).
• PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr() (git-fixes).
• PCI: qcom: Honor IOMMU provider's #iommu-cells in qcom_pcie_config_sid_1_9_0() (git-fixes).
• PCI: rockchip-host: Do not attempt 5.0 GT/s retraining (git-fixes).
• PCI: xgene: Use managed clock for PCIe controller (git-fixes).
• peci: aspeed: Initialize state before requesting IRQ (git-fixes).
• phy: core: Fix race-condition between _of_phy_get() and try_module_get() (git-fixes).
• pinctrl: mediatek: mt7629: fix the 2.4 GHz Wi-Fi pin mode array (git-fixes).
• pinctrl: sprd: free maps on DT map failure (git-fixes).
• pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank() (git-fixes).
• platform/chrome: cros_ec_proto: Fix deferred response (git-fixes).
• power: supply: charger-manager: Convert to platform remove callback returning void (stable-fixes).
• power: supply: lp8788-charger: Convert to platform remove callback returning void (stable-fixes).
• power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).
• power: supply: lp8788: Use devm_power_supply_register() helper (stable-fixes).
• pwm: mtk-disp: Fix period readback (git-fixes).
• RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).
• regulator: ab8500: Fix AB8505 VANA voltage selectors (git-fixes).
• regulator: ab8500: Handle AB8505 VINTCORE selector 7 (git-fixes).
• regulator: ab8500: Propagate mode enable read errors (git-fixes).
• regulator: ab8500: Test dedicated enable bits only (git-fixes).
• regulator: ab8500: Treat cut 1.0 VAUX3 as fixed (git-fixes).
• regulator: core: Fix c_rdev reference leak in regulator_resolve_coupling() (git-fixes).
• regulator: core: Fix coupled regulators reference leak on removal (git-fixes).
• regulator: core: Fix rdev reference leak in regulator_resolve_supply() (git-fixes).
• regulator: mp886x: check get_voltage_sel() return value (git-fixes).
• regulator: mp886x: fix pontential division by zero (git-fixes).
• regulator: mp886x: fix vsel_mask (git-fixes).
• regulator: rt6190: Fix runtime PM imbalance in rt6190_out_enable() (git-fixes).
• Reinstate 'resource: avoid unnecessary lookups in find_next_iomem_res()' (bsc#1284243).
• Revert 'wifi: mac80211: do not use old MBSSID elements' (git-fixes).
• rtc: ac100: Assign .num before accessing .hws (git-fixes).
• rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).
• rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).
• rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).
• selftests/alsa: Do not take another control's event as our own (git-fixes).
• selftests/landlock: Add a new test for setuid() (git-fixes).
• selftests/landlock: Fix build with non-default pthread linking (git-fixes).
• selftests/landlock: Fix screwed up pointers in the scoped_signal_test (git-fixes).
• selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available (git-fixes).
• selftests/landlock: Split signal_scoping_threads tests (git-fixes).
• serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() (git-fixes).
• serial: core: shut down initialized port on removal (git-fixes).
• serial: max310x: don't clobber the TX break bit in set_termios (git-fixes).
• serial: pmac_zilog: push received data to the port that received it (git-fixes).
• serial: pmac_zilog: report received breaks (git-fixes).
• slimbus: messaging: fix leaked PM vote on tid allocation failure (git-fixes).
• soc/tegra: flowctrl: Release OF node reference on error (git-fixes).
• soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() (git-fixes).
• soc: fsl: dpio: Fix cleanup on IRQ registration failure (git-fixes).
• soc: fsl: dpio: Free the IRQ before releasing the I/O object (git-fixes).
• soc: qcom: apr: clean up failed service registrations (git-fixes).
• soc: ti: k3-ringacc: Correct ring API kernel-doc (git-fixes).
• soc: ti: k3-ringacc: Fix DMA ring initialization kernel-doc (git-fixes).
• spi: amd: fix len==0 underflow and FIFO overflow (git-fixes).
• spi: bcm63xx-hsspi: Disable runtime PM on remove (git-fixes).
• spi: Fix the return value in spi_new_ancillary_device() kernel-doc (git-fixes).
• spi: jcore: fix divide-by-zero when speed_hz is zero (git-fixes).
• spi: mtk-nor: fix runtime PM usage count leak in probe error path (git-fixes).
• spi: mxic: fix ps_clk leak in runtime resume (git-fixes).
• spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer (git-fixes).
• spi: omap2-mcspi: Remove unbalanced pm_runtime_put_sync() calls (git-fixes).
• spi: spi-sun4i: sun4i_spi_fill_fifo(): always apply A10 FIFO fill level workaround (git-fixes).
