Changelog in Linux kernel 7.2.6

clocksource/drivers/armada: Unwind timer clock on init failure

clocksource/drivers/clps711x: Do not unmap clocksource MMIO

clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type

clocksource: Unregister subsystem on device registration failure

coresight: etm4x: fix leaked trace id

coresight: etm4x: fix underflow for usage of (nrseqstate - 1)

coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()

coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable

cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization

cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks

cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf

cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems

cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active

cpufreq: imx6q: fix devres accumulation across driver rebind

cpufreq: imx6q: fix out-of-bounds write when probed more than once

cpufreq: intel_pstate: Fix setting minimum P-state at init time

cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()

cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()

crash_dump: release keyring reference at the correct time

crypto: acomp - allocate async request context when cloning

crypto: aspeed - Propagate platform_get_irq() errors

crypto: atmel-ecc - reject hardware ECDH without a public key

crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

crypto: ccp - Fix memory leak in SEV INIT_EX path

crypto: ccp - Fix possible deadlock in SEV init failure path

crypto: hisilicon/sec2 - fix CCM algorithm long packet failure

crypto: keembay - Fix AEAD unregister count in error path

crypto: keembay - Initialize completion before requesting IRQ

crypto: keembay - publish OF module alias for OCS AES/SM4

crypto: lskcipher - propagate errors from unaligned crypt

crypto: qat - cancel work on re-enable SR-IOV timeout

crypto: qat - clear AES key schedule from stack

crypto: qat - remove dead ADF_HEX code

crypto: qat - use 2-arg strscpy where destination size is known

crypto: rk3288 - fail ahash requests on HASH idle timeout

crypto: sa2ul - stop probe if context pool creation fails

crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping

csky: Fix a4/a5 restoration in syscall trace path

cuse: wait for pending RCU callbacks on module exit

cxl/features: Clamp Get Feature output size to the remaining buffer

cxl/features: Reject Get Feature count larger than the output buffer

cxl/features: Reject Set Features output buffer smaller than the header

cxl/features: Serialize multi-part Get/Set Feature transfers

cxl/mbox: Break poison list loop on an empty payload

cxl/mbox: Clamp mailbox output allocation to the payload size

cxl/memdev: Fix firmware upload exact-fit handling

cxl/pci: Honor -EPROBE_DEFER from component register setup

cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox()

cxl/port: Restart port enumeration when a sibling adds the dport first

cxl/region: Fix use-after-free in find_pos_and_ways() error path

cxl/test: Add hierarchy enumeration support for type2 device

cxl/test: Add test for module parameters

cxl/test: Propagate -ENOMEM on platform_device_alloc() failures

cxl/test: Refactor platform device enumerations

cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add()

dax/fsdev: clear pgmap ops and owner on unbind

dax/fsdev: clear vmemmap_shift when binding static pgmap

dax/fsdev: don't leave a dangling dev_dax->pgmap on probe failure

dax/fsdev: fail probe on invalid pgmap offset

dax/fsdev: fix multi-range offset in memory_failure handler

dax/fsdev: use __va(phys) for kaddr in direct_access

dax: fix holder_ops race in fs_put_dax()

dax: fix misleading comment about share/index union in dax_folio_reset_order()

dax: read holder_ops once in dax_holder_notify_failure()

dcache: keep shrink_dcache_for_umount() making progress on busy roots

dm-integrity: fix buffer overflow with keyed discard

dm-integrity: replace forgeable discard filler with a keyed sector marker

dm-pcache: validate seg_id fields from persistent memory

dm-pcache: validate the persisted dirty_tail chain at load

dma-resv: Fix undefined symbol when CONFIG_DMA_SHARED_BUFFER is disabled

dmaengine: dw-edma: Clear stale requests on termination

dmaengine: dw-edma: Serialize abort state updates

dmaengine: dw-edma: Serialize channel state checks

dmaengine: dw-edma: Terminate all descriptors without callbacks

dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe

dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure

dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal

dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

dmaengine: zynqmp_dma: fix race between runtime PM and device removal

dpll: fix NULL deref in dpll_device_ops() during teardown race

driver core: soc: Unregister bus on early device registration failure

drivers: base: Remove statistics group if encryption group not created

Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition

drm/amd/display: Fix dangling pointer in CRTC reset function

drm/amd/display: Fix dangling pointer in plane reset function

drm/amd/display: Fix DM I2C teardown race

drm/amd/display: fix wrong register field in dccg35_set_hdmistreamclk_src_new

drm/amd/display: remove duplicate link_dp_panel_replay.h include

drm/amd/display: Remove unused-but-set variable hubp from

drm/amd/display: Resize MST HDCP per-connector arrays to 32

drm/amd/display: Scale custom brightness curve from full range

drm/amd/pm: silence uninitialized variable warnings

drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

drm/amdgpu/gfx6: Fixup emit_cntxcntl()

drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets

drm/amdgpu/gfx6: Use PFP on the compute queues too

drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC

drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12

drm/atomic: Drop drm_private_obj.state assignment from create_state

drm/bridge: cdns-dsi: Return an error pointer on allocation failure

drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure

drm/bridge: display-connector: don't autoenable HPD IRQ

drm/bridge: display-connector: trigger initial HPD event for DP

drm/bridge: of-display-mode-bridge: Fix missing static const for the bridge funcs

drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel

drm/bridge: tc358767: clamp the reported AUX read size to the request

drm/display: hdmi-state-helper: Try subsampling in mode_valid

drm/gfx12: Program DB_RING_CONTROL

drm/lima: call drm_mm_init() with a valid allocation range

drm/msm/a6xx: Fix A621 GPUCC register list for state capture

drm/msm/a6xx: Fix A663 GPUCC register list for state capture

drm/msm/a6xx: Fix IRQ storm during msm_recovery test

drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg

drm/msm/a6xx: Fix stale rpmh votes after suspend

drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()

drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID

drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active

drm/msm/dp: Drop dev_pm_opp_set_rate(0)

drm/msm/dp: reject YUV420-only modes without VSC SDP support

drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)

drm/msm/dpu: Fix DMA SSPP REC block offsets on DPU v13

drm/msm/dsi: Drop dev_pm_opp_set_rate(0)

drm/msm: don't tear down KMS twice when KMS init fails

drm/msm: Fix task_struct reference leak in recover_worker

drm/msm: Only fini scheduler after successful init

drm/msm: Recover HW before retire hung submit

drm/msm: remove objects from evit list after pinning them

drm/omap: dsi: Do not copy isr table

drm/panel: samsung-s6d16d0: Power off on prepare failure

drm/panthor: Add vm_bind region with kbo range overlap check

drm/panthor: Fix NPD issue on partial unmap of an evicted BO

drm/panthor: Pass vm_bind_op to vm_prepare_map_op_ctx

drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()

drm/panthor: Support sparse mappings

drm/rockchip: analogix_dp: Enable hclk for RK3588

drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup

drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message

drm/rockchip: dw_dp: Release core resources

drm/rockchip: vop2: Add RK3576 to the RG swap special case

drm/rockchip: vop2: Fix wrong wait target in layer cfg done check

drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format

drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL

drm/solomon: remove unneeded variables in blit functions

drm/sun4i: crtc: Propagate layer initialization error

drm/sun4i: Drop node references while building component list

drm/sun4i: dw-hdmi: Drop TCON TOP port reference

drm/sun4i: Fix V3s YUV scanline size

drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz

drm/sun4i: hdmi: Don't leak sync polarity bits into packet control

drm/sun4i: tcon-top: Keep mixer routes distinct

drm/sun4i: tcon: Drop remote endpoint reference

drm/sun4i: tcon: Drop TCON TOP device reference

drm/sun4i: tcon: Set output mux for DSI and LVDS

drm/sun4i: vi scaler: Fix coefficient selection

drm/sun4i: vi scaler: Restore opaque alpha in video modes

drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader

drm/tve200: add OF module alias for autoloading

drm/v3d: Associate BOs with every job that accesses them

drm/v3d: Clear queue->active_job when v3d_fence_create() fails

drm/v3d: Convert submit helpers to operate on struct v3d_submit

drm/v3d: Drop unused drm_encoder.h include from v3d_drv.h

drm/v3d: Extract v3d_job_add_syncobjs() helper

drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls

drm/v3d: Make v3d_get_cpu_indirect_csd_params() a pure parser

drm/v3d: Migrate BO reservation locking to DRM exec

drm/xe/sysctrl: Read mailbox phase bit from hardware

drm/xe/uapi: Add additional error components to xe drm_ras

drm/xe/xe_gt_idle: Add CCS to the powergating info print

drm/xe/xe_ras: Add support to get error counter value

drm/xe: Do not apply WA 14025883347 to media 3503

drm/xe: don't WARN on kernel job timeout when device already wedged

drm/xe: Reject page faults from non-fault-mode scratch VMs

drm/xe: tests: fix error message in xe_migrate_sanity_test()

