Oracle ELSA-2026-50293 Kernel Important Security Advisory Update

kernel-uek-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-core-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-devel-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-doc-6.12.0-203.76.7.1.el10uek.noarch.rpm kernel-uek-modules-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-core-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-deprecated-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-desktop-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-extra-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-extra-netfilter-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-usb-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-modules-wireless-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-tools-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-core-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-devel-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-core-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-deprecated-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-desktop-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-extra-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-extra-netfilter-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-usb-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek-debug-modules-wireless-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-core-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-devel-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-core-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-deprecated-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-desktop-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-extra-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-extra-netfilter-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-usb-6.12.0-203.76.7.1.el10uek.aarch64.rpm kernel-uek64k-modules-wireless-6.12.0-203.76.7.1.el10uek.aarch64.rpm - uek-rpm/config-aarch64: Enable NVIDIA-recommended Vera-Rubin configs (Vijay Kumar) [Orabug: 39157707] - kselftest/arm64: Add HWCAP test for FEAT_LS64 (Yicong Yang) [Orabug: 39157707] - arm64: Provide basic EL2 setup for FEAT_{LS64, LS64_V} usage at EL0/1 (Yicong Yang) [Orabug: 39157707] - perf: arm_spe: Relax period restriction (Leo Yan) [Orabug: 39157707] - perf/arm_cspmu: Add PMEVFILT2R support (Robin Murphy) [Orabug: 39157707] - ACPI: CPPC: Add IS_OPTIONAL_CPC_REG macro to judge if a cpc_reg is optional (Lifeng Zheng) [Orabug: 39157707] - dt-bindings: gpio: Add Tegra256 support (Prathamesh Shete) [Orabug: 39157707] - perf/arm_cspmu: nvidia: Add revision id matching (Besar Wicaksono) [Orabug: 39157707] - arm64: Handle BRBE booting requirements (Anshuman Khandual) [Orabug: 39157707] - arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again (Rob Herring) [Orabug: 39157707] - arm64/gcs: Provide basic EL2 setup to allow GCS usage at EL0 and EL1 (Mark Brown) [Orabug: 39157707] - tools headers arm64: Add NVIDIA Olympus part (Besar Wicaksono) [Orabug: 39157707] - perf arm-spe: Add NVIDIA Olympus to neoverse list (Besar Wicaksono) [Orabug: 39157707] - perf arm_spe: Add CPU variants supporting common data source packet (Leo Yan) [Orabug: 39157707] - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Yicong Yang) [Orabug: 39157707] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Yicong Yang) [Orabug: 39157707] - perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions (Yicong Yang) [Orabug: 39157707] - perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Besar Wicaksono) [Orabug: 39157707] - perf/arm_cspmu: Add pmpidr support (Besar Wicaksono) [Orabug: 39157707] - perf/arm_cspmu: Move register definitons to header (Robin Murphy) [Orabug: 39157707] - perf/arm_cspmu: Add callback to reset filter config (Besar Wicaksono) [Orabug: 39157707] - perf/arm_cspmu: Generalise event filtering (Robin Murphy) [Orabug: 39157707] - perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) (Rob Herring) [Orabug: 39157707] - arm64/sysreg: Add BRBE registers and fields (Anshuman Khandual) [Orabug: 39157707] - perf: arm_pmu: Move PMUv3-specific data (Mark Rutland) [Orabug: 39157707] - perf: apple_m1: Don't disable counter in m1_pmu_enable_event() (Rob Herring) [Orabug: 39157707] - perf: arm_v7_pmu: Don't disable counter in (armv7|krait_|scorpion_)pmu_enable_event() (Rob Herring) [Orabug: 39157707] - perf: arm_v7_pmu: Drop obvious comments for enabling/disabling counters and interrupts (Rob Herring) [Orabug: 39157707] - perf: arm_pmuv3: Don't disable counter in armv8pmu_enable_event() (Mark Rutland) [Orabug: 39157707] - ACPI: CPPC: Rename EPP constants for clarity (Sumit Gupta) [Orabug: 39157707] - ACPI: CPPC: Add three functions related to autonomous selection (Lifeng Zheng) [Orabug: 39157707] - ACPI: CPPC: Modify cppc_get_auto_sel_caps() to cppc_get_auto_sel() (Lifeng Zheng) [Orabug: 39157707] - cpufreq/amd-pstate: Store the boost numerator as highest perf again (Mario Limonciello) [Orabug: 39157707] - ACPI: CPPC: Refactor register value get and set ABIs (Lifeng Zheng) [Orabug: 39157707] - ACPI: CPPC: Add cppc_set_reg_val() (Lifeng Zheng) [Orabug: 39157707] - ACPI: CPPC: Extract cppc_get_reg_val_in_pcc() (Lifeng Zheng) [Orabug: 39157707] - ACPI: CPPC: Rename cppc_get_perf() to cppc_get_reg_val() (Lifeng Zheng) [Orabug: 39157707] - ACPI: CPPC: Optimize cppc_get_perf() (Lifeng Zheng) [Orabug: 39157707] - ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() (Jie Zhan) [Orabug: 39157707] - ACPI: CPPC: Clean up cppc_perf_caps and cppc_perf_ctrls structs (Sumit Gupta) [Orabug: 39157707] - cpufreq: CPPC: Add generic helpers for sysfs show/store (Sumit Gupta) [Orabug: 39157707] - cpufreq: CPPC: Add support for autonomous selection (Lifeng Zheng) [Orabug: 39157707] - PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Nirmoy Das) [Orabug: 39157707] - PCI: Add ASPEED vendor ID to pci_ids.h (Nirmoy Das) [Orabug: 39157707] - i2c: tegra: Add support for SW mutex register (Kartik) [Orabug: 39157707] - i2c: tegra: Use internal reset when reset property is not available (Akhil R) [Orabug: 39157707] - i2c: tegra: Add HS mode support (Akhil R) [Orabug: 39157707] - i2c: tegra: Update Tegra256 timing parameters (Akhil R) [Orabug: 39157707] - i2c: tegra: Use separate variables for fast and fastplus (Akhil R) [Orabug: 39157707] - i2c: tegra: Add Tegra264 support (Akhil R) [Orabug: 39157707] - i2c: tegra: Add Tegra256 support (Akhil R) [Orabug: 39157707] - i2c: tegra: Do not configure DMA if not supported (Kartik) [Orabug: 39157707] - gpio: tegra186: Fix GPIO name collisions for Tegra410 (Kartik) [Orabug: 39157707] - gpio: tegra186: Use generic macro for port definitions (Kartik) [Orabug: 39157707] - gpio: tegra186: Add support for Tegra410 (Prathamesh Shete) [Orabug: 39157707] - gpio: tegra186: Add support for Tegra256 (Prathamesh Shete) [Orabug: 39157707] - arm64: acpi: Enable ACPI CCEL support (Suzuki K Poulose) [Orabug: 39157707] - arm64: Enable EFI secret area Securityfs support (Suzuki K Poulose) [Orabug: 39157707] - arm64: realm: ioremap: Allow mapping memory as encrypted (Suzuki K Poulose) [Orabug: 39157707] - arm64: Document Arm Confidential Compute (Steven Price) [Orabug: 39157707] - virt: arm-cca-guest: TSM_REPORT support for realms (Sami Mujawar) [Orabug: 39157707] - arm64: Enable memory encrypt for Realms (Suzuki K Poulose) [Orabug: 39157707] - arm64: mm: Avoid TLBI when marking pages as valid (Steven Price) [Orabug: 39157707] - arm64: Enforce bounce buffers for realm DMA (Steven Price) [Orabug: 39157707] - efi: arm64: Map Device with Prot Shared (Suzuki K Poulose) [Orabug: 39157707] - arm64: rsi: Map unprotected MMIO as decrypted (Suzuki K Poulose) [Orabug: 39157707] - arm64: rsi: Add support for checking whether an MMIO is protected (Suzuki K Poulose) [Orabug: 39157707] - arm64: realm: Query IPA size from the RMM (Steven Price) [Orabug: 39157707] - arm64: Detect if in a realm and set RIPAS RAM (Suzuki K Poulose) [Orabug: 39157707] - arm64: rsi: Add RSI definitions (Suzuki K Poulose) [Orabug: 39157707] - PCI/TPH: Add TPH documentation (Wei Huang) [Orabug: 39157707] - PCI/TPH: Add Steering Tag support (Wei Huang) [Orabug: 39157707] - PCI: Add TLP Processing Hints (TPH) support (Wei Huang) [Orabug: 39157707] - sched: Update rq->avg_idle when a task is moved to an idle CPU (Shubhang Kaushik) [Orabug: 39214522] - arm64: mte: Set TCMA1 whenever MTE is present in the kernel (Carl Worth) [Orabug: 39214522] - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628} - uek-rpm: Enable FWCTL modules for aarch64 (Dave Kleikamp) [Orabug: 39252919] - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39259550] [6.12.0-203.76.1] - Revert "EDAC: Octeon: Init SDEI" (Jeremy Tang) [Orabug: 39203407] [6.12.0-202.76.2] - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135} - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug: 