Changelog in Linux kernel 6.18.57

clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type

coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable

crypto: drbg - Fix ineffective sanity check

cxgb4/ch_ktls: disable softirqs around tid_list erases

cxl/features: Serialize multi-part Get/Set Feature transfers

cxl/region: Block region delete during region creation

dcache: don't put a mountpoint on a dentry that's being removed

devlink: fix devlink_rel reference leak when notify work is pending

dm ioctl: don't let data_start run past the buffer

dm-crypt: reject the lmk IV mode with AEAD ciphers

dm-integrity: fix buffer overflow in inline mode with large tag size

dm-pcache: validate seg_id fields from persistent memory

dm-snap: reject the transient exception store for snapshot-merge

dm: fix reading free memory in do_resume

dmaengine: idxd: fix double free of wq, engine, and group structs

dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

doc/netlink: netlink-raw: Add max check

dpll: fix NULL deref in dpll_device_ops() during teardown race

drivers: firmware: xilinx: Add unique family code for all platforms

drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info()

drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35

drm/amd/display: check if dml21_add_phantom_plane() is successful

drm/amd/display: disable replay when crc source is enabled

drm/amd/display: Don't replace a sink mode that shares the native totals

drm/amd/display: Fix dangling pointer in CRTC reset function

drm/amd/display: Fix dangling pointer in plane reset function

drm/amd/display: Fix dc_link NULL handling in HPD init

drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs

drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport

drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock

drm/amd/display: Resize MST HDCP per-connector arrays to 32

drm/amd/display: use kvzalloc to allocate struct dc

drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED

drm/amdgpu/userq: fix access to stale wptr mapping

drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

drm/amdgpu/userq: return the memdup_user() error for the user MQD

drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks

drm/amdgpu: fix amdgpu_hmm_range_get_pages

drm/amdgpu: Fix kernel panic during driver load failure

drm/amdgpu: force complete the KIQ ring fences on reset

drm/amdgpu: force complete the MES ring fences on reset

drm/amdgpu: make Mac FB workaround generic

drm/amdgpu: serialize vblank counter reads against GPU reset

drm/amdgpu: skip the VMID 0 flush for VRAM

drm/amdkfd: Add bounds check for CRAT subtype length

drm/amdkfd: align SDMA doorbell base for shader doorbell writes

drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info

drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length

drm/aspeed: Balance the display clock enable on teardown

drm/dp: don't mark the AUX backlight enabled when enabling failed

drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN

drm/gud: don't keep a connector without a CRTC as connector_state

drm/i915/gem: Prevent overstepping exec array boundary

drm/i915/gt: Fix NULL deref on sched_engine alloc failure

drm/i915/gt: Unmask interrupts only when ACTIVE is true

drm/imagination: Fix reference and vm_bo handling in remap()

drm/imagination: Size page table preallocation by device address

drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()

drm/panthor: Add vm_bind region with kbo range overlap check

drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock

drm/panthor: validate userspace queue count against initialized firmware slot count

drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure

drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure

drm/vc4: drain the hangcheck timer and works on V3D unbind

drm/vc4: Fix binner slot allocation failing on an idle GPU

drm/vc4: Fix firmware reference leak in vc4_drm_bind()

drm/vc4: Free the BO cache size list on teardown

drm/vmwgfx: validate pitch coming from userspace

drm/xe/guc: Hold device ref until queue teardown completes

drm/xe/guc: Keep scheduler timeline name alive

drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums

drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

drm/xe: don't WARN on kernel job timeout when device already wedged

drm/xe: Fix shrinker accounting double-subtraction on nested external pins

drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

EDAC/amd64: Mask UMC chip select to the four implemented selects

erofs: fix metabuf leak in inode xattr initialization

esp: do not unref managed frag pages in esp_ssg_unref()

eth: bnxt: avoid deadlock when canceling IRQ affinity notifier

eth: bnxt: decrease indent in bnxt_request_irq()

eventfs: Use children field for rcu head and add memory barriers

ext2: Fix lost inode updates for IS_SYNC inodes

ext4: add mext_check_validity() to do basic check

ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()

ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT

f2fs: fix data loss caused by incorrect use of nat_entry flag

f2fs: fix to reset all pinned status during fggc

f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()

f2fs: read COW data with the original inode during atomic write

fbdev: omap2: fix inconsistent lock returns in omapfb_mmap

fbdev: omap2: fix use-after-free in omapfb_mmap

fbdev: Wrap user-invoked calls to fb_set_var() in helper

fcntl: refuse F_SET_RW_HINT on an immutable inode

firmware: arm_scmi: Clear SystemPower flag on create failure

firmware: arm_scmi: Fix OF node reference handling

firmware: arm_scmi: Fix SCMI device destroy lifetimes

flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

flow_dissector: avoid u16 truncation of skb->len when computing thoff

fs/ntfs3: call _ntfs_bad_inode() when failing to rename

fs/ntfs3: Reformat code and update terminology

fs/resctrl: Fix UAF from worker threads when domains are removed

fs: don't let a migrating task hide its reference from do_umount()

fs: don't silently unmount busy mounts

fs: Free any excess xarray nodes in clear_inode()

fs: move mntput_no_expire() slowpath into a dedicated routine

fs: refuse fspick() on internal superblocks

fuse: Fix the condition to enable over-io-uring

fwctl/bnxt_en: Refactor aux bus functions to be more generic

gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit

gfs2: Add clean argument to lm_unmount hook

gfs2: Asynchronous withdraw

gfs2: Clean up quotad timeout handling

gfs2: fix memory leaks in gfs2_fill_super error path

gfs2: Get rid of delayed withdraws

gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn

gpio: exar: initialize the ID before registering its cleanup

gpio: mpsse: fix race when arming the IRQ poll worker

gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

gpio: xilinx: fix runtime PM leak on request error path

greybus: raw: fix use-after-free on cdev close

gve: fix napi_disable deadlock when attempting to disable XSK pools

gve: fix XSK buffer leak on error descriptor

gve: fix XSK buffer leak when rings are stopped

hdlc_ppp: fix potential null pointer in ppp_cp_event logging

hfs: Replace BUG_ON with error handling for CNID count checks

HID: logitech-hidpp: Fix FF device cleanup on init failure

HID: steam: Clean up locking

HID: steam: Fully unregister controller when hidraw is opened

HID: steam: Rearrange teardown sequence

HID: steam: Refactor registration

i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()

ibmveth: fix TX LTB and filter unwind on open-fail

ibmveth: h_free logical LAN on open-fail after register

ice: fix double-free of tx_buf skb

ice: fix metadata_dst refcount handling on representor teardown

ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

ice: fix race condition in TX timestamp ring cleanup

ice: fix use-after-free in dynamic port cleanup

ice: reshuffle and group Rx and Tx queue fields by cachelines

ice: Restore Ordered MMIO Writes for Tx Doorbells

idpf: bound interrupt-vector register fill to the allocated array

idpf: fix max_vport related crash on allocation error during init

Input: ati_remote2 - fix type confusion in device attribute handlers

Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox

Input: xpad - add support for Corsair Novablade Pro

iomap: release pages on atomic dio size mismatch

iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

iommu/riscv: Serialize command queue publishing

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

iommu/vt-d: Fix iopf_refcount leak on RID domain replacement

iommu: Pass in old domain to attach_dev callback functions

ip6mr: do not clone dst in ip6mr_cache_report()