drm: lcdif: Wait for vblank before disabling DMA

drm: Remove unused header in drm_dumb_buffers.c

efi: fix stale reference to efi_recover_from_page_fault()

erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic

erofs: fix interlaced ztailpacking pclusters

erofs: fix unused pcluster_pools for higher page sizes

erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX

esp: do not unref managed frag pages in esp_ssg_unref()

exfat: fix valid_size extension over a shared writable mapping

ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

ext4: clear stale xarray tags on folios skipped during writeback

ext4: drain in-flight DIO before buffered write fallback

ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()

ext4: fix buffer_head leak in ext4_init_orphan_info

ext4: fix circular lock dependency in ext4_ext_migrate

ext4: fix out-of-bounds read in ext4_read_inline_dir()

ext4: fix spurious message about orphan cleanup on RO fs

ext4: fix transaction overflow during writeback

ext4: skip extra isize expansion during mount to prevent deadlock

ext4: skip tail block zeroing for inline data files

ext4: teach ext4_meta_trans_blocks() about number of allocated extents

ext4: use fsdata to track inline data write state and fix race

ext4: validate readdir offset before accessing dirent

f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}

f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode

f2fs: use adjusted write range after f2fs_write_checks()

fanotify: initialize permission event watchdog state

fanotify: report full event length for FIONREAD

fanotify: stop permission watchdog when timeout is zero

fat: release buffer head after rebuilding parent

fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call

fbdev: kyro: Validate overlay viewport coordinates

fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()

firewire: core: add KUnit test skeleton for node tree

firewire: core: add KUnit tests for failure of tree building

firewire: core: add KUnit tests for successful tree building

firewire: core: consolidate port counting in build_tree()

firewire: core: fix memory leak in error path of build_tree()

firewire: core: validate parent port count before allocating nodes in build_tree()

firmware: arm_scmi: Avoid IDR updates while cleaning channels

firmware: arm_scmi: Clean up channels on setup failure

firmware: arm_scmi: Clear SystemPower flag on create failure

firmware: arm_scmi: Drop handle on protocol bind failures

firmware: arm_scmi: Fix OF node reference handling

firmware: arm_scmi: Fix requested device removal race

firmware: arm_scmi: Fix SCMI device destroy lifetimes

firmware: arm_scmi: Fix transport device teardown lookup

firmware: arm_scmi: Free transport channel on IDR failure

firmware: arm_scmi: Protect device request lookup with RCU

firmware: arm_scmi: Publish channel state before callbacks

firmware: arm_scmi: Quiesce notifications before teardown

firmware: arm_scmi: Reject out of range DT protocol IDs

firmware: arm_scmi: Roll back partial protocol table registration

firmware: arm_scmi: Unregister device notifier before IDR teardown

firmware: arm_scmi: Unrequest devices if driver registration fails

firmware: arm_scmi: Unwind P2A receiver mailbox setup failure

firmware: arm_scmi: Unwind TX receiver mailbox setup failure

firmware: arm_scmi: Use channel ID for transport teardown

firmware: coreboot: Validate table bounds

firmware: imx: sm-misc: Add NULL check for kmalloc in syslog_show

firmware: qcom: scm: add trace events for the SMC call interface

firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published

firmware: qcom: scm: Fix reserved memory cleanup on probe failure

firmware: qcom: scm: Fix tzmem state on probe retry

firmware: qcom: scm: instrument SMC call path with tracepoints

firmware_loader: do not queue completed sysfs fallback requests

forcedeth: stop the tx_timeout register dump past the requested window

fs/ntfs3: fix integer overflow in MFT cluster validation

fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

fs/ntfs3: reject restart table growth beyond U16_MAX entries

fs/ntfs3: validate ef->size covers the record's name and value

fs/resctrl: Fix UAF from worker threads when domains are removed

fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

fs: annotate inode timestamp accessors

fuse: check for NULL root inode in fuse_fill_super_submount

fuse: Fix the condition to enable over-io-uring

fuse: invalidate the correct range after O_APPEND direct write

fuse: move "epoch" from dentry.d_time to fuse_dentry.epoch

fuse: reject a duplicate fd= mount option

fuse: use release/acquire for fch->initialized

gpib: Move stuck SRQ update under lock

gpib: use 'static inline' instead of 'extern inline'

gpu: host1x: Avoid double device_add when clients already present

gpu: host1x: Avoid stack over-read in debug output helpers

gpu: host1x: Fix offset calculation in trace_write_gather

gpu: nova-core: build SetRegistry entries dynamically

gpu: nova-core: clean up FSP FRTS comments

gpu: nova-core: correct FRTS vidmem offset calculation

gpu: nova-core: correct RISC-V HALTED field

gpu: nova-core: factor out common FSP message header

gpu: nova-core: fix packed registry table size

gpu: nova-core: gsp: tu102: keep unloading if FWSEC-SB fails

greybus: audio: bound the topology section sizes against the fetched size

gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

hfsplus: validate thread record before delete key rebuild

HID: asus: fix a off-by-one in mcu_parse_version_string() validation

HID: asus: refactor the two workqueues and init sequence

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

HID: haptic: don't write an uninitialized value to unhandled usages

HID: i2c-hid: Fix "(null)" output when reading report descriptor fails

HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure

HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver

HID: lg4ff: validate report length before fixed offsets

HID: logitech-hidpp: Fix FF device cleanup on init failure

HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU

HID: nintendo: Fix imu_timestamp_us double increment per report

HID: roccat: bound device-supplied profile index

HID: sony: add missing __packed to struct with static_assert()

HID: steam: Add support for sensor events on the Steam Controller (2015)

HID: steam: Improve logging and other cleanup

HID: steam: Refactor and clean up report parsing

HID: steam: Reject short reads

HID: steam: Rename some constants that got renamed upstream

HID: synchronize input before cleaning up a failed probe

HID: tmff: Use 64-bit arithmetic for force feedback scaling

hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed

hrtimer: Account nr_retries on recovered interrupt retries

hugetlbfs: release subpool on fill_super failure

hwmon: (coretemp) Fix core_data leak on CPUs without PTS

hwmon: (cros_ec) Register the thermal devices after the hwmon ones

hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv

hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks

hwmon: (emc1403) Drop hysteresis for low limit temperature

hwmon: (pmbus/ltc4283) Add missing MODULE_DEVICE_TABLE for OF match table

hwrng: core - fix rng list on registration error

hwrng: imx-rngc - Disable clock on registration failure

hwrng: ks-sa - Fix runtime PM cleanup on registration failure

hwrng: omap - Fix probe error path cleanup

hwrng: xilinx-trng - propagate timeout before any data is read

hwspinlock: propagate errno when registering single lock

i2c: ocores: Disable clock on failed resume

i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices

i3c: master: adi: add OF module alias for autoloading

i3c: master: Do not treat master device as a duplicate target

i3c: master: Fix device_register() error path

i3c: master: Fix recursive locking during device registration

i3c: master: Fix use-after-free of master->this

i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode

i3c: renesas: Don't register devices when ENTDAA times out

i3c: renesas: Follow a unified pattern for transfer and command initialization

i3c: renesas: Return immediately if there is no transfer

IB/isert: delay the final Login Response until the session is registered

IB/isert: post the full-feature receive buffers after session registration

IB/isert: reject login PDUs declaring more data than was received

IB/isert: reject PDUs declaring more data than was received

ice: acquire NVM lock around each flash read

ice: clear the default forwarding VSI rule when releasing a VSI

ice: fall back to SBQ when LL PHY timer interface times out

idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc

iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE

iio: dac: ad5686: missing NULL check on match data

iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

iio: light: gp2ap002: re-enable irq if runtime suspend fails

iio: light: isl29028: return zero in write_raw() on success

iio: light: opt4060: Fix pointer type passed to div_u64_rem()

iio: light: tsl2583: return zero in write_raw() on success

iio: light: tsl2772: fix ALS calibscale readback

iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure

inetpeer: randomize RB-tree node comparison using SipHash

intel_idle: Avoid using deep idle states during initialization

iomap: add ->iomap_next()

iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit

iomap: release the folio batch on iomap callback failures

iomap: split iomap_iter() logic into iomap_iter_next()

iommu/amd: Fix false positive in SB IOAPIC IVRS validation

iommu/amd: Fix incorrect device ID in invalid PASID error message

iommu/amd: Fix undefined behavior in devid_write debugfs function

iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors

iommu/arm-smmu-v3: Convert to use atomic poll timeout

iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64

iommu/dma: Check atomic pool allocation result directly

iommu/dma: Restore locking around msi_page_list

iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX

iommu/msm: Return -ENOMEM on memory allocation failure in probe

iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()

iommu/qcom: Remove sysfs device on probe failure path

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path

iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs

iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized

iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID

iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

iommu/vt-d: Clear Present bit before tearing down copied context entry

iommu/vt-d: Fix iopf_refcount leak on RID domain replacement

iommu/vt-d: Fix UCTP context table slot when copying root entries

iommu/vt-d: Flush context cache with correct SID when tearing down aliases

iommu/vt-d: Tear down scalable-mode context on probe failure

iommufd/selftest: Avoid selftest dirty bitmap size wrap

iommufd: Simplify iommufd_device_remove_vdev()

ionic: add missing dma_rmb() after the completion publish check

ionic: fix completion descriptor access with 2x desc size

ip6mr: do not clone dst in ip6mr_cache_report()

ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

ipv6: avoid divide by zero in rt6_multipath_rebalance

ipvs: fix integer overflow in ftp helper port/address parsing

irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback

irqchip/ast2700-intc: Disable all interrupt merge banks on probe

irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()

irqchip/gic-v3-its: Fix memleak in its_probe_one()

irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()

irqchip/gic-v5: Check for NULL LPI domain on domain teardown

irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing

irqchip/gic-v5: Clear per-CPU IRS data on teardown

irqchip/gic-v5: Defer default SPI and LPI IAFFID programming

irqchip/gic-v5: Disable IRSes on probe failures

irqchip/gic-v5: Fix gicv5_init_common() error paths

irqchip/gic-v5: Release IRS iomem region on driver init failure

irqchip/gic-v5: Synchronize CPU interface disable

irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation

irqchip/irq-realtek-rtl: Add interrupt data structure

irqchip/irq-realtek-rtl: Add mask for interrupt handling

irqchip/irq-realtek-rtl: Split out parent setup code

irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()

irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

irqchip/renesas-rzg2l: Fix loss of interrupt

isofs: fix out-of-bounds page array access on empty zisofs block

isofs: release zisofs block pointer buffer head

kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile

kbuild: unset sub_make_done before calling kselftest build system

kcsan: avoid unintended access checking in NMIs

kselftest/arm64: Don't write to P0 in irritator on SME only systems

kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets

ksmbd: add AAPL kAAPL_SERVER_QUERY create context support

ksmbd: add procfs monitoring for active shares

ksmbd: add SMB3 request replay support

ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size

ksmbd: decrypt requests from expired encrypted sessions

ksmbd: defer CHANGE_NOTIFY completion instead of STATUS_NOT_IMPLEMENTED

ksmbd: defer publishing granted locks to prevent UAF/double-free race

ksmbd: detach blocked lock requests before freeing

ksmbd: disconnect on SMB3 decryption failure

ksmbd: do not advertise unimplemented CA support

ksmbd: Do not skip lock checks for single-byte ranges

ksmbd: expire SMB sessions when Kerberos tickets expire

ksmbd: fix durable handle v2 default timeout units (60 -> 60000)

ksmbd: fix encrypted request lookup on bound channels

ksmbd: fix maximum allowed access checks

ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

ksmbd: fix tree connection use-after-free in smb2_tree_connect()

ksmbd: free preauth sessions on connection teardown

ksmbd: handle encrypted compressed requests

ksmbd: prevent out-of-bounds reads in share config responses

ksmbd: recognize replayed SMB2 lock sequences

ksmbd: retain connection for pending notify work

ksmbd: safely discard unregistered deferred locks

ksmbd: scope session state changes to bound connections

ksmbd: serialize oplock close with pending break ownership

ksmbd: support access-based directory enumeration

ksmbd: validate ipc response length before dereferencing its fields

ksmbd: validate SMB2 write offsets

kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix

KVM: x86: Check EFER validity on KVM_SET_SREGS*

KVM: x86: Extract REGS and SREGS runtime sync code to helpers

KVM: x86: Move get_segment_base() to regs.h, as kvm_get_segment_base()

KVM: x86: Move the bulk of register specific code from x86.c to regs.c

KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2()

leds: gpio: Clear error pointers for skipped LEDs

leds: lp5860-spi: Fix an error handling path

leds: lp5860: Fix a potential double-unlock

leds: pca9532: Fix inverted GPIO output polarity

leds: pca9532: Fix phantom device registration on missing hardware

leds: st1202: Disable channel when brightness is set to zero

leds: st1202: Fix brightness having no effect while pattern mode is active

leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker

leds: st1202: Fix spurious pattern sequence start in setup

leds: st1202: Set all pattern PWM slots to full after clearing pattern

leds: st1202: Stop pattern sequence before reprogramming

leds: st1202: Validate LED reg property against channel count

lib/interval_tree: fix allocation warning messages

lib/string: fix memchr_inv() for large ranges

lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone

libbpf: Change has_nop_combo to work on top of nop10

libbpf: Detect uprobe syscall with new error

libbpf: Search /lib64 and /lib in resolve_full_path()

libceph: validate banner payload length

libnvdimm/labels: Bound the on-media label size before the shift

Linux: Linux 7.2.6

liveupdate: Reference count outgoing FLB data

liveupdate: reject nonzero reserved value for SESSION_FINISH

liveupdate: Remember FLB retrieve() status

lockd: Regenerate NLMv4 XDR code

locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

lwt_bpf: Restore reserved headroom after xmit program

m68k: Fix backtraces for non-running tasks

m68k: nfcon: Do not call console_is_registered() in nfcon_device()

mailbox: pcc: Fix command timeout due to missed interrupt

mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

mailbox: qcom-cpucp: handle NULL data in send_data callback

mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

mailbox: rockchip: disable pclk on probe failure and unbind

maple_tree: catch race in mas_alloc_cyclic()

maple_tree: fix argument name in header

md/bitmap: resume array on backlog_store() error path

md/md-llbitmap: prevent create failure bitmap UAF

md/md-llbitmap: stop daemon timer rearm on destroy

md/raid10: consistently fail atomic writes that require splitting

md/raid1: create serial pool adding rdev to array with serialize_policy=1

md/raid1: don't set array_frozen in raid1_takeover()

md/raid1: restrict atomic write limits and handle runtime constraints

md/raid5-ppl: fix use-after-free in ppl_do_flush()

md/raid5: fix lockless max_nr_stripes reads

md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency

md/raid5: protect lockless recovery_offset accesses during reshape

md/raid5: round bitmap stripes with sector division

md: avoid stale clone I/O accounting timestamps

md: recheck spare changes before starting sync

md: remove REQ_NOWAIT support from raid1/10/456

md: scope memalloc_noio to allocation critical sections

md: wait for behind writes before destroying bitmap

media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path

media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()

media: bcm2835-unicam: Fix asc leaked in error/remove path

media: cec-pin: Fix event FIFO ordering

media: i2c: rdacm21: Fix missing media_entity_cleanup()

media: ipu6: Do not free aux device pdata after init

media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define

media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define

media: platform: amd: fix unmet dependency for VIDEO_V4L2_SUBDEV_API

media: platform: amd: use refcount_t instead of atomic_t

media: qcom: iris: Fix bitmask test in iris_allow_cmd()

media: qcom: iris: handle runtime PM resume failure in core deinit

media: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entry

media: staging/ipu7: fix async notifier leak on init error

media: stm32: dcmi: fix error handling on MDMA pool alloc failure

media: stm32: dcmi: fix some error handling bugs in probe()

media: ti: vpe: Select V4L2_FWNODE for VIP

media: v4l2-async: Unregister sub-device if asc_list is empty

mei: lb: fix incorrect type in assignment

memcg: move LRU size accounting on reparenting instead of copying it

mfd: cs42l43: Fix regmap defaults ordering

mfd: iqs62x: Reject zero-length firmware records

mfd: macsmc: Fix key count endianness annotation

mfd: rave-sp: validate received frame payload lengths

MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL

misc: ad525x_dpot: use driver core groups for sysfs files

misc: bcm-vk: Use acquire/release for msgq_inited

misc: lan966x_pci: depopulate children on populate failure

misc: pch_phub: Complete enum usage for device identification

misc: pci_endpoint_test: Check SUCCESS bit for doorbell status

misc: rtsx: add missing write register handling

misc: rtsx_usb: avoid USB I/O in runtime autosuspend

misc: sgi-gru: remove interrupt-context page-table walks

misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

mlxbf-bootctl: fix the build error with FIELD_PREP()