38887740,39181101,39202431] {CVE-2026-23004} - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39029337,39131054] {CVE-2026-23381} - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39144150,39343763] {CVE-2026-43366} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116] {CVE-2026-23207} - spi: tegra210-quad: Check hardware status on timeout (Vishwaroop A) [Orabug: 39166116] - spi: tegra210-quad: Refactor error handling into helper functions (Vishwaroop A) [Orabug: 39166116] - spi: tegra210-quad: Add support for internal DMA (Vishwaroop A) [Orabug: 39166116] - spi: tegra210-quad: Update dummy sequence configuration (Vishwaroop A) [Orabug: 39166116] - iommufd/device: Add helper to detect the first attach of a group (Yi Liu) [Orabug: 39166116] - iommufd/device: Replace idev->igroup with local variable (Yi Liu) [Orabug: 39166116] - iommufd/device: Only add reserved_iova in non-pasid path (Yi Liu) [Orabug: 39166116] - iommufd: Pass @pasid through the device attach/replace path (Yi Liu) [Orabug: 39166116] - iommu: Drop iommu_group_replace_domain() (Yi Liu) [Orabug: 39166116] - arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (Piotr Jaroszynski) [Orabug: 39166116] [6.12.0-202.76.1] - uek-rpm/config-x86_64-onos: Reduce unneeded options in config file for ONOS (Brian Utterback) [Orabug: 39029491] - Kconfig for ARISTA_SCD_DRIVER driver needs select REGMAP_I2C (Brian Utterback) [Orabug: 39095293] - memfd: move MFD_MF_KEEP_UE_MAPPED flag to higher bit (William Roche) [Orabug: 39109772] - uek-rpm: Enable CONFIG_NET_VRF in container kernel (Boris Ostrovsky) [Orabug: 39161478] - sched: idle: Make skipping governor callbacks more consistent (Rafael J. Wysocki) - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (Guenter Roeck) - soc: rockchip: grf: Add missing of_node_put() when returning (Shawn Lin) - tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772] {CVE-2026-23309} - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Laurent Vivier) - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231] {CVE-2026-31413} - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload (Peter Ujfalusi) - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164] {CVE-2026-31513} - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" (Sasha Levin) - erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514} - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208] {CVE-2026-23443} - kbuild: Leave objtool binary around with 'make clean' (Nathan Chancellor) - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug: 39262447] {CVE-2026-31552} - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume (Kevin Hao) - net: macb: Introduce gem_init_rx_ring() (Kevin Hao) - net: macb: Shuffle the tx ring before enabling tx (Kevin Hao) - remoteproc: mediatek: Unprepare SCP clock during system suspend (Tzung-Bi Shih) - LTS version: v6.12.76 (Sherry Yang) - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" (Sasha Levin) - LTS version: v6.12.75 (Sherry Yang) - most: core: fix leak on early registration failure (Johan Hovold) - arm64: Fix sampling the "stable" virtual counter in preemptible section (Marc Zyngier) - xfs: fix copy-paste error in previous fix (Darrick J. Wong) - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros (Jani Nikula) - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() (Nathan Chancellor) - NTB: ntb_transport: Fix too small buffer for debugfs_name (Koichiro Den) - tracing: Wake up poll waiters for hist files when removing an event (Petr Pavlu) - tracing: Fix checking of freed trace_event_file for hist files (Petr Pavlu) - fgraph: Do not call handlers direct when not using ftrace_ops (Steven Rostedt) - tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678] {CVE-2026-43210} - net: nfc: nci: Fix parameter validation for packet data (Michael Thalmeier) - drm/amdgpu: keep vga memory on MacBooks with switchable graphics (Alex Deucher) - arm64: Force the use of CNTVCT_EL0 in __delay() (Marc Zyngier) - x86/kexec: Copy ACPI root pointer address from config table (Ard Biesheuvel) - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784] {CVE-2026-43238} - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (Thomas Fourier) - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR (Gustavo Salvini) - cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693} - fbcon: Remove struct fbcon_display.inverse (Thomas Zimmermann) - fbdev: ffb: fix corrupted video output on Sun FFB1 (René Rebe) - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889] {CVE-2026-43264} - fbdev: vt8500lcdfb: fix missing dma_free_coherent() (Thomas Fourier) - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303] {CVE-2026-43123} - mm: numa_memblks: Identify the accurate NUMA ID of CFMW (Cui Chao) - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577] {CVE-2026-43186} - function_graph: Restore direct mode when callbacks drop to one (Shengming Hu) - atm: fore200e: fix use-after-free in tasklets during device removal (Duoming Zhou) - net: intel: fix PCI device ID conflict between i40e and ipw2200 (Ethan Nelson-Moore) - procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241] {CVE-2026-43178} - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug: 39343623] {CVE-2026-43318} - drm/amd/display: Increase DCN35 SR enter/exit latency (Sun Peng Li) - io_uring/filetable: clamp alloc_hint to the configured alloc range (Jens Axboe) - tracing: Fix to set write permission to per-cpu buffer_size_kb (Masami Hiramatsu) - net: macb: Fix tx/rx malfunction after phy link down and up (Kevin Hao) - net: ti: icssg-prueth: Add optional dependency on HSR (Kevin Hao) - octeontx2-af: CGX: fix bitmap leaks (Bo Sun) - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() (Thomas Fourier) - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID (Ethan Nelson-Moore) - LoongArch: Disable instrumentation for setup_ptwalker() (Tiezhu Yang) - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT (Tiezhu Yang) - LoongArch: Use %px to print unmodified unwinding address (Tiezhu Yang) - LoongArch: Prefer top-down allocation after arch_mem_init() (Huacai Chen) - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry) - rust: kbuild: pass -Zunstable-options for Rust 1.95.0 (Miguel Ojeda) - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924] {CVE-2026-43273} - MIPS: rb532: Fix MMIO UART resource registration (Jiaxun Yang) - cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215} - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() (Shengming Hu) - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format (Alan Maguire) - staging: rtl8723bs: fix null dereference in find_network (Ethan Tidmore) - parisc: kernel: replace kfree() with put_device() in create_tree_node() (Haoxiang Li) - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211} - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path (Kevin Hao) - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661] {CVE-2026-43206} - tipc: fix RCU dereference race in tipc_aead_users_dec() (Daniel Hodges) - mtd: rawnand: pl353: Fix software ECC support (Andrea Scian) - usb: dwc2: fix resume failure if dr_mode is host (Jisheng Zhang) - usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170} - PCI: dwc: Fix msg_atu_index assignment (Niklas Cassel) - mm/slab: use unsigned long for orig_size to ensure proper metadata align (Harry Yoo) - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937] {CVE-2026-43275} - perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435] {CVE-2026-43150} - remoteproc: imx_rproc: Fix invalid loaded resource table detection (Peng Fan) - btrfs: continue trimming remaining devices on failure (Jinbaohong) - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 (Marek Vasut) - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y (Marco Elver) - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle) [Orabug: 39331422] {CVE-2026-43147} - kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289} - ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168} - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (Haoxiang Li) - mm/highmem: fix __kmap_to_page() build error (William Tambe) - mtd: spinand: Disable continuous read during probe (David Laporte) - iio: gyro: itg3200: Fix unchecked return value in read_raw (Antoniu Miclaus) - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() (Guangshuo Li) - vhost: move vdpa group bound check to vhost_vdpa (Eugenio Pérez) [Orabug: 39331827] {CVE-2026-43248} - tools: Fix bitfield dependency failure (Leo Yan) - arm64: poe: fix stale POR_EL0 values for ptrace (Joey Gouly) - dm mpath: make pg_init_delay_msecs settable (Benjamin Marzinski) - bus: fsl-mc: fix an error handling in fsl_mc_device_add() (Haoxiang Li) - io_uring/net: don't continue send bundle if poll was required for retry (Jens Axboe) - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Haotien Hsu) - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546] {CVE-2026-43292} - nvmem: Drop OF node reference on nvmem_add_one_cell() failure (Krzysztof Kozlowski) - nfsd: fix return error