# changelog

author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-102.36.3.el10uek]
changelog:
  - aarch64: increase DEFAULT_CRASH_KERNEL_LOW_SIZE for kdump for 64K kernels (Brian Maly) [Orabug: 38001657]
  - fs: use new field for kstat.atomic_write_unit_max_opt to avoid KABI issue (John Garry) [Orabug: 38026089]
  - nvme: all namespaces in a subsystem must adhere to a common atomic write size (Alan Adamson) [Orabug: 38026089]
  - nvme: multipath: enable BLK_FEAT_ATOMIC_WRITES for multipathing (Alan Adamson) [Orabug: 38026089]
  - scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH (John Garry) [Orabug: 38026089]
  - xfs: allow sysadmins to specify a maximum atomic write limit at mount time (John Garry) [Orabug: 38026089]
  - xfs: update atomic write limits (John Garry) [Orabug: 38026089]
  - xfs: add xfs_calc_atomic_write_unit_max() (John Garry) [Orabug: 38026089]
  - xfs: add xfs_file_dio_write_atomic() (John Garry) [Orabug: 38026089]
  - xfs: commit CoW-based atomic writes atomically (John Garry) [Orabug: 38026089]
  - xfs: add large atomic writes checks in xfs_direct_write_iomap_begin() (John Garry) [Orabug: 38026089]
  - xfs: add xfs_atomic_write_cow_iomap_begin() (John Garry) [Orabug: 38026089]
  - xfs: refine atomic write size check in xfs_file_write_iter() (John Garry) [Orabug: 38026089]
  - xfs: refactor xfs_reflink_end_cow_extent() (John Garry) [Orabug: 38026089]
  - xfs: allow block allocator to take an alignment hint (John Garry) [Orabug: 38026089]
  - xfs: ignore HW which cannot atomic write a single block (Darrick J. Wong) [Orabug: 38026089]
  - xfs: add helpers to compute transaction reservation for finishing intent items (Darrick J. Wong) [Orabug: 38026089]
  - xfs: add helpers to compute log item overhead (Darrick J. Wong) [Orabug: 38026089]
  - xfs: separate out setting buftarg atomic writes limits (Darrick J. Wong) [Orabug: 38026089]
  - xfs: rename xfs_inode_can_atomicwrite() -> xfs_inode_can_hw_atomic_write() (John Garry) [Orabug: 38026089]
  - xfs: only call xfs_setsize_buftarg once per buffer target (Darrick J. Wong) [Orabug: 38026089]
  - fs: add atomic write unit max opt to statx (John Garry) [Orabug: 38026089]
  - xfs: stop using set_blocksize (Darrick J. Wong) [Orabug: 38026089]
  - block: hoist block size validation code to a separate function (Darrick J. Wong) [Orabug: 38026089]
  - xfs: cleanup xfs_vn_getattr (Christoph Hellwig) [Orabug: 38026089]
  - fs: reformat the statx definition (Christoph Hellwig) [Orabug: 38026089]
  - dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits (John Garry) [Orabug: 38026089]
  - iomap: rework IOMAP atomic flags (John Garry) [Orabug: 38026089]
  - iomap: comment on atomic write checks in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
  - iomap: inline iomap_dio_bio_opflags() (John Garry) [Orabug: 38026089]
  - iomap: Lift blocksize restriction on atomic writes (Ritesh Harjani) [Orabug: 38026089]
  - iomap: Support SW-based atomic writes (John Garry) [Orabug: 38026089]
  - iomap: Rename IOMAP_ATOMIC -> IOMAP_ATOMIC_HW (John Garry) [Orabug: 38026089]
  - iomap: Minor code simplification in iomap_dio_bio_iter() (John Garry) [Orabug: 38026089]
  - dm-mirror: Support atomic writes (John Garry) [Orabug: 38026089]
  - dm-io: Warn on creating multiple atomic write bios for a region (John Garry) [Orabug: 38026089]
  - dm-stripe: Enable atomic writes (John Garry) [Orabug: 38026089]
  - dm-linear: Enable atomic writes (John Garry) [Orabug: 38026089]
  - dm: Ensure cloned bio is same length for atomic write (John Garry) [Orabug: 38026089]
  - dm-table: atomic writes support (John Garry) [Orabug: 38026089]
  - block: Don't trim an atomic write (John Garry) [Orabug: 38026089]
  - block: Add common atomic writes enable flag (John Garry) [Orabug: 38026089]
  - block: Change blk_stack_atomic_writes_limits() unit_min check (John Garry) [Orabug: 38026089]
  - block: Ensure start sector is aligned for stacking atomic writes (John Garry) [Orabug: 38026089]
  - md/raid10: Atomic write support (John Garry) [Orabug: 38026089]
  - md/raid1: Atomic write support (John Garry) [Orabug: 38026089]
  - md/raid0: Atomic write support (John Garry) [Orabug: 38026089]
  - block: Support atomic writes limits for stacked devices (John Garry) [Orabug: 38026089]
  - block: Add extra checks in blk_validate_atomic_write_limits() (John Garry) [Orabug: 38026089]
  - md/raid10: Handle bio_split() errors (John Garry) [Orabug: 38026089]
  - md/raid1: Handle bio_split() errors (John Garry) [Orabug: 38026089]
  - md/raid0: Handle bio_split() errors (John Garry) [Orabug: 38026089]
  - block: Handle bio_split() errors in bio_submit_split() (John Garry) [Orabug: 38026089]
  - block: Error an attempt to split an atomic write in bio_split() (John Garry) [Orabug: 38026089]
  - block: Rework bio_split() return value (John Garry) [Orabug: 38026089]
  - ext4: Do not fallback to buffered-io for DIO atomic write (Ritesh Harjani) [Orabug: 38026089]
  - ext4: Support setting FMODE_CAN_ATOMIC_WRITE (Ritesh Harjani) [Orabug: 38026089]
  - ext4: Check for atomic writes support in write iter (Ritesh Harjani) [Orabug: 38026089]
  - ext4: Add statx support for atomic writes (Ritesh Harjani) [Orabug: 38026089]
  - xfs: Support setting FMODE_CAN_ATOMIC_WRITE (John Garry) [Orabug: 38026089]
  - xfs: Validate atomic writes (John Garry) [Orabug: 38026089]
  - xfs: Support atomic write for statx (John Garry) [Orabug: 38026089]
  - fs: iomap: Atomic write support (John Garry) [Orabug: 38026089]
  - fs: Export generic_atomic_write_valid() (John Garry) [Orabug: 38026089]
  - block: Add bdev atomic write limits helpers (John Garry) [Orabug: 38026089]
  - Revert "SUNRPC: Don't allow waiting for exiting tasks" (Harshvardhan Jha) [Orabug: 38162684]
  - Revert "Add normal counters" (Boris Ostrovsky) [Orabug: 38184971]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-102.36.4.el10uek]
changelog:
  - PCI/AER: Add sysfs attributes for log ratelimits (Jon Pan-Doh) [Orabug: 38126943]
  - PCI/AER: Ratelimit correctable and non-fatal error logging (Jon Pan-Doh) [Orabug: 38126943]
  - PCI/AER: Simplify add_error_device() (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Convert aer_get_device_error_info(), aer_print_error() to index (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Reduce pci_print_aer() correctable error level to KERN_WARNING (Karolina Stolarek) [Orabug: 38126943]
  - PCI/AER: Check log level once and remember it (Karolina Stolarek) [Orabug: 38126943]
  - PCI/AER: Trace error event before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Update statistics before ratelimiting (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Simplify pci_print_aer() (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Initialize aer_err_info before using it (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Move aer_print_source() earlier in file (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Rename aer_print_port_info() to aer_print_source() (Jon Pan-Doh) [Orabug: 38126943]
  - PCI/AER: Extract bus/dev/fn in aer_print_port_info() with PCI_BUS_NUM(), etc (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Consolidate Error Source ID logging in aer_isr_one_error_type() (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Factor COR/UNCOR error handling out from aer_isr_one_error() (Bjorn Helgaas) [Orabug: 38126943]
  - PCI/AER: Descope pci_printk() to aer_printk() (Ilpo Järvinen) [Orabug: 38126943]
  - md/md-bitmap: fix GPF in bitmap_get_stats() (Håkon Bugge) [Orabug: 38137957,38254392] {CVE-2025-38451}
  - Revert "net/rds: Add krefs to struct rds_connection" (Håkon Bugge) [Orabug: 38184408]
  - Revert "net/rds: tracepoints for rds_conn_kref_get and put" (Håkon Bugge) [Orabug: 38184408]
  - sched: Change nr_uninterruptible type to unsigned long (Aruna Ramakrishna) [Orabug: 38195223]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-102.36.5.el10uek]
changelog:
  - uek-rpm: Enable few modules related to various subsystems in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Enable more sound related options in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Enable few desktop related modules (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Enable few wireless modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Enable few USB related modules in UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Add accessibility related modules to UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: intel: Enable few platform and thermal drivers (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Enable few config options in both Architectures (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Enable SOUND related config options to UEK8 (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Re-sort modules.yaml files as a cleanup (Harshit Mogalapalli) [Orabug: 37846468]
  - uek-rpm: Run savedefconfig for UEK8U1 (Harshit Mogalapalli) [Orabug: 37846468]
  - net/mlx5: set graceful_period to 0 to allow multiple transmission queue recovery (Praveen Kumar Kannoju) [Orabug: 38182989]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.36.1.el10uek]
changelog:
  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
  - mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
  - memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
  - mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
  - net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
  - net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.2.el10uek]
changelog:
  - arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
  - scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
  - scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
  - scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
  - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
  - fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
  - LTS version: v6.12.40 (Jack Vogel)
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
  - iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
  - smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
  - drm/xe: Move page fault init after topology init (Matthew Brost)
  - drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
  - sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
  - i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
  - i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
  - i2c: omap: Add support for setting mux (Jayesh Choudhary)
  - selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
  - rust: use `#[used(compiler)]` to fix build and `modpost` with Rust >= 1.89.0 (Miguel Ojeda)
  - net: libwx: fix multicast packets received count (Jiawen Wu)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
  - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
  - libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
  - drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
  - drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
  - rxrpc: Fix transmission of an abort in response to an abort (David Howells)
  - rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
  - net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
  - tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
  - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
  - drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
  - drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
  - net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
  - net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
  - Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
  - riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
  - riscv: Enable interrupt during exception handling (Nam Cao)
  - loop: use kiocb helpers to fix lockdep warning (Ming Lei)
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
  - ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
  - ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
  - hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
  - selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
  - can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
  - can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
  - wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
  - nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
  - nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
  - net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
  - smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
  - nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
  - fix a leak in fcntl_dirnotify() (Al Viro)
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
  - rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
  - block: fix kobject leak in blk_unregister_queue (Ming Lei)
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
  - selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
  - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
  - arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
  - soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
  - soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
  - arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
  - arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
  - iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
  - iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
  - net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
  - net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
  - net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
  - cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
  - Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
  - arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
  - arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
  - arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
  - arm64: dts: add big-endian property back into watchdog node (Meng Li)
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
  - net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
  - mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
  - mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
  - io_uring/poll: fix POLLERR handling (Pavel Begunkov)
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
  - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
  - drm/amd/display: Free memory allocation (Clayton King)
  - drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
  - drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
  - tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
  - tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
  - dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
  - spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
  - nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
  - Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
  - thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
  - i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
  - usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
  - LTS version: v6.12.39 (Jack Vogel)
  - KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
  - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
  - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
  - ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
  - kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
  - net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
  - erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
  - selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
  - HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
  - bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
  - net: mana: Record doorbell physical address in PF mode (Long Li)
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
  - driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
  - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
  - ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
  - io_uring: make fallocate be hashed work (Fengnan Chang)
  - ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
  - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
  - um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
  - net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
  - selftests: net: lib: fix shift count out of range (Hangbin Liu)
  - selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
  - erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
  - erofs: refine readahead tracepoint (Gao Xiang)
  - erofs: tidy up zdata.c (Gao Xiang)
  - erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
  - erofs: free pclusters if no cached folio is attached (Chunhai Guo)
  - drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
  - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
  - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
  - drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
  - wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
  - wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
  - wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
  - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
  - drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
  - wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
  - netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
  - erofs: address D-cache aliasing (Gao Xiang)
  - erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
  - smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
  - clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
  - clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
  - rust: init: allow `dead_code` warnings for Rust >= 1.89.0 (Miguel Ojeda)
  - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
  - scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
  - scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
  - scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
  - mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
  - maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
  - kallsyms: fix build without execinfo (Achill Gilgenast)
  - Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
  - drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
  - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
  - Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
  - drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
  - drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
  - drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
  - drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
  - drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
  - drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
  - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
  - wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
  - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
  - wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
  - wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - pwm: Fix invalid state detection (Uwe Kleine-König)
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
  - net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
  - KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
  - KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
  - KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
  - rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
  - net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
  - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
  - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
  - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
  - tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
  - vsock: fix `vsock_proto` declaration (Stefano Garzarella)
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
  - net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
  - net: phy: qcom: move the WoL function to shared library (Luo Jie)
  - arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
  - bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
  - sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
  - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
  - Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
  - ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
  - sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
  - irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
  - perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
  - ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
  - ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
  - ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
  - ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
  - ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
  - ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
  - ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
  - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
  - crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
  - drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
  - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
  - eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
  - LTS version: v6.12.38 (Jack Vogel)
  - x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
  - LTS version: v6.12.37 (Jack Vogel)
  - x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
  - x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
  - KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
  - x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
  - Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
  - mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
  - mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
  - powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
  - platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
  - platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
  - iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
  - optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
  - smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
  - usb: acpi: fix device link removal (Krogerus Heikki)
  - usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
  - usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
  - usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
  - Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
  - usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
  - drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
  - IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
  - RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
  - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
  - add a string-to-qstr constructor (Al Viro)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
  - regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
  - ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
  - platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
  - ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
  - scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag (Ewan D. Milne)
  - sched_ext: Make scx_group_set_weight() always update tg->scx.weight (Tejun Heo)
  - drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
  - arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
  - drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
  - drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
  - drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
  - drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
  - drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
  - selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
  - drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
  - drm/xe/guc: Dead CT helper (John Harrison)
  - drm/xe: Replace double space with single space after comma (Gote, Nitin R)
  - drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
  - drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
  - drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
  - drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
  - drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
  - mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
  - netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
  - remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
  - remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
  - remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
  - remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
  - remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
  - remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
  - ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
  - arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
  - arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
  - arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
  - arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
  - arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
  - arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
  - bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
  - bpf: use common instruction history across all states (Andrii Nakryiko)
  - hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
  - hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
  - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
  - f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
  - f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
  - f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
  - iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
  - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
  - wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
  - wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
  - wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
  - bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
  - ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
  - ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
  - ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
  - ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
  - gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
  - gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
  - sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
  - sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
  - sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
  - btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
  - btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
  - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
  - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
  - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
  - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
  - gfs2: Prevent inode creation race (Andreas Gruenbacher)
  - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
  - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher)
  - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
  - kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
  - kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
  - kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
  - crypto: zynqmp-sha - Add locking (Herbert Xu)
  - spinlock: extend guard with spinlock_bh variants (Christian Marangi)
  - crypto: iaa - Do not clobber req->base.data (Herbert Xu)
  - crypto: iaa - Remove dst_null support (Herbert Xu)
  - arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
  - smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
  - amd-xgbe: do not double read link status (Raju Rangoju)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - netfs: Fix i_size updating (David Howells)
  - smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
  - smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
  - smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
  - idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
  - drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
  - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
  - smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
  - drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
  - platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
  - platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
  - platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
  - platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
  - platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
  - nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
  - nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
  - btrfs: fix inode lookup error handling during log replay (Filipe Manana)
  - btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
  - btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
  - btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
  - btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
  - platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
  - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
  - RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
  - firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
  - firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
  - firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
  - Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
  - iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
  - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
  - Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
  - Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
  - net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
  - s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
  - s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
  - virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
  - rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.3.el10uek]
changelog:
  - enic: get max rq & wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
  - enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
  - enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
  - enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
  - enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
  - enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
  - enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
  - enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
  - enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
  - enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
  - enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
  - enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
  - enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
  - enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
  - enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
  - enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
  - enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
  - enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
  - enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
  - enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
  - enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
  - enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
  - enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
  - Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
  - block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
  - dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
  - md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
  - md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
  - block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
  - ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
  - net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
  - net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
  - net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.4.el10uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.4.2.el10uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]  
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]  
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]  
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]  
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]  
  - x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]  
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]  
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]  
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.4.2.el10uek]
changelog:
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta)  [Orabug: 38343659]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta)  [Orabug: 38343659]
  - x86/vmscape: Enable the mitigation (Pawan Gupta)  [Orabug: 38343659]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta)  [Orabug: 38343659]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf)  [Orabug: 38343659]
  - x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf)  [Orabug: 38343659]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta)  [Orabug: 38343659]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta)  [Orabug: 38343659]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta)  [Orabug: 38343659]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-103.40.4.3.el10uek]
changelog:
  - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560} 
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500} 
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566} 
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571} 
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618} 
  - tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-103.40.4.3.el10uek]
changelog:
  - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky)  [Orabug: 38453836]  {CVE-2025-38560}
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger)  [Orabug: 38453837]  {CVE-2025-38500}
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia)  [Orabug: 38453835]  {CVE-2025-38566}
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia)  [Orabug: 38453834]  {CVE-2025-38571}
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic)  [Orabug: 38453833]  {CVE-2025-38618}
  - tls: fix handling of zero-length records on the rx_list (Jakub Kicinski)  [Orabug: 38453832]  {CVE-2025-39682}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.4.4.el10uek]
changelog:
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton)  [Orabug: 38500610]  {CVE-2025-38724} 
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38500621]  {CVE-2025-39698} 
  - kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38500629]  {CVE-2025-39881} 
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38500632]  {CVE-2025-39866}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.2.el10uek]
changelog:
  - arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
  - arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
  - scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
  - scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
  - scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
  - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
  - fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
  - LTS version: v6.12.40 (Jack Vogel)
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas)
  - iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
  - smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
  - drm/xe: Move page fault init after topology init (Matthew Brost)
  - drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
  - sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
  - i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
  - i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
  - i2c: omap: Add support for setting mux (Jayesh Choudhary)
  - selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
  - rust: use `#[used(compiler)]` to fix build and `modpost` with Rust >= 1.89.0 (Miguel Ojeda)
  - net: libwx: fix multicast packets received count (Jiawen Wu)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
  - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
  - libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
  - drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
  - drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
  - rxrpc: Fix transmission of an abort in response to an abort (David Howells)
  - rxrpc: Fix recv-recv race of completed call (David Howells)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
  - net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
  - tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
  - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
  - drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
  - drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
  - net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
  - net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
  - Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
  - riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
  - riscv: Enable interrupt during exception handling (Nam Cao)
  - loop: use kiocb helpers to fix lockdep warning (Ming Lei)
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
  - ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
  - ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
  - hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann)
  - selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
  - can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
  - can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
  - wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
  - nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
  - nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
  - net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
  - smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima)
  - nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
  - fix a leak in fcntl_dirnotify() (Al Viro)
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
  - rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima)
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
  - block: fix kobject leak in blk_unregister_queue (Ming Lei)
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
  - selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
  - bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
  - arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
  - soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
  - soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
  - arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
  - arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott)
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott)
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott)
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott)
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott)
  - iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
  - iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich)
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - net: libwx: properly reset Rx ring descriptor (Jiawen Wu)
  - net: libwx: fix the using of Rx buffer DMA (Jiawen Wu)
  - net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu)
  - net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter)
  - cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
  - Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
  - arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
  - arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
  - arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
  - arm64: dts: add big-endian property back into watchdog node (Meng Li)
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
  - net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
  - mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
  - mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
  - io_uring/poll: fix POLLERR handling (Pavel Begunkov)
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
  - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
  - drm/amd/display: Free memory allocation (Clayton King)
  - drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
  - drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
  - objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0 (Miguel Ojeda)
  - tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
  - tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
  - dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
  - spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
  - nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
  - Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
  - thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
  - i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
  - LTS version: v6.12.39 (Jack Vogel)
  - KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
  - rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
  - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
  - ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon)
  - kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun)
  - net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
  - erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
  - selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
  - HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
  - bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
  - net: mana: Record doorbell physical address in PF mode (Long Li)
  - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
  - driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
  - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
  - ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
  - io_uring: make fallocate be hashed work (Fengnan Chang)
  - ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
  - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
  - um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
  - net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
  - net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
  - selftests: net: lib: fix shift count out of range (Hangbin Liu)
  - selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu)
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
  - erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
  - erofs: refine readahead tracepoint (Gao Xiang)
  - erofs: tidy up zdata.c (Gao Xiang)
  - erofs: get rid of `z_erofs_next_pcluster_t` (Gao Xiang)
  - erofs: free pclusters if no cached folio is attached (Chunhai Guo)
  - drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko)
  - nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
  - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin)
  - drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
  - wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
  - wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
  - wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
  - raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
  - drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
  - wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
  - netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
  - erofs: address D-cache aliasing (Gao Xiang)
  - erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
  - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
  - smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
  - clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
  - clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang)
  - rust: init: allow `dead_code` warnings for Rust >= 1.89.0 (Miguel Ojeda)
  - lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo)
  - mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
  - scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
  - scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
  - scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
  - mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
  - maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
  - kallsyms: fix build without execinfo (Achill Gilgenast)
  - Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
  - drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
  - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254117] {CVE-2025-38448}
  - Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
  - drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
  - drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
  - drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
  - drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
  - drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
  - drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle)
  - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
  - wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
  - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu)
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
  - wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
  - wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
  - pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
  - pwm: Fix invalid state detection (Uwe Kleine-König)
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
  - net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li)
  - gre: Fix IPv6 multicast route creation. (Guillaume Nault)
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum)
  - KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
  - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
  - KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
  - KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells)
  - rxrpc: Fix bug due to prealloc collision (David Howells)
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
  - net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar)
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
  - net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
  - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` (Michal Luczaj)
  - vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
  - vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
  - tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
  - vsock: fix `vsock_proto` declaration (Stefano Garzarella)
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
  - net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
  - net: phy: qcom: move the WoL function to shared library (Luo Jie)
  - arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
  - bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
  - sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
  - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
  - Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
  - ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
  - sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
  - irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
  - perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
  - ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
  - ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
  - ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
  - ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
  - ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
  - ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
  - ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
  - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
  - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
  - crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
  - drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
  - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
  - eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
  - LTS version: v6.12.38 (Jack Vogel)
  - x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
  - LTS version: v6.12.37 (Jack Vogel)
  - x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
  - x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
  - KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
  - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
  - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
  - x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
  - Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
  - Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
  - mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
  - mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
  - powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
  - platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
  - platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
  - platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
  - riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang)
  - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
  - iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
  - optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
  - Logitech C-270 even more broken (Oliver Neukum)
  - i2c/designware: Fix an initialization issue (Michael J. Ruhl)
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
  - smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
  - usb: acpi: fix device link removal (Krogerus Heikki)
  - usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang)
  - usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
  - usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
  - usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
  - Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
  - xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
  - usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
  - Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
  - usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
  - drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
  - IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
  - RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
  - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
  - add a string-to-qstr constructor (Al Viro)
  - rcu: Return early if callback is not specified (Uladzislau Rezki)
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
  - scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
  - regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
  - ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
  - platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
  - ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
  - drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
  - drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
  - scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag (Ewan D. Milne)
  - sched_ext: Make scx_group_set_weight() always update tg->scx.weight (Tejun Heo)
  - drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
  - arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
  - drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
  - drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
  - drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
  - drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
  - drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
  - selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
  - drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko)
  - drm/xe/guc: Dead CT helper (John Harrison)
  - drm/xe: Replace double space with single space after comma (Gote, Nitin R)
  - drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
  - drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
  - drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
  - drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
  - drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
  - mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
  - netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells)
  - remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
  - remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
  - remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
  - remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
  - remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
  - remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
  - ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
  - arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
  - arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
  - arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
  - arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
  - arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
  - arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
  - bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
  - bpf: use common instruction history across all states (Andrii Nakryiko)
  - hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
  - hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
  - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
  - f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
  - f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
  - f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
  - iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
  - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
  - wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
  - wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
  - wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
  - bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
  - ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
  - ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
  - ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
  - ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
  - gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
  - gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
  - sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
  - sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
  - sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
  - btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
  - btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
  - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
  - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
  - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
  - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
  - gfs2: Prevent inode creation race (Andreas Gruenbacher)
  - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
  - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher)
  - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
  - kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
  - kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
  - kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
  - crypto: zynqmp-sha - Add locking (Herbert Xu)
  - spinlock: extend guard with spinlock_bh variants (Christian Marangi)
  - crypto: iaa - Do not clobber req->base.data (Herbert Xu)
  - crypto: iaa - Remove dst_null support (Herbert Xu)
  - arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
  - smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
  - amd-xgbe: do not double read link status (Raju Rangoju)
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - netfs: Fix i_size updating (David Howells)
  - smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
  - smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
  - smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
  - igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
  - idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
  - idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
  - drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
  - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
  - smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
  - drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
  - platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
  - platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
  - platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
  - platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
  - platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
  - platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
  - platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
  - platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
  - platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
  - nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
  - nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
  - btrfs: fix inode lookup error handling during log replay (Filipe Manana)
  - btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
  - btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
  - btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
  - btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
  - platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
  - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
  - RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
  - firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla)
  - firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
  - firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal)
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
  - Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
  - iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
  - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
  - Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
  - Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
  - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
  - Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
  - net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
  - s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
  - s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
  - virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
  - rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
  - rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
  - rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-103.40.4.el10uek]
changelog:
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898,38440300] {CVE-2025-39823}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-104.43.1.el10uek]
changelog:
  - net/rds: Add support for RDS_CMSG_TOS (Gerd Rausch) [Orabug: 37899646]
  - net/rds: Add support RDS_FEATURE ELF notes (Gerd Rausch) [Orabug: 38063326]
  - nvme: revert the cross-controller atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
  - nvme: fix atomic write size validation (Christoph Hellwig) [Orabug: 38318975]
  - nvme: refactor the atomic write unit detection (Christoph Hellwig) [Orabug: 38318975]
  - ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() (Charles Han) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Check if user asked for EINJV2 injection (Tony Luck) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Fix trigger actions (Tony Luck) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p (Colin Ian King) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable (Colin Ian King) [Orabug: 38343326]
  - ACPI: APEI: EINJ: prevent memory corruption in error_type_set() (Dan Carpenter) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Clean up on error in einj_probe() (Dan Carpenter) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Update the documentation for EINJv2 support (Zaid Alali) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Enable EINJv2 error injections (Zaid Alali) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome (Tony Luck) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Discover EINJv2 parameters (Zaid Alali) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Add einjv2 extension struct (Zaid Alali) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities (Zaid Alali) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Fix kernel test sparse warnings (Zaid Alali) [Orabug: 38343326]
  - ACPI: APEI: EINJ: Remove redundant calls to einj_get_available_error_type() (Zaid Alali) [Orabug: 38343326]
  - ACPICA: Logfile: Changes for version 20241212 (Saket Dumbre) [Orabug: 38343326]
  - ACPICA: Fix warnings from PR #295 merge (Saket Dumbre) [Orabug: 38343326]
  - ACPICA: Fix typo in comments for SRAT structures (Adam Lackorzynski) [Orabug: 38343326]
  - ACPICA: actbl1: Add EINJv2 get error type action (Zaid Alali) [Orabug: 38343326]
  - ACPICA: actbl1: Update values to hex to follow ACPI specs (Zaid Alali) [Orabug: 38343326]
  - ACPICA: New release 20240927 (Saket Dumbre) [Orabug: 38343326]
  - perf vendor events arm64: AmpereOne/AmpereOneX: Mark LD_RETIRED impacted by errata (Ilkka Koskinen) [Orabug: 38343326]
  - tracepoint: Print the function symbol when tracepoint_debug is set (Huang Shijie) [Orabug: 38343326]
  - firmware: smccc: Support optional Arm SMCCC SOC_ID name (Paul Benoit) [Orabug: 38343326]
  - LTS version: v6.12.43 (Jack Vogel)
  - ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled (Li Chen)
  - dm: split write BIOs on zone boundaries when zone append is not emulated (Shin'Ichiro Kawasaki)
  - rcu: Fix racy re-initialization of irq_work causing hangs (Frederic Weisbecker)
  - drm/amd/display: Allow DCN301 to clear update flags (Ivan Lipski)
  - firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS (Arnd Bergmann)
  - io_uring/rw: cast rw->flags assignment to rwf_t (Jens Axboe)
  - ata: libata-sata: Add link_power_management_supported sysfs attribute (Damien Le Moal)
  - rust: workaround `rustdoc` target modifiers bug (Miguel Ojeda)
  - rust: kbuild: clean output before running `rustdoc` (Miguel Ojeda)
  - arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C (Siddharth Vadapalli)
  - arm64: dts: ti: k3-j722s-evm: Fix USB2.0_MUX_SEL to select Type-C (Hrushikesh Salunke)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - PCI: Allow PCI bridges to go to D3Hot on all non-x86 (Manivannan Sadhasivam)
  - PCI: Store all PCIe Supported Link Speeds (Ilpo Järvinen)
