openSUSE-SU-2026:22091-1

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).
• CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).
• CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).
• CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).
• CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).
• CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).
• CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).
• CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
• CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).
• CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).
• CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).
• CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).
• CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).
• CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
• CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).
• CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).
• CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).
• CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).
• CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).
• CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).
• CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).
• CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).
• CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).
• CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).
• CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).
• CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).
• CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).
• CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).
• CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).
• CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).
• CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).
• CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).
• CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).
• CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).
• CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).
• CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).
• CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).
• CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c (bsc#1276947).
• CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).
• CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).
• CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).
• CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519).
• CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).
• CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).
• CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
• CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).
• CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).
• CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).
• CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
• CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).
• CVE-2026-74359: configfs_lookup(): don't leave ->s_dentry dangling on failure (bsc#1278067).
• CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).
• CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).
• CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).
• CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).
• CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).
• CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).
• CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).
• CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
• CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).
• CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).
• CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).
• CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).
• CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
• CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).
• CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
• CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
• CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).
• CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).
• CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).
• CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).
• CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).
• CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
• CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
• CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).
• CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).
• CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).
• CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).
• CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).
• CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
• CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
• CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
• CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).
• CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).
• CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).
• CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).
• CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
• CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).
• CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).
• CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).
• CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).
• CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).
• CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).
• CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
• CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).
• CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).
• CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
• CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
• CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).
• CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).
• CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).
• CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).
• CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).
• CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).
• CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).
• CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).
• CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).
• CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).
• CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).
• CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).
• CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
• CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).
• CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).
• CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).
• CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).
• CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).
• CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).
• CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).
• CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).
• CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).
• CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).
• CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).
• CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).
• CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).
• CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).
• CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).
• CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
• CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).
• CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).
• CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).
• CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).
• CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).
• CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).
• CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).
• CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).
• CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).
• CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
• CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).
• CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).
• CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).
• CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
• CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).
• CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).
• CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
• CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
• CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).
• CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
• CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).
• CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).
• CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).
• CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).
• CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
• CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).
• CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).
• CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).
• CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).
• CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).
• CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).
• CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
• CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).
• CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).
• CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).
• CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).
• CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
• CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).
• CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).
• CVE-2026-89451: iommu/sva: Set handle->dev before the SVA handle is visible (bsc#1280383).
• CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).
• CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).
• CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
• CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).
• CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).
• CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
• CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).
• CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).
• CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).
• CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).
• CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).
• CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).
• CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).
• CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).
• CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).
• CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).
• CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).
• CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).
• CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).
• CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
• CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
• CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).
• CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).
• CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).
• CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).
• CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).
• CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).
• CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
• CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).
• CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).
• CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).
• CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
• CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).
• CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).
• CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
• CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).
• CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).
• CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).
• CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).
• CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).
• CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).
• CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).
• CVE-2026-89671: nfsd: gate nfs3 setacl by argp->mask (bsc#1280252).
• CVE-2026-89672: nfsd: gate nfs2 setacl by argp->mask (bsc#1280235).
• CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
• CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).
• CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).
• CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).
• CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).
• CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).
• CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).
• CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).
• CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).
• CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).
• CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).
• CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).
• CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).
• CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).
• CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
• CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).
• CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).
• CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).
• CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).
• CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).
• CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).
• CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).
• CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).
• CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).
• CVE-2026-89780: net: qualcomm: rmnet: restore skb->dev on deaggregated frames (bsc#1280969).
• CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).
• CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).
• CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).
• CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).
• CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).
• CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).
• CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
• CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).
• CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).
• CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
• CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).
• CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).
• CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).
• CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).
• CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
• CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).
• CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).
• CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).
• CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).
• CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).
• CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).
• CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).
• CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).
• CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).
• CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).
• CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).
• CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).
• CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).
• CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).
• CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).
• CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).
• CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).
• CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).
• CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).
• CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).
• CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
• CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
• CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).
• CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).
• CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
• CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
• CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).
• CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).
• CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).
• CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).
• CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).
• CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).
• CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).
• CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (bsc#1282270).
• CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).
• CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).
• CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).
• CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).
• CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).
• CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).
• CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).
• CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).
• CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).
• CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).
• CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
• CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).
• CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
• CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).
• CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.
• CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().
• CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).
• CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).
• CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).
• CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).
• CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).
• CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).
• CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).
• CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).
• CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).
• CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).
• CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).
• CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).
• CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).
• CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).
• CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).
• CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).
• CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).
• CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).
• CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).
• CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).
• CVE-2026-97934: tracing: Fix memory corruption from a "STACKTRACE" histogram key (bsc#1282997).
• CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).
• CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).
• CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).
• CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).
• CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).
• CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).
• CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).
• CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).
• CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

The following non security issues were fixed:

• ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).
• ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).
• ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).
• ACPICA: add boundary checks in two places (stable-fixes).
• ACPICA: Add package limit checks in parser functions (stable-fixes).
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).
• ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).
• ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).
• ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).
• ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).
• ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).
• ACPICA: Prevent adding invalid references (stable-fixes).
• ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).
• ACPICA: validate handler object type in two places (stable-fixes).
• ALSA: 6fire: Clean ups with guard() (stable-fixes).
• ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).
• ALSA: aloop: Check card index validity at probe (stable-fixes).
• ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).
• ALSA: caiaq: unregister the input device when probe fails (git-fixes).
• ALSA: core: Add scoped cleanup helper for card references (stable-fixes).
• ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).
• ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).
• ALSA: es18xx: check control allocation before private data setup (stable-fixes).
• ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).
• ALSA: hda/common: Use guard() for mutex locks (stable-fixes).
• ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).
• ALSA: hda/core: Use guard() for mutex locks (stable-fixes).
• ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).
• ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).
• ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).
• ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).
• ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).
• ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).
• ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).
• ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).
• ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).
• ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).
• ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).
• ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).
• ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).
• ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).
• ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).
• ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).
• ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).
• ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).
• ALSA: hda: trace PCM open only after assigning a stream (git-fixes).
• ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).
• ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).
• ALSA: line6: reject oversized playback packets (git-fixes).
• ALSA: mpu401: Check card index validity at probe (stable-fixes).
• ALSA: mts64: Check card index validity at probe (stable-fixes).
• ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).
• ALSA: pcm: set timer->private_data before registering the PCM timer (git-fixes).
• ALSA: portman2x4: Check card index validity at probe (stable-fixes).
• ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).
• ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).
• ALSA: seq: Serialize compat port-info ioctls (git-fixes).
• ALSA: serial-u16550: Check card index validity at probe (stable-fixes).
• ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).
• ALSA: ump: Copy FB name string more safely (stable-fixes).
• ALSA: ump: Copy safe string name to rawmidi (stable-fixes).
• ALSA: ump: Update rawmidi name per EP name update (stable-fixes).
• ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).
• ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).
• ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).
• ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).
• ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).
• ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).
• ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).
• ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).
• ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).
• ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).
• ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).
• ALSA: virmidi: Check card index validity at probe (stable-fixes).
• ALSA: virtio: reset device before deleting virtqueues (git-fixes).
• arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).
• arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).
• arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
• arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).
• arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
• arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
• arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
• arm64: percpu: Fix this_cpu_write() casting (git-fixes).
• arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
• ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).
• ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).
• ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).
• ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).
• ASoC: codecs: aw88261: reduce log spam (stable-fixes).
• ASoC: codecs: max98363: fix uninitialized stream_config->type (git-fixes).
• ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).
• ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).
• ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).
• ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).
• ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (git-fixes).
• ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (git-fixes).
• ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).
• ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).
• ASoC: Intel: catpt: Complete coredump handling (stable-fixes).
• ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).
• ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).
• ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).
• ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).
• ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).
• ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).
• ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).
• ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).
• ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).
• ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).
• ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).
• ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).
• ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).
• ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).
• ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).
• Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).
• Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).
• Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).
• Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).
• Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).
• Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).
• Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).
• Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).
• Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).
• Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).
• Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).
• Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).
• Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).
• Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).
• Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).
• Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).
• Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).
• Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).
• Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).
• Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).
• Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).
• Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).