mm/damon/core: skip aging from repeated aggressive merging

mm/memcontrol: avoid false sharing between vmstats and events

mm/mm_init: fix incorrect node_spanned_pages

mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP

modpost: prevent leak when early return no suffix .o in read_symbols()

module/dups: Fix use-after-free in kmod_dup_req lifetime handling

module/dups: Inform duplicate requests about the result directly

module: use strscpy() to copy module names in stats and dup tracking

mtd: intel-dg: Fix runtime PM error path in probe

mtd: mtdswap: Avoid freeing registered blktrans device twice

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

mtd: rawnand: pl353: Fix debug prints

mtd: ubi: Release device reference on busy detach

net/mlx5: E-Switch, preserve max tx speed on vport state modification

net/mlx5: E-Switch, use state lock for vport state changes

net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()

net/rds: use wq_has_sleeper() in rds_cong_map_updated()

net/sched: account classifier filter allocations to memcg

net/sched: act_ife: Only operate on Ethernet frames

net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

net/sched: add get_fill_size callbacks for actions missing them

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

net/sched: fq: add overflow bounds to quantum and initial quantum

net/sched: fq: clamp quantum and initial_quantum in change path

net/sched: fq_codel: clamp default quantum and mtu

net/sched: fq_pie: clamp default quantum to avoid signed overflow

net/sched: hhf: clamp quantum before hhf_change() to avoid overflow

net/sched: sch_cake: fix autorate reconfiguration throttling

net/sched: sch_codel: clamp default mtu to avoid disabling CoDel

net/sched: sch_htb: limit htb_classify inner-class filter hops

net/sched: sch_teql: restore skb->dev on the slave failure path

net/sched: sfq: clamp quantum to avoid signed overflow soft lockup

net/smc: free pending qentry in smc_llc_flow_stop() before memset

net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

net/smc: hash socket only after full initialisation in smc_sk_init()

net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()

net: add missing ref_tracker_dir_exit() to net_passive_dec()

net: airoha: fix ETS QoS stats counter underflow and cross-channel corruption

net: airoha: npu: fix missing streaming DMA mask

net: bridge: arp/nd proxy: fix reading neigh ha

net: bridge: Reject descending VLAN tunnel ranges

net: bridge: vlan: fix inverted default vlan notification

net: core: check skb_frags_readable before uncloning in skb_copy_ubufs

net: dsa: b53: fix error propagation from b53_fdb_dump()

net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error

net: dsa: mxl862xx: enable assisted learning on CPU port

net: enetc: convert ndo_set_rx_mode() to ndo_set_rx_mode_async()

net: enetc: extract common helpers for MAC hash filter configuration

net: enetc: extract common helpers for MAC promiscuous mode setting

net: enetc: improve MAFT entry management with bitmap tracking

net: enetc: remove invalid code from enetc4_pl_mac_link_up()

net: enetc: restore RX ring congestion mode after ring reconfiguration

net: enetc: restore RX ring congestion mode for ENETC v4

net: ethernet: sun4i-emac: Fix IRQ error handling

net: fec: only stop PTP if it was initialized

net: fix a resource leak in copy_net_ns() error handling path

net: hibmcge: fix page_pool DMA direction mismatch

net: hsr: free learned nodes on device setup failure

net: ipa: balance runtime PM reference on remove error

net: kcm: Hold RCU read lock while running BPF parser

net: libwx: fix concurrent bitmap overwrite in PTP setup

net: mana: Cap MSI-X vectors to the device MSI-X table size

net: microchip: vcap: use port number instead of netdev name for debugfs

net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race

net: page_pool: Remove zone/policy GFP flags when allocating XArray entries

net: phy: air_en8811h: move LED GPIO configuration to config_init

net: qlcnic: validate unified ROM sections before loading

net: qualcomm: rmnet: restore skb->dev on deaggregated frames

net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

net: sparx5: fix sleep in atomic context in MAC table access

net: stmmac: drop gso_enabled_types and rely on netdev features

net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering

net: stmmac: dwmac4: Account for the primary MAC address for UC filtering

net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering

net: stmmac: restore NET_IP_ALIGN in the RX DMA offset

net: stmmac: selftests: Account for the UC filter list for filtering tests

net: stmmac: selftests: Check multiple MMC counters

net: stmmac: selftests: Don't test flow control for small rx fifos

net: stmmac: selftests: Pass the IP proto mask in the TC selftest

net: stmmac: Skip PHY attach if custom PCS is in use

net: tcp: block mixing readable and unreadable frags

net: thunderbolt: Count delivered packets in rx_packets and rx_bytes

net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown

net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs

net_sched: sch_fq: fix pacing delay underflow with pacing offload

netdevsim: update queue NAPI association on queue reset

netfilter: ctnetlink: do not expose expectation DEAD flag

netfilter: ipset: remove need to allocate memory on delete operations

netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

netfilter: nf_tables: move hardware offload step after building the chain blob

netfilter: nf_tables: skip double clone set expressions on element insert

netfilter: nft_ct: move custom expectation support to helper

netfilter: nft_ct: support expectation creation for natted flows

netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()

nfc: digital: Do not dump a NULL response in command completion

nfc: llcp: avoid userspace overflow on invalid optlen

nfc: llcp: bound SNL TLV parsing to the skb and add length checks

nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

nfc: nci: fix double completion race in nci_data_exchange_complete

nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

nfc: pn533: hold a reference to the request skb during send_frame

NFS: Fix delayed delegation return list handling

nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3

nfs: refactor pNFS functions using clear_and_wake_up_bit

nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper

NFS: Return a delegation the client fails to record

nfsd: add protocol support for CB_NOTIFY

NFSD: Release the export reference when reaping open stateids

NFSv4.1: zero referring call lists before decoding

NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers

NFSv4/pnfs: key the data server cache on the NFS version

NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()

NFSv4: remove callback IDR entry on client allocation failure

nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

nilfs2: fix infinite loop in nilfs_clean_segments()

nilfs2: prevent out-of-bounds read in super root block parsing

ntfs: allow index root relocation

ntfs: apply Windows name checks only with windows_names

ntfs: convert iomap ops to ->iomap_next()

ntfs: do not update ctime when setxattr fails

ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()

ntfs: fix kmap_local_page() usage in compress

ntfs: fix off-by-one page overflow in ntfs_decompress()

ntfs: Inline zero_partial_compressed_page()

ntfs: reject unprivileged writes to reserved $LX* xattrs

ntfs: remove empty EA attribute pair

ntfs: Remove references to page->__folio_index

ntfs: Remove use of __folio_index in handle_bounds_compressed_page()

ntfs: respect per-file chmod mode over mount masks

ntfs: rewrite EA stream before updating metadata

ntfs: serialize resident iomap reads with mrec_lock

ntfs: Use zero_user_segment() in handle_bounds_compressed_page()

ntfs: validate final EA attribute size

ntfs: validate usa_ofs before preserving the update sequence number

null_blk: free global tag_set on init error path

null_blk: free zones array on device power-off

null_blk: register configfs subsystem after creating default devices

null_blk: reject per-device queue resize for shared tag set

null_blk: serialize configfs attribute stores with the lock

null_blk: serialize configfs attribute updates with device setup

null_blk: use DEFINE_MUTEX for the file-scope mutex

nvdimm: pmem: keep PREFLUSH before data writes

nvdimm: preserve flush callback -ENOMEM

nvdimm: virtio_pmem: always wake -ENOSPC waiters

nvdimm: virtio_pmem: refcount requests for token lifetime

nvdimm: virtio_pmem: stop allocating child flush bio

nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags

nvme-apple: Destroy the admin queue on removal

nvme-apple: Don't set a DMA direction for commands without a data transfer

nvme-apple: Drop the PRP null check chicken bit

nvme-apple: Never set the opcode in the NVMMU TCB

nvme-apple: Require page aligned buffers on the admin queue

nvme-apple: Use acquire/release for queue enabled state

nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request

nvme-pci: release descriptor pools on probe failure

nvme-pci: return error when parsing a quirk string fails

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

nvme: Add a quirk for page aligned admin queue buffers

nvme: reject passthrough of driver-managed Set Features

nvmet-rdma: factor out response resource cleanup

nvmet-rdma: fix response resource leak on queue teardown

nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

nvmet: fix max_qid race between configfs and controller allocation

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

nvmet: fix Reservation Register Replace for unregistered host with IEKEY

nvmet: fix return status of RMI log page on allocation failure

nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()

nvmet: reject out-of-range mdts values in configfs store

objtool/klp: Add .klp.symid for sympos disambiguation

objtool/klp: Don't match local symbols against exports

objtool/klp: Fix .kcfi_traps special section extraction

objtool/klp: Fix cross-module klp relocation section naming

objtool/klp: Fix false module dependencies caused by dead relocs

objtool/klp: Fix module name normalization for paths with dots

objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols

objtool/klp: Fix size of empty special section entries

objtool/klp: Fix symbol resolution for duplicate data symbols

objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols

objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols

objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES()

objtool/klp: Ignore replacement offset of empty x86 alternatives

objtool/klp: Normalize Module.symvers paths to module names

ocfs2/cluster: keep heartbeat local node stable

ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()

ocfs2: fix circular locking dependency in ocfs2_init_acl()

ocfs2: o2hb: quiesce negotiate handlers and timeout work

ocfs2: synchronize heartbeat callbacks with o2net teardown

ocfs2: validate DIO orphan slot during inode read

ocfs2: validate external xattr entries when reading metadata

ocfs2: validate inline xattrs during inode block validation

ocfs2: validate orphan slot during inode read

octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()

octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity

octeontx2-af: Fix TL3/TL2 link config ENA clearing

octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()

octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

octeontx2-vf: fix workqueue and netdev race in probe/remove

of/irq: Fix device node refcount leak in of_irq_get_affinity()