  - smb: client: fix netns refcount leak after net_passive changes (Wang Zhaolong)
  - net: better track kernel sockets lifetime (Eric Dumazet) [Orabug: 37766278] {CVE-2025-21884}
  - net: Add net_passive_inc() and net_passive_dec(). (Kuniyuki Iwashima)
  - mfd: cros_ec: Separate charge-control probing from USB-PD (Thomas Weißschuh)
  - HID: apple: avoid setting up battery timer for devices without battery (Aditya Garg)
  - tools/hv: fcopy: Fix irregularities with size of ring buffer (Naman Jain)
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters (Mikhail Lobanov)
  - HID: magicmouse: avoid setting up battery timer when not needed (Aditya Garg)
  - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages (Pedro Falcato)
  - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros (Willy Tarreau)
  - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() (Marek Szyprowski)
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: venus: Fix OOB read due to missing payload bound check (Vedang Nagar)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394814] {CVE-2025-38680}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao)
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long)
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() (Anshuman Khandual)
  - mm, slab: restore NUMA policy support for large kmalloc (Vlastimil Babka)
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - hv_netvsc: Fix panic during namespace deletion with VF (Haiyang Zhang) [Orabug: 38394829] {CVE-2025-38683}
  - net/sched: ets: use old 'nbands' while purging unused classes (Davide Caratti) [Orabug: 38394835] {CVE-2025-38684}
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [Orabug: 38394842] {CVE-2025-38685}
  - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry (Suren Baghdasaryan) [Orabug: 38394850] {CVE-2025-38686}
  - xfs: fix scrub trace with null pointer in quotacheck (Andrey Albershteyn)
  - btrfs: do not allow relocation of partially dropped subvolumes (Qu Wenruo) [Orabug: 38423270] {CVE-2025-39738}
  - btrfs: fix iteration bug in __qgroup_excl_accounting() (Boris Burkov)
  - btrfs: zoned: do not select metadata BG as finish target (Naohiro Aota)
  - btrfs: error on missing block group when unaccounting log tree extent buffers (Filipe Manana)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - btrfs: clear dirty status from extent buffer on error at insert_new_root() (Filipe Manana)
  - btrfs: don't skip remaining extrefs if dir not found during log replay (Filipe Manana)
  - btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled (Filipe Manana)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - btrfs: fix ssd_spread overallocation (Boris Burkov)
  - btrfs: don't ignore inode missing when replaying log tree (Filipe Manana)
  - btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations (Filipe Manana)
  - btrfs: zoned: do not remove unwritten non-data block group (Naohiro Aota)
  - btrfs: abort transaction during log replay if walk_log_tree() failed (Filipe Manana)
  - btrfs: zoned: use filesystem size not disk size for reclaim decision (Johannes Thumshirn)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott)
  - usb: typec: ucsi: Update power_supply on power role change (Myrrh Periwinkle)
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [Orabug: 38423419] {CVE-2025-39760}
  - ext4: initialize superblock fields in the kballoc-test.c kunit tests (Zhang Yi)
  - ext4: fix largest free orders lists corruption on mb_optimize_scan switch (Baokun Li)
  - ext4: fix zombie groups in average fragment size lists (Baokun Li)
  - iommufd: Prevent ALIGN() overflow (Jason Gunthorpe) [Orabug: 38394859] {CVE-2025-38688}
  - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range (Nicolin Chen)
  - iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (Alexey Klimov) [Orabug: 38423279] {CVE-2025-39739}
  - iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes (Lu Baolu)
  - cifs: reset iface weights when we cannot find a candidate (Shyam Prasad N)
  - clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src (Christian Marangi)
  - dm: Always split write BIOs to zoned device limits (Damien Le Moal) [Orabug: 38429172] {CVE-2025-39792}
  - block: Introduce bio_needs_zone_write_plugging() (Damien Le Moal)
  - mm/damon/core: commit damos->target_nid (Bijan Tabatabai)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - drm/amdgpu: fix vram reservation issue (Yipeng Chai)
  - cifs: Fix collect_sample() to handle any iterator type (David Howells)
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits (Shengjiu Wang)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394864] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() (John Garry) [Orabug: 38429189] {CVE-2025-39795}
  - ASoC: Intel: avs: Fix uninitialized pointer error in probe() (Cezary Rojewski)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table (Thomas Croft)
  - lib/sbitmap: convert shallow_depth from one word to the whole sbitmap (Yu Kuai)
  - smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in _smbd_get_connection (Stefan Metzmacher)
  - tools/power turbostat: Handle cap_get_proc() ENOSYS (Calvin Owens)
  - tools/power turbostat: Fix build with musl (Calvin Owens)
  - tools/power turbostat: Handle non-root legacy-uncore sysfs permissions (Len Brown)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - vfio/mlx5: fix possible overflow in tracking max message size (Artem Sadovnikov)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs (Maurizio Lombardi)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - vfio/type1: conditional rescheduling while pinning (Keith Busch)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - printk: nbcon: Allow reacquire during panic (John Ogness)
  - f2fs: check the generic conditions first (Jaegeuk Kim)
  - exfat: add cluster chain loop check for dir (Yuezhang Mo) [Orabug: 38394871] {CVE-2025-38692}
  - i2c: Force DLL0945 touchpad i2c freq to 100khz (Fangzhong Zhou)
  - apparmor: fix x_table_lookup when stacking is not the first entry (John Johansen)
  - apparmor: use the condition in AA_BUG_FMT even with debug disabled (Mateusz Guzik)
  - dm-table: fix checking for rq stackable devices (Benjamin Marzinski)
  - dm-mpath: don't print the "loaded" message if registering fails (Mikulas Patocka)
  - i3c: master: Initialize ret in i3c_i2c_notifier_call() (Jorge Marques)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - apparmor: shift ouid when mediating hard links in userns (Gabriel Totev)
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - i3c: add missing include to internal header (Wolfram Sang)
  - module: Prevent silent truncation of module name in delete_module(2) (Petr Pavlu)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use (Purva Yeshi)
  - soundwire: Move handle_nested_irq outside of sdw_dev_lock (Charles Keepax)
  - soundwire: amd: cancel pending slave status handling workqueue during remove sequence (Vijendar Mukunda)
  - soundwire: amd: serialize amd manager resume sequence during pm_prepare (Vijendar Mukunda)
  - clk: renesas: rzg2l: Postpone updating priv->clks[] (Claudiu Beznea)
  - crypto: ccp - Add missing bootloader info reg for pspv6 (Mario Limonciello)
  - crypto: octeontx2 - add timeout for load_fvc completion poll (Bharat Bhushan)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: uvcvideo: Add quirk for HP Webcam HD 2300 (Ricardo Ribalda)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394878] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394885] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpi3mr: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - power: supply: qcom_battmgr: Add lithium-polymer entry (Abel Vesa)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394892] {CVE-2025-38695}
  - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk (Justin Tee)
  - RDMA/core: reduce stack using in nldev_stat_get_doit() (Arnd Bergmann)
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423284] {CVE-2025-39742}
  - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs (Amelie Delaunay)
  - leds: leds-lp50xx: Handle reg to get correct multi_index (Johan Adolfsson)
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control (Niklas Söderlund)
  - media: ipu-bridge: Add _HID for OV5670 (Daniel Scally)
  - clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED (Michal Wilczynski)
  - MIPS: lantiq: falcon: sysctrl: fix request memory check logic (Shiji Yang)
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - crypto: jitter - fix intermediary handling (Markus Theil)
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (Kalesh Ap)
  - media: hi556: Fix reset GPIO timings (Hans de Goede)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte)
  - jfs: Regular file corruption check (Edward Adam Davis)
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu)
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394922] {CVE-2025-38699}
  - watchdog: iTCO_wdt: Report error if timeout configuration fails (Ziyan Fu)
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - clk: qcom: ipq5018: keep XO clock always on (George Moussalem)
  - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state (Florin Leotescu)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394929] {CVE-2025-38700}
  - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal (Geraldo Nascimento)
  - mfd: axp20x: Set explicit ID for AXP313 regulator (Chen-Yu Tsai)
  - clk: tegra: periph: Fix error handling and resolve unsigned compare warning (Pei Xiao)
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394935] {CVE-2025-38701}
  - crypto: hisilicon/hpre - fix dma unmap sequence (Zhiqi Song)
  - fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [Orabug: 38394942] {CVE-2025-38702}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition (Aaron Plattner)
  - drm/amd/display: Disable dsc_power_gate for dcn314 by default (Roman Li)
  - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported (Mario Limonciello)
  - drm/amd/display: Only finalize atomic_obj if it was initialized (Mario Limonciello)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page (Will Deacon)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work (Joel Fernandes) [Orabug: 38423299] {CVE-2025-39744}
  - drm/ttm: Respect the shrinker core free target (Tvrtko Ursulin)
  - drm/amd/display: Avoid trying AUX transactions on disconnected ports (Wayne Lin)
  - drm/amd/display: Update DMCUB loading sequence for DCN3.5 (Nicholas Kazlauskas)
  - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size (Yonghong Song)
  - selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size (Yonghong Song)
  - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP (Ihor Solodrai)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - drm/ttm: Should to return the evict error (Emily Deng)
  - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range (Lad Prabhakar)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - drm/xe: Make dma-fences compliant with the safe access rules (Tvrtko Ursulin)
  - ionic: clean dbpage in de-init (Shannon Nelson)
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() (Thomas Fourier)
  - wifi: rtw89: scan abort when assign/unassign_vif (Chih-Kang Chang)
  - ptp: Use ratelimite for freerun error message (Breno Leitao)
  - bpftool: Fix JSON writer resource leak in version command (Yuan Chen)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: ensure BCM5325 PHYs are enabled (Álvaro Fernández Rojas)
  - gve: Return error for unknown admin queue command (Alok Tiwari)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured (Gal Pressman)
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual (Mario Limonciello)
  - dpaa_eth: don't use fixed_phy_change_carrier (Heiner Kallweit)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - arm64: stacktrace: Check kretprobe_find_ret_addr() return value (Mark Rutland)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - powerpc: floppy: Add missing checks after DMA map (Thomas Fourier)
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling (Karthikeyan Kathirvel)
  - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 (Raj Kumar Bhagat)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: mac80211: update radar_required in channel context after channel switch (Ramya Gnanasekar)
  - drm/amd/display: Initialize mode_select to 0 (Alex Hung)
  - drm/amd/display: Fix 'failed to blank crtc!' (Wen Chen)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - lib: packing: Include necessary headers (Nathan Lynch)
  - wifi: ath12k: Fix station association with MBSSID Non-TX BSS (Hari Chandrakanthan)
  - wifi: ath12k: Add memset and update default rate value in wmi tx completion (Sarika Sharma)
  - wifi: ath10k: shutdown driver when hardware is unreliable (Kang Yang) [Orabug: 38423316] {CVE-2025-39746}
  - drm/amd/display: Separate set_gsl from set_gsl_source_select (Ilya Bakoulin)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - net: ieee8021q: fix insufficient table-size assertion (Rubenkelevra)
  - ACPI: Suppress misleading SPCR console message when SPCR table is absent (Li Chen)
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol (Eric Work)
  - xfrm: Duplicate SPI Handling (Aakash Kumar S) [Orabug: 38429199] {CVE-2025-39797}
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() (Jianrong Zhang)
  - net: thunderbolt: Enable end-to-end flow control also in transmit (Jianrong Zhang)
  - drm/xe/xe_query: Use separate iterator while filling GT list (Matt Roper)
  - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace (Mark Brown)
  - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch (David Bauer)
  - wifi: rtw89: Fix rtw89_mac_power_switch() for USB (Bitterblue Smith)
  - drm/imagination: Clear runtime PM errors while resetting the GPU (Alessio Belle)
  - perf/arm: Add missing .suppress_bind_attrs (Robin Murphy)
  - drm/msm: Add error handling for krealloc in metadata setup (Yuan Chen) [Orabug: 38423323] {CVE-2025-39747}
  - drm/msm: use trylock for debugfs (Rob Clark)
  - wifi: mac80211: fix rx link assignment for non-MLO stations (Hari Chandrakanthan)
  - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access (Zqiang) [Orabug: 38394958] {CVE-2025-38704}
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). (Kuniyuki Iwashima)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/early: Copy last breaking event address to pt_regs (Heiko Carstens)
  - wifi: mac80211: avoid weird state in error path (Miri Korenblit)
  - wifi: mac80211: don't complete management TX on SAE commit (Johannes Berg)
  - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails (Chris Mason)
  - net: phy: bcm54811: PHY initialization (Kamil Horák)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - um: Re-evaluate thread flags repeatedly (Thomas Weißschuh)
  - wifi: iwlwifi: mvm: set gtk id also in older FWs (Miri Korenblit)
  - bpf: Forget ranges when refining tnum after JSET (Paul Chaignon) [Orabug: 38423330] {CVE-2025-39748}
  - sched/deadline: Fix accounting after global limits change (Juri Lelli)
  - perf/cxlpmu: Remove unintended newline from IRQ name format string (Alok Tiwari)
  - net: phy: micrel: Add ksz9131_resume() (Biju Das)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: mac80211: don't unreserve never reserved chanctx (Johannes Berg)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - net: mctp: Prevent duplicate binds (Matt Johnston)
