* Update to upstream stable Linux 5.10.273 (from 5.10.272). * Bump kernel ABI to 54: ship the ELS kernel as 5.10.0-54-*, distinct from the prior 5.10.0-53. * CVE-2022-49106 - staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances {CVE-2022-49106} * CVE-2022-49234 - net: dsa: Avoid cross-chip syncing of VLAN filtering {CVE-2022-49234} * CVE-2022-49328 - mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328} * CVE-2022-49359 - drm/panfrost: Job should reference MMU not file_priv {CVE-2022-49359} * CVE-2022-49444 - module: fix [e_shstrndx].sh_size=0 OOB access {CVE-2022-49444} * CVE-2022-49622 - netfilter: nf_tables: avoid skb access on nf_stolen {CVE-2022-49622} * CVE-2022-49722 - ice: Fix memory corruption in VF driver {CVE-2022-49722} * CVE-2022-49961 - Revert "bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}" - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961} * CVE-2022-50167 - bpf: fix potential 32-bit overflow when accessing ARRAY map element {CVE-2022-50167} * CVE-2022-50300 - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300} * CVE-2023-52531 - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531} * CVE-2023-52561 - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved {CVE-2023-52561} * CVE-2023-52586 - drm/msm/dpu: Add mutex lock in control vblank irq {CVE-2023-52586} * CVE-2023-53111 - Revert "loop: Fix use-after-free issues {CVE-2023-53111}" - loop: Fix use-after-free issues {CVE-2023-53111} * CVE-2023-53510 - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510} * CVE-2023-53733 - net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode {CVE-2023-53733} * CVE-2024-26589 - Revert "bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589}" - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589} * CVE-2024-26792 - btrfs: fix double free of anonymous device after snapshot creation failure {CVE-2024-26792} * CVE-2024-36898 - gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898} * CVE-2024-41048 - skmsg: Skip zero length skb in sk_msg_recvmsg {CVE-2024-41048} * CVE-2024-41069 - ASoC: topology: Fix references to freed memory {CVE-2024-41069} - ASoC: topology: Fix route memory corruption {CVE-2024-41069} * CVE-2024-46770 - ice: Add netif_device_attach/detach into PF reset flow {CVE-2024-46770} * CVE-2024-46813 - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813} * CVE-2024-46830 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS {CVE-2024-46830} * CVE-2024-49901 - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs {CVE-2024-49901} * CVE-2024-49950 - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950} - Bluetooth: hci_core: Fix calling mgmt_device_connected {CVE-2024-49950} * CVE-2024-49991 - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991} * CVE-2024-57798 - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798} * CVE-2024-57982 - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982} * CVE-2025-21656 - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur {CVE-2025-21656} * CVE-2025-37879 - 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879} * CVE-2025-38068 - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} * CVE-2025-39790 - bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790} * CVE-2025-39810 - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} * CVE-2025-68256 - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser {CVE-2025-68256} * CVE-2025-68321 - page_pool: always add GFP_NOWARN for ATOMIC allocations {CVE-2025-68321} * CVE-2025-71089 - iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089} * CVE-2026-23272 - netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272} * CVE-2026-23378 - net/sched: act_ife: Fix metalist update behavior {CVE-2026-23378} * CVE-2026-23392 - Revert "netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}" - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} - netfilter: nf_tables: wait for an RCU grace period on the flowtable transaction error path {CVE-2026-23392} * CVE-2026-23447 - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447} * CVE-2026-23448 - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} * CVE-2026-31419 - net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419} * CVE-2026-31663 - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663} * CVE-2026-31678 - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} * CVE-2026-43042 - mpls: add seqcount to protect the platform_label{,s} pair {CVE-2026-43042} * CVE-2026-43116 - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} * CVE-2026-43125 - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree {CVE-2026-43125} * CVE-2026-45894 - iommu/vt-d: Clear Present bit before tearing down PASID entry {CVE-2026-45894} * CVE-2026-46099 - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels {CVE-2026-46099} * CVE-2026-46165 - openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165} * CVE-2026-46181 - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} * CVE-2026-46265 - RDMA/hns: Fix WQ_MEM_RECLAIM warning {CVE-2026-46265} * CVE-2026-46324 - netfilter: nf_tables: use list_del_rcu for netlink hooks {CVE-2026-46324} * CVE-2026-52989 - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers {CVE-2026-52989} * CVE-2026-53009 - ice: fix double-free of tx_buf skb {CVE-2026-53009} * CVE-2026-53053 - iommu/amd: Fix clone_alias() to use the original device's devid {CVE-2026-53053} * CVE-2026-53136 - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} * CVE-2026-53254 - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} * CVE-2026-53353 - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). {CVE-2026-53353} * CVE-2026-53388 - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} * CVE-2026-64001 - ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001} * CVE-2026-64015 - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} * CVE-2026-64190 - net: team: fix NULL pointer dereference in team_xmit during mode change {CVE-2026-64190} * CVE-2026-64440 - staging: rtl8723bs: fix OOB write in HT_caps_handler() {CVE-2026-64440} * CVE-2026-64444 - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop {CVE-2026-64444} * CVE-2026-64557 - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() {CVE-2026-64557} * CVE-2026-68190 - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() {CVE-2026-68190} * CVE-2026-72085 - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085} * CVE-2026-72288 - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling {CVE-2026-72288} * CVE-2026-72404 - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404} * CVE-2026-72413 - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} * CVE-2026-72463 - xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463} * CVE-2026-72469 - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE {CVE-2026-72469} * CVE-2026-74302 - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() {CVE-2026-74302} * CVE-2026-74339 - ALSA: seq: Clear variable event pointer on read {CVE-2026-74339} * CVE-2026-74341 - Revert "wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341}" - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341} * CVE-2026-74386 - nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386} * CVE-2026-74387 - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} * CVE-2026-74405 - OPP: Fix race between OPP addition and lookup {CVE-2026-74405} * CVE-2026-74406 - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). {CVE-2026-74406} * CVE-2026-74649 - staging: rtl8723bs: fix missing shared-key auth challenge length check {CVE-2026-74649} * CVE-2026-74672 - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF {CVE-2026-74672} * CVE-2026-74739 - net/sched: cls_u32: skip hash tables in u32_bind_class() {CVE-2026-74739} * CVE-2026-80572 - Input: byd - synchronize timer deletion before freeing private data {CVE-2026-80572} * CVE-2026-80676 - Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676} * CVE-2026-80841 - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} * CVE-2026-80851 - gtp: serialize PDP context updates {CVE-2026-80851} * CVE-2026-80852 - tls: device: fix out-of-bounds write in tls_append_frag() {CVE-2026-80852} * CVE-2026-80855 - fuse: fix invalidate lock leak on open O_TRUNC DAX failure {CVE-2026-80855} * CVE-2026-80856 - fuse: fix invalidate lock leak on setattr writeback failure {CVE-2026-80856} * CVE-2026-80861 - usb: xhci: bail out of setup if the controller is inaccessible {CVE-2026-80861} * CVE-2026-80947 - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947} * CVE-2026-80967 - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ {CVE-2026-80967} * CVE-2026-80983 - net/smc: fix socket refcount leak in smc_switch_conns() {CVE-2026-80983} * CVE-2026-89441 - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441} * CVE-2026-89463 - power: supply: ucs1002: fix use-after-free on remove {CVE-2026-89463} * CVE-2026-89465 - power: supply: rt9455: quiesce delayed work before teardown {CVE-2026-89465} * CVE-2026-89475 - power: supply: bq24257: fix use-after-free on remove {CVE-2026-89475} * CVE-2026-89480 - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} - Revert "nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480}" - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} * CVE-2026-89481 - Revert "nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}" - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} * CVE-2026-89492 - ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492} * CVE-2026-89539 - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539} * CVE-2026-89544 - SUNRPC: fix gssx_dec_option_array error path bugs {CVE-2026-89544} * CVE-2026-89552 - params: fix charp corruption on allocation failure {CVE-2026-89552} * CVE-2026-89553 - Revert "nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}" - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} * CVE-2026-89633 - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} * CVE-2026-89638 - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638} * CVE-2026-89640 - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 {CVE-2026-89640} * CVE-2026-89650 - ceph: bound num_export_targets array for mds info v2/v3 {CVE-2026-89650} * CVE-2026-89652 - ceph: bound copied dentry name length in NFS export get_name {CVE-2026-89652} * CVE-2026-89672 - nfsd: gate nfs2 setacl by argp->mask {CVE-2026-89672} * CVE-2026-89680 - nfsd: fix nfsd_file leak on inter-server COPY setup failure {CVE-2026-89680} * CVE-2026-89685 - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} * CVE-2026-89693 - nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() {CVE-2026-89693} * CVE-2026-89707 - nfsd: release path refs on follow_down() error {CVE-2026-89707} * CVE-2026-89719 - zram: fix out-of-bounds access in read_block_state() {CVE-2026-89719} * CVE-2026-89744 - device property: fix infinite loop in fwnode_for_each_child_node() {CVE-2026-89744} * CVE-2026-89761 - apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761} - Revert "apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761}" - apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761} * CVE-2026-89763 - KEYS: trusted: Fix TPM teardown ordering {CVE-2026-89763} * CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} * CVE-2026-89838 - f2fs: limit recovery filename logging to stored length {CVE-2026-89838} * CVE-2026-89848 - scsi: qla2xxx: Quiesce response IRQ before freeing request queue {CVE-2026-89848} * CVE-2026-89859 - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859} * CVE-2026-89860 - scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860} * CVE-2026-89870 - media: zoran: Avoid freeing a registered video_device twice {CVE-2026-89870} * CVE-2026-89877 - media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877} * CVE-2026-89912 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912} * CVE-2026-89921 - KVM: s390: Zero initialize data structures for inject_pfault_token {CVE-2026-89921} * CVE-2026-89926 - KVM: s390: Fix length check __import_wp_info() {CVE-2026-89926} * CVE-2026-89930 - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter {CVE-2026-89930} * CVE-2026-89972 - Revert "nvme: add missing SRCU grace period in error path {CVE-2026-89972}" - nvme: add missing SRCU grace period in error path {CVE-2026-89972} * CVE-2026-89980 - ALSA: harmony: initialize locks before requesting IRQ {CVE-2026-89980} * CVE-2026-89987 - mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987} * CVE-2026-89988 - Revert "kprobes: Protect kprobe_blacklist with RCU {CVE-2026-89988}" - kprobes: Protect kprobe_blacklist with RCU {CVE-2026-89988} * CVE-2026-90002 - ftrace: Take trace_array reference before accessing its ftrace_ops {CVE-2026-90002} * CVE-2026-90016 - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016} * CVE-2026-90023 - usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023} * CVE-2026-90091 - Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan {CVE-2026-90091} * CVE-2026-90092 - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN {CVE-2026-90092} * CVE-2026-90093 - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt {CVE-2026-90093} * CVE-2026-90180 - block: mtip32xx: synchronize ioctls with device removal {CVE-2026-90180} * CVE-2026-90392 - bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392} * CVE-2026-90398 - wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() {CVE-2026-90398} * CVE-2026-93175 - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} * CVE-2026-93179 - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read {CVE-2026-93179} * CVE-2026-93196 - nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196} * CVE-2026-93199 - i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199} * CVE-2026-93200 - i3c: master: Fix use-after-free of master->this {CVE-2026-93200} * CVE-2026-93231 - lockd: fix swapped arguments in nlmsvc_match_ip() {CVE-2026-93231} * CVE-2026-93239 - arm64: mm: Fix the lockless page-table walk in show_pte() {CVE-2026-93239} * CVE-2026-93285 - f2fs: embed f2fs_gc_kthread in f2fs_sb_info {CVE-2026-93285} * CVE-2026-93791 - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} * CVE-2026-93817 - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} * CVE-2026-97529 - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] {CVE-2026-97529} * CVE-2026-97532 - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path {CVE-2026-97532} * CVE-2026-97536 - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} * CVE-2026-97537 - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking {CVE-2026-97537} * CVE-2026-97540 - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} * CVE-2026-97557 - smb: client: avoid leaking refcount in cifs_queue_oplock_break() {CVE-2026-97557} * CVE-2026-97564 - Revert "smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}" - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} * CVE-2026-97582 - hwmon: (gpio-fan) Fix use-after-free in alarm work {CVE-2026-97582} * CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} * CVE-2026-97616 - net/sched: act_api: release all action references on NEWACTION failure {CVE-2026-97616} * CVE-2026-97619 - io_uring/rw: end write accounting from ->ki_complete {CVE-2026-97619} * CVE-2026-97901 - genetlink: pin family module during policy dump {CVE-2026-97901} * CVE-2026-97908 - Revert "Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908}" - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908} * CVE-2026-97925 - tick/broadcast: Plug clockevents replacement race {CVE-2026-97925} * CVE-2026-97935 - tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935} * CVE-2026-97938 - reboot: fix cad_pid use-after-free race {CVE-2026-97938} * CVE-2026-97939 - ipmr: account multicast table and route memory {CVE-2026-97939} * CVE-2026-97949 - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} * CVE-2026-98019 - bpf: mark a NULL call argument precise {CVE-2026-98019} * CVE-2026-98103 - igmp: convert struct ip_sf_list to RCU {CVE-2026-98103} * CVE-2026-98116 - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116} * CVE-2026-98169 - smb: client: fix potential OOB read in smb3_enum_snapshots() {CVE-2026-98169} * CVE-2026-98170 - smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() {CVE-2026-98170} * CVE-2026-98171 - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171} * CVE-2026-98172 - smb: client: fix smbd_connection leak on cifs_get_tcp_session() error {CVE-2026-98172} * CVE-2026-98192 - wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown {CVE-2026-98192} * CVE-2026-98193 - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} - Revert "wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193}" - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} * CVE-2026-98248 - arm64: percpu: Fix LSE operations on {8,16}-bit types {CVE-2026-98248} * CVE-2026-98312 - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} * CVE-2026-98375 - Revert "xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}" - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} * CVE-2026-98377 - vlan: require the MAC header to be present in __vlan_insert_inner_tag() {CVE-2026-98377} * CVE-2026-98386 - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386} * CVE-2026-98409 - watchdog: rtd119x: Avoid division by zero {CVE-2026-98409} * CVE-2026-98450 - smb: client: close completed creates on compound wait errors {CVE-2026-98450} * CVE-2026-98451 - smb: client: record CreateAction FILE_CREATED from SMB2 opens {CVE-2026-98451} - do_cifs_create(): don't set ->i_mode of something we had not created {CVE-2026-98451} - smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451} - Revert "smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451}" - smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451} * CVE-2026-98453 - smb: client: close handle after create-context parsing failure {CVE-2026-98453} * CVE-2026-98454 - smb3: make query_on_disk_id open context consistent and move to common code {CVE-2026-98454} - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} - Revert "smb: client: fix create context out-of-bounds reads {CVE-2026-98454}" - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} * CVE-2026-98456 - Bluetooth: mgmt: fix race in read_unconf_index_list() {CVE-2026-98456} * CVE-2026-98486 - net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486} * CVE-2026-98490 - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} - Revert "net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490}" - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} * CVE-2026-98493 - net: ipconfig: bound DHCP option construction {CVE-2026-98493} * CVE-2026-98502 - HID: alps: unregister DualPoint Stick input device on remove {CVE-2026-98502} * CVE-2026-98507 - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish {CVE-2026-98507} * CVE-2026-98511 - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() {CVE-2026-98511} * CVE-2026-98519 - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() {CVE-2026-98519} * CVE-2026-98549 - tcp: prevent collapsing skbs across boundary in rtx queue {CVE-2026-98549} * CVE-2026-98568 - Revert "vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568}" - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} * CVE-2026-98655 - perf: Require kernel access for text poke events {CVE-2026-98655} * CVE-2026-98657 - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657} * CVE-2026-98662 - Revert "iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662}" - iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662} * CVE-2026-98663 - iio: imu: adis16480: fix unprotected debugfs reads {CVE-2026-98663} * CVE-2026-98664 - iio: imu: adis16400: fix unprotected debugfs reads {CVE-2026-98664} * CVE-2026-98666 - iio: gyro: adis16136: fix unprotected debugfs reads {CVE-2026-98666} * CVE-2026-98671 - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure {CVE-2026-98671} * CVE-2026-98679 - iio: accel: kxcjk-1013: reject duplicate event disable {CVE-2026-98679} * CVE-2026-98681 - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681} * CVE-2026-98687 - Revert "thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687}" - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} * CVE-2026-98694 - thunderbolt: Fix KASAN reported use-after-free when request is canceled {CVE-2026-98694} - Revert "thunderbolt: Fix KASAN reported use-after-free when request is canceled {CVE-2026-98694}" - thunderbolt: Fix KASAN reported use-after-free when request is canceled {CVE-2026-98694} * CVE-2026-98695 - USB: serial: fix ioctl hangup race {CVE-2026-98695} * CVE-2026-98696 - USB: serial: fix driver deregistration order {CVE-2026-98696} * CVE-2026-98697 - USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697} * CVE-2026-98698 - wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698} * CVE-2026-98700 - wifi: mac80211: set info->band for 802.3 encap offload frames {CVE-2026-98700} * CVE-2026-98701 - wifi: mac80211: release mesh path quota on failed additions {CVE-2026-98701} * CVE-2026-98704 - wifi: mac80211: keep fallback association elements alive {CVE-2026-98704} * CVE-2026-98705 - wifi: mac80211: account proxy paths against the mesh path limit {CVE-2026-98705} * CVE-2026-98706 - wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706} * CVE-2026-98708 - wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708} * CVE-2026-98709 - wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709} * CVE-2026-98710 - wifi: iwlegacy: 3945: free EEPROM data on remove {CVE-2026-98710} * CVE-2026-98711 - wifi: cw1200: fix TX padding OOB read leaking heap data to device {CVE-2026-98711} * CVE-2026-98716 - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} - Revert "KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716}" - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} * CVE-2026-98721 - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ {CVE-2026-98721} * CVE-2026-98722 - mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722} * CVE-2026-98726 - nvme-multipath: fix underflow in ANA log bounds checks {CVE-2026-98726} * CVE-2026-98732 - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732} * CVE-2026-98735 - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion {CVE-2026-98735} * CVE-2026-98739 - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739} * CVE-2026-98741 - Revert "ALSA: ua101: reject mismatched capture/playback packet sizes {CVE-2026-98741}" - ALSA: ua101: reject mismatched capture/playback packet sizes {CVE-2026-98741} * CVE-2026-98742 - ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742} - Revert "ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742}" - ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742} * CVE-2026-98749 - tty: serial: max3100: shut down timer before freeing port {CVE-2026-98749} * CVE-2026-98750 - tty: fix saved termios reset race {CVE-2026-98750} - Revert "tty: fix saved termios reset race {CVE-2026-98750}" - tty: fix saved termios reset race {CVE-2026-98750} * CVE-2026-98751 - tty: abort break signalling on hangup {CVE-2026-98751} * CVE-2026-98752 - tty: port: fix tty_port_tty_vhangup() race {CVE-2026-98752} * CVE-2026-98753 - tty: tty_port: restore TTY_IO_ERROR on activation failure {CVE-2026-98753} * CVE-2026-98754 - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup {CVE-2026-98754} * CVE-2026-98755 - tty: vcc: zero-initialize control packet in vcc_send_ctl() {CVE-2026-98755} * CVE-2026-98756 - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe {CVE-2026-98756} * CVE-2026-98757 - usb: cdns3: fix use-after-free in cdns3_gadget_exit() {CVE-2026-98757} * CVE-2026-98763 - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763} * CVE-2026-98764 - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764} * CVE-2026-98765 - USB: gadget: dummy-hcd: Fix wait for outstanding request completions {CVE-2026-98765} * CVE-2026-98766 - usb: gadget: aspeed-vhub: cancel wake work on device removal {CVE-2026-98766} * CVE-2026-98769 - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769} * CVE-2026-98771 - usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771} * CVE-2026-98772 - USB: serial: fix port tear down use-after-free {CVE-2026-98772} * CVE-2026-98775 - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure {CVE-2026-98775} * CVE-2026-98779 - drm/amdgpu: fix ACP MFD device leak on init failure {CVE-2026-98779} * CVE-2026-98784 - drm/amdgpu/gfx6: fix firmware leak on teardown {CVE-2026-98784} * CVE-2026-98794 - Revert "ipvs: filter some flags received in the backup server {CVE-2026-98794}" - ipvs: filter some flags received in the backup server {CVE-2026-98794} * CVE-2026-98805 - Revert "tipc: prevent GCM nonce reuse on peer key changes {CVE-2026-98805}" - tipc: prevent GCM nonce reuse on peer key changes {CVE-2026-98805} * CVE-2026-98819 - Bluetooth: btintel: validate DDC record lengths {CVE-2026-98819} * CVE-2026-98823 - wifi: cfg80211: preserve hidden-group beacon IE ownership {CVE-2026-98823} * CVE-2026-98831 - of/overlay: don't leak fragment references when changeset init fails {CVE-2026-98831} * CVE-2026-98836 - Revert "ALSA: line6: reject oversized playback packets {CVE-2026-98836}" - ALSA: line6: reject oversized playback packets {CVE-2026-98836} * CVE-2026-98837 - Revert "ALSA: caiaq: unregister the input device when probe fails {CVE-2026-98837}" - ALSA: caiaq: unregister the input device when probe fails {CVE-2026-98837} * CVE-2026-98838 - vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838} * CVE-2026-98840 - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF {CVE-2026-98840} * CVE-2026-98846 - Revert "sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846}" - sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846} * CVE-2026-98847 - rtc: spear: initialize IRQ state before requesting alarm IRQ {CVE-2026-98847} * CVE-2026-98850 - net/packet: prevent TX_RING byte count overflow {CVE-2026-98850} * CVE-2026-98851 - netfilter: nft_flow_offload: drop flowtable reference on init error path {CVE-2026-98851} * CVE-2026-98853 - net: gso: limit recursive IP-in-IP segmentation {CVE-2026-98853} * CVE-2026-98855 - of/overlay: put property on deadprops only after changeset add succeeds {CVE-2026-98855} * CVE-2026-98856 - kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856} * CVE-2026-98857 - Revert "ipvs: fix missing counter decrement in lblc {CVE-2026-98857}" - Revert "ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857}" - ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857} * CVE-2026-98862 - audit: fix exe mark UAF in kill_rules() {CVE-2026-98862} * CVE-2026-98933 - usb: hub: use shorter 120ms post resume hold for SS root hubs {CVE-2026-98933} * CVE-2026-98934 - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() {CVE-2026-98934} * CVE-2026-98936 - wifi: ath11k: reset ar->num_stations on hardware start {CVE-2026-98936} * CVE-2026-98943 - HID: steam: Clean up locking {CVE-2026-98943} * CVE-2026-98944 - HID: steam: Refactor registration {CVE-2026-98944} * CVE-2026-98945 - HID: steam: Rearrange teardown sequence {CVE-2026-98945} * CVE-2026-98950 - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() {CVE-2026-98950} * CVE-2026-98955 - flow_dissector: avoid u16 truncation of skb->len when computing thoff {CVE-2026-98955} * CVE-2026-98959 - btrfs: fix xattr replace when multiple xattrs are packed in the same item {CVE-2026-98959} * CVE-2026-98964 - nvmet: use the local P2P device on metadata allocation failure {CVE-2026-98964} * CVE-2026-98967 - cxgb4/ch_ktls: disable softirqs around tid_list erases {CVE-2026-98967} * CVE-2026-98969 - net/sched: em_text: reject unterminated algo before autoload {CVE-2026-98969} * CVE-2026-98970 - drm/vc4: Free the BO cache size list on teardown {CVE-2026-98970} * CVE-2026-98977 - namespace: handle mount locking for automounts correctly {CVE-2026-98977} * CVE-2026-98979 - namespace: refuse an automount below a mount that is in no namespace {CVE-2026-98979} * CVE-2026-98981 - namespace: unhash a dentry before detaching the mounts on it {CVE-2026-98981} * CVE-2026-98984 - dcache: don't put a mountpoint on a dentry that's being removed {CVE-2026-98984} * CVE-2026-98985 - namespace: check the mounts before reading their parents in pivot_root() {CVE-2026-98985} * CVE-2026-98990 - namespace: check a submount for references right before unmounting it {CVE-2026-98990} * CVE-2026-98992 - namespace: don't copy an unmounted mount tree {CVE-2026-98992} * CVE-2026-98993 - namespace: don't inherit MNT_UMOUNT in clone_mnt() {CVE-2026-98993} * CVE-2026-99002 - drm/vmwgfx: validate pitch coming from userspace {CVE-2026-99002} * CVE-2026-99005 - drm/i915/gt: Unmask interrupts only when ACTIVE is true {CVE-2026-99005} * CVE-2026-99006 - drm/i915/gem: Prevent overstepping exec array boundary {CVE-2026-99006} * CVE-2026-99007 - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN {CVE-2026-99007} * CVE-2026-99008 - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown {CVE-2026-99008} * CVE-2026-99009 - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex {CVE-2026-99009} * CVE-2026-99010 - Bluetooth: RFCOMM: free the skb when the DLC has no owner {CVE-2026-99010} * CVE-2026-99015 - Bluetooth: hci_sock: Serialize dead-device detachment {CVE-2026-99015} * CVE-2026-99019 - scsi: ch: Do not keep references to data transfer element devices {CVE-2026-99019} * CVE-2026-99022 - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers {CVE-2026-99022} * CVE-2026-99024 - optee: register TEE devices only once fully initialized {CVE-2026-99024} * CVE-2026-99025 - openvswitch: fix soft lockup in the netlink flow dump {CVE-2026-99025} * CVE-2026-99027 - net: team: stop reusing skb after queue override {CVE-2026-99027} * CVE-2026-99031 - net: bridge: avoid recursive multicast port cleanup {CVE-2026-99031} * CVE-2026-99032 - net/smc: protect clcsock lifetime in smc_getname {CVE-2026-99032} * CVE-2026-99033 - net/packet: guard the ll header push in packet_rcv_spkt() {CVE-2026-99033} * CVE-2026-99034 - mmc: sdhci-sprd: disable runtime PM on remove {CVE-2026-99034} * CVE-2026-99035 - mmc: mtk-sd: Cancel request timeout work on remove {CVE-2026-99035} * CVE-2026-99036 - dm: fix reading free memory in do_resume {CVE-2026-99036} * CVE-2026-99037 - dm-crypt: reject the lmk IV mode with AEAD ciphers {CVE-2026-99037} * CVE-2026-99038 - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them {CVE-2026-99038} * CVE-2026-99039 - memstick: core: wait for request completion before freeing card {CVE-2026-99039} * CVE-2026-99040 - KEYS: Fix add_key() race with keyring restriction {CVE-2026-99040} * CVE-2026-99045 - ibmveth: h_free logical LAN on open-fail after register {CVE-2026-99045} * CVE-2026-99052 - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts {CVE-2026-99052} * CVE-2026-99053 - tipc: hold a reference to nodes found by link name {CVE-2026-99053} * CVE-2026-99054 - tipc: destroy topsrv workqueues before closing connections {CVE-2026-99054} * CVE-2026-99056 - strparser: make sure __strp_recv isn't running before tearing down the parser {CVE-2026-99056} * CVE-2026-99057 - xen/netfront: don't leak the skb when xennet_fill_frags() fails {CVE-2026-99057} * CVE-2026-99058 - workqueue: Fix NULL current_pwq deref in chained work check {CVE-2026-99058} * CVE-2026-99059 - wireguard: noise: reject response consumption after intermediate initiation {CVE-2026-99059} * CVE-2026-99061 - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() {CVE-2026-99061} * CVE-2026-99063 - dm ioctl: don't let data_start run past the buffer {CVE-2026-99063} * CVE-2026-99067 - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() {CVE-2026-99067} * CVE-2026-99077 - ipv4: udp: Create exceptions before socket matching {CVE-2026-99077} * CVE-2026-99080 - fs: Free any excess xarray nodes in clear_inode() {CVE-2026-99080} * CVE-2026-99081 - bnxt_en: fix DMA mapping length for padded small packets {CVE-2026-99081} * CVE-2026-99082 - KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082} * CVE-2026-99088 - net: openvswitch: validate transport header presence in set_ipv6_addr {CVE-2026-99088} * CVE-2026-99089 - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM {CVE-2026-99089} * CVE-2026-99100 - wifi: p54: validate firmware record lengths {CVE-2026-99100} * CVE-2026-99112 - net/sched: cls_flower: validate mask pointer after nla_next() {CVE-2026-99112} * CVE-2026-99117 - net: bridge: mcast: don't truncate the port group walk on teardown {CVE-2026-99117} * CVE-2026-99118 - drm/i915/dmc: Harden DMC firmware payload parsing {CVE-2026-99118} * CVE-2026-99121 - ipv4: avoid divide by zero in fib_rebalance {CVE-2026-99121} * CVE-2026-99124 - s390/pci: Fix leak of uninitialized kernel data in SCLP report {CVE-2026-99124} * CVE-2026-99126 - s390/ctcm: Prevent XID null dereference {CVE-2026-99126} * CVE-2026-99128 - sctp: validate chunk length in the inqueue parser {CVE-2026-99128} * CVE-2026-99132 - xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf {CVE-2026-99132} * CVE-2026-99135 - dm-integrity: fix infinite loop on discard with large tag size {CVE-2026-99135} * CVE-2026-99136 - dm-crypt: fix a tiny race condition in crypt_dec_pending {CVE-2026-99136} * CVE-2026-99138 - tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) {CVE-2026-99138} * CVE-2026-99150 - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr {CVE-2026-99150} * CVE-2026-99152 - scsi: libiscsi: Validate the task named by a management response {CVE-2026-99152} * CVE-2026-99153 - scsi: libiscsi: Validate the ITT reflected in a Reject PDU {CVE-2026-99153} * CVE-2026-99154 - scsi: libiscsi: Reject a negative task index from parse_pdu_itt {CVE-2026-99154} * CVE-2026-99156 - scsi: st: Fix use-after-free race between st_remove() and st_open() {CVE-2026-99156} * CVE-2026-99161 - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() {CVE-2026-99161} * CVE-2026-99163 - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields {CVE-2026-99163} * CVE-2026-99165 - sctp: revalidate output stream after association connect wait {CVE-2026-99165} * CVE-2026-99166 - net: rds: fix uninitialized trans dereference in CM event handler {CVE-2026-99166} * CVE-2026-99167 - net/sched: fix use-after-free in __tcf_action_put() {CVE-2026-99167} * CVE-2026-99169 - futex: Fix mm reuse handling for FUT_OFF_MMSHARED {CVE-2026-99169} * CVE-2026-99175 - fsnotify: prevent mark additions during connector teardown {CVE-2026-99175} * CVE-2026-99176 - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry {CVE-2026-99176} * CVE-2026-99179 - watch_queue: Fix note pool publication race in watch_queue_set_size() {CVE-2026-99179} * CVE-2026-99180 - unicode: free the map after a grace period {CVE-2026-99180} * CVE-2026-99181 - autofs: ignore notification errors from a replaced pipe {CVE-2026-99181} * CVE-2026-99201 - netlink: avoid hashing the network namespace pointer {CVE-2026-99201} * CVE-2026-99203 - pipe: preserve existing fasync readers on writer setup failure {CVE-2026-99203} * CVE-2026-99204 - ocfs2/dlm: Protect the recovery list during debugfs reads {CVE-2026-99204} * CVE-2026-99206 - scsi: target: iscsi: Fix race in discovery auth updates {CVE-2026-99206} * CVE-2026-99211 - netlink: reset skb headers before unicast and multicast filtering {CVE-2026-99211} * CVE-2026-99213 - vsock: treat TCP_CLOSING as once-established {CVE-2026-99213} * CVE-2026-99216 - Drivers: hv: Don't reset VMBus connection state on error/exit paths {CVE-2026-99216} * CVE-2026-99222 - keys: Protect the read method check against type removal {CVE-2026-99222} * CVE-2026-99223 - keys: make keyring indexes independent of kernel addresses {CVE-2026-99223} * CVE-2026-99224 - keys: Protect the type name while describing a key {CVE-2026-99224} * CVE-2026-99225 - keys: Check the authorization payload in process keyring searches {CVE-2026-99225} * CVE-2026-99226 - keys: Avoid the owner account dereference in named keyring lookup {CVE-2026-99226} * CVE-2026-99234 - tracing: Unregister field variable histograms when the command fails {CVE-2026-99234} * CVE-2026-99235 - tracing: Save the event file instead of the compatible histogram {CVE-2026-99235} * CVE-2026-99236 - tracing: Reject incomplete event filter expressions {CVE-2026-99236} * CVE-2026-99239 - Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn {CVE-2026-99239} * CVE-2026-99245 - KEYS: Fix key_reject_and_link() race with keyring restriction {CVE-2026-99245} * CVE-2026-99246 - tipc: protect node reset trace dump with node lock {CVE-2026-99246} * CVE-2026-99256 - dm cache: fix issue with background work locking {CVE-2026-99256} * Miscellaneous upstream changes - device property: Add cleanup.h based fwnode_handle_put() scope based cleanup. - ocfs2: validate dx_root extent list fields during block read - staging: rtl8723bs: fix spacing around operators - zram: fixup read_block_state() - coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior - kernel/params.c: Use kstrtobool() instead of strtobool() - params: Do not go over the limit when getting the string length - params: Use size_add() for kmalloc() - params: Sort headers - params: Fix multi-line comment style - dmaengine: Add devm_dma_request_chan() - i2c: mxs: fix DMA channel leak on probe error - power: supply: rt9455: Convert to i2c's .probe_new() - i2c: core: Introduce i2c_client_get_device_id helper function - power: supply: max17040: Convert to i2c's .probe_new() - power: supply: max17040: drop incorrect I2C functionality check - workqueue: Add resource managed version of delayed work init - hwrng: stm32 - Fix runtime PM cleanup on registration failure - ALSA: pcxhr: use __func__ to get funcion's name in an output message - spi: bcm63xx: disable clock on resume failure - staging: sm750fb: sm750_accel: Provide description for 'accel' and fix function naming - staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() - ftrace: Synchronize the initialization of ftrace_ops - ALSA: parisc: Fix assignment in if condition - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate - f2fs: return writeback error from collapse range - drm/msm/dsi: do not enable PHYs when called for the slave DSI interface - drm/msm/dsi: rename dual DSI to bonded DSI - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value - ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() - devm-helpers: Add resource managed version of work init - smb: client: fix file type corruption in cifs_reparse_point_to_fattr() - watchdog: rtd119x: Use devm_clk_get_enabled() helper - perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities - perf tools: Fix a asan issue in parse_events_multi_pmu_add() - perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg - drm/nouveau: switch over to the new pin interface - net: ipconfig: Remove outdated comment and indent code block - pinctrl: sunxi: Refactor register/offset calculation - pinctrl: sunxi: Use devm_clk_get_enabled() helpers - pinctrl: sunxi: keep a shadow copy of the data register output latches - tools/thermal/tmon: Fix compilation warning for wrong format - smb: client: validate POSIX create context length - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table - HID: core: remove #ifdef CONFIG_PM from hid_driver - HID: hid-alps: use default remove for hid device - HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() - smb/client: pass cifs_open_info_data to SMB2_open() - of/irq: Fix remaining refcount leaks in of_irq_init() - wifi: cfg80211: avoid double free if updating BSS fails - openvswitch: add nf_ct_is_confirmed check before assigning the helper - rds_tcp: close NULL deref window in rds_tcp_set_callbacks - of/irq: add missing of_node_put() for interrupt parent node - scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort - nvmet: preserve device path on allocation failure - of/overlay: don't create "//" paths for fragments targeting the root - ASoC: wm8903: Move the DRC QR threshold to the register that holds it - ASoC: codecs: rt274: Fix format setting for 44100 rate - Bluetooth: hci_core: free the HCI ID if naming fails - netfilter: ipset: do not update comments from kernel-side adds - net: systemport: Fix RUNT MIB counter register offset calculation - net/sched: fq_codel: match the no-drop threshold to the packet size - net/sched: sch_codel: match the no-drop threshold to the packet size - tcp: refresh TS.Recent for accepted old ACKs - ipvs: fix missing counter decrement in lblc - ipvs: do not create invisible templates - net: add and use skb_get_hash_net - i2c: at91: release DMA channels when probe defers - PCI: Accept AtomicOps already enabled by the hypervisor - drm/radeon: Read the VRAM VBIOS signature with readb() - kgdboc: Fix tty driver reference leak in configure_kgdboc() - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 - Input: synaptics - limit T440p InterTouch quirk to LEN0036 - USB: cdc-acm: fix racy TIOCMIWAIT implementation - usb: ohci-da8xx: disable controller wakeup on cleanup - usb: ohci-s3c2410: disable controller wakeup on removal - usb: ohci-st: disable controller wakeup on removal - usb: typec: ucsi: Get the connector fwnode based on reg value - usb: typec: ucsi: displayport: Current CAM OOB index fixup - tty: amiserial: fix broken TIOCMIWAIT - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle - serial: tegra: don't clear the Tx FIFO on an Rx-only reset - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB - USB: serial: cp210x: add Corsair AX1500i Power Supply - USB: serial: quatech2: fix baud rate overflow - USB: serial: ssu100: fix baud rate overflow - USB: serial: option: add support for SIMCom SIM8260C - USB: serial: option: add Quectel EG060W - USB: serial: option: add Compal EXM-G1x support - USB: serial: option: add Quectel RG660QB - USB: serial: option: add Compal EXC-T1 support - iio: accel: sca3000: fix frequency divider condition check - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls - iio: proximity: isl29501: Fix return type of isl29501_register_write - Revert "scsi: sd: sd_zbc: Use logical blocks as unit when querying zones" - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages - wifi: wl12xx: Drop if with an always false condition - wifi: wlcore: Convert to platform remove callback returning void - wifi: wlcore: Fix runtime PM leak in wlcore_remove() - net: usb: qmi_wwan: add Quectel EG120K-EA - usb: typec: tcpm: fix