• spi: spi-sun4i: sun4i_spi_transfer_one(): fix transfers for SUN4I_FIFO_DEPTH (git-fixes).
• staging: iio: adc: ad7816: Fix DMA safety issues in SPI transfers (git-fixes).
• staging: media: av7110: fix corrupted BER reporting in sp8870 (git-fixes).
• staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error (git-fixes).
• staging: rtl8723bs: clean up redundant & parentheses (stable-fixes).
• Staging: rtl8723bs: Delete dead code from update_current_network() (stable-fixes).
• staging: rtl8723bs: fix buffer over-read in rtw_update_protection (git-fixes).
• staging: rtl8723bs: fix RX buffer OOB write from device-reported length (git-fixes).
• Staging: rtl8723bs: Remove dead code from _rtw_free_network() (stable-fixes).
• staging: sm750fb: free cmap on framebuffer release (git-fixes).
• thermal/drivers/sprd: validate the sensor id from the device tree (git-fixes).
• thermal: intel: int340x: Fix temperature selection around 0 C (git-fixes).
• thermal: intel: powerclamp: Reject invalid window_size values (git-fixes).
• thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc (git-fixes).
• thunderbolt: Disable CL states for the Anker Prime TB5 dock (stable-fixes).
• thunderbolt: Do not RPM complete unrelated subtrees on unplug (git-fixes).
• tools/thermal/tmon: Fix string truncation warning in optarg copy (git-fixes).
• tpm: fix zero-length read discarding the pending response (git-fixes).
• tpm: tpm_nsc: fix NULL pointer dereference on init failure (git-fixes).
• tpm: tpm_nsc: stop using the cleanup callback as dev.release (git-fixes).
• tty: add break_wait kernel-doc (git-fixes).
• tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup (stable-fixes).
• tty: vcc: zero-initialize control packet in vcc_send_ctl() (stable-fixes).
• um: hostfs: avoid issues on inode number reuse by host (git-fixes).
• usb-storage: alauda: check the return value of alauda_read_map() (git-fixes).
• usb-storage: alauda: do not do DMA from the stack (git-fixes).
• usb-storage: alauda: fix out-of-bounds zone index (git-fixes).
• USB: cdc-acm: fix urb leak on disconnect (git-fixes).
• usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (stable-fixes).
• usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).
• usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).
• usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior (stable-fixes).
• usb: fotg210: validate endpoint index in ep0 handlers (git-fixes).
• usb: gadget: composite: avoid warning on aborted delayed status (git-fixes).
• usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket (git-fixes).
• usb: gadget: dummy_hcd: prevent unbind via sysfs (git-fixes).
• usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).
• usb: gadget: f_mass_storage: ignore class requests while inactive (git-fixes).
• usb: gadget: f_midi: Annotate struct f_midi with __counted_by (stable-fixes).
• usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).
• USB: gadget: ffs: fix mm lifetime handling (stable-fixes).
• usb: gadget: functionfs: Factorize wait-for-endpoint code (stable-fixes).
• usb: image: microtek: stop SG processing after transfer errors (git-fixes).
• usb: musb: da8xx: depopulate OF children on probe failure (git-fixes).
• usb: musb: da8xx: depopulate OF children on remove (git-fixes).
• usb: ohci-spear: disable controller wakeup on removal (git-fixes).
• usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() (stable-fixes).
• USB: pci-quirks: Release EHCI device reference (git-fixes).
• USB: serial: cp210x: add Corsair AX1500i Power Supply (stable-fixes).
• USB: serial: option: add Compal EXC-T1 support (stable-fixes).
• USB: serial: option: add Compal EXM-G1x support (stable-fixes).
• USB: serial: option: add Quectel EG060W (stable-fixes).
• USB: serial: option: add Quectel RG660QB (stable-fixes).
• USB: serial: option: add support for SIMCom SIM8260C (stable-fixes).
• USB: serial: sierra: fix urb leak on write completion (git-fixes).
• USB: serial: usb_wwan: fix urb leak on disconnect (git-fixes).
• usb: typec: ucsi_ccg: Add retry mechanism in ccg_read (git-fixes).
• USB: usbmon: fix null-ptr-deref in mon_bus_remove() when mon_bus_init() fails (git-fixes).
• usbnet: fix smp_processor_id() use in preemptible context (git-fixes).
• vfio/type1: batch vfio_find_vpfn() in function vfio_unpin_pages_remote() (bsc#1284243).
• vfio/type1: conditional rescheduling while pinning (bsc#1284243).