  - can: ti_hecc: fix -Woverflow compiler warning (Vincent Mailhol)
  - drm/amd/display: limit clear_update_flags to dcn32 and above (Charlene Liu)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423339] {CVE-2025-39749}
  - drm/amd/pm: fix null pointer access (Umio Yasuno) [Orabug: 38394967] {CVE-2025-38705}
  - arm64: Mark kernel as tainted on SAE and SError panic (Breno Leitao)
  - net: pcs: xpcs: mask readl() return value to 16 bits (Jack Ping Chng)
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Leon Romanovsky)
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB (Bitterblue Smith)
  - wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode (Chin-Yen Lee)
  - idpf: preserve coalescing settings across resets (Ahmed Zaki)
  - libbpf: Verify that arena map exists when adding arena relocations (Eduard Zingerman)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - wifi: ath12k: Correct tid cleanup when tid setup fails (Sarika Sharma)
  - net: usb: cdc-ncm: check for filtering capability (Oliver Neukum)
  - wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn (Avraham Stern)
  - xen/netfront: Fix TX response spurious interrupts (Anthoine Bourgeois)
  - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() (Zijun Hu)
  - Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 (En-Wei Wu)
  - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 (Steven Rostedt)
  - selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG (Sebastian Andrzej Siewior)
  - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal)
  - ASoC: qcom: use drvdata instead of component to keep id (Srinivas Kandagatla)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement (Jonathan Santos)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop (Christophe Leroy)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423356] {CVE-2025-39751}
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent (Tomasz Michalec)
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - soc: qcom: mdt_loader: Actually use the e_phoff (Bjorn Andersson)
  - imx8m-blk-ctrl: set ISI panic write hurry level (Krzysztof Hałasa)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present (Tomasz Michalec)
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (Peter Ujfalusi) [Orabug: 38394976] {CVE-2025-38706}
  - tty: serial: fix print format specifiers (Joseph Tilahun)
  - ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode (Peter Ujfalusi)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - x86/bugs: Avoid warning when overriding return thunk (Pawan Gupta)
  - ALSA: hda: Disable jack polling at shutdown (Takashi Iwai)
  - ALSA: hda: Handle the jack polling always via a work (Takashi Iwai)
  - platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready (Gwendal Grignou)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - mei: bus: Check for still connected devices in mei_cl_bus_dev_release() (Hans de Goede)
  - char: misc: Fix improper and inaccurate error code returned by misc_init() (Zijun Hu)
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835 (Peter Robinson)
  - pps: clients: gpio: fix interrupt handling order in remove path (Eliav Farber)
  - selftests: vDSO: vdso_test_getrandom: Always print TAP header (Thomas Weißschuh)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed (Sarthak Garg)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - firmware: tegra: Fix IVC dependency problems (Thierry Reding)
  - firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume (Peng Fan)
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Zhu Qiyu)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - tools/build: Fix s390(x) cross-compilation with clang (Thomas Weißschuh)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling)
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - iio: adc: ad_sigma_delta: don't overallocate scan buffer (David Lechner)
  - tools/nolibc: define time_t in terms of __kernel_old_time_t (Thomas Weißschuh)
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required (David Collins)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - EDAC/synopsys: Clear the ECC counters on init (Shubhrajyoti Datta)
  - PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov)
  - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode (Li Rongqing)
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - gpio: wcd934x: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - pmdomain: ti: Select PM_GENERIC_DOMAINS (Guillaume La Roque)
  - usb: typec: tcpm/tcpci_maxim: fix irq wake usage (André Draszik)
  - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU (Hiago De Franco)
  - ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (Shuai Xue) [Orabug: 38423437] {CVE-2025-39763}
  - soc: qcom: rpmh-rsc: Add RSC version 4 support (Maulik Shah)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default (Benson Leung)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag (Prashant Malani)
  - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list (Mario Limonciello)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - tracefs: Add d_delete to remove negative dentries (Steven Rostedt)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - fix locking in efi_secret_unlink() (Al Viro)
  - ext2: Handle fiemap on empty files to prevent EINVAL (Wei Gao)
  - pidfs: raise SB_I_NODEV and SB_I_NOEXEC (Christian Brauner)
  - fs/ntfs3: correctly create symlink for relative path (Rong Zhang)
  - fs/ntfs3: Add sanity check for file name (Lizhi Xu)
  - ata: libata-sata: Disallow changing LPM state if not supported (Damien Le Moal)
  - ata: ahci: Disable DIPM if host lacks support (Damien Le Moal)
  - ata: ahci: Disallow LPM policy control if not supported (Damien Le Moal)
  - better lockdep annotations for simple_recursive_removal() (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394993] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - loop: Avoid updating block size under exclusive owner (Jan Kara) [Orabug: 38394999] {CVE-2025-38709}
  - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (Andrew Price) [Orabug: 38423379] {CVE-2025-39753}
  - gfs2: Validate i_depth for exhash directories (Andrew Price) [Orabug: 38395006] {CVE-2025-38710}
  - nvme-tcp: log TLS handshake failures at error level (Maurizio Lombardi)
  - nvme-pci: try function level reset on init failure (Keith Busch)
  - smb/server: avoid deadlock when linking with ReplaceIfExists (Neil Brown)
  - firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall (Levi Yun)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko)
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko)
  - hfs: fix general protection fault in hfs_find_init() (Viacheslav Dubeyko)
  - net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann)
  - tls: handle data disappearing from under the TLS ULP (Jakub Kicinski) [Orabug: 38351758] {CVE-2025-38616}
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() (Jeongjun Park)
  - cpuidle: governors: menu: Avoid using invalid recent intervals data (Rafael J. Wysocki)
  - intel_idle: Allow loading ACPI tables for any family (Len Brown)
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395056] {CVE-2025-38718}
  - net: ti: icss-iep: Fix incorrect type for return value in extts_enable() (Alok Tiwari)
  - net: ti: icssg-prueth: Fix emac link speed handling (Md Danish Anwar)
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395065] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - mm/smaps: fix race between smaps_hugetlb_range and migration (Tu Jinjiang) [Orabug: 38423389] {CVE-2025-39754}
  - habanalabs: fix UAF in export_dmabuf() (Al Viro)
  - KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest (Maxim Levitsky)
  - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs (Maxim Levitsky)
  - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter (Maxim Levitsky)
  - KVM: VMX: Extract checking of guest's DEBUGCTL into helper (Sean Christopherson)
  - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported (Sean Christopherson)
  - KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag (Sean Christopherson)
  - KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap (Sean Christopherson)
  - smb: client: don't wait for info->send_pending == 0 on error (Stefan Metzmacher)
  - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() (Stefan Metzmacher)
  - mm/memory-tier: fix abstract distance calculation overflow (Li Zhijian)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - eventpoll: Fix semi-unbounded recursion (Jann Horn) [Orabug: 38335160] {CVE-2025-38614}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423395] {CVE-2025-39756}
  - fscrypt: Don't use problematic non-inline crypto engines (Eric Biggers)
  - clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock (André Draszik)
  - clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD (André Draszik)
  - clk: samsung: exynos850: fix a comment (André Draszik)
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - LoongArch: Avoid in-place string operation on FDT content (Yao Zi)
  - LoongArch: Make relocate_new_kernel_size be a .quad value (Huacai Chen)
  - LoongArch: Don't use %pK through printk() in unwinder (Thomas Weißschuh)
  - LoongArch: BPF: Fix jump offset calculation in tailcall (Haoran Jiang)
  - PCI: Extend isolated function probing to LoongArch (Huacai Chen)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429209] {CVE-2025-39798}
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395079] {CVE-2025-38724}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus (Xu Yang) [Orabug: 38395087] {CVE-2025-38725}
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: ti: icss-iep: fix device and OF node leaks at probe (Johan Hovold)
  - net: mtk_eth_soc: fix device leak at probe (Johan Hovold)
  - net: enetc: fix device and OF node leak at probe (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect (Heiner Kallweit)
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Florian Larysch)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38395123] {CVE-2025-38727}
  - Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" (Daniel Golle)
  - leds: flash: leds-qcom-flash: Fix registry access after re-bind (Krzysztof Kozlowski)
  - gpio: mlxbf3: use platform_get_irq_optional() (David Thompson)
  - Revert "gpio: mlxbf3: only get IRQ for device instance 0" (David Thompson)
  - gpio: mlxbf2: use platform_get_irq_optional() (David Thompson)
  - gpio: virtio: Fix config space reading. (Harald Mommer)
  - smb: client: remove redundant lstrp update in negotiate protocol (Wang Zhaolong)
  - smb3: fix for slab out of bounds on mount to ksmbd (Steve French) [Orabug: 38395093] {CVE-2025-38728}
  - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks (Christopher Eby)
  - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X (Vasiliy Kovalev)
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423405] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395099] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - LTS version: v6.12.42 (Jack Vogel)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - USB: gadget: f_hid: Fix memory leak in hidg_bind error path (Yuhao Jiang)
  - HID: apple: validate feature-report field count to prevent NULL pointer dereference (Qasim Ijaz) [Orabug: 38334911] {CVE-2025-38557}
  - media: ti: j721e-csi2rx: fix list_del corruption (Julien Massot)
  - perf/arm-ni: Set initial IRQ affinity (Robin Murphy)
  - mm: swap: fix potential buffer overflow in setup_clusters() (Kemeng Shi) [Orabug: 38401739] {CVE-2025-39727}
  - mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop (Kemeng Shi)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - s390/mm: Remove possible false-positive warning in pte_free_defer() (Gerald Schaefer)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - platform/x86/intel/pmt: fix a crashlog NULL pointer access (Michael J. Ruhl) [Orabug: 38334915] {CVE-2025-38559}
  - ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) (Edip Hazuri)
  - ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx (Edip Hazuri)
  - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx (Edip Hazuri)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() (Thorsten Blum)
  - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334918,38453836] {CVE-2025-38560}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano (Zenm Chen)
  - PCI/ASPM: Fix L1SS saving (Ilpo Järvinen)
  - PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state() (Jian-Hong Pan)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - smb: server: Fix extension string in ksmbd_extract_shortname() (Thorsten Blum)
  - ksmbd: limit repeated connections from clients with the same IP (Namjae Jeon)
  - ksmbd: fix corrupted mtime and ctime in smb2_open (Namjae Jeon)
  - ksmbd: fix Preauh_HashValue race condition (Namjae Jeon)
  - ksmbd: fix null pointer dereference error in generate_encryptionkey (Namjae Jeon)
  - drm/i915/ddi: only call shutdown hooks for valid encoders (Jani Nikula)
  - drm/i915/display: add intel_encoder_is_hdmi() (Jani Nikula)
  - drm/i915/ddi: gracefully handle errors from intel_ddi_init_hdmi_connector() (Jani Nikula)
  - drm/i915/hdmi: add error handling in g4x_hdmi_init() (Jani Nikula)
  - drm/i915/hdmi: propagate errors from intel_hdmi_init_connector() (Jani Nikula)
  - drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type (Jani Nikula)
  - selftests/bpf: Fix build error with llvm 19 (Alexei Starovoitov)
  - selftests/bpf: Add a test for arena range tree algorithm (Alexei Starovoitov)
  - ice/ptp: fix crosstimestamp reporting (Anton Nadezhdin)
  - Revert "bcache: remove heap-related macros and switch to generic min_heap" (Kuan-Wei Chiu)
  - accel/ivpu: Fix reset_engine debugfs file logic (Andrzej Kacprowski)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351769,38453833] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351762] {CVE-2025-38617}
  - selftests/perf_events: Add a mmap() correctness test (Lorenzo Stoakes)
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334946] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334955] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38334966,38453835] {CVE-2025-38566}
  - smb: client: return an error if rdma_connect does not return within 5 seconds (Stefan Metzmacher)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - nvmet: exit debugfs after discovery subsystem exits (Mohamed Khalfella)
  - smb: client: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
  - smb: client: remove separate empty_packet_queue (Stefan Metzmacher)
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move (Stefan Metzmacher)
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection (Stefan Metzmacher)
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already (Stefan Metzmacher)
  - smb: server: remove separate empty_recvmsg_queue (Stefan Metzmacher)
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() (Takashi Iwai)
  - irqchip: Build IMX_MU_MSI only on ARM (Arnd Bergmann)
  - eth: fbnic: remove the debugging trick of super high page bias (Jakub Kicinski)
  - s390/mm: Allocate page table with PAGE_SIZE granularity (Sumanth Korikkar)
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (Maher Azz) [Orabug: 38334972] {CVE-2025-38568}
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334974] {CVE-2025-38569}
  - x86/irq: Plug vector setup race (Thomas Gleixner)