debug accessory mode detection for sink ports - usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC - soc: qcom: geni-se: Correct QUP Core ICC vote constants - arm64: errata: Factor out broken AMU const counter cap - arm64: errata: Add Cortex-A725 erratum 3821522 workaround - fsverity: add dependency on 64K or smaller pages - drm/amd/pm/si: Fix updating clock limits on AC/DC - drm/amdgpu: reset VI ASIC on MacBookPro15,1 - drm/amdgpu: reset VI ASIC on MacBookPro14,3 - usb: octeon-hcd: fix the FIFO-flush timeout computation - usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() - usb: ohci-spear: disable controller wakeup on removal - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 - Input: s6sy761 - fix resume ordering and restore sensing - tty: vt: fix memory leak in vc_allocate() - serial: fix TIOCMIWAIT race - drm/amd/display: Mark DCE 6.4 as not APU - mtd: spinand: Enable QE on all dies - USB: serial: clean up core error labels - tty: introduce and use tty_port_tty_vhangup() helper - mm/hugetlb: fix avoid_reserve to allow taking folio from subpool - iio: adc: aspeed: propagate reset deassert errors - iio: adc: max1363: sign-extend bipolar differential channel reads - HID: core: introduce hid_safe_input_report() - HID: uhid: convert to hid_safe_input_report() - crypto: drbg - Fix ineffective sanity check - Revert "wifi: libertas: reject short monitor TX frames" - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - keys: finalize persistent keyring timeout after link attempt - dm-snap: reject the transient exception store for snapshot-merge - mmc: cavium-octeon: destroy slot platform devices on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - net: usb: ax88179_178a: fix rx frame length for non-last packets - scsi: qedi: Initialize callback state before registration - drm/amdgpu: make Mac FB workaround generic - fs: refuse fspick() on internal superblocks - drm/aspeed: Balance the display clock enable on teardown - net/mlx5e: Order ICOSQ cc update after CQ doorbell - can: fix unique skb identifier regression under RPS - drm/amd/display: Don't replace a sink mode that shares the native totals - HID: hid-steam: Fix cleanup in probe() - HID: hid-steam: Make client_opened a counter - HID: steam: Fully unregister controller when hidraw is opened - selinux: fix data race on AVC latest_notif - EDAC/amd64: Mask UMC chip select to the four implemented selects - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge - Revert "netfilter: nf_tables: fix bidirectional offload regression" - netfilter: nf_tables: fix bidirectional offload regression - net: team: Remove unused team_mode_op, port_enabled - net: team: Rename port_disabled team mode op to port_tx_disabled - highmem: round down the address passed to kunmap_flush_on_unmap() - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: rockchip: propagate subdomain add errors - fcntl: refuse F_SET_RW_HINT on an immutable inode - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc - netfilter: nf_tables: fix crash when nf_trace is enabled - xfrm: prevent policy_hthresh.work from racing with netns teardown - xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover - xfs: improve the code that checks recovered bmap intent items - xfs: hoist recovered rmap intent checks out of xfs_rui_item_recover - xfs: improve the code that checks recovered rmap intent items - xfs: hoist recovered refcount intent checks out of xfs_cui_item_recover - xfs: improve the code that checks recovered refcount intent items - xfs: don't nest icloglock inside ic_callback_lock - xfs: convert XLOG_FORCED_SHUTDOWN() to xlog_is_shutdown() - xfs: log items should have a xlog pointer, not a mount - xfs: aborting inodes on shutdown may need buffer lock - xfs: remove xfs_buf_t typedef - xfs: fix super block buf log item UAF during force shutdown - xfs: fix intermittent hang during quotacheck - xfs: buffer pins need to hold a buffer reference - xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock - xfs: catch stale AGF/AGF metadata - xfs: rearrange code in xfs_buf_item.c - xfs: factor out stale buffer item completion - xfs: fix unmount hang with unflushable inodes stuck in the AIL - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value - ASoC: stm32: spdifrx: fix synchronization state check - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register - ASoC: cs42l52: Fix the NG Type Switch bit - ASoC: pcm3168a: Fix the DAC zero flag polarity bit - ASoC: max98371: Fix the Speaker DHT Min Volume bits - ASoC: wm8978: Fix the 128x oversampling switch bits - ASoC: nau8822: Fix the 128x oversampling switch bits - netlink: remove netlink_broadcast_filtered - netlink: Reverse the patch which removed filtering - nios2: fix __wsum type degradation in csum_fold() - scsi: st: Save the visited block for the partition the drive is in - samples: pidfd: fix userprogs typo - clone: add CLONE_AUTOREAP - exit: fix lost-update race on the child_subreaper bitfields - net: initialize net->net_cookie at netns setup - tools: gpio: fix building from the top level with O= - i2c: qcom-cci: Fix HALT_ACK reset request being dropped - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang - tracing: Fix the shift out of bounds in the log2 histogram modifier - dm cache: fix demotion stats in passthrough mode - dm-ebs: fix incorrect device offset check in ebs_ctr() - drm/amdgpu: Fix VCE 3 ring align_mask - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots - dm-integrity: require stable writes for internal hash modes - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() - netfilter: nf_tables: always increment set element count - net_sched: codel: fix stale state for empty flows in fq_codel - tracing: Fix 64-bit and signed histogram fields on 32-bit kernels - signal: don't retarget shared signals in a dying thread group - nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() - nvme-tcp: Do not reset transport on data digest errors - Bluetooth: btqcomsmd: Convert to platform remove callback returning void - Linux 5.10.273