OPP: Fix cleanup ordering

PCI/ASPM: Disable/restore ASPM on every function for multi-function devices

PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore

PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node

PCI/pwrctrl: tc9563: Power off only the external ports in tc9563_pwrctrl_disable_port()

PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers

PCI/sysfs: Return -EINVAL for unsupported I/O BAR mmap

PCI: cadence: Fix host/endpoint dependencies for cadence-plat driver

PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup()

PCI: dwc: ep: Fix unmap potentially unmapping the wrong iATU

PCI: dwc: ep: Flush cached MSI write before unmapping the iATU

PCI: Fix dyn_id add TOCTOU

PCI: Fix UAF when probe runs concurrent to dyn ID removal

PCI: imx6: Fix building against PCI_HOST_COMMON

PCI: imx6: Fix building against PCI_PWRCTRL_GENERIC

PCI: j721e: Fix incorrect max_lanes for J7200

PCI: keystone: Fix OF node reference leak in init

PCI: Make pci_match_one_device() match on ID instead of device

PCI: qcom: Skip PERST# GPIOs provided by downstream PCIe devices

PCI: starfive: Fix Runtime PM handling and teardown ordering

PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe

PCI: ultrarisc: Get and enable DP1000 PCIe controller clocks

PCI: xgene: Drop unnecessary OF node reference

perf annotate: Be robust to annotating without a thread

perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero

perf auxtrace: Fix queue grow overflow and old array leak

perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()

perf build: Fix a build error on 32-bit x86

perf build: Fix compiler errors with old capstone

perf build: Remove leftover feature tests for removed cxx and clang support

perf c2c: Clean up registered formats on c2c_hists__init() and c2c_hists__reinit() failure

perf c2c: Fix error masking, OOM, and unchecked caller errors in hpp_list__parse()

perf cap: Remove used_root parameter and simplify capability checks

perf capstone: Fix kernel map reference count leak

perf cs-etm: Avoid truncating AUX buffer sizes to int

perf cs-etm: Filter synthesized branch samples

perf cs-etm: Fix thread leaks on trace queue init failure

perf cs-etm: Flush thread stacks after decoder reset

perf data convert json: Fix trace_seq memory leak in process_sample_event()

perf dso: Fix kallsyms DSO detection with fallback logic

perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()

perf dso: Guard against errno==0 when dso__get_filename() returns NULL

perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()

perf dso: Replace assert with runtime check in dso__read_symbol()

perf dso: Use stored fd error instead of stale errno in file_read() and file_size()

perf evlist: Add reference count

perf evlist: Add reference count checking

perf evsel: Add reference count

perf header: Use write lock when translating BPF prog info pointers

perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow

perf intel-bts: Fix off-by-one in auxtrace_info minimum size check

perf intel-pt: Fix off-by-one in auxtrace_info minimum size check

perf jevents: Add more components to the metric sorting order

perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly

perf libbfd: Validate BPF prog info arrays before pointer cast

perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag

perf machine: Check snprintf truncation for guest kallsyms path

perf machine: Check snprintf truncation in machines__findnew()

perf machine: Don't abort guest map creation on first inaccessible dir

perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()

perf machine: Fix NULL parent dereference in fork event processing

perf machine: Free scandir entries in guest kernel map creation

perf machine: Guard against NULL strlist in machines__findnew()

perf machine: Reset errno before strtol in guest kernel map creation

perf metricgroup: Fix metric expression copy leaks

perf parse-events: Restrict core PMU bypass to --cputype option

perf pmu: Recognize default_core as a core PMU in more places

perf python: Add missed explicit dependencies

perf python: Check counts_values size in set_values

perf python: Fix count_values memory leak in pyrf_evsel__read

perf python: Fix memory leak in pyrf__metrics_cb

perf python: Fix memory leak in pyrf_evlist__get_pollfd

perf python: Handle Py_None for thread and cpu maps

perf python: Validate attribute setters in pyrf_evsel

perf python: Validate CPU and thread maps in pyrf_evsel__open

perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push

perf record: fix poll storm when monitored threads exit

perf record: Fix teardown hang on system-wide multi-threaded sessions

perf record: Return the written size from process_comp_header()

perf sched: Add missing perf_session__delete()

perf sched: Fix memory leaks in perf sched stats report

perf sched: Free subcommand string after perf sched stats

perf sched: Handle missing trace samples in pipe mode

perf sched: Suppress latency table output when trace samples are missing

perf script: Fix metric_evlist leak in script_find_metrics

perf stat: Fix duplicate output with --for-each-cgroup

perf stat: Fix evsel_list leak in cmd_stat

perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads

perf synthetic-events: Fix uninitialized pthread_join

perf test amd ibs: avoid using executable heap

perf test: Fix skiplist leak in cmd_test

perf test: Skip failing 'perf test aslr' test case

perf test: Truncate test description to fit terminal width

perf tests: Add robust record retry helper and use subsecond workloads

perf tests: Fix flakiness in BPF counters test on hybrid systems

perf tests: Fix flakiness in branch stack sampling tests

perf tests: Fix flakiness in trace record and replay test

perf tests: Fix Python JIT dump profiling test failure

perf tests: Skip metrics validation if system-wide recording lacks permission

perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

perf tools: Fix sb_evlist leaks in top and record

perf trace-event: Fix buffer overflow in read_string()

perf trace-event: Fix integer truncation in do_read() and skip()

perf trace: Correct default cpumask formatting to hexadecimal

perf ui hists: Fix dso_filter reference leak and exit zoom cleanup

perf ui hists: Fix uninitialized stack memory free on pstack allocation failure

perf ui hists: In report UI ensure thread is set with reference counting

perf unwind-libdw: Fix unwinding of multi-threaded processes

perf util: Sort includes and add missed explicit dependencies

perf vendor events amd: Reintroduce deprecated Zen 5 core events

perf vendor events amd: Update Zen 5 core events

perf vendor events amd: Update Zen 6 core events

perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics

perf vendor events arm64: Fix Tegra410 Olympus event 0x0197

perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register

perf/x86/amd/uncore: Add group validation

perf/x86/intel/pt: Factor out pt_config_enable()

perf/x86/intel/pt: Fix stop/start with no update

perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED

perf/x86/intel/uncore: Factor out box setup code

perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure

perf/x86/intel/uncore: Fix refcnt and other cleanups

perf/x86/intel/uncore: Fix uncore_box ref/unref ordering

perf/x86/intel/uncore: Introduce PMU flags and broken state

perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails

perf/x86/intel/uncore: Let init_box() callback report failures

perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable state

perf: arm_pmuv3: Zero initialize hw_id branch stack field

perf: arm_spe: Make wakeup range check overflow safe

perf: evsel: Fix error handling in tp_format lookup

phonet: pep: do not write beyond optlen in getsockopt

phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs

phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy

phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets

phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend

phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend

phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads

phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend

phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator

phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure

phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator

phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table

phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL

phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc

phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow

phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes

phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate

phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe

phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe

phy: sunplus: fix error handling in sp_uphy_init()