• Bluetooth: btusb: refactor endpoint lookup (stable-fixes).
• Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).
• Bluetooth: eir: validate service data length before reading UUID (git-fixes).
• Bluetooth: hci_codec: validate vendor codec count length (git-fixes).
• Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).
• Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).
• Bluetooth: hci_core: Print number of packets in conn->data_q (stable-fixes).
• Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).
• Bluetooth: hci_sock: validate event length before filtering (git-fixes).
• Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).
• Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).
• Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).
• Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).
• Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).
• Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).
• Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).
• Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).
• Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).
• Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).
• Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).
• Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (git-fixes).
• Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).
• Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).
• bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).
• bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).
• bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).
• bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).
• bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).
• bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).
• btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).
• btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).
• btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).
• config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
• dmaengine: Add devm_dma_request_chan() (stable-fixes).
• dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).
• dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).
• dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).
• dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).
• dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).
• dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).
• dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).
• dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).
• dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).
• dmaengine: wait for RCU readers before releasing dma_device (git-fixes).
• dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).
• dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).
• driver core: Export get_dev_from_fwnode() (stable-fixes).
• drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).
• drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).
• drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).
• drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).
• drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).
• drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).
• drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).
• drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).
• drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).
• drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).
• drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).
• drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).
• drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).
• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).
• drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).
• drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).
• drm/amdgpu: add a helper to calculate ring distance (stable-fixes).
• drm/amdgpu: check ras and obj before dereference (git-fixes).
• drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).
• drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).
• drm/amdgpu: Failed to check various return code (stable-fixes).
• drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).
• drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).
• drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).
• drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).
• drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).
• drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).
• drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).
• drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).
• drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).
• drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).
• drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).
• drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).
• drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).
• drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).
• drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).
• drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap (stable-fixes).
• drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).
• drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).
• drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).
• drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).
• drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).
• drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).
• drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).
• drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).
• drm/cirrus: Use video aperture helpers (stable-fixes).
• drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).
• drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).
• drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).
• drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).
• drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).
• drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).
• drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).
• drm/i915: fix incorrect RCU teardown order (git-fixes).
• drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).
• drm/imagination: clamp freelist reconstruction requests (git-fixes).
• drm/imagination: Fix page count for page table for map() interface (git-fixes).
• drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).
• drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).
• drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).
• drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).
• drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).
• drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).
• drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).
• drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).
• drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).
• drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).
• drm/msm: Recover HW before retire hung submit (git-fixes).
• drm/nouveau/bios: skip the IFR header if present (stable-fixes).
• drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).
• drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).
• drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).
• drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).
• drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).
• drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).
• drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).
• drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).
• drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).
• drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).
• drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).
• drm/omap: dsi: Do not copy isr table (git-fixes).
• drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).
• drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).
• drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).
• drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).
• drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).
• drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).
• drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).
• drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).
• drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).
• drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).
• drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).
• drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).
• drm: add drm_memory_stats_is_zero (stable-fixes).
• drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).
• fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).
• fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).
• fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).
• firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).
• firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).
• firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
• firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).
• firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).
• firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).
• firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).
• gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).
• gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).
• gpio: pisosr: Read "ngpios" as u32 (stable-fixes).
• gpio: tps65219: Fix GPIO input value reads (git-fixes).
• gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).
• gpio: zynq: fix runtime PM leak on request error path (git-fixes).
• HID: alps: fix use-after-free on input2 registration failure (git-fixes).
• HID: alps: unregister DualPoint Stick input device on remove (git-fixes).
• HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).
• HID: asus: fortify keyboard handshake (stable-fixes).
• HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).
• HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).
• HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).
• HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).
• HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).
• HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).
• HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).
• HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).
• HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).
• HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).
• HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).
• HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).
• host1x: bus: Fix missing ops null check in error teardown (stable-fixes).
• hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).
• hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).
• hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).
• hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).
• hwmon: (emc1403) Rely on subsystem locking (stable-fixes).
• hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).
• hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).
• hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).
• hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).
• hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).
• hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).
• hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).
• hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).
• hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).
• hwmon: (w83793) release probe data through kref (git-fixes).
• i2c: at91: release DMA channels on remove and probe error (git-fixes).
• i2c: atr: fix dangling adapter pointer on add failure (git-fixes).
• i2c: imx: disable autosuspend on remove (git-fixes).
• i2c: imx: release DMA channels on probe error (git-fixes).
• i2c: mxs: fix DMA channel leak on probe error (git-fixes).
• i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).
• i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).
• i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).
• i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).
• i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).
• i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).
• i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).
• ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).
• ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).
• ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).
• iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).
• iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).
• iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).
• iio: accel: sca3000: fix frequency divider condition check (git-fixes).
• iio: adc: pac1934: check ACPI label duplication (git-fixes).
• iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).
• iio: adc: rtq6056: add i2c_device_id support (stable-fixes).
• iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).
• iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).
• iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).
• iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).
• iio: admv1013: initialize callback mutex before registering notifier (git-fixes).
• iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).
• iio: buffer: serialize buffer teardown with mode claims (git-fixes).
• iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).
• iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).
• iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).
• iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).
• iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).
• iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).
• iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).
• iio: proximity: aw96103: validate firmware data length (git-fixes).
• iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).
• iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).
• iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).
• iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).
• iio: trigger: cancel reenable_work before freeing trigger (git-fixes).
• Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).
• Input: aiptek - validate raw macro indices before updating state (stable-fixes).
• Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).
• Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).
• Input: eeti_ts - publish the OF module alias (git-fixes).
• Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).
• Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).
• Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).
• Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).
• Input: soc_button_array - check btns_desc->package.count (git-fixes).
• Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).
• Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).
• Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).
• Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).
• Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).
• Input: xpad - add support for Azeron devices (stable-fixes).
• Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).
• Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).
• Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).
• kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.
• kernel-binary.spec.in: Fix syntax error.
• KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).
• keys: fix lost wakeup when reaping a dead key type (git-fixes).
• keys: translate request_key_auth pid for the reading procfs instance (git-fixes).
• KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).
• KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).
• KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).
• KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).
• KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).
• KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).
• KVM: nVMX: Always flush vpid02 on first use (git-fixes).
• KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).
• KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).
• KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).
• KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).
• KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).
• KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).
• KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).
• KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).
• leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).
• leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).
• leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).
• media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).
• media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).
• media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).
• media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).
• media: i2c: imx355: Replace client->dev usage (stable-fixes).
• media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).
• media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).
• media: qcom: camss: avoid format string warning (stable-fixes).
• media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).
• media: video-i2c: fix buffer queue ordering (stable-fixes).
• media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).
• memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).
• mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).
• mfd: rsmu: Add 8a34002 support (stable-fixes).
• mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).
• mmc: core: Add validation for host-provided max_segs (stable-fixes).
• mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).
• mmc: core: Fix OF node reference leak on card add failure (git-fixes).
• mmc: davinci: avoid NULL deref of host->data in IRQ handler (stable-fixes).
• mmc: davinci: fix mmc_add_host order in probe (stable-fixes).
• mmc: hsq: Fix use-after-free in retry work (git-fixes).
• mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).
• mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).
• mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).
• mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).
• mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).
• mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).
• mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).
• mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).
• mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).
• mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).
• mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).
• mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).
• mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).
• mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).
• mtd: core: avoid double-free of OTP NVMEM device (git-fixes).
• mtd: core: call _get_device() with the master MTD (git-fixes).
• mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).
• mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).
• mtd: rawnand: pl353: Fix debug prints (git-fixes).
• mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).
• mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).
• mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).
• net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).
• net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
• net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
• net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
• net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).
• net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).
• net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).
• net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).
• net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).
• net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).
• net: usb: sr9700: include receive overhead in the length check (git-fixes).
• net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).
• net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).
• net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).
• net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).
• nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).
• nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).
• nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).
• nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).
• nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).
• nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).
• nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).
• nfc: nfcmrvl: validate helper command length before pull (git-fixes).
• nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).
• nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).
• nfc: st21nfca: validate ISO15693 inventory length (git-fixes).
• nfc: st21nfca: validate received frame size (git-fixes).
• nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).
• PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).
• PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).
• PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).
• PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).
• PCI: altera: Protect root bus removal with rescan lock (stable-fixes).
• PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).
• PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).
• PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).
• PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).
• PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).
• PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).
• PCI: plda: Protect root bus removal with rescan lock (stable-fixes).
• PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).
• PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).
• PCI: switchtec: Add Gen6 Device IDs (stable-fixes).
• PCI: Wait for device readiness after D3hot -> D0uninitialized transition (stable-fixes).
• PCI: xgene: Drop unnecessary OF node reference (git-fixes).
• PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).
• phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).
• phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).
• pinctrl: meson: Fix typo in s4 group name (git-fixes).
• pinctrl: single: free the IRQ on domain creation failure (git-fixes).
• pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).
• platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).
• platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).
• platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).
• platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).
• platform/x86: ISST: Check for admin capability for write commands (stable-fixes).
• platform/x86: ISST: Validate max level for set feature (git-fixes).
• platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).
• platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).
• platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).
• power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).
• power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).
• power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).
• power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).
• power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).
• powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).
• powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).
• powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).
• powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).
• powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).
• powerpc: Add Power12 architected mode (jsc#PED-16906).
• powerpc: Add Power12 raw mode (jsc#PED-16906).
• procfs: fix possible double mmput() in do_procmap_query() (git-fixes).
• RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).
• RDMA/core: Fix potential use after free in counter_release() (git-fixes).
• RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).
• RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).
• RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).
• RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).
• RDMA/core: Fix use after free in ib_query_qp() (git-fixes).
• RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).
• RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
• RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).
• RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).
• RDMA/hfi1: Create workqueues before device initialization (git-fixes).
• RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).
• RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).
• RDMA/hfi1: Free RX data on late probe failure (git-fixes).
• RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).
• RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).
• RDMA/hfi1: Preserve unit 0 on (git-fixes).
• RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).
• RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).
• RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).
• RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).
• RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).
• RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).
• RDMA/rvt: Return NULL after port allocation failure (git-fixes).
• regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).
• regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).
• ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).
• ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).
• ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).
• rtc: ac100: Assign .num before accessing .hws (git-fixes).
• rtc: aspeed: add AST2700 compatible (stable-fixes).
• rtc: bq32000: add delay between RTC reads (stable-fixes).
• rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).
• rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).
• rtc: mv: add suspend/resume support for wakeup (stable-fixes).
• rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).
• selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).
• serial: 8250: fix possible ISR soft lockup (stable-fixes).
• serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).
• serial: fix TIOCMIWAIT race (git-fixes).
• serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).
• serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).
• serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).
• serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).
• serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).
• smb: client: reject overlapping data areas in SMB2 responses (git-fixes).
• soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).
• soundwire: cadence_master: wait and cancel cdns->work before clock stop (git-fixes).
• soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).
• soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).
• soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).
• soundwire: only handle alert events when the peripheral is attached (stable-fixes).
• soundwire: validate DT compatible before parsing it (stable-fixes).
• spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).
• spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).
• spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).
• spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).
• spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).
• thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).
• thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).
• thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).
• thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).
• thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).
• thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).
• thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).
• thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).
• thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).
• thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).
• thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).
• thunderbolt: Reject oversized XDomain properties responses (git-fixes).
• thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).
• thunderbolt: Set tb->root_switch to NULL when domain is stopped (stable-fixes).
• thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).
• tpm: Disable TPM on null key name mismatch (git-fixes).
• tty: serial: max3100: shut down timer before freeing port (git-fixes).
• tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).
• tty: vt: fix memory leak in vc_allocate() (git-fixes).
• usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).
• USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).
• USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).
• USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).
• usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).
• usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).
• usb: cdns3: rename hibernated argument of role->resume() to lost_power (stable-fixes).
• usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).
• usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).
• usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).
• usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).
• usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).
• usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).
• USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).
• usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).
• usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).
• usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).
• USB: gadget: ffs: fix mm lifetime handling (stable-fixes).
• USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).
• usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (stable-fixes).
• usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).
• usb: gadget: udc: skip pullup() if already connected (stable-fixes).
• usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).
• usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).
• usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).
• usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).
• usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).
• usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).
• usb: ohci-st: disable controller wakeup on removal (git-fixes).
• USB: serial: fix driver deregistration order (git-fixes).
• USB: serial: fix dynamic id driver deregistration race (git-fixes).
• USB: serial: fix ioctl hangup race (git-fixes).
• USB: serial: fix port tear down use-after-free (git-fixes).
• USB: serial: quatech2: fix baud rate overflow (git-fixes).
• usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).
• USB: serial: ssu100: fix baud rate overflow (git-fixes).
• usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).
• usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).
• usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).
• usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).
• usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).
• usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).
• usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).
• usb: usbtmc: don't store usb_device_id (stable-fixes).
• usb: xhci: Improve Soft Retries after short transfers (stable-fixes).
• usb: xhci: use cached HCSPARAMS1 value (stable-fixes).
• usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).
• usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).
• vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).
• vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).
• watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
• watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).
• watchdog: digicolor: Avoid division by zero (git-fixes).
• watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).
• watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).
• watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).
• watchdog: msc313e: Fix premature reset during timeout update (git-fixes).
• watchdog: msc313e: Propagate error code in resume() (git-fixes).
• watchdog: rtd119x: Avoid division by zero (git-fixes).
• watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).
• watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).
• wifi: ath9k_htc: don't store usb_device_id (stable-fixes).
• wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).
• wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).
• wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
• wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).
• wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).
• wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).
• wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).
• wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).
• wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).
• wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).
• wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).
• wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).
• wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).
• wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).
• wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).
• wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).
• wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).
• wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).
• wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).
• wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).
• wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).
• wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).
• wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).
• wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).
• wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).
• wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).
• wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).
• wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).
• wifi: libertas: reject short monitor TX frames (stable-fixes).
• wifi: libipw: fix key index receive bound checks (stable-fixes).
• wifi: libipw: reject too-short association responses (git-fixes).
• wifi: libipw: reject too-short beacon and probe responses (git-fixes).
• wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).
• wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).
• wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).
• wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).
• wifi: mac80211: don't access the TSF of a down interface (git-fixes).
• wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).
• wifi: mac80211: don't allow link changes when iface is down (git-fixes).
• wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).
• wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).
• wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).
• wifi: mac80211: don't start a ROC while scanning (git-fixes).
• wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).
• wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).
• wifi: mac80211: mesh: release the channel if start fails (git-fixes).
• wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).
• wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).
• wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).
• wifi: mac80211: reset state when starting AP fails (git-fixes).
• wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).
• wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).
• wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).
• wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).
• wifi: mac80211: validate deauth frame length before reason access (stable-fixes).
• wifi: mt76: add init_wiphy callback (stable-fixes).
• wifi: mt76: mt7915: set correct background radar capability (stable-fixes).
• wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).
• wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).
• wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).
• wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).
• wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).
• wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).
• wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).
• wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).
• wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).
• wifi: mwifiex: prevent authentication frame length truncation (git-fixes).
• wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).
• wifi: mwifiex: validate action frame fixed fields (git-fixes).
• wifi: mwifiex: validate scan response extents (git-fixes).
• wifi: nl80211: reject beacons with bad HE operation (stable-fixes).
• wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).
• wifi: p54: validate curve data length in the calibration curve converters (git-fixes).
• wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).
• wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).
• wifi: rsi: fix heap OOB write on key removal (git-fixes).
• wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).
• wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (stable-fixes).
• wifi: rtw88: Fix the random "error beacon valid" messages for USB (stable-fixes).
• wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).
• wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).
• wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).
• wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).
• wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).
• wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).
• wifi: virt_wifi: don't transfer operstate before register (git-fixes).
• wifi: virt_wifi: free skb when disconnected (git-fixes).
• wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).
• wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).
• wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).
• xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).