code for nfsd_map_name_to_[ug]id (Anthony Iliopoulos) - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163} - xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129] {CVE-2026-23249} - xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131] {CVE-2026-23250} - xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133] {CVE-2026-23251} - pinctrl: intel: Add code name documentation (Raag Jadav) - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions (Manikanta Maddireddy) - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693] {CVE-2026-43214} - xfs: fix remote xattr valuelblk check (Darrick J. Wong) - xfs: fix the xattr scrub to detect freemap/entries array collisions (Darrick J. Wong) - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187} - iio: accel: adxl380: Avoid reading more entries than present in FIFO (Francesco Lavra) - mfd: omap-usb-host: Fix OF populate on driver rebind (Johan Hovold) - mfd: qcom-pm8xxx: Fix OF populate on driver rebind (Johan Hovold) - mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143} - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug: 39331341] {CVE-2026-43130} - media: verisilicon: AV1: Fix tile info buffer size (Benjamin Gaignard) - xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153} - xfs: mark data structures corrupt on EIO and ENODATA (Darrick J. Wong) - drm/bridge: anx7625: Fix invalid EDID size (Loic Poulain) - drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510] {CVE-2026-43169} - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs (Li Wang) - drm: of: drm_of_panel_bridge_remove(): fix device_node leak (Luca Ceresoli) - media: venus: vdec: restrict EOS addr quirk to IRIS2 only (Dikshita Agarwal) - media: venus: vdec: fix error state assignment for zero bytesused (Renjiang Han) - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro (Yan Jun) - dm-unstripe: fix mapping bug when there are multiple targets in a table (Matt Whitlock) - dm-integrity: fix recalculation in bitmap mode (Mikulas Patocka) - reset: gpio: suppress bind attributes in sysfs (Bartosz Golaszewski) - s390/pci: Handle futile config accesses of disabled devices directly (Niklas Schnelle) - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() (Haoxiang Li) - media: i2c: ov01a10: Fix digital gain range (Mehdi Djait) - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop (Alain Volmat) - soc: rockchip: grf: Support multiple grf to be handled (Shawn Lin) - soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition (Shawn Lin) - clk: clk-apple-nco: Add "apple,t8103-nco" compatible (Janne Grunau) - bus: omap-ocp2scp: fix OF populate on driver rebind (Johan Hovold) - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358] {CVE-2026-43133} - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() (Xu Wang) - soc: ti: k3-socinfo: Fix regmap leak on probe failure (Johan Hovold) - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954] {CVE-2026-43278} - dm-integrity: fix a typo in the code for write/discard race (Mikulas Patocka) - platform/x86: ISST: Add missing write block check (Srinivas Pandruvada) - media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545] {CVE-2026-43177} - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c (Bingbu Cao) - media: i2c: ov5647: use our own mutex for the ctrl lock (Xiaolei Wang) - media: ccs: Fix setting initial sub-device state (Sakari Ailus) - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode (Jai Luthra) - media: i2c: ov5647: Sensor should report RAW color space (David Plowman) - media: i2c: ov5647: Correct minimum VBLANK value (David Plowman) - media: i2c: ov5647: Correct pixel array offset (David Plowman) - media: i2c: ov5647: Initialize subdev before controls (Jai Luthra) - media: ccs: Avoid possible division by zero (Sakari Ailus) - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (Alper Ak) - media: i2c: ov01a10: Fix test-pattern disabling (Hans de Goede) - media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() (Hans de Goede) - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls (Hans de Goede) - media: i2c: ov01a10: Fix analogue gain range (Hans de Goede) - media: i2c: ov01a10: Fix reported pixel-rate value (Hans de Goede) - media: i2c: ov01a10: Fix the horizontal flip control (Hans de Goede) - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821] {CVE-2026-43246} - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705] {CVE-2026-43218} - media: cx25821: Add missing unmap in snd_cx25821_hw_params() (Haoxiang Li) - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366] {CVE-2026-43135} - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257} - media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231} - media: verisilicon: AV1: Set IDR flag for intra_only frame type (Benjamin Gaignard) - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (Alper Ak) - media: amphion: Drop min_queued_buffers assignment (Ming Qian) - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on (Janne Grunau) - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Günther Noack) [Orabug: 39331370] {CVE-2026-43136} - HID: prodikeys: Check presence of pm->input_ep82 (Günther Noack) [Orabug: 39331846] {CVE-2026-43251} - HID: magicmouse: Do not crash on missing msc->input (Günther Noack) [Orabug: 39331389] {CVE-2026-43140} - HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152} - arm64: Disable branch profiling for all arm64 code (Breno Leitao) - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson) [Orabug: 39343613] {CVE-2026-43315} - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR (Sean Christopherson) - ARM: omap2: Fix reference count leaks in omap_control_init() (Xu Wang) - arm64: dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs (Abel Vesa) - media: verisilicon: AV1: Fix tx mode bit setting (Benjamin Gaignard) - media: verisilicon: AV1: Fix enable cdef computation (Benjamin Gaignard) - media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (Xulin Sun) - media: chips-media: wave5: Fix kthread worker destruction in polling mode (Xulin Sun) - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (Haoxiang Li) - media: mtk-mdp: Fix error handling in probe function (Haoxiang Li) - media: mediatek: encoder: Fix uninitialized scalar variable issue (Irui Wang) - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353] {CVE-2026-43132} - phy: qcom: edp: Make the number of clocks flexible (Abel Vesa) - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" (Niklas Cassel) - drm/tests: shmem: Swap names of export tests (Thomas Zimmermann) - fpga: dfl: use subsys_initcall to allow built-in drivers to be added (Thadeu Lima de Souza Cascardo) - ASoC: SOF: ipc4-control: Keep the payload size up to date (Peter Ujfalusi) - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (Peter Ujfalusi) - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug: 39331023] {CVE-2025-71286} - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Peter Ujfalusi) - clk: renesas: rzg2l: Select correct div round macro (Chris Brandt) - clk: renesas: rzg2l: Fix intin variable size (Chris Brandt) - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012] {CVE-2025-71274} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761] {CVE-2026-43233} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (Junrui Luo) - net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194} - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628] {CVE-2026-43199} - net/mlx5e: Support routed networks during IPsec MACs initialization (Alexandre Cassen) - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Shay Drory) - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Shay Drory) - net/mlx5: DR, Fix circular locking dependency in dump (Shay Drory) - RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128} - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156} - RDMA/efa: Fix typo in efa_alloc_mr() (Jason Gunthorpe) - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (Duoming Zhou) - RDMA/core: Fix stale RoCE GIDs during netdev events at registration (Jiri Pirko) - tipc: fix duplicate publication key in tipc_service_insert_publ() (Tung Nguyen) - kcm: fix zero-frag skb in frag_list on partial sendmsg error (Jiayuan Chen) - tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240} - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug: 39331361] {CVE-2026-43134} - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz) - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ (Luiz Augusto von Dentz) - Bluetooth: hci_qca: Cleanup on all setup failures (Jinwang Li) - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short (Luiz Augusto von Dentz) - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ (Luiz Augusto von Dentz) - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option (Linus Torvalds) - wifi: cfg80211: wext: fix IGTK key ID off-by-one (Johannes Berg) - bnxt_en: Fix deleting of Ntuple filters (Pavan Chebbi) - bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260} - net: ethernet: xscale: Check for PTP support properly (Linus Walleij) - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean) - net: usb: lan78xx: scan all MDIO addresses on LAN7801 (Martin Pålsson) - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549] {CVE-2026-43180} - espintcp: Fix race condition in espintcp_close() (Hyunwoo Kim) - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496] {CVE-2026-43167} - ipmi: ipmb: initialise event handler read bytes (Matt Johnston) - xfrm: skip templates check for packet offload tunnel mode (Leon Romanovsky) - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139} - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut (Maciej Grochowski) - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (Maciej Grochowski) - rtc: zynqmp: correct frequency value (Tomas Melin) - drm/amd/display: Remove conditional for shaper 3DLUT power-on (Alex Hung) - arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) (Arnd Bergmann) - btrfs: replace BUG() with error handling in __btrfs_balance() (Adarsh Das) - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959] {CVE-2026-43279} - drm/radeon: Add HAINAN clock adjustment (Decce6) - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626] {CVE-2026-43319} - drm/amd/display: bypass post csc for additional color spaces in dal (Clay King) - drm/amdgpu: Add HAINAN clock adjustment (Decce6) - ALSA: usb-audio: Update the number of packets properly at receiving (Takashi Iwai) - drm/amdgpu: Adjust usleep_range in fence wait (Ce Sun) - drm/amd/display: Avoid updating surface with the same surface under MPO (Wayne Lin) - drm/amd/display: Fix system resume lag issue (Tom Chung) - drm/amd/display: Fix writeback on DCN 3.2+ (Alex Hung) - ARM: 9467/1: mm: Don't use %pK through printk (Thomas Weißschuh) - include: uapi: netfilter_bridge.h: Cover for musl libc (Phil Sutter) - ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 (Yauhen Kharuzhy) - thermal: int340x: Fix sysfs group leak on DLVR registration failure (Kaushlendra Kumar) - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304} - ceph: supply snapshot context in ceph_uninline_data() (Ethanwu) - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() (Konstantin Komarov) - fs/ntfs3: drop preallocated clusters for sparse and compressed files (Konstantin Komarov) - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (Jaehun Gou) - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (Jaehun Gou) - fs: ntfs3: check return value of indx_find to avoid infinite loop (Jaehun Gou) - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE (John Garry) - iio: magnetometer: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior) - iio: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior) - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs (Ilpo Järvinen) - Revert "mfd: da9052-spi: Change read-mask to write-mask" (Marcus Folkesson) - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Xu Yang) - phy: mvebu-cp110-utmi: fix dr_mode property read from dts (Aleksandar Gerasimovski) - watchdog: imx7ulp_wdt: handle the nowayout option (Oleksandr Suvorov) - binder: don't use %pK through printk (Thomas Weißschuh) - fix it87_wdt early reboot by reporting running timer (René Rebe) - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done (Moteen Shah) - serial: 8250: 8250_omap.c: Add support for handling UART error conditions (Moteen Shah) - staging: rtl8723bs: fix memory leak on failure path (Diksha Kumari) - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (Mario Peter) - usb: gadget: f_fs: Fix ioctl error handling (Sam Day) - usb: gadget: f_fs: fix DMA-BUF OUT queues (Sam Day) - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 (Markus Koch) - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() (Tuo Li) - phy: cadence-torrent: restore parent clock for refclk during resume (Thomas Richard) - phy: ti: phy-j721e-wiz: restore mux selection during resume (Thomas Richard) - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings (Clément Le Goffic) - dmaengine: sun6i: Choose appropriate burst length under maxburst (Chen-Yu Tsai) - most: core: fix resource leak in most_register_interface error paths (Navaneeth K) - fpga: of-fpga-region: Fail if any bridge is missing (Romain Gantois) - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Benson Leung) - serial: 8250_dw: handle clock enable errors in runtime_resume (Artem Shimko) - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (Liang Jie) - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Maciej Strozek) - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Peter Ujfalusi) - dmaengine: stm32-dma3: use module_platform_driver (Amelie Delaunay) - 9p/xen: protect xen_9pfs_front_free against concurrent calls (Stefano Stabellini) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 (Daniel Palmer) - HID: i2c-hid: Add FocalTech FT8112 (Daniel Peng) - clk: microchip: core: correct return value on *_get_parent() (Brian Masney) - mailbox: sprd: clear delivery flag before handling TX done (Otto Pflüger) - remoteproc: mediatek: Break lock dependency to prepare_lock (Tzung-Bi Shih) - mailbox: sprd: mask interrupts that are not handled (Otto Pflüger) - mailbox: imx: Skip the suspend flag for i.MX7ULP (Jacky Bai) - mailbox: pcc: Remove spurious IRQF_ONESHOT usage (Mark Brown) - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized (Iuliana Prodan) - tracing: Fix false sharing in hwlat get_sample() (Colin Lord) - riscv: vector: init vector context with proper vlenb (Sergey Matyukevich) - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event (Keita Morisaki) - vhost: fix caching attributes of MMIO regions by setting them explicitly (Kommula Shiva Shankar) - scsi: buslogic: Reduce stack usage (Arnd Bergmann) - hisi_acc_vfio_pci: update status after RAS error (Longfang Liu) - ata: libata: avoid long timeouts on hot-unplugged SATA DAS (Henry Tseng) - RDMA/rtrs-clt: For conn rejection use actual err number (Md Haris Iqbal) - nfc: nxp-nci: remove interrupt trigger type (Carl Lee) - myri10ge: avoid uninitialized variable use (Arnd Bergmann) - PCI: Mark Nvidia GB10 to avoid bus reset (Johnny-Cc Chang) - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur (Krishna Chaitanya Chundru) - PCI: Fix pci_slot_lock () device locking (Keith Busch) - PCI/AER: Clear stale errors on reporting agents upon probe (Lukas Wunner) - PCI: Mark ASM1164 SATA controller to avoid bus reset (Alex Williamson) - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 (Arnd Bergmann) - net: usb: sr9700: remove code to drive nonexistent multicast filter (Ethan Nelson-Moore) - bnxt_en: Allow ntuple filters for drops (Joe Damato) - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() (Ziyi Guo) - wifi: rtw89: pci: restore LDO setting after device resume (Dian-Syuan Yang) - net: sfp: add quirk for Lantech 8330-265D (Marek Behún) - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (Geetha Sowjanya) - Bluetooth: btusb: Add device ID for Realtek RTL8761BU (Jacopo Scannella) - Bluetooth: btusb: Add new VID/PID for RTL8852CE (Shell Chen) - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout (Stefan Sørensen) - Bluetooth: hci_conn: Set link_policy on incoming ACL connections (Stefan Sørensen) - Bluetooth: btusb: Add support for MediaTek7920 0489:e158 (Andrew Elantsev) - ipv4: fib: Annotate access to struct fib_alias.fa_state. (Kuniyuki Iwashima) - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() (Ziyi Guo) - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() (Ziyi Guo) - net: hns3: extend HCLGE_FD_AD_QID to 11 bits (Jijie Shao) - ipv4: igmp: annotate data-races around idev->mr_maxdelay (Eric Dumazet) - gro: change the BUG_ON() in gro_pull_from_frag0() (Eric Dumazet) - ext4: propagate flags to convert_initialized_extent() (Ojaswin Mujoo) - wifi: rtw89: 8922a: add digital compensation for 2GHz (Po-Hao Huang) - wifi: rtw89: fix unable to receive probe responses under MLO connection (Po-Hao Huang) - wifi: iwlwifi: mvm: check the validity of noa_len (Miri Korenblit) - net: usb: r8152: fix transmit queue timeout (Mingj Ye) - openrisc: define arch-specific version of nop() (Brian Masney) - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591] {CVE-2026-43190} - netfilter: nf_conntrack: Add allow_clash to generic protocol handler (Yuto Hamaguchi) - ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi) - ext4: mark group extend fast-commit ineligible (Li Chen) - ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531] {CVE-2026-43288} - ext4: mark group add fast-commit ineligible (Li Chen) - ipv6: exthdrs: annotate data-race over multiple sysctl (Eric Dumazet) - ipv6: annotate data-races over sysctl.flowlabel_reflect (Eric Dumazet) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() (Eric Dumazet) - wifi: cfg80211: allow only one NAN interface, also in multi radio (Miri Korenblit) - wifi: ath12k: fix preferred hardware mode calculation (Baochen Qiang) - wifi: ath11k: Fix