• vfio/type1: introduce a new member has_rsvd for struct vfio_dma (bsc#1284243).
• vfio/type1: optimize vfio_pin_pages_remote() (bsc#1284243).
• vfio/type1: optimize vfio_unpin_pages_remote() (bsc#1284243).
• vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).
• watchdog: mediatek: Apply the driver's mode to a watchdog left running (git-fixes).
• wifi: ath6kl: don't take RTNL in del_virtual_intf (git-fixes).
• wifi: ath9k: delete channel-context timers on deinit (git-fixes).
• wifi: ath10k: avoid IDR mutation during TX cleanup (git-fixes).
• wifi: ath11k: avoid IDR mutation during pending mgmt TX cleanup (git-fixes).
• wifi: ath11k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).
• wifi: ath11k: disable interrupts during firmware crash recovery (git-fixes).
• wifi: ath11k: fix locking problem in ath11k_dp_rx_tid_del_func() (git-fixes).
• wifi: ath11k: fix NULL dereference in ahb remove when QMI init incomplete (git-fixes).
• wifi: ath11k: Fix possible memory leak in ath11k_dp_srng_setup() (git-fixes).
• wifi: ath11k: fix sporadic WLAN initialization failures (git-fixes).
• wifi: ath11k: fix unbalanced IRQ enable/disable during suspend/resume (git-fixes).
• wifi: ath11k: modify null check logic in ath11k_ce_rx_post_pipe() (git-fixes).
• wifi: ath11k: reset ar->num_stations on hardware start (git-fixes).
• wifi: ath11k: unregister PM notifier on QMI init failure path (git-fixes).
• wifi: ath12k: avoid IDR mutation during vif mgmt TX cleanup (git-fixes).
• wifi: ath12k: fix incorrect TID updation in DP monitor status path (stable-fixes).
• wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info (stable-fixes).
• wifi: ath12k: fix the fetching of combined rssi (git-fixes).
• wifi: ath12k: Free allocated CE IRQs on request_irq() failure (git-fixes).
• wifi: ath12k: Reserve space for a string terminator (git-fixes).
• wifi: b43: don't pass unterminated string to sscanf() (git-fixes).
• wifi: b43: fix use-after-free in b43_bcma_remove() (git-fixes).
• wifi: b43legacy: debugfs: NUL terminate string in debugfs (git-fixes).
• wifi: brcmsmac: Adjust txpwrindex value in nphy_ipa_rxcal_gaintbl_2GHz (git-fixes).
• wifi: carl9170: NUL terminate string in debugfs (git-fixes).
• wifi: cfg80211: allow zero HE OBSS PD offsets (git-fixes).
• wifi: cfg80211: preserve hidden-group beacon IE ownership (git-fixes).
• wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).
• wifi: cfg80211: track SSID regardless of country data (git-fixes).
• wifi: cw1200: fix TX padding OOB read leaking heap data to device (git-fixes).
• wifi: iwlegacy: 3945: free EEPROM data on remove (git-fixes).
• wifi: iwlwifi: dvm: pair transport op-mode enter/leave (stable-fixes).
• wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp* (stable-fixes).
• wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).
• wifi: iwlwifi: simplify nested if checks (stable-fixes).
• wifi: mac80211: account proxy paths against the mesh path limit (git-fixes).
• wifi: mac80211: Add 802.3 multicast encapsulation offload support (stable-fixes).
• wifi: mac80211: Add multicast to unicast support for 802.3 path (stable-fixes).
• wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() (stable-fixes).
• wifi: mac80211: clear fragment cache entry 'is_protected' (git-fixes).
• wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).
• wifi: mac80211: don't reset the TXQ scheduling round number (git-fixes).
• wifi: mac80211: don't send encap offload frames unencrypted (git-fixes).
• wifi: mac80211: drain PS delivery work during station teardown (git-fixes).
• wifi: mac80211: drop encap offload frames with a tainted key (git-fixes).
• wifi: mac80211: Fix a race when expiring a mesh path (git-fixes).
• wifi: mac80211: fix encryption tailroom (git-fixes).
• wifi: mac80211: fix key selection for encap offload frames (git-fixes).
• wifi: mac80211: fix mesh fast xmit path deletion UAF (git-fixes).
• wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (stable-fixes).
• wifi: mac80211: fix swapped fq_overlimit/fq_overmemory in aqm debugfs (git-fixes).
• wifi: mac80211: Fix the return value in mesh_path_add() kernel-doc (git-fixes).
• wifi: mac80211: fix typo in HE MCS check (stable-fixes).
• wifi: mac80211: fix unauthorised port check for encap offload (git-fixes).