ipv4: do not warn on route notification size race

ipv4: stop exception dump when nexthop group shrinks

ipv4: stop PMTU walk when nexthop group shrinks

ipv4: stop route notification sizing when nexthop group shrinks

ipv4: validate checksum_start before completing checksum

ipv6: do not warn on route notification size race

ipv6: Fix redirect exception creation for UDP/RAW sockets

ipv6: mcast: annotate data-races around mca_users

ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

ipvs: revalidate ihl to prevent out-of-bounds access

irqchip/gic-v5: Clear per-CPU IRS data on teardown

irqwork: Move data struct to a types header

ixgbe: do not configure xps for XDP queues

keys: finalize persistent keyring timeout after link attempt

KEYS: Fix add_key() race with keyring restriction

kho: fix size calculation in kho_preserved_memory_reserve()

ksmbd: convert tree_conns_lock to rw_semaphore

ksmbd: defer publishing granted locks to prevent UAF/double-free race

ksmbd: detach blocked lock requests before freeing

ksmbd: fix maximum allowed access checks

ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

ksmbd: prevent path traversal bypass by restricting caseless retry

ksmbd: remove redundant DACL check in smb_check_perm_dacl

ksmbd: safely discard unregistered deferred locks

ksmbd: scope session state changes to bound connections

ksmbd: serialize oplock close with pending break ownership

KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor

KVM: arm64: vgic: Fix race between LPI release and re-registration

KVM: guest_memfd: Treat memslot binding offset+size as unsigned values

KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT

KVM: riscv: Fix Spectre-v1 in PMU counter access

KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped

libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()

Linux: Linux 6.18.57

lockd, nfsd: RCU-protect nlmsvc_ops dispatch

LoongArch: BPF: Zero-extend signed ALU32 div/mod results

LoongArch: KVM: Get VM PMU capability from HW GCFG register

LoongArch: KVM: Validate MSI data before routing it to EIOINTC

md/raid1,raid10: fix bio accounting for split md cloned bios

md/raid1,raid10: fix deadlock in read error recovery path

md/raid1,raid10: fix error-path detection with md_cloned_bio()

md/raid10: fix writes_pending leak on write request failures

md/raid1: fix writes_pending and barrier reference leaks on write failures

md: remove REQ_NOWAIT support from raid1/10/456

md: replace wait loop with wait_event() in md_handle_request()

media: chips-media: wave5: Resume device before setting EOS flag

media: iris: fix use-after-free of fmt_src during MBPF check

media: iris: turn platform caps into constants

media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure

media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC

media: verisilicon: Fix kernel panic due to __initconst misuse

memstick: core: wait for request completion before freeing card

memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

mm: don't schedule deferred kernel page table freeing while booting

mmc: cavium-octeon: destroy slot platform devices on remove

mmc: cavium-thunderx: destroy slot platform devices on remove

mmc: mtk-sd: Cancel request timeout work on remove

mmc: sdhci-sprd: disable runtime PM on remove

mount: keep a copied mount unbindable

mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount

mshv: Centralize guest memory region destruction

mshv: Fix error handling in mshv_region_pin

mshv: Move region management to mshv_regions.c

mshv: Refactor and rename memory region handling functions

namei: don't reveal overmounted entries in refwalk

namespace: check a recursive bind mount for mount namespace loops

namespace: check a submount for references right before unmounting it

namespace: check the mounts before reading their parents in pivot_root()

namespace: check the target before walking it in do_mount_setattr()

namespace: don't copy an unmounted mount tree

namespace: don't inherit MNT_UMOUNT in clone_mnt()

namespace: don't let a pseudo dentry become the root of a mount

namespace: handle mount locking for automounts correctly

namespace: look at the topmost mount for a mount namespace file

namespace: never expire a locked mount

namespace: queue a mount only once for mount notifications

namespace: refuse an automount below a mount that is in no namespace

namespace: remove the fsnotify marks of a mount namespace in process context

namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

namespace: unhash a dentry before detaching the mounts on it

net/liquidio: drop cached VF pci_dev LUT

net/mlx5: LAG, Fix off-by-one in single-FDB error rollback

net/mlx5e: Order ICOSQ cc update after CQ doorbell

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

net/mlx5e: Prevent stale XSK buffer release on refill retry

net/packet: guard the ll header push in packet_rcv_spkt()