pinctrl: airoha: add missed get_direction() function for gpio_chip

pinctrl: airoha: add missed IRQ resource helpers

pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins

pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins

pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order

pinctrl: airoha: an7583: fix muxing of non-gpio default pins

pinctrl: airoha: an7583: fix spi group pins

pinctrl: airoha: fix edge-triggered interrupts handling

pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code

pinctrl: airoha: fix IRQ mask/unmask code

pinctrl: airoha: fix mdio bitfield names

pinctrl: bcm2835: Don't remove an unregistered GPIO chip

pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE

pinctrl: fix PINCTRL_GENERIC_MUX not always being selectable

pinctrl: fix unmet dependencies from missing GPIOLIB

pinctrl: generic: free maps on pinctrl_generic_to_map() failure

pinctrl: imx1: fix device_node leak in dt_is_flat_functions()

pinctrl: mediatek: free EINT resources on unbind

pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip

pinctrl: qcom: shikra: Fix intr_target_width for summary interrupt routing

pinctrl: rockchip: Decode drive strength in the get function

pinctrl: rockchip: Reset the pin count when recalculating SoC data

pinctrl: rockchip: Restrict the RV1103B 2-bit drive type to bank 2

pinctrl: spacemit: validate pins in pinconf callbacks

pinctrl: tegra264: fix DAP2 DIN/DOUT pin assignment

platform/chrome: cros_ec_debugfs: Clean up console log on probe failure

platform/chrome: cros_ec_debugfs: Unregister panic notifier

platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

platform/chrome: lightbar: Limit payload to max packet size

platform/chrome: sensorhub: Fix memory overread in ring handler

platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL

platform/surface: acpi-notify: Check ACPI companion before use

platform/x86/amd/hsmp: Reject negative power cap writes in hwmon

platform/x86: acer-wmi: reject missing gaming WMI results

platform/x86: asus-wireless: Fail probe when there is no ACPI match

platform/x86: asus-wmi: fix resource leaks on probe failure

platform/x86: dell-privacy: Fix race condition

platform/x86: dell-wmi-base: Fix handling of ultra performance key

platform/x86: dell-wmi-base: Fix resource leak on module load failure

platform/x86: dell-wmi-sysman: Fix instance ID bounds

platform/x86: hp-bioscfg: fix password encoding bounds check

platform/x86: lg-laptop: Fix LED resource handling

platform: arm64: qcom-hamoa-ec: reject incomplete responses

PM: hibernate: Fix memory leak in snapshot_write_next() error path

PM: sleep: Fix off-by-one in wakelocks number limit check

pmdomain: bcm: bcm2835: handle genpd provider registration errors

pnfs/blocklayout: Fix device leaks on parse failure

power: reset: reboot-mode: Remove devres based allocations

power: supply: bd71815: Fix temperature reading

power: supply: bd71828: Do not hide errors

power: supply: bd71828: Drop duplicate power-supply property

power: supply: bd71828: Fix current direction

power: supply: bd99954: Drop bad register fields

power: supply: bq27xxx: bq27520g4: fix REG_TTES address

power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address

power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address

power: supply: isp1704_charger: cancel work on remove

power: supply: sbs-battery: Use a per-device serial number buffer

power: supply: sc2731_charger: cancel work on remove

powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound

powercap: intel_rapl_tpmi: Handle PMU registration failure during probe

powerpc/44x: Set GPIO chip parent

powerpc/configs: enable CONFIG_RAS to fix EDAC support

powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()

powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

powerpc/syscall: Fix syscall skip handling for seccomp and ptrace

powerpc/xive: add error return value to xive_smp_probe()

powerpc/xive: make xive IPI allocation NULL-safe

powerpc/xive: propagate IPI init errors to prevent use-after-free

powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto

powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel()

powerpc: implement get_direction() in cpm2

ppdev: prevent overflow when setting port timeout

pppox: drain queued packets on channel handoff

pps-gpio: remove dead capture_clear code

pps: don't try to wait for negative timeouts in PPS_FETCH

pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler

prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

printk: Fix possible console use-after-free

ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

ptp: netc: skip PEROUT disable if channel is not enabled

rapidio: clear mport->net when rio_add_net() fails

rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs

RDMA/bng_re: return a timeout when firmware responses stall

RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

RDMA/bnxt_re: Validate udata before executing commands

RDMA/cma: Fix WARNING in res_to_rt

RDMA/core: Add ib_no_udata_io() helper

RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations

RDMA/core: Fix potential use after free in counter_release()

RDMA/core: Fix potential use after free in ib_dealloc_pd_user()

RDMA/core: Fix potential use after free in ib_destroy_cq_user()

RDMA/core: Fix potential use after free in ib_destroy_srq_user()

RDMA/core: Fix potential use after free in ib_free_cq()

RDMA/core: Fix potential use after free in uverbs_free_dmah()

RDMA/core: Fix use after free in ib_query_qp()

RDMA/core: Wait for RCU callbacks before unloading ib_core

RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()

RDMA/cxgb4: Free debugfs on registration failure

RDMA/cxgb4: free STAG index when TPT entry write fails

RDMA/efa: Fix PBL chunk length computation

RDMA/erdma: complete object teardown when the destroy command fails

RDMA/erdma: Fix CEQ tasklet use-after-free on removal

RDMA/erdma: Hold CQ references when processing EQ events

RDMA/erdma: Hold QP references for AE and CM processing

RDMA/erdma: restrict the driver to little-endian systems

RDMA/hfi1: Free RX data on late probe failure

RDMA/hfi1: Initialize debugfs after probe completes

RDMA/hfi1: Preserve unit 0 on allocation failure

RDMA/hfi1: Propagate sdma_txinit_ahg() errors

RDMA/hfi1: Stop flushing the global IB workqueue

RDMA/ipoib: Drain RCU callbacks during module teardown

RDMA/irdma: Add a refcount to track user ring MR associations

RDMA/irdma: Add irdma_cq fields to track pbl allocations

RDMA/irdma: Add refcounting to user ring MRs

RDMA/irdma: Deduplicate the irdma_del_memlist logic

RDMA/mana_ib: drain QP references after partial table insertion

RDMA/mlx5: Drain RCU callbacks during module teardown

RDMA/mlx5: Fix integer overflow of user QP buffer size

RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

RDMA/mlx5: Send cong param changes to the resolved port mdev

RDMA/nldev: validate dynamic counter attribute length

RDMA/rvt: Return NULL after port allocation failure

RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

RDMA/rxe: Fix UAF in ODP init error-handling path

RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

RDMA/siw: Fix use-after-free in siw_accept()

RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

RDMA/srpt: Pass the mapped task attribute to target_init_cmd()

RDMA/ucma: Allow path records to exactly fit the output buffer

regulator: adp5055: Fix error code in adp5055_of_parse_cb()

regulator: core: use system_freezable_wq for init complete work

regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling

regulator: tps65185: handle gpiod_get_value_cansleep() error returns

regulator: tps65185: wait for the IC to wake before the first I2C access

regulator: tps6594: Fix device node reference leaks in multiphase loop

remoteproc: Allow shutdown of crashed processors

remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()

remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()

remoteproc: Prevent crash handling to race with rproc_del()

remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev

remoteproc: qcom: pas: Add late attach support for subsystems

remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side

remoteproc: qcom_q6v5_adsp: Fix reference leak for device node

remoteproc: qcom_q6v5_mss: Fix MDM9607 subsystem control instance ID

remoteproc: qcom_q6v5_mss: Make ssctl_id configurable per platform

remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3

Revert "drm/msm: dsi: fix PLL init in bonded mode"

Revert "esp: do not unref managed frag pages in esp_ssg_unref()"

Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"

ring-buffer: Remove trace_buffer::cpus

riscv, bpf: Fix kernel stack corruption in tailcall with CFI

riscv, bpf: Fix memory leak in bpf_jit_free

riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

riscv: cpufeature: Clarify ISA spec version for canonical order

riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller

riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board

riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX

riscv: dts: spacemit: Fix phy id check for the phy on com260 board

riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board

riscv: dts: spacemit: improve RTL8211F PHY configuration on K3 Pico-ITX board

riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups

riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board

riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board

riscv: dts: spacemit: set console baud rate on K3 Pico-ITX board

riscv: dts: thead: th1520: remove pclk for I2C1

riscv: kexec_file: Fix crashk_low_res not exclude bug

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

rtc: gamecube: check return value of devm_rtc_register_device()

rtc: pcf85363: Add error checking to regmap calls in probe()

rtc: pcf8563: fix clock provider leak on unbind

rtc: spacemit: handle regmap_test_bits() error return

rtc: zynqmp: Return optional clock lookup errors

rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table

rust: cpufreq: Fix temporary write in Registration::bios_limit_callback

rust: device: make lifetime on `Core` and `CoreInternal` invariant

rust: drm: gpuvm: require Send + Sync for the driver's associated data

rust: drm: gpuvm: update DriverGpuVm for DeviceContext

rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h

s390/bpf: Replace ly instruction with llgf

s390/debug: Fix deadlock during unregister

s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN

s390/vdso: Pass --eh-frame-hdr to the linker

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

samples: rust: debugfs: fix excessive stack use

sched/core: Fix inter-class wakeup_preempt()

sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY

sched/fair: Check CPU capacity before comparing group types during load balance

sched/fair: Fix overflow in update_tg_cfs_runnable()

sched/isolation: Defer freeing of cpumask memblock memory to initcall

sched/topology: Add a cpus_read_lock to rebuild_sched_domains()

sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry

sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging

sched_ext: Abort directly from the hardlockup handler

sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable()

sched_ext: Fix exit_cpu accuracy for lockup paths

sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR

scripts/tags.sh: Prevent binary files appearing in cscope.files

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

scsi: qla2xxx: Fix an loop timeout test

scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

scsi: sd: Fix error handling in sd_probe() after large pool creation failure

scsi: sd: Fix sd_done() sense handling condition

scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.

scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags

scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

scsi: ufs: core: Set task state before io_schedule_timeout()

scsi: ufs: core: Validate connected lane counts

scsi: ufs: core: Validate string descriptors

scsi: ufs: debugfs: Reserve space for a string terminator

scsi: ufs: rpmb: Validate request frame length before parsing

selftests/arm64: Fix MTE prctl TAP plan

selftests/arm64: Print missing MTE TAP headers

selftests/arm64: Treat KSM merge_across_nodes as optional

selftests/bpf: Check malloc result with ASSERT_NEQ in test_loader

selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256

selftests/bpf: Fix for veristat file/prog filters processing

selftests/bpf: Fix incorrect error checking for pthread_create

selftests/bpf: Fix lsm_bdev dev_t encoding mismatch

selftests/bpf: Fix make install target

selftests/bpf: Fix memory leak in msg_alloc_iov

selftests/bpf: Fix memory leak in msg_alloc_iov error path

selftests/bpf: Fix memory leak on subtest_states reallocation

selftests/bpf: Fix missing allocation null checks in test_progs.c

selftests/bpf: Fix selftest build after filter.h update

selftests/bpf: libarena: Clean up allocation state before buddy tests

selftests/bpf: Mask socket type flags in mptcpify prog

selftests/bpf: Retry stat generation in cgroup_iter_memcg

selftests/bpf: Silence array bounds warning in global_map_resize

selftests/bpf: Silence maybe-uninitialized compiler warning in libarena

selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap

selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM

selftests/cgroup: Avoid awk -e in cpuset tests

selftests/cgroup: Preserve CPU hotplug write errors

selftests/lsm: Fix memory leak in attr_lsm_count

selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes

selftests/mm: fix memleak in migration benchmark

selftests/mm: fix read_file() return value check

selftests/mm: fix ternary operator precedence in ksm_tests

selftests/mm: handle EINVAL when configuring gigantic hugepages

selftests/mm: skip COW tmpfile cases when fallocate() is unsupported

selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check

selftests/mm: unpoison pages in memory-failure teardown

selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate

selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC

selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check

selftests/sched_ext: Check skeleton open failure in exit test

selftests/sched_ext: Fix bpf_link leak on early return in prog_run

selftests/sched_ext: Fix flaky ddsp failure tests on busy systems

selftests/zram: fix kernel_gte() for POSIX sh

selftests: drv-net: so_txtime: fix qdisc replace with handle

selftests: drv-net: so_txtime: only send test traffic to sch_etf

selftests: drv-net: Test queue stall upon reconfig

selftests: harness: Mark test fixture objects __maybe_unused

selftests: proc: include fcntl.h in proc-pidns

selftests: timers: leap-a-day: Fix -w option and update usage comment

serial: 8250: Clear CON_PRINTBUFFER on port re-registration

serial: amba-pl011: keep console clock enabled for atomic writes

serial: amba-pl011: unprepare console clock on unregister

serial: core: clear freed pointers on uart_register_driver() failure

serial: core: do fallible allocations before the console can be registered

serial: ma35d1: Fix OF node reference leaks in console init

serial: qcom-geni: do not advance stale DMA completions

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

smack: deduplicate smackfs/{direct,mapped} file_operations

Smack: Fix error in capability bypass

smack: fix incorrect task context in smack_msg_queue_msgrcv

smack: restrict smackfs/{direct,mapped} values to 0-255

smack: simplify write handlers of sysfs entries

smb/client: preserve open info type across compound queries

smb/client: return EOPNOTSUPP for unsupported O_TMPFILE

smb/server: abort initialization when proc setup fails

smb/server: call ksmbd_proc_cleanup() on module init failure

smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

smb/server: fix session counter on session removal

smb/server: fix session leak in ksmbd_session_register()

smb/server: fix tree connection leak in smb2_tree_connect()

smb/server: preserve error status in smb2_handle_negotiate()

smb/server: update session counter under sessions table lock

smb/server: warn if ksmbd_proc_create() fails

smb: client: fix request buffer leak in smb2_new_read_req()

smb: client: set replay flag on the read send-error retry path

smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer

smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file

smb: server: remove unused DES crypto header

smb: smbdirect: avoid recursive listen.lock during cleanup

smb: smbdirect: destroy QP before mem pools on accept failure

smb: smbdirect: free completion queues with ib_free_cq()

smb: smbdirect: release pending child sockets outside the handler lock

soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()

soc: fsl: qe: implement get_direction()

soc: fsl: qe: properly scan GPIO nodes at startup

soc: qcom: pmic_glink_altmode: Define the TBT extradata properly

soc: qcom: rpmh-rsc: manage PM notifiers with devres

soc: qcom: ubwc: Fix missing include

soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS"

soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()

soc: ti: knav_qmss: Remove debugfs file on teardown

software node: Fix software_node_get_reference_args() with index -1

soundwire: cadence_master: add BRA_NumBytes[8] support

soundwire: qcom: Fix port exhaustion check in stream_alloc_ports

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

spi: amlogic-spisg: Make sure clk_init_data is fully initialized

spi: davinci: switch to managed controller allocation

spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto

spi: img-spfi: don't disable runtime PM on DMA deferred probe

spi: oc-tiny: switch to managed controller allocation

spi: qcom-geni: Fix missing error check on pm_runtime_get_sync()

spi: sprd-adi: Fix probe succeeding without registering the controller

Squashfs: check block offset is not negative

staging: fbtft: Use sysfs_emit_at() to print to sysfs file

staging: greybus: audio: correct sscanf() return value check

staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys()

staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown

staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths

staging: rtl8723bs: use kfree_sensitive() for key material

staging: sm750fb: Add missing Kconfig dependency

staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()

staging: sm750fb: gate dualview dataflow using g_dualview

SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

super: fix dying superblock warning messages

swiotlb: Preserve allocation virtual address for dynamic pools

tcp: fix corruption of urgent data on multi-segment retransmit

tcp: reject non zerocopy devmem tx

thermal/drivers/airoha: Fix copy paste error for sen internal

thermal/drivers/airoha: Fix copy paste error on clamp_t low temp

thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp

thermal/drivers/rcar: Fix error checking in probe()

thermal/drivers/spacemit: Validate clamped trip thresholds

thermal: hwmon: Remove hwmon class device along with its parent

thermal: intel: int3400: clean up ODVP on probe failures

thunderbolt: stream: Fix possible short reads/writes

thunderbolt: stream: Restore consumer if copying from iter fails

time/namespace: Validate nanosecond field in proc_timens_set_offset()