failure to connect to a 6 GHz AP (Qian Zhang) - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 (Ross Vandegrift) - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode (Chin-Yen Lee) - wifi: rtw89: mac: correct page number for CSI response (Ping-Ke Shih) - iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253} - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255} - net: wwan: mhi: Add network support for Foxconn T99W760 (Slark Xiao) - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency (Alexander Grest) - dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314} - dm: replace -EEXIST with -EBUSY (Daniel Gomez) - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data (Bitterblue Smith) - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003] {CVE-2025-71273} - wifi: rtw89: ser: enable error IMR after recovering from L1 (Zong-Zhe Yang) - wifi: rtw89: 8922a: set random mac if efuse contains zeroes (Jose Ignacio Tornos Martinez) - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H (Hsiu-Ming Chang) - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515] {CVE-2025-71297} - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero (Roman Peshkichev) - jfs: nlink overflow in jfs_rename (Jori Koolstra) - jfs: Add missing set_freezable() for freezable kthread (Xu Wang) - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio (Lianqin Hu) - ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126} - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx (Illia Barbashyn) - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe (Ziyi Guo) - spi: geni-qcom: Fix abort sequence execution for serial engine errors (Praveen Talari) - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375] {CVE-2026-43137} - power: sequencing: fix missing state_lock in pwrseq_power_on() error path (Ziyi Guo) - modpost: Amend ppc64 save/restfpr symnames for -Os build (René Rebe) - ASoC: es8328: Add error unwind in resume (Hsieh Hung-En) - HID: logitech-hidpp: Add support for Logitech K980 (Bastien Nocera) - hwmon: (f71882fg) Add F81968 support (Ji-Ze Hong) - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE (Denis Pauk) - hwmon: (dell-smm) Add support for Dell OptiPlex 7080 (Armin Wolf) - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() (Chen Ni) - drm/amd/display: avoid dig reg access timeout on usb4 link training fail (Zhongwei) - drm/amd/display: Fix GFX12 family constant checks (Matthew Stewart) - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end (Chin-Ting Kuo) - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio (Chen Ni) - gpio: aspeed-sgpio: Change the macro to support deferred probe (Billy Tsai) - ALSA: hda/realtek: fix LG Gram Style 14 speakers (Damien Dagorn) - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro (Gongqi) - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK (David Phillips) - HID: multitouch: add eGalaxTouch EXC3188 support (Thorsten Schmelzer) - media: rkisp1: Fix filter mode register configuration (Rui Wang) - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (Ludovic Desroches) - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts (Ludovic Desroches) - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (Ludovic Desroches) - drm/amd/display: Disable FEC when powering down encoders (Ovidiu Bunea) - PCI: Add Intel Nova Lake audio Device ID (Peter Ujfalusi) - ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Bard Liao) - virt: vbox: uapi: Mark inner unions in packed structs as packed (Thomas Weißschuh) - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed (Thomas Weißschuh) - drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287} - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() (Donet Tom) - drm/amdkfd: Relax size checking during queue buffer get (Donet Tom) - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk (Bharat Dev Burman) - media: ipu6: Always close firmware stream (Sakari Ailus) - media: ipu6: Close firmware streams on streaming enable failure (Sakari Ailus) - media: ipu6: Ensure stream_mutex is acquired when dealing with node list (Sakari Ailus) - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found (Hans de Goede) - media: mt9m114: Avoid a reset low spike during probe() (Hans de Goede) - media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585] {CVE-2026-43189} - media: cx25821: Fix a resource leak in cx25821_dev_setup() (Haoxiang Li) - media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316} - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719] {CVE-2026-43223} - media: adv7180: fix frame interval in progressive mode (Thorsten Schmelzer) - drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (Tuo Li) - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START (Ming Qian) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations (Miquel Raynal) - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug (Sebastian Krzyszkowiak) - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask (Sebastian Krzyszkowiak) - drm/xe: Only toggle scheduling in TDR if GuC is running (Matthew Brost) - drm/amd/display: only power down dig on phy endpoints (Dmytro Laktyushkin) - drm/amdgpu: Skip loading SDMA_RS64 in VF (Yubiao Wang) - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards (Joey Bednar) - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug: 39331807] {CVE-2026-43243} - drm/amdgpu: avoid a warning in timedout job handler (Alex Deucher) - drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320} - drm/amdgpu: add support for HDP IP version 6.1.1 (Tim Huang) - media: mediatek: vcodec: Don't try to decode 422/444 VP9 (Nicolas Dufresne) - media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder (Brandon Brnich) - media: chips-media: wave5: Fix conditional in start_streaming (Brandon Brnich) - media: omap3isp: set initial format (Hans Verkuil) - media: omap3isp: isppreview: always clamp in preview_try_format() (Hans Verkuil) - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes (Hans Verkuil) - drm/v3d: Set DMA segment size to avoid debug warnings (Xiaolei Wang) - spi: stm32: fix Overrun issue at < 8bpw (Deepak Kumar) - media: dvb-core: dmxdevfilter must always flush bufs (Hans Verkuil) - ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET (Peter Ujfalusi) - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 (Lincheng Ku) - spi-geni-qcom: use xfer->bits_per_word for can_dma() (Jonathan Marek) - spi-geni-qcom: initialize mode related registers to 0 (Jonathan Marek) - drm/amdkfd: Handle GPU reset and drain retry fault race (Philip Yang) - drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294} - gpu/panel-edp: add AUO panel entry for B140HAN06.4 (Alexey Klimov) - drm/display/dp_mst: Add protection against 0 vcpi (Suraj Kandpal) - parisc: Prevent interrupts during reboot (Helge Deller) - arm64: tegra: smaug: Add usb-role-switch support (Diogo Ivo) - Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (Tomas Melin) - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure (Haoxiang Li) - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308] {CVE-2026-43124} - sched/debug: Fix updating of ppos on server write ops (Joel Fernandes) - char: tpm: cr50: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior) - mailbox: bcm-ferxrm-mailbox: Use default primary handler (Sebastian Andrzej Siewior) - crypto: hisilicon/qm - move the barrier before writing to the mailbox register (Chenghai Huang) - PCI/MSI: Unmap MSI-X region on error (Haoxiang Li) - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF (Bartosz Golaszewski) - clocksource/drivers/sh_tmu: Always leave device running after probe (Niklas Söderlund) - bpf: Recognize special arithmetic shift in the verifier (Alexei Starovoitov) - bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306} - perf/x86/cstate: Add Airmont NP (Martin Schiller) - perf/x86/msr: Add Airmont NP (Martin Schiller) - bpf: verifier improvement in 32bit shift sign extension pattern (Cupertino Miranda) - sparc: don't reference obsolete termio struct for TC* constants (Sam James) - sparc: Synchronize user stack on fork and clone (Andreas Larsson) - block: decouple secure erase size limit from discard size limit (Luke Wang) - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() (Yu Kuai) - xenbus: Use .freeze/.thaw to handle xenbus devices (Jason Andryuk) - ACPI: battery: fix incorrect charging status when current is zero (Ata İLhan Köktürk) - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) (Jakob Riemenschneider) - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD (Sebastian Andrzej Siewior) - s390/perf: Disable register readout on sampling events (Thomas Richter) - cpufreq: dt-platdev: Block the driver from probing on more QC platforms (Konrad Dybcio) - md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918] {CVE-2026-43271} - alpha: fix user-space corruption during memory compaction (Magnus Lindholm) - powercap: intel_rapl: Add PL4 support for Ice Lake (Daniel