net/sched: account classifier filter allocations to memcg

net/sched: cls_route: reject change with no routing attribute

net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

net/sched: em_text: reject unterminated algo before autoload

net/sched: fix packet loop on netem when duplicate is on

net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains

net/smc: protect clcsock lifetime in smc_getname

net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET

net: bridge: arp/nd proxy: fix reading neigh ha

net: bridge: avoid recursive multicast port cleanup

net: Convert proto_ops bind() callbacks to use sockaddr_unsized

net: dsa: microchip: fix KSZ8765 fiber detection

net: dsa: mt7530: fix .get_stats64 sleeping in atomic context

net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT

net: fully inline backlog_unlock_irq_restore()

net: hsr: defer node table free until after RCU readers

net: Introduce skb tc depth field to track packet loops

net: make dev_xdp_sb_prog_count() see programs attached through a link

net: mana: Cap MSI-X vectors to the device MSI-X table size

net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()

net: mana: Skip WQ object destruction for uninitialized RXQ

net: openvswitch: validate transport header presence in set_ipv6_addr

net: optimize enqueue_to_backlog() for the fast path

net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind

net: serialize netif_running() check in enqueue_to_backlog()

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

net: sparx5: free the matchall entry on destroy

net: sparx5: start the TOD counters on non-PTP lan969x variants

net: stmmac: fix dma mapping leak in stmmac_tso_xmit()

net: team: free skb when broadcast has no txable port

net: team: stop reusing skb after queue override

net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues

net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path

net: ti: icssg-prueth: Make emac_run_xdp function independent of page

net: usb: ax88179_178a: fix rx frame length for non-last packets

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them

netfilter: nf_tables: add hook transactions for device deletions

netfilter: nf_tables: skip double clone set expressions on element insert

netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding

netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

netfilter: x_tables: allocate hook ops while under mutex

netfilter: x_tables: allow initial table replace without emitting audit log message

netfs, afs: Fix symlink reading

netfs: Fix folio_queue ENOMEM in writeback by adding a mempool

netfs: Fix missing alloc tagging of direct mempool allocations

netfs: Fix missing barriers when accessing stream->subrequests locklessly

netfs: Fix zeropoint update where i_size > remote_i_size

netfs: zero the tail of a short DIO/unbuffered read

nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

nexthop: take nh->lock for f6i_list walks in replace check and notify

NFS: Return a delegation the client fails to record

nfsd: convert nfsd_net boolean flags to unsigned long flags word

nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths

nfsd: use workqueue enable/disable APIs for v4_end_grace sync

NFSv4.1: zero referring call lists before decoding

NTB: core: Add .get_dma_dev() callback to ntb_dev_ops

NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers

ntb: Store original DMA address for future release

nvme-pci: fix dma mapping leak on data setup error

nvme-pci: fix dma_vecs leak on p2p memory

nvme: fix swapped ZRASF zone state values for full and read only

nvmet: fix max_qid race between configfs and controller allocation

nvmet: fix return status of RMI log page on allocation failure

nvmet: return Invalid Field for invalid NSIDs feature 82h

nvmet: use the local P2P device on metadata allocation failure

ocfs2/heartbeat: fix slot mapping rollback leaks on error paths

ocfs2: o2hb: quiesce negotiate handlers and timeout work

ocfs2: validate fast symlink target during inode read

octeontx2-af: Block VFs from clobbering special CGX PKIND state

octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()

openvswitch: fix soft lockup in the netlink flow dump

optee: ffa: Add NULL check in optee_ffa_lend_protmem

optee: register TEE devices only once fully initialized

ovpn: defer key slot crypto freeing to workqueue

papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()

PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers

PCI: Add WQ_PERCPU to alloc_workqueue() users

PCI: endpoint: Add missing NULL check for alloc_workqueue()