timekeeping: Account for monotonicity adjustment in ntp_error

timekeeping: Unwind aux clock sysfs children on failure

timers/migration: Fix memory leak in tmigr_setup_groups() error path

tlclk: if sscanf() fails, fall back to 0, not random value

tls: fix RX desync on overlapping skbs

tools/bpf/bpftool: Reset vmlinux BTF after map commands

tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

tools/build: Allow versioning of all LLVM tools defined in Makefile.include

tools/nolibc/powerpc: mark ctr and xer as clobbered by system call

tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only

tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure

tools/sched_ext: scx_qmap: Fix stale API name in comment

tools: Ensure tools copy of linux/filter.h exports the UAPI

tpm: st33zp24: Return zero on status read failure

tpm: st33zp24: Validate locality read result

tracing/probes: Fix BTF kflag check for anonymous struct member access

tracing/probes: ignore id update from btf_type_skip_modifiers

tracing: Have trace_event_update_all() only handle module that is loading

tty: clear cdev pointer after cdev_add() failure

tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64

tty: skip cdev_del() when no cdev is registered

UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs

ubi: Fix rollback for explicit UBI device numbers

UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC

UBI: Preserve torture flag when rescheduling failed erasures

ublk: avoid teardown retry loop on xarray allocation failure

ublk: check for ublk_unmap_io() returning 0

ublk: check import_ubuf() return value

ublk: clear auto buf reg before updating io->buf in batch commit

ublk: reject non-power-of-2 zone sizes in SET_PARAMS

ublk: validate auto buf reg before taking uring_cmd

Linux: UDF symlink pathComponent header OOB read

udf: Fix data loss when converting inline inodes to out of line

udf: Mark LVID buffer as uptodate before marking it dirty

udf: Move udf_map_block() up

uio: Fix stale info pointer in failed registration path

uprobes/x86: Allow to copy uprobe trampolines on fork

uprobes/x86: Do not leak trampoline vma mapping on optimization failure

uprobes/x86: Move optimized uprobe from nop5 to nop10

uprobes/x86: Remove struct uprobe_trampoline object

usb: atm: usbatm: fix invalid ci_range initialization

usb: chipidea: imx: fix missing ret assignment for dev_err_probe

usb: fix UAF when probe runs concurrent to dyn ID removal

usb: gadget: aspeed_udc: check endpoint DMA allocation

usb: gadget: configfs: fix out-of-bounds read of qw_sign

usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths

usb: gadget: f_uac1_legacy: remove broken string configfs attributes

usb: gadget: r8a66597: avoid double free of ep0_req in probe error path

usb: gadget: uac: validate rate list length before storing

usb: ljca: bound bank_num in ljca_enumerate_gpio()

usb: mtu3: allow system suspend during active gadget connection

usb: renesas_usbhs: Fix power-off ordering on unbind

usb: typec: tcpm: fix EPR AVS APDO maximum voltage decoding

usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure

usb: typec: ucsi: unregister debugfs entries on teardown

vdpa/mlx5: fix wrong list iterated in add_direct_chain error path

vdpa_sim: fix cleanup after worker creation failure

vfio/pci: Avoid mapping BARs for devices with non-mappable BARs

vfio/pci: clear vdev->msi_perm after freeing it on init failure

vfio: selftests: Avoid VLAs

vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY

virt: arm-cca-guest: use migrate_disable() for attestation token requests

virtio-net: Ensure that TCP packets don't overflow gso_segs

virtio: add virtio_device_shutdown() helper

virtio: rtc: time out alarm requests

virtio_balloon: disable indirect descriptors

virtio_balloon: factor out virtballoon_quiesce()

virtio_balloon: quiesce balloon work before device shutdown

virtio_net: Fix resize of the RX ring

virtio_pci: fix wrong queue index for admin vq in intx path

vsock: don't check the listener's sk_err in vsock_accept()

vsock: use sock_error() to consume sk_err after a failed connect

vxlan: fix reading neigh ha

vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

w1: ds2482: Fix signedness bug in ds2482_w1_triplet()

wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump

wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()

wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

wifi: ath11k: Correctly copy the hint BSSID in WMI scan request

wifi: ath11k: fix leak in ath11k_service_ready_ext_event()

wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()

wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()

wifi: ath12k: advertise ieee_link_id in vdev start MLO params

wifi: ath12k: Advertise multicast Ethernet encapsulation offload support

wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region

wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()

wifi: ath12k: correct monitor destination ring size

wifi: ath12k: Correctly copy the hint BSSID in WMI scan request

wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

wifi: ath12k: fix encrypted EAPOL TX in encap offload mode

wifi: ath12k: fix ML-STA authentication timeout on QCC2072

wifi: ath12k: fix MLO peer delete race

wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()

wifi: ath12k: fix rx_mpdu_start layout for QCC2072

wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()

wifi: ath12k: fix survey indexing across bands

wifi: ath12k: fix TLV32 length mask

wifi: ath12k: refactor QMI memory assignment

wifi: ath12k: Set IEEE80211_OFFLOAD_ENCAP_4ADDR after tx_encap_type vdev param

wifi: ath12k: switch to name-based reserved memory lookup

wifi: ath12k: validate TLV length in process_tpc_stats()

wifi: ath6kl: avoid buffer overreads in WMI event handlers

wifi: brcmfmac: fix P2P action frame handling without device vif

wifi: cfg80211: stop PMSR before P2P and NAN teardown

wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

wifi: iwlwifi: mei: check SAP message length before reading it

wifi: iwlwifi: mei: pass correct argument to function

wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

wifi: mac80211: disconnect on CSA to channel 0

wifi: mac80211: fix per-STA profile length in cross-link CSA parsing

wifi: mac80211: send TWT teardown to peer after setup TX failure

wifi: mac80211: skip default WMM setup for AP_VLAN links

wifi: mac80211: skip unused probe response countdown offsets

wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

wifi: mt76: add init_wiphy callback

wifi: mt76: assign link_id when sending probe request during scan

wifi: mt76: cancel reset and rc work on device unregister

wifi: mt76: check txfree done event on the WED hw path

wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()

wifi: mt76: connac: add NAN connection type

wifi: mt76: decode the full VHT Rx STBC capability field

wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll

wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode

wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()

wifi: mt76: fix HE DCM max-RU capability encoding

wifi: mt76: fix non-AQL packet accounting for MLO stations

wifi: mt76: fix out-of-bounds access in mmio copy helpers

wifi: mt76: fix queue assignment for disassoc packets

wifi: mt76: fix RX data queuing of RRO 3.0

wifi: mt76: fix RXDMAD_C buffer recycling race

wifi: mt76: fix stranded frames in mt76_txq_schedule_pending

wifi: mt76: fix uninitialised RXDMAD_C descriptor info

wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length

wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss

wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear

wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1

wifi: mt76: mt7915: fix double hif2 init on the non-WED path

wifi: mt76: mt7915: fix ext PHY use-after-free on register error path

wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986

wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie

wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

wifi: mt76: mt7915: report RX chain signal for all RX paths

wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement

wifi: mt76: mt7915: unwind state on add_interface failure

wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields

wifi: mt76: mt7915: write RX header translation bit to the correct register

wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash

wifi: mt76: mt7925: add NAN MCU helpers

wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum

wifi: mt76: mt7925: fix msg len mismatch between driver and firmware

wifi: mt76: mt7925: update clc before setting sar power table

wifi: mt76: mt7927: set band index for sniffer mode

wifi: mt76: mt792x: Fix memory leak in SDIO TX path

wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete

wifi: mt76: mt792x: stop USB register access after bus hang

wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar

wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config

wifi: mt76: mt7996: clear stale link state on full reset

wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed

wifi: mt76: mt7996: do not leave state behind after a failed WED attach

wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure

wifi: mt76: mt7996: don't report a zero TX bitrate

wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU

wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations

wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990

wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP

wifi: mt76: mt7996: fix non-MLD station num_sta leak

wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()

wifi: mt76: mt7996: fix reg addr remap when addr is 0

wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset

wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER

wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations

wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset

wifi: mt76: mt7996: skip key upload when adding an offchannel link

wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]

wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER

wifi: mt76: only consume the WO drop bit on WED v2 devices

wifi: mt76: reject out-of-range link ids in mt76_vif_link()

wifi: mt76: report data NSS for STBC frames in RX rate decode

wifi: mt76: set MT76_SCANNING when starting a hw scan

wifi: nl80211: clean up color-change beacon data on errors

wifi: rtlwifi: pci: fix error path in rtl_pci_probe()

wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready

wifi: rtw89: check return values in rtw89_ops_start_ap()

wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()

wifi: rtw89: fix HE extended capability length check

wifi: rtw89: fw: correct preload field of w2 in rtw89_fw_h2c_default_cmac_tbl_be()

wifi: rtw89: fw: fix link ID filling for LPS MLO common info

wifi: rtw89: fw: use MAC source for IO offload delay command

wifi: zd1211rw: reject secondary interfaces to prevent conflicts

workqueue: only show running workers in stall diagnostics

x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist

x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()

x86/entry/fred: Encode frame pointer on entry

x86/mm/pat: Take cpa_lock around large-page collapse

x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported

xdrgen: Add XDR width macros for short integer types

xdrgen: Do not declare union XDR functions in the definitions header

xdrgen: Emit a blank line ahead of enum declarations

xdrgen: Fix opaque and string encoders for unbounded members

xen/xenbus: check otherend_id only after it has been initialized

xenbus: Unregister reboot notifier on init failure

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

xfrm: Fix skb double-free in xfrm_dev_direct_output()

xsk: align TX metadata layout across ABIs

xsk: fix NULL pointer dereference in __xsk_rcv()

xsk: honor XDP_TX_METADATA in zero-copy path

y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32