• wifi: mac80211: handle empty FILS association request payload (git-fixes).
• wifi: mac80211: init radiotap iter after length checks (git-fixes).
• wifi: mac80211: kill wake_txqs_tasklet on unregistration (git-fixes).
• wifi: mac80211: limit injected HT/VHT MCSes (git-fixes).
• wifi: mac80211: log link information in ieee80211_determine_chan_mode (stable-fixes).
• wifi: mac80211: mesh: use hlist_add_head_rcu() (git-fixes).
• wifi: mac80211: minstrel_ht: validate fixed rate index (git-fixes).
• wifi: mac80211: prevent AP VLAN tx from other interfaces (git-fixes).
• wifi: mac80211: refactor populating mesh related fields in sinfo (stable-fixes).
• wifi: mac80211: release mesh path quota on failed additions (git-fixes).
• wifi: mac80211: reserve MME tailroom for protected beacons (git-fixes).
• wifi: mac80211: set info->band for 802.3 encap offload frames (git-fixes).
• wifi: mac80211: use link address as TA for non-MLO 4-addr station on MLD AP (git-fixes).
• wifi: mt76: feed the station RSSI average from the chain signals (git-fixes).
• wifi: mt76: fix memory leak in USB TX path (git-fixes).
• wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits() (git-fixes).
• wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add() (git-fixes).
• wifi: mt76: fix wcid->pktid corruption in mt76_wcid_cleanup() (git-fixes).
• wifi: mt76: mt76x02: validate RX padding before use (git-fixes).
• wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff (git-fixes).
• wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory (git-fixes).
• wifi: mt76: mt7603: don't drop short frames looped back on PS entry (git-fixes).
• wifi: mt76: mt7615: cancel reset work during unregister (git-fixes).
• wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs (git-fixes).
• wifi: mt76: mt7615: read MT7663 temperature from the correct offset (git-fixes).
• wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy (git-fixes).
• wifi: mt76: mt7615: validate MCU response lengths (git-fixes).
• wifi: mt76: mt7915: allocate vif wcid in the same range as stations (stable-fixes).
• wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (git-fixes).
• wifi: mt76: mt7915: check default EEPROM firmware size before copying (git-fixes).
• wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).
• wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() (git-fixes).
• wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump (git-fixes).
• wifi: mt76: mt7915: set correct background radar capability (stable-fixes).
• wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure (git-fixes).
• wifi: mt76: mt7921: check drv_pmctrl return in the PCIe reset path (git-fixes).
• wifi: mt76: mt7921: fix lock inversion between dev->mutex and iflist_mtx (git-fixes).
• wifi: mt76: mt7921: fix the lock inversion in suspend and resume (git-fixes).
• wifi: mt76: mt7925: check drv_pmctrl return in the PCIe reset path (git-fixes).
• wifi: mt76: mt7925: fix lock inversion between dev->mutex and iflist_mtx (git-fixes).
• wifi: mt76: mt7925: fix the lock inversion in suspend and resume (git-fixes).
• wifi: mt76: mt7925: honour mac80211's FIF_FCSFAIL instead of hardcoding drop_err (git-fixes).
• wifi: mt76: mt7925: restore the reset state when fw_pmctrl fails (git-fixes).
• wifi: mt76: mt7996: fix PLE free page and AC queue register offsets (git-fixes).
• wifi: mt76: mt7996: validate firmware event lengths before parsing (git-fixes).
• wifi: mt76: usb: fix source overread in mt76u_copy (git-fixes).
• wifi: mwifiex: append hotfix number to firmware version string (git-fixes).
• wifi: rtw88: debugfs: don't vzalloc(0) when rsvd_page is read unconfigured (git-fixes).
• wifi: rtw88: debugfs: support multiple adapters debugging (stable-fixes).
• wifi: rtw88: fix out-of-bounds CAM write when key table is full (git-fixes).
• wifi: rtw88: sdio: zero the padding added to a TX transfer (git-fixes).
• wifi: rtw89: 8851b: fix swapped DPK channel/bandwidth backup fields (git-fixes).
• wifi: rtw89: cap firmware section_num before parsing (git-fixes).
• wifi: wfx: fix possible device hang during init (git-fixes).
• wifi: wfx: fix use-after-free of the cooling work on device removal (git-fixes).
• wifi: wfx: validate MIB read length before copying to caller (git-fixes).
• wwan: wwan_hwsim: Pin module for debugfs file operations (git-fixes).
• x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() (git-fixes).
• x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 (git-fixes).
• xhci: dbc: lock the minor IDR on registration failure (git-fixes).