PCI: Fix dyn_id add TOCTOU

PCI: Fix UAF when probe runs concurrent to dyn ID removal

PCI: Make pci_match_one_device() match on ID instead of device

pfcp: make sure the SEID is linear before reading it

pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip

platform/x86: asus-wmi: fix resource leaks on probe failure

platform/x86: dell-wmi-base: Fix handling of ultra performance key

pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains

pmdomain: rockchip: don't ignore clock lookup errors on attach

pmdomain: rockchip: fix clock leak on domain probe failure

pmdomain: rockchip: propagate subdomain add errors

power: supply: max77705: Drop duplicated IRQ error message

power: supply: max77705: Free allocated workqueue and fix removal order

powerpc/64s: Fix unmap race with PMD migration entries

powerpc/xive: add error return value to xive_smp_probe()

powerpc/xive: propagate IPI init errors to prevent use-after-free

printk: Don't WARN on kthread_run failure.

pseries/papr-hvpipe: Fix race with interrupt handler

ptp: ocp: fix PCIe delay estimation calculation

ptp: ocp: fix resource freeing order

ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware

RDMA/bnxt_re: Add a max slot check for SQ

RDMA/bnxt_re: Free CQ toggle page after firmware teardown

RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()

RDMA/rvt: Return NULL after port allocation failure

regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

regulator: of: fill in supply names in of_regulator_bulk_get_all()

regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4

remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3

Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"

Revert "net/smc: Introduce TCP ULP support"

Revert "wifi: ath12k: add panic handler"

Revert "wifi: libertas: reject short monitor TX frames"

ring-buffer: Add checking nr_subbufs to persistent ring buffer validation

ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer

RISC-V: KVM: Fix PMU event info array size overflow

riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

riscv: fix load_unaligned_zeropad() fixup for RV32

riscv: futex: untag the user pointer before the atomic access

riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header

riscv: vector: Fix data pointer constraints in context save/restore

riscv: vector: Fix output operands in context save

rust_binder: reschedule node refcount update on thread exit

s390/zcrypt: Close speculative mem read possibility

s390/zcrypt: Improve CCA CPRB length and overflow checks

s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing

s390/zcrypt: Improve EP11 CPRB length and overflow checks

s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code

s390/zcrypt: Pad trailing CCA or EP11 message with zeros

s390/zcrypt: Rework domain processing within zcrypt device driver

sched_ext: Generate qseq from a per-task counter

scsi: core: pair EH runtime PM get and put

scsi: qedi: Initialize callback state before registration

scsi: qla2xxx: Completely fix fcport double free

scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

scsi: sd: Move the sd_config_discard() function definition

scsi: ufs: core: Convert string descriptor format macros to enum

scsi: ufs: core: Validate string descriptors

sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute

selinux: fix data race on AVC latest_notif

selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

serial: core: clear freed pointers on uart_register_driver() failure

serial: core: do fallible allocations before the console can be registered

smb/client: fix chown/chgrp with SMB3 POSIX Extensions

smb/server: fix tree connection leak in smb2_tree_connect()

smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid

soc/tegra: pmc: Fix unsafe generic_handle_irq() call

soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

soc: xilinx: Fix race condition in event registration

spi: sg2044-nor: Honor SPI clock limits

spi: sg2044-nor: Return transfer errors

srcu: Use irq_work to start GP in tiny SRCU

static_call: allow using STATIC_CALL_TRAMP_STR() from assembly

strparser: make sure __strp_recv isn't running before tearing down the parser

SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx

SUNRPC: Add errno-to-GSS status conversion helper

SUNRPC: Add Kconfig dependency on CRYPTO_KRB5

SUNRPC: Prepare crypto/krb5 encryption and checksum handles

SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

SUNRPC: Switch MIC token generation to crypto/krb5

SUNRPC: Switch MIC token verification to crypto/krb5

SUNRPC: Switch wrap token decryption to crypto/krb5

SUNRPC: Switch wrap token encryption to crypto/krb5

svcrdma: Add Write chunk WRs to the RPC's Send WR chain

svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails

svcrdma: wake sq waiters when the transport closes

swiotlb: fix default_swiotlb_limit() for non-growable default pool

tcp: reject net_iov in zerocopy receive mapping hints

tee: optee: ffa: support shared memory offsets on large-page kernels

tee: optee: fix kernel-doc warnings

tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

thermal: hwmon: Remove hwmon class device along with its parent

ti: icssg: convert to ndo_hwtstamp API

tipc: avoid busy looping in tipc_exit_net()