Tang) - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP (Armin Wolf) - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] (Ai Chao) - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug: 39343603] {CVE-2026-43313} - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896] {CVE-2026-43266} - APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug: 39331636] {CVE-2026-43201} - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947] {CVE-2026-43277} - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518] {CVE-2026-43171} - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set (Hou Wenlong) - rnbd-srv: Zero the rsp buffer before using it (Md Haris Iqbal) - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261} - perf/arm-cmn: Support CMN-600AE (Robin Murphy) - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS (Heiko Carstens) - tools/power cpupower: Reset errno before strtoull() (Kaushlendra Kumar) - smb: client: prevent races in ->query_interfaces() (Henrique Carvalho) [Orabug: 39331789] {CVE-2026-43239} - gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262} - smb: client: add proper locking around ses->iface_last_update (Henrique Carvalho) - btrfs: handle user interrupt properly in btrfs_trim_fs() (Jinbaohong) - btrfs: fallback to buffered IO if the data profile has duplication (Qu Wenruo) - dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125} - minix: Add required sanity checking to minix_check_superblock() (Jori Koolstra) - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init (Adrian Hunter) - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() (Frank Li) - hfsplus: pretend special inodes as regular files (Tetsuo Handa) - audit: add missing syscalls to read class (Jeffrey Bencteux) - fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug: 39331077] {CVE-2025-71295} - hfsplus: fix volume corruption issue for generic/498 (Viacheslav Dubeyko) - audit: add fchmodat2() to change attributes class (Jeffrey Bencteux) - statmount: permission check should return EPERM (Bhavik Sachdev) - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin) - libperf build: Always place libperf includes first (Ian Rogers) - libperf: Don't remove -g when EXTRA_CFLAGS are used (James Clark) - perf vendor events amd: Fix Zen 5 MAB allocation events (Sandipan Das) - perf annotate: Fix memcpy size in arch__grow_instructions() (Suchit Karunakaran) - perf maps: Fix reference count leak in maps__find_ams() (Ian Rogers) - libsubcmd: Fix null intersection case in exclude_cmds() (Sri Jayaramappa) - perf callchain: Fix srcline printing with inlines (Ian Rogers) - perf unwind-libdw: Fix invalid reference counts (Ian Rogers) - perf test stat tests: Fix for virtualized machines (Thomas Richter) - perf test stat: Update test expectations and events (Ian Rogers) - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names (Shengjiu Wang) - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names (Shengjiu Wang) - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false (Shengjiu Wang) - dt-bindings: phy: qcom-edp: Add missing clock for X Elite (Abel Vesa) - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (Daniel Hodges) - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (Chuck Lever) - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT (Jan Kiszka) - ata: libata-scsi: refactor ata_scsi_translate() (Damien Le Moal) - ata: pata_ftide010: Fix some DMA timings (Linus Walleij) - ext4: use optimized mballoc scanning regardless of inode format (Jan Kara) - ext4: fix dirtyclusters double decrement on fs shutdown (Brian Foster) - ext4: fix e4b bitmap inconsistency reports (Yongjian Sun) - ext4: fix memory leak in ext4_ext_shift_extents() (Zilin Guan) - ext4: drop extent cache when splitting extent fails (Zhang Yi) - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout (Zhang Yi) - ext4: don't cache extent during splitting extent (Zhang Yi) - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (Zhang Yi) - ext4: subdivide EXT4_EXT_DATA_VALID1 (Zhang Yi) - MIPS: Work around LLVM bug when gp is used as global register variable (Yao Zi) - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats (Mario Kleiner) - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk (Detlev Casanova) - x86/hyperv: Fix error pointer dereference (Ethan Tidmore) - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (Filipe Manana) - btrfs: use the correct type to initialize block reserve for delayed refs (Filipe Manana) - efi: Fix reservation of unaccepted memory table (Kiryl Shutsemau) - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 (Matt Roper) - drm/xe/xe2_hpg: Add set of workarounds (Shekhar Chauhan) - drm/xe/ptl: Apply Wa_13011645652 (Vinay Belgaumkar) - drm/xe/mmio: Avoid double-adjust in 64-bit reads (Shuicheng Lin) - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt (Matt Roper) - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code (Matt Roper) - drm/xe: Add xe_tile backpointer to xe_mmio (Matt Roper) - drm/xe: Switch mmio_ext to use 'struct xe_mmio' (Matt Roper) - drm/xe: Populate GT's mmio iomap from tile during init (Matt Roper) - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' (Matt Roper) - drm/xe: Clarify size of MMIO region (Matt Roper) - drm/xe: Create dedicated xe_mmio structure (Matt Roper) - drm/xe: Move forcewake to 'gt.pm' substructure (Matt Roper) - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n (Alexander Egorenkov) - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() (Felix Gu) - drm/amd/display: Fix out-of-bounds stream encoder index v3 (Srinivasan Shanmugam) - drm/amd/display: Reject cursor plane on DCE when scaled differently than primary (Timur Kristóf) - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (Srinivasan Shanmugam) - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init (Alexandre Ferrieux) - drm/i915/acpi: free _DSM package when no connectors (Kaushlendra Kumar) - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo) - drm/amdgpu: Fix memory leak in amdgpu_ras_init() (Zilin Guan) - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() (Zilin Guan) - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() (Zilin Guan) - apparmor: fix aa_label to return state from compount and component match (John Johansen) - apparmor: fix invalid deref of rawdata when export_binary is unset (Georgia Garcia) - apparmor: avoid per-cpu hold underflow in aa_get_buffer (Zhengmian Hu) - apparmor: make label_match return a consistent value (John Johansen) - apparmor: remove apply_modes_to_perms from label_match (John Johansen) - apparmor: fix rlimit for posix cpu timers (John Johansen) - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure (Ryan Lee) - apparmor: Fix & Optimize table creation from possibly unaligned memory (Helge Deller) - AppArmor: Allow apparmor to handle unaligned dfa tables (Helge Deller) - apparmor: fix NULL sock in aa_sock_file_perm (John Johansen) - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Cosmin Ratiu) - net/mlx5: Fix multiport device check over light SFs (Shay Drory) - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (Hangbin Liu) - octeontx2-af: Fix default entries mcam entry action (Hariprasad Kelam) - icmp: prevent possible overflow in icmp_global_allow() (Eric Dumazet) - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39110677] {CVE-2026-23273} - ping: annotate data-races in ping_lookup() (Eric Dumazet) - bpftool: Fix truncated netlink dumps (Jakub Kicinski) - ipv6: fix a race in ip6_sock_set_v6only() (Eric Dumazet) - net: remove WARN_ON_ONCE when accessing forward path array (Pablo Neira Ayuso) - ipvs: do not keep dest_dst if dev is going down (Julian Anastasov) - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled (Aleksei Oladko) - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled (Aleksei Oladko) - net: bridge: mcast: always update mdb_n_entries for vlan contexts (Nikolay Aleksandrov) - xen-netback: reject zero-queue configuration from guest (Ziyi Guo) - net: usb: catc: enable basic endpoint checking (Ziyi Guo) - net: sparx5/lan969x: fix PTP clock max_adj value (Daniel Machon) - ipv6: Fix out-of-bound access in fib6_add_rt2node(). (Kuniyuki Iwashima) - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() (Ziyi Guo) - net: mscc: ocelot: split xmit into FDMA and register injection paths (Ziyi Guo) - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (Ziyi Guo) - net: sparx5/lan969x: fix DWRR cost max to match hardware register width (Daniel Machon) - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 (Ido Schimmel) - cpuidle: Skip governor when only one idle state is available (Aboorva Devarajan) - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO (Zhai Can) - objpool: fix the overestimation of object pooling metadata size (Zhouwenhao) - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT (Aristeu Rozanski) - kbuild: Add objtool to top-level clean target (Josh Poimboeuf) - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check (Kuppuswamy