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38334980,38453834] {CVE-2025-38571}
  - net/sched: taprio: enforce minimum value for picos_per_byte (Takamitsu Iwai)
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351784] {CVE-2025-38622}
  - net: mdio: mdio-bcm-unimac: Correct rate fallback logic (Florian Fainelli)
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334986] {CVE-2025-38572}
  - net/mlx5: Correctly set gso_segs when LRO is used (Christoph Paasch)
  - spi: cs42l43: Property entry should be a null-terminated array (Simon Trimmer)
  - ASoC: tas2781: Fix the wrong step for TLV on tas2781 (Baojun Xu)
  - block: ensure discard_granularity is zero when discard is not supported (Christoph Hellwig)
  - block: Fix default IO priority if there is no IO context (Guenter Roeck)
  - netlink: specs: ethtool: fix module EEPROM input/output arguments (Jakub Kicinski)
  - s390/ap: Unmask SLCF bit in card and queue ap functions sysfs (Harald Freudenberger)
  - nvmet: initialize discovery subsys after debugfs is initialized (Mohamed Khalfella)
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335002] {CVE-2025-38574}
  - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() (Luca Weiss)
  - phy: mscc: Fix parsing of unicast frames (Horatiu Vultur)
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - md/md-cluster: handle REMOVE message earlier (Heming Zhao)
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington)
  - NFSv4.2: another fix for listxattr (Olga Kornievskaia)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401743] {CVE-2025-39730}
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Trond Myklebust)
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Neil Brown)
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors (Tigran Mkrtchyan)
  - PCI: pnv_php: Fix surprise plug detection and recovery (Timothy Pearson)
  - powerpc/eeh: Make EEH driver device hotplug safe (Timothy Pearson)
  - powerpc/eeh: Export eeh_unfreeze_pe() (Timothy Pearson)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson)
  - kconfig: qconf: fix ConfigList::updateListAllforAll() (Masahiro Yamada)
  - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately (Salomon Dushimirimana)
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume (Seunghui Lee)
  - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" (Li Lingfeng)
  - scsi: mpt3sas: Fix a fw_event memory leak (Tomas Henzl)
  - vfio/pci: Separate SR-IOV VF dev_set (Alex Williamson)
  - vfio/pds: Fix missing detach_ioas op (Brett Creeley) [Orabug: 38351809] {CVE-2025-38625}
  - vfio: Prevent open_count decrement to negative (Jacob Pan)
  - vfio: Fix unbalanced vfio_df_close call in no-iommu mode (Jacob Pan)
  - i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() (Christophe Jaillet)
  - exfat: fdatasync flag should be same like generic_write_sync() (Zhengxu Zhang)
  - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode (Chao Yu)
  - f2fs: fix to calculate dirty data during has_not_enough_free_secs() (Chao Yu)
  - f2fs: fix to update upper_p in __get_secs_required() correctly (Chao Yu)
  - f2fs: vm_unmap_ram() may be called from an invalid context (Jan Prusakowski)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu)
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu)
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu)
  - f2fs: doc: fix wrong quota mount option description (Chao Yu)
  - f2fs: fix to check upper boundary for gc_no_zoned_gc_percent (Chao Yu)
  - f2fs: fix to check upper boundary for gc_valid_thresh_ratio (Chao Yu)
  - f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent (Yohan Joung)
  - f2fs: fix KMSAN uninit-value in extent_info usage (Abinash Singh)
  - f2fs: fix bio memleak when committing super block (Sheng Yong)
  - f2fs: turn off one_time when forcibly set to foreground GC (Daeho Jeong)
  - rtc: rv3028: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: pcf85063: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: nct3018y: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - ucount: fix atomic_long_inc_below() argument type (Uros Bizjak)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - apparmor: Fix unaligned memory accesses in KUnit test (Helge Deller)
  - apparmor: fix loop detection used in conflicting attachment resolution (Ryan Lee)
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2 (Ryan Lee)
  - bpf: Check netfilter ctx accesses are aligned (Paul Chaignon)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - vhost: Reintroduce kthread API and add mode selection (Cindy Lu)
  - vdpa: Fix IDR memory leak in VDUSE module exit (Anders Roxell)
  - vdpa/mlx5: Fix release of uninitialized resources on error path (Dragos Tatulea) [Orabug: 38351825] {CVE-2025-38628}
  - vdpa/mlx5: Fix needs_teardown flag calculation (Dragos Tatulea)
  - perf record: Cache build-ID of hit DSOs only (Namhyung Kim)
  - selftests: ALSA: fix memory leak in utimer test (Yuli Wang)
  - drm/xe/vf: Disable CSC support on VF (Lukasz Laguna)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: rockchip: Add missing check after DMA map (Thomas Fourier)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang)
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - crypto: qat - fix DMA direction for compression on GEN2 devices (Giovanni Cabiddu)
  - perf tools: Remove libtraceevent in .gitignore (Chen Pei)
  - sh: Do not use hyphen in exported variable name (Ben Hutchings)
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists (Shengjiu Wang)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - remoteproc: xlnx: Disable unsupported features (Tanmay Shah)
  - clk: imx95-blk-ctl: Fix synchronous abort (Laurentiu Palcu)
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute (Manivannan Sadhasivam)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: qat - disable ZUC-256 capability for QAT GEN5 (Bairavi Alagappan)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - crypto: keembay - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - clk: at91: sam9x7: update pll clk ranges (Varshini Rajendran)
  - ext4: Make sure BH_New bit is cleared in ->write_end handler (Jan Kara)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: elx: efct: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - clk: thead: th1520-ap: Correctly refer the parent of osc_12m (Yao Zi)
  - RDMA/mana_ib: Fix DSCP value in modify QP (Shiraz Saleem)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - pinmux: fix race causing mux_owner NULL with active mux_usecount (Mukesh Ojha) [Orabug: 38351837] {CVE-2025-38632}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Zijie Wang) [Orabug: 38351898] {CVE-2025-38653}
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask (Arnd Bergmann)
  - RDMA/hns: Fix -Wframe-larger-than issue (Junxian Huang)
  - RDMA/hns: Drop GFP_NOWARN (Junxian Huang)
  - RDMA/hns: Fix accessing uninitialized resources (Junxian Huang)
  - RDMA/hns: Get message length of ack_req from FW (Junxian Huang)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong)
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value (Thomas Fourier)
  - crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
  - RDMA/hns: Fix HW configurations not cleared in error flow (Wenglianfa)
  - RDMA/hns: Fix double destruction of rsv_qp (Wenglianfa)
  - perf sched: Fix memory leaks in 'perf sched latency' (Namhyung Kim)
  - perf sched: Use RC_CHK_EQUAL() to compare pointers (Namhyung Kim)
  - perf sched: Fix memory leaks for evsel->priv in timehist (Namhyung Kim)
  - perf sched: Fix memory leaks in 'perf sched map' (Namhyung Kim)
  - perf sched: Free thread->priv using priv_destructor (Namhyung Kim)
  - perf sched: Make sure it frees the usage string (Namhyung Kim)
  - mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER (Takahiro Kuwano)
  - perf dso: Add missed dso__put to dso__load_kcore (Ian Rogers)
  - perf tools: Fix use-after-free in help_unknown_cmd() (Namhyung Kim)
  - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq (Nuno Sa)
  - fanotify: sanitize handle_type values when reporting fid (Amir Goldstein)
  - phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers (Luca Weiss)
  - dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning (Krzysztof Kozlowski)
  - pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() (Yuan Chen)
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails (Jerome Brunet)
  - crypto: arm/aes-neonbs - work around gcc-15 warning (Arnd Bergmann)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name (Charles Han)
  - clk: xilinx: vcu: unregister pll_post only if registered correctly (Rohit Visavalia)
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check (James Cowgill)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin)
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: qat - fix state restore for banks with exceptions (Svyatoslav Pankratov)
  - crypto: qat - allow enabling VFs in the absence of IOMMU (Ahsan Atta)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - crypto: qat - use unmanaged allocation for dc_data (Suman Kumar Chakraborty)
  - crypto: sun8i-ce - fix nents passed to dma_unmap_sg() (Ovidiu Panait)
  - clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks (Lad Prabhakar)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - fortify: Fix incorrect reporting of read buffer size (Kees Cook)
  - staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() (Kees Cook)
  - bpf, arm64: Fix fp initialization for exception boundary (Puranjay Mohan) [Orabug: 38335064] {CVE-2025-38586}
  - bpf/preload: Don't select USERMODE_DRIVER (Thomas Weißschuh)
  - ipv6: annotate data-races around rt->fib6_nsiblings (Eric Dumazet)
  - ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [Orabug: 38335068] {CVE-2025-38587}
  - ipv6: prevent infinite loop in rt6_nlmsg_size() (Eric Dumazet) [Orabug: 38335071] {CVE-2025-38588}
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - stmmac: xsk: fix negative overflow of budget in zerocopy mode (Jason Xing)
  - net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 (Tristram Ha)
  - net/mlx5e: Remove skb secpath if xfrm state is not found (Jianbo Liu) [Orabug: 38335076] {CVE-2025-38590}
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Alexei Lazar)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351852] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - can: peak_usb: fix USB FD devices potential malfunction (Stephane Grosjean)
  - selftests: drv-net: Fix remote command checking in require_cmd() (Gal Pressman)
  - tools/rv: Do not skip idle in trace (Gabriele Monaco)
  - bpf: Disable migration in nf_hook_run_bpf(). (Kuniyuki Iwashima) [Orabug: 38351858] {CVE-2025-38640}
  - Bluetooth: hci_event: Mask data status from LE ext adv reports (Chris Down)
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' (Arseniy Krasnov) [Orabug: 38335086] {CVE-2025-38593}
  - memcg_slabinfo: Fix use of PG_slab (Matthew Wilcox)
  - kcsan: test: Initialize dummy variable (Marco Elver)
  - ring-buffer: Remove ring_buffer_read_prepare_sync() (Steven Rostedt)
  - wifi: nl80211: Set num_sub_specs before looping through sub_specs (Kees Cook)
  - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (Kees Cook)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - wifi: ath12k: fix endianness handling while accessing wmi service bit (Tamizh Chelvam Raja)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() (Remi Pommarel)
  - wifi: mac80211: Don't call fq_flow_idx() for management frames (Alexander Wetzel)
  - wifi: mac80211: Do not schedule stopped TXQs (Alexander Wetzel)
  - wifi: plfxlc: Fix error handling in usb driver probe (Murad Masimov)
  - wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [Orabug: 38351870] {CVE-2025-38644}
  - rcu: Fix delayed execution of hurry callbacks (Tze-Nan Wu)
  - iommu/amd: Fix geometry.aperture_end for V2 tables (Jason Gunthorpe)
  - drm/amdgpu/gfx10: fix kiq locking in KCQ reset (Alex Deucher)
  - drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset (Alex Deucher)
  - drm/amdgpu/gfx9: fix kiq locking in KCQ reset (Alex Deucher)
  - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() (Baochen Qiang) [Orabug: 38401750] {CVE-2025-39732}
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtw88: Fix macid assigned to TDLS station (Bitterblue Smith)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - tcp: call tcp_measure_rcv_mss() for ooo packets (Eric Dumazet)
  - xen/gntdev: remove struct gntdev_copy_batch from stack (Juergen Gross)
  - xen: fix UAF in dmabuf_exp_from_pages() (Al Viro)
  - RDMA/mlx5: Fix UMR modifying of mkey page size (Edward Srouji)
  - net_sched: act_ctinfo: use atomic64_t for three counters (Eric Dumazet)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331464] {CVE-2025-38553}
  - iommu/amd: Enable PASID and ATS capabilities in the correct order (Easwar Hariharan)
  - um: rtc: Avoid shadowing err in uml_rtc_start() (Tiwei Bie)
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - netfilter: nf_tables: Drop dead code from fill_*_info routines (Phil Sutter)
  - fbcon: Fix outdated registered_fb reference in comment (Shixiong Ou)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - refscale: Check that nreaders and loops multiplication doesn't overflow (Artem Sadovnikov)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - drm/msm/dpu: Fill in min_prefill_lines for SC8180X (Konrad Dybcio)
  - bpf: Ensure RCU lock is held around bpf_prog_ksym_find (Kumar Kartikeya Dwivedi)
  - kselftest/arm64: Fix check for setting new VLs in sve-ptrace (Mark Brown)
  - net: dst: annotate data-races around dst->output (Eric Dumazet)
  - net: dst: annotate data-races around dst->input (Eric Dumazet)
  - net/mlx5: Check device memory pointer before usage (Stav Aviram) [Orabug: 38351876] {CVE-2025-38645}
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists (Sergey Senozhatsky) [Orabug: 38335104] {CVE-2025-38601}
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335108] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335117] {CVE-2025-38604}
  - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band (Zong-Zhe Yang)
  - caif: reduce stack size, again (Arnd Bergmann)
  - powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add (Haren Myneni)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - drm/amdgpu: Remove nbiov7.9 replay count reporting (Lijo Lazar)
  - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel (Ian Forbes)
  - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain (Petr Machata)
  - selftests/bpf: Fix unintentional switch case fall through (Mykyta Yatsenko)
  - selftests/bpf: fix signedness bug in redir_partial() (Wangfushuai)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335129] {CVE-2025-38608}
  - bpf, sockmap: Fix psock incorrectly pointing to sk (Jiayuan Chen)
  - drm/panthor: Add missing explicit padding in drm_panthor_gpu_info (Boris Brezillon)
  - drm/panfrost: Fix panfrost device variable name in devfreq (Adrián Larumbe)
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed (Andy Yan)
  - selftests/tracing: Fix false failure of subsystem event test (Steven Rostedt)
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 (Slark Xiao)
  - interconnect: qcom: sc8180x: specify num_nodes (Dmitry Baryshkov)
  - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg (Dmitry Baryshkov)
  - soc: qcom: pmic_glink: fix OF node leak (Johan Hovold)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - staging: greybus: gbphy: fix up const issue with the match callback (Greg Kroah-Hartman)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - cpufreq: Initialize cpufreq-based frequency-invariance later (Lifeng Zheng)
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode (Rafael J. Wysocki)
  - PM / devfreq: Fix a index typo in trans_stat (Chanwoo Choi)
  - PM / devfreq: Check governor before using governor->name (Lifeng Zheng) [Orabug: 38335133] {CVE-2025-38609}
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed (Adam Ford)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - selftests: breakpoints: use suspend_stats to reliably check suspend success (Moon Hee Lee)
  - arm64: dts: st: fix timer used for ticks (Patrick Delaunay)
  - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS (Sumit Gupta)
  - arm: dts: ti: omap: Fixup pinheader typo (Albin Törnqvist)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() (Sivan Zohar-Kotzer)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - selftests: vDSO: chacha: Correctly skip test if necessary (Thomas Weißschuh)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - spi: stm32: Check for cfg availability in stm32_spi_probe (Clément Le Goffic)
  - mei: vsc: Unset the event callback on remove and probe errors (Hans de Goede)
  - mei: vsc: Event notifier fixes (Hans de Goede)
  - mei: vsc: Destroy mutex after freeing the IRQ (Hans de Goede)
  - usb: typec: ucsi: yoga-c630: fix error and remove paths (Dmitry Baryshkov)
  - firmware: arm_scmi: Fix up turbo frequencies selection (Sibi Sankar)
  - cpufreq: armada-8k: make both cpu masks static (Arnd Bergmann)
  - arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size (Michael Walle)
  - arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports (Wadim Egorov)
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique (Charalampos Mitrodimas)
  - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() (Seungjin Bae)
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely (André Apitzsch)
  - arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc (Lijuan Gao)
  - arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes (Will Deacon)
  - arm64: dts: qcom: sc7180: Expand IMEM region (Konrad Dybcio)
  - arm64: dts: qcom: sdm845: Expand IMEM region (Konrad Dybcio)
  - soc: qcom: QMI encoding/decoding for big endian (Alexander Wilhelm)
  - selftests: Fix errno checking in syscall_user_dispatch test (Dmitry Vyukov)
  - arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV (Alexander Stein)
  - ASoC: mediatek: use reserved memory or enable buffer pre-allocation (Chen-Yu Tsai)
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)
  - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() (Kuninori Morimoto)
  - io_uring: fix breakage in EXPERT menu (Randy Dunlap)
  - gfs2: No more self recovery (Andreas Gruenbacher) [Orabug: 38351907] {CVE-2025-38659}
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock" (Konstantin Komarov)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li)
  - hfs: make splice write available again (Yangtao Li)
  - hfsplus: make splice write available again (Yangtao Li)
  - ublk: use vmalloc for ublk_device's __queues (Caleb Sander)
  - fs/ntfs3: cancle set bad inode after removing name fails (Edward Adam Davis)
  - fs_context: fix parameter name in infofc() macro (Rubenkelevra)
  - parse_longname(): strrchr() expects NUL-terminated string (Al Viro) [Orabug: 38351912] {CVE-2025-38660}
  - audit,module: restore audit logging in load failure case (Richard Guy Briggs)
  - ASoC: amd: yc: add DMI quirk for ASUS M6501RM (Alexandru Andries)
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX (Richard Fitzgerald)
  - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx (Adam Queler)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - LTS version: v6.12.41 (Jack Vogel)
  - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma (Liu Shixin)
  - KVM: x86: Free vCPUs before freeing VM state (Sean Christopherson)
  - Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" (Tomita Moeko)
  - Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" (Tomita Moeko)
  - Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" (Tomita Moeko)
  - Revert "drm/xe/gt: Update handling of xe_force_wake_get return" (Tomita Moeko)
  - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x (Ville Syrjälä)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - ALSA: hda/tegra: Add Tegra264 support (Mohan Kumar)
  - Drivers: hv: Make the sysfs node size for the ring buffer dynamic (Naman Jain)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - iio: hid-sensor-prox: Restore lost scale assignments (Zhang Lixu)
  - wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure (Ming Yen Hsieh)
  - Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" (Sean Wang)
  - arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage (Stephan Gerhold)
  - x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() (Roman Kisel)
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Manuel Andreas) [Orabug: 38217316] {CVE-2025-38351}
  - KVM: x86: model canonical checks more precisely (Maxim Levitsky)
  - KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks (Maxim Levitsky)
  - KVM: x86: Route non-canonical checks in emulator through emulate_ops (Maxim Levitsky)
  - KVM: x86: drop x86.h include from cpuid.h (Maxim Levitsky)
  - ext4: fix out of bounds punch offset (Zhang Yi) [Orabug: 38369646] {CVE-2025-38221}
  - ext4: correct the error handle in ext4_fallocate() (Zhang Yi)
  - ext4: fix incorrect punch max_end (Zhang Yi)
  - ext4: move out common parts into ext4_fallocate() (Zhang Yi)
  - ext4: move out inode_lock into ext4_fallocate() (Zhang Yi)
  - ext4: factor out ext4_do_fallocate() (Zhang Yi)
  - ext4: refactor ext4_insert_range() (Zhang Yi)
  - ext4: refactor ext4_collapse_range() (Zhang Yi)
  - ext4: refactor ext4_zero_range() (Zhang Yi)
  - ext4: refactor ext4_punch_hole() (Zhang Yi)
  - ext4: don't explicit update times in ext4_fallocate() (Zhang Yi)
  - erofs: fix large fragment handling (Gao Xiang)
  - erofs: clean up header parsing for ztailpacking and fragments (Gao Xiang)
  - erofs: simplify tail inline pcluster handling (Gao Xiang)
  - erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches (Hongzhen Luo)
  - erofs: refine z_erofs_get_extent_compressedlen() (Gao Xiang)
  - erofs: simplify z_erofs_load_compact_lcluster() (Gao Xiang)
  - arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on (Johan Hovold)
  - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() (Md Sadre Alam)
  - crypto: powerpc/poly1305 - add depends on BROKEN for now (Eric Biggers)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov)
  - x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() (Michael Zhivich)
  - spi: cadence-quadspi: fix cleanup of rx_chan on failure paths (Khairul Anuar Romli)
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach (Rd Babiera)
  - usb: typec: tcpm: allow switching to mode accessory to mux properly (Michael Grzeschik)
  - usb: typec: tcpm: allow to use sink in accessory mode (Michael Grzeschik)
  - selftests/bpf: Add tests with stack ptr register in conditional jmp (Yonghong Song)
  - rust: give Clippy the minimum supported Rust version (Miguel Ojeda)
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list (Tu Jinjiang) [Orabug: 38401778] {CVE-2025-39725}
  - selftests: mptcp: connect: also cover checksum (Matthieu Baerts)
  - selftests: mptcp: connect: also cover alt modes (Matthieu Baerts)
  - resource: fix false warning in __request_region() (Akinobu Mita)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi)
  - kasan: use vmalloc_dump_obj() for vmalloc error reports (Marco Elver)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351928] {CVE-2025-38664}
  - gve: Fix stuck TX queue for DQ queue format (Praveen Kaligineedi)
  - e1000e: ignore uninitialized checksum word on tgp (Jacek Kowalski)
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set (Jacek Kowalski)
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling (Ma Ke)
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() (Ada Couprie Diaz) [Orabug: 38351989] {CVE-2025-38670}
  - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx (Edip Hazuri)
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx (Dawid Rezler)
  - sprintf.h requires stdarg.h (Stephen Rothwell)
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() (Ma Ke)
  - i2c: virtio: Avoid hang by using interruptible completion wait (Viresh Kumar)
  - i2c: tegra: Fix reset error handling with ACPI (Akhil R)
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351992] {CVE-2025-38671}
  - timekeeping: Zero initialize system_counterval when querying time from phc drivers (Markus Blöchl)
  - ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 (Nathan Chancellor)
  - mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() (Nathan Chancellor)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - drm/amdgpu: Reset the clear flag in buddy during resume (Arunpravin Paneer Selvam)
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots (Rongrong)
  - platform/x86: ideapad-laptop: Fix FnLock not remembered among boots (Rongrong)
  - net: hns3: default enable tx bounce buffer when smmu enabled (Jijie Shao)
  - net: hns3: fixed vf get max channels bug (Jian Shen)
  - net: hns3: disable interrupt when ptp init failed (Yonglong Liu)
  - net: hns3: fix concurrent setting vlan filter issue (Jian Shen)
  - s390/ism: fix concurrency management in ism_cmd() (Halil Pasic)
  - selftests: drv-net: wait for iperf client to stop sending (Nimrod Oren)
  - ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop (Sharan Kumar M)
  - drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() (Douglas Anderson)
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [Orabug: 38351934] {CVE-2025-38665}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu)
  - i40e: When removing VF MAC filters, only check PF-set MAC (Jamie Bainbridge)
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen)
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Shahar Shitrit)
  - net/mlx5: Fix memory leak in cmd_exec() (Chiara Meiohas)
  - net: ti: icssg-prueth: Fix buffer allocation for ICSSG (Himanshu Mittal)
  - ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv (Guoqing Jiang)
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38310014,38453837] {CVE-2025-38500}
  - xfrm: Set transport header to fix UDP GRO handling (Tobias Brunner)
  - xfrm: state: use a consistent pcpu_id in xfrm_state_find (Sabrina Dubroca)
  - xfrm: state: initialize state_ptrs earlier in xfrm_state_find (Sabrina Dubroca) [Orabug: 38352014] {CVE-2025-38675}
  - staging: vchiq_arm: Make vchiq_shutdown never fail (Stefan Wahren)
  - platform/x86: Fix initialization order for firmware_attributes_class (Torsten Hilbrich)
  - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu (Nuno Das Neves)
  - tools/hv: fcopy: Fix incorrect file path conversion (Yasumasa Suenaga)
  - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (Shravan Kumar Ramani)
  - platform/mellanox: mlxbf-pmc: Validate event/enable input (Shravan Kumar Ramani)
  - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (Shravan Kumar Ramani)
  - regmap: fix potential memory leak of regmap_bus (Abdun Nihaal)
  - iio: adc: ad7949: use spi_is_bpw_supported() (David Lechner)
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node (Xilin Wu)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA (Rahul Chandra)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351976] {CVE-2025-38668}
  - virtio_ring: Fix error reporting in virtqueue_resize (Laurent Vivier)
  - virtio_net: Enforce minimum TX ring size for reliability (Laurent Vivier)
  - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT (Fabrice Gasnier) [Orabug: 38180691] {CVE-2025-38335}
  - x86/traps: Initialize DR7 by writing its architectural reset value (Xin Li)


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-104.43.2.el10uek]
changelog:
  - vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
  - uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
  - uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
  - crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
  - x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
  - x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
  - x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
  - x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
  - x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
  - x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
  - x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
  - platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
  - platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-104.43.3.el10uek]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
  - drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
  - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
  - ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343659]
  - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
  - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
  - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
  - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
  - Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
  - igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
  - drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343659]
  - Revert "can: ti_hecc: fix -Woverflow compiler warning" (Greg Kroah-Hartman) [Orabug: 38343659]
  - proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
  - perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
  - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
  - x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
  - uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]


author: Sherry Yang <sherry.yang@oracle.com> [6.12.0-104.43.4.el10uek]
changelog:
  - tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-104.43.4.2.el10uek]
changelog:
  - Revert "sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails" (Joseph Salisbury)  [Orabug: 38517178]


author: Jack Vogel <jack.vogel@oracle.com> [6.12.0-104.43.4.3.el10uek]
changelog:
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]  {CVE-2025-39698} 
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]  {CVE-2025-39866} 
  - kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988} 
  - vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]  {CVE-2025-39718} 
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]  {CVE-2025-39964} 
  - io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]  {CVE-2025-39963} 
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965} 
  - tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]  {CVE-2025-39946} 
  - futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]  {CVE-2025-39977} 
  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38572941]  {CVE-2025-39973}


author: Eric Sandeen <sandeen@redhat.com> - 6.10.1-1
changelog:
  - Update to latest upstream version
  - Fix C++ compilation errors in xfs_fs.h
  - Related: rhbz#2309693, rhbz#2308609


author: Darrick J. Wong <darrick.wong@oracle.com> 6.12.0-1.0.1
changelog:
  - Add mkfs configuration files for OL.
  - Add mkfs.xmem script.
  - Enable background online fsck services by default.  Users must set autofsck=1 on their filesystems.
  - Rebase atop latest upstream.