tipc: destroy topsrv workqueues before closing connections

tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()

tipc: hold a reference to nodes found by link name

tipc: serialize udp bearer replicast list updates

tracing: Fix subbuf resize races with trace_pipe_raw readers

tracing: Take trace_array reference when opening a tracer options file

tty: skip cdev_del() when no cdev is registered

ublk: reset per-IO canceled flag on each fetch

ublk: validate auto buf reg before taking uring_cmd

udf: fix partition descriptor append bookkeeping

uprobes/x86: Move optimized uprobe from nop5 to nop10

usb: f81604: fix struct f81604_int_data size mismatch

usb: gadget: uac: validate rate list length before storing

vduse: validate virtqueue alignment

veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down

vhost: invalidate vring access on IOTLB transitions

vhost_iotlb: bound map allocation in add_range

virtio_net: Fix resize of the RX ring

virtio_ring: fix stale descriptor flags after a failed packed add

vsock/virtio: account only unread bytes in read_skb()

vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

vxlan: fix reading neigh ha

wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()

wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()

wifi: brcmfmac: fix P2P action frame handling without device vif

wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

wifi: cfg80211: enforce HE/EHT cap/oper consistency

wifi: cfg80211: use wiphy work for socket owner autodisconnect

wifi: ieee80211: split S1G definitions out

wifi: mac80211: add AQL support for multicast packets

wifi: mac80211: add ieee80211_txq_aql_pending()

wifi: mac80211: bound S1G TIM PVB walk to the TIM element

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

wifi: mac80211: fix missing RX bitrate update for mesh forwarding path

wifi: mac80211: validate extension-frame layout before RX

wifi: mt76: account non-AQL frames per peer rather than per link

wifi: mt76: add PS buffering support for HW-managed TIM drivers

wifi: mt76: cancel reset and rc work on device unregister

wifi: mt76: don't return TXQ when exceeding max non-AQL packets

wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()

wifi: mt76: mt7603: initialize global station WCID

wifi: mt76: mt7915: disable rx napi when removing device

wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

wifi: mt76: mt7925: don't put the band auto marker in TGID

wifi: mt76: mt7925: restore the legacy BSS after MLO teardown

wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

wifi: mt76: mt792x: pick the SAR table layout from the table itself

wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit

wifi: mt76: mt7996: clear stale link state on full reset

wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout

wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()

wifi: mt76: route nullfunc frames to PSD/ALTX queue

wifi: mt76: use ALTX queue for packets to disassociated stations

wifi: nl80211: clean up color-change beacon data on errors

wireguard: noise: reject response consumption after intermediate initiation

wireguard: queueing: preserve tstamp_type when encapsulating packet

workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)

workqueue: devres: Add device-managed allocate workqueue

workqueue: fix devm_alloc_workqueue() va_list misuse

workqueue: Fix NULL current_pwq deref in chained work check

x86/CPU/AMD: Fix AMD TLBI Erratum #1718

xen/netfront: don't leak the skb when xennet_fill_frags() fails

xen/pvcalls: bound backend response req_id before indexing rsp[]

xfs: fix exchange-range-to-eof file size exchange

xfs: remove duplicate INO1_WRITTEN check

xfs: stop exchanging reflink flags when exchanging mappings

xsk: provide sufficient space in pool->tx_descs

xsk: reclaim invalid Tx descriptors in ZC batch path

ynl: fix schema check errors

zloop: zero out only the unread tail of short reads

zram: fix out-of-bounds access in writeback_store()