Sathyanarayanan) - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs (Sean V Kelley) - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (Jiasheng Jiang) - fs/ntfs3: prevent infinite loops caused by the next valid being the same (Edward Adam Davis) - fs/ntfs3: Initialize new folios before use (Bartlomiej Kubik) - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data (Jens Axboe) - drbd: always set BLK_FEAT_STABLE_WRITES (Christoph Böhmwalder) - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Jared Kangas) - backlight: qcom-wled: Change PM8950 WLED configurations (Barnabás Czémán) - backlight: qcom-wled: Support ovp values for PMI8994 (Barnabás Czémán) - leds: qcom-lpg: Check the return value of regmap_bulk_write() (Xu Wang) - pinctrl: single: fix refcount leak in pcs_add_gpio_func() (Wei Li) - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition (Luca Weiss) - iio: sca3000: Fix a resource leak in sca3000_probe() (Harshit Mogalapalli) - ovl: Fix uninit-value in ovl_fill_real (Qing Wang) - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() (Felix Gu) - usb: bdc: fix sleep during atomic (Justin Chen) - drivers: iio: mpu3050: use dev_err_probe for regulator request (Svyatoslav Ryhel) - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support (Robert Marko) - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order (Ioana Ciornei) - mfd: simple-mfd-i2c: Add SpacemiT P1 support (Alex Elder) - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA (Ioana Ciornei) - mfd: simple-mfd-i2c: Add MAX77705 support (Dzmitry Sankouski) - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure (Xu Wang) - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" (Greg Kroah-Hartman) - phy: freescale: imx8qm-hsio: fix NULL pointer dereference (Thomas Richard) - coresight: etm3x: Fix cpulocked warning on cpuhp (Antonio Borneo) - watchdog: starfive-wdt: Fix PM reference leak in probe error path (Kery Qi) - iio: pressure: mprls0025pa: fix pressure calculation (Petre Rodan) - iio: pressure: mprls0025pa: fix scan_type struct (Petre Rodan) - iio: pressure: mprls0025pa: fix interrupt flag (Petre Rodan) - iio: pressure: mprls0025pa: fix SPI CS delay violation (Petre Rodan) - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation (Petre Rodan) - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms (Matthew Schwartz) - serial: SH_SCI: improve "DMA support" prompt (Randy Dunlap) - serial: imx: change SERIAL_IMX_CONSOLE to bool (Randy Dunlap) - staging: greybus: lights: avoid NULL deref (Chaitanya Mishra) - iio: test: drop dangling symbol in gain-time-scale helpers (Randy Dunlap) - soundwire: intel_ace2x: add SND_HDA_CORE dependency (Arnd Bergmann) - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue (Nuno Sa) - dma: dma-axi-dmac: fix SW cyclic transfers (Nuno Sa) - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX (AngeloGioacchino Del Regno) - interconnect: mediatek: Aggregate bandwidth with saturating add (Nicolas Frattaroli) - interconnect: mediatek: Don't hijack parent device (Nicolas Frattaroli) - clk: mediatek: Fix error handling in runtime PM setup (Xu Wang) - clk: qcom: gfx3d: add parent to parent request map (Dmitry Baryshkov) - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src (David Heidelberger) - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks (Petr Hodina) - clk: Move clk_{save,restore}_context() to COMMON_CLK section (Geert Uytterhoeven) - clk: qcom: gcc-ipq5018: flag sleep clock as critical (George Moussalem) - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán) - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc (Barnabás Czémán) - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona) - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona) - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona) - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona) - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (Jagadeesh Kona) - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs (Martin Blumenstingl) - clk: qcom: rcg2: compute 2d using duty fraction directly (Taniya Das) - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs (Vladimir Zapolskiy) - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs (Vladimir Zapolskiy) - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() (Felix Gu) - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() (Felix Gu) - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros (Steven Rostedt) - tracing: Properly process error handling in event_hist_trigger_parse() (Miaoqian Lin) - fs/nfs: Fix readdir slow-start regression (Sagi Grimberg) - nvdimm: virtio_pmem: serialize flush requests (Li Chen) - scsi: csiostor: Fix dereference of null pointer rn (Colin Ian King) - scsi: ufs: host: mediatek: Require CONFIG_PM (Arnd Bergmann) - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (Zilin Guan) - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc (Liuyi) - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer (Val Packett) - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler (Waqar Hameed) - mtd: spinand: Fix kernel doc (Miquel Raynal) - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() (Weigang He) - cxl: Fix premature commit_end increment on decoder commit failure (Yuxiong Wang) - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing (Chuck Lever) - RDMA/rxe: Fix race condition in QP timer handlers (Li Zhijian) - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Zilin Guan) - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (Liuyi) - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit (Mike Snitzer) - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx (Mike Snitzer) - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() (Zilin Guan) - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails (Mario Limonciello) - crypto: ccp - Factor out ring destroy handling to a helper (Mario Limonciello) - crypto: ccp - Add an S4 restore flow (Mario Limonciello) - crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails (Mario Limonciello) - platform/x86/amd/pmf: Prevent TEE errors after hibernate (Shyam Sundar S K) - vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (Anthony Pighin) - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper (Alok Tiwari) - IB/mlx5: Fix port speed query for representors (Or Har-Toov) - RDMA/mlx5: Fix UMR hang in LAG error state unload (Chiara Meiohas) - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() (Malaya Kumar Rout) - RDMA/iwcm: Fix workqueue list corruption by removing work_list (Jacob Moroni) - RDMA/rxe: Fix double free in rxe_srq_from_init (Jiasheng Jiang) - RDMA/rtrs-srv: fix SG mapping (Roman Pen) - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() (Waqar Hameed) - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported (Xu Wang) - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write (Alexander Koskovich) - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: rt9455: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: goldfish: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: bq25980: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: bq256xx: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: act8945a: Fix use-after-free in power_supply_changed() (Waqar Hameed) - power: supply: ab8500: Fix use-after-free in power_supply_changed() (Waqar Hameed) - RDMA/hns: Notify ULP of remaining soft-WCs during reset (Chengchang Tang) - RDMA/hns: Fix RoCEv1 failure due to DSCP (Junxian Huang) - RDMA/hns: Fix WQ_MEM_RECLAIM warning (Chengchang Tang) - IB/cache: update gid cache on client reregister event (Etienne Aujames) - RDMA/rtrs: server: remove dead code (Lihonggang) - octeontx2-pf: Unregister devlink on probe failure (Hariprasad Kelam) - octeon_ep_vf: ensure dbell BADDR updation (Vimlesh Kumar) - octeon_ep: ensure dbell BADDR updation (Vimlesh Kumar) - octeon_ep: disable per ring interrupts (Vimlesh Kumar) - serial: caif: fix use-after-free in caif_serial ldisc_close() (Jiayuan Chen) - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (Jiayuan Chen) - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers (Stanislav Fomichev) - net: Add skb_dstref_steal and skb_dstref_restore (Stanislav Fomichev) - net: sunhme: Fix sbus regression (René Rebe) - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476] {CVE-2026-31411} - smb: client: correct value for smbd_max_fragmented_recv_size (Stefan Metzmacher) - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (Jinliang Zheng) - net: hns3: fix double free issue for tx spare buffer (Jian Shen) - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] (Nicolas Cavallari) - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (Pablo Neira Ayuso) - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval (Pablo Neira Ayuso) - netfilter: nft_counter: fix reset of counters on 32bit archs (Anders Grahn) - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Florian Westphal) - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Scott Mitchell) - nfc: hci: shdlc: Stop timers and work before freeing context (Victoria Votokina) - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Eric Dumazet) - bonding: only set speed/duplex to unknown, if getting speed failed (Thomas Bogendoerfer) - mptcp: fix receive space timestamp initialization (Paolo Abeni) - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() (Tuo Li) - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() (Ondrej Mosnacek) - ipc: don't audit capability check in ipc_permissions() (Ondrej Mosnacek) - selftests/mm: convert page_size to unsigned long (Siddarth G) - selftests/mm: pagemap_ioctl: Fix types mismatches shown by compiler options (Muhammad Usama Anjum) - PCI/ACPI: Restrict program_hpx_type2() to AER bits (Håkon Bugge) - PCI: Add defines for bridge window indexing (Ilpo Järvinen) - PCI: Initialize RCB from pci_configure_device() (Håkon Bugge) - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() (Ziyi Guo) - PCI: Check parent for NULL in of_pci_bus_release_domain_nr() (Sergey Shtylyov) - tcp: tcp_tx_timestamp() must look at the rtx queue (Eric Dumazet) - fat: avoid parent link count underflow in rmdir (Zhiyu Zhang) - nfsd: never defer requests during idmap lookup (Anthony Iliopoulos) - xdrgen: Initialize data pointer for zero-length items (Chuck Lever) - NFS: NFSERR_INVAL is not defined by NFSv2 (Chuck Lever) - xdrgen: Fix struct prefix for typedef types in program wrappers (Chuck Lever) - dm: use bio_clone_blkg_association (Mikulas Patocka) - iommu/vt-d: Clear Present bit before tearing down PASID entry (Lu Baolu) - iommu/vt-d: Avoid draining PRQ in sva mm release path (Lu Baolu) - iommu/vt-d: Drain PRQs when domain removed from RID (Lu Baolu) - iommu/vt-d: Separate page request queue from SVM (Joel Granados) - iommu/vt-d: Flush cache for PASID table before using it (Dmytro Maluka) - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken (Jörg Wedekind) - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() (Petr Mladek) - module: add helper function for reading module_buildid() (Petr Mladek) - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera) - netfilter: nft_compat: add more restrictions on netlink attributes (Florian Westphal) - netfilter: nf_conncount: increase the connection clean up limit to 64 (Fernando Fernandez Mancera) - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH (Fernando Fernandez Mancera) - netfilter: nf_tables: reset table validation state on abort (Florian Westphal) - wifi: cfg80211: stop NAN and P2P in cfg80211_leave (Miri Korenblit) - mctp i2c: initialise event handler read bytes (Matt Johnston) - net: mctp-i2c: fix duplicate reception of old data (Jian Zhang) - quota: fix livelock between quotactl and freeze_super (Abhishek Bapat) - dm: use READ_ONCE in dm_blk_report_zones (Mikulas Patocka) - dm: fix unlocked test for dm_suspended_md (Mikulas Patocka) - PCI/portdrv: Fix potential resource leak (Uwe Kleine-König) - PCI: Do not attempt to set ExtTag for VFs (Håkon Bugge) - Documentation: tracing: Add PCI tracepoint documentation (Shuai Xue) - Documentation: trace: Refactor toctree (Purva Yeshi) - docs: fix WARNING document not included in any toctree (Surajsonawane2415) - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (Hou Tao) - wifi: cfg80211: Fix use_for flag update on BSS refresh (Huang Chenming) - PCI/PM: Avoid redundant delays on D3hot->D3cold (Brian Norris) - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors (Baruch Siach) - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails (Xu Wang) - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification (Carl Lee) - hwmon: pmbus: mpq8785: Add support for MPM82504 (Pawel Dembicki) - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration (Pawel Dembicki) - hwmon: pmbus: mpq8785: Prepare driver for multiple device support (Pawel Dembicki) - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (Guenter Roeck) - spi: tools: Add include folder to .gitignore (Francesco Lavra) - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (Ryan Lin) - platform/chrome: cros_ec_lightbar: Fix response size initialization (Tzung-Bi Shih) - drm/xe: Unregister drm device on probe error (Shuicheng Lin) - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() (Roberto Sassu) - media: uvcvideo: Fix allocation for small frame sizes (Ricardo Ribalda) - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev (Andy Shevchenko) - drm/buddy: release free_trees array on buddy mm teardown (Michał Grzelak) - drm/msm/a2xx: fix pixel shader start on A225 (Dmitry Baryshkov) - media: ccs: Accommodate C-PHY into the calculation (David Heidelberger) - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x (Dmitry Baryshkov) - drm/msm/disp: set num_planes to 1 for interleaved YUV formats (Dmitry Baryshkov) - HID: playstation: Add missing check for input_ff_create_memless (Xu Wang) - regulator: core: move supply check earlier in set_machine_constraints() (André Draszik) - drm/msm/dpu: fix WD timer handling on DPU 8.x (Dmitry Baryshkov) - drm/msm/dpu: Set vsync source irrespective of mdp top support (Teguh Sobirin) - drm/msm/disp/dpu: add merge3d support for sc7280 (Mahadevan P) - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init (Srinivasan Shanmugam) - drm/amdkfd: Fix signal_eviction_fence() bool return value (Srinivasan Shanmugam) - drm/amd: Drop "amdgpu kernel modesetting enabled" message (Mario Limonciello) - media: chips-media: wave5: Fix memory leak on codec_info allocation failure (Zilin Guan) - ASoC: nau8821: Fixup nau8821_enable_jack_detect() (Cristian Ciocaltea) - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Cristian Ciocaltea) - ASoC: nau8821: Consistently clear interrupts before unmasking (Cristian Ciocaltea) - smack: /smack/doi: accept previously used values (Konstantin Andreev) - smack: /smack/doi must be > 0 (Konstantin Andreev) - drm/panthor: Evict groups before VM termination (Ketil Johnsen) - ALSA: vmaster: Relax __free() variable declarations (Takashi Iwai) - ALSA: pcm: Relax __free() variable declarations (Takashi Iwai) - ALSA: pcm: use new array-copying-wrapper (Chenyuan Yang) - drm/panel: sw43408: Remove manual invocation of unprepare at remove (David Heidelberger) - workqueue: Process rescuer work items one-by-one using a cursor (Lai Jiangshan) - workqueue: Only assign rescuer work when really needed (Lai Jiangshan) - workqueue: Factor out assign_rescuer_work() (Lai Jiangshan) - drm/panthor: Make sure we resume the tick when new jobs are submitted (Boris Brezillon) - drm/panthor: Fix the logic that decides when to stop ticking (Boris Brezillon) - drm/panthor: Fix immediate ticking on a disabled tick (Boris Brezillon) - drm/panthor: Fix the group priority rotation logic (Boris Brezillon) - drm/panthor: Fix the full_tick check (Boris Brezillon) - drm/panthor: Recover from panthor_gpu_flush_caches() failures (Boris Brezillon) - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions (Konrad Dybcio) - arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions (Konrad Dybcio) - arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) (Jonathan Marek) - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 (Dmitry Baryshkov) - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 (Dmitry Baryshkov) - arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm (Dmitry Baryshkov) - arm64: dts: amlogic: g12: assign the MMC A signal clock (Jerome Brunet) - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks (Jerome Brunet) - arm64: dts: amlogic: gx: assign the MMC signal clocks (Jerome Brunet) - arm64: dts: amlogic: axg: assign the MMC signal clocks (Jerome Brunet) - arm64: dts: amlogic: c3: assign the MMC signal clocks (Jerome Brunet) - hwspinlock: omap: Handle devm_pm_runtime_enable() errors (Xu Wang) - arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 (Abhash Kumar Jha) - arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order (Abhash Kumar Jha) - arm64: dts: amlogic: s4: fix mmc clock assignment (Jerome Brunet) - arm64: dts: amlogic: s4: assign mmc b clock to 24MHz (Jerome Brunet) - arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node (AngeloGioacchino Del Regno) - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node (Vladimir Zapolskiy) - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells (Vladimir Zapolskiy) - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling (Narayana Murty N) - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() (Zilin Guan) - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe (Xu Wang) - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() (Christophe Leroy) - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property (Chen-Yu Tsai) - arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 (Vladimir Zapolskiy) - arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks (Abel Vesa) - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on (Casey Connolly) - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on (Casey Connolly) - arm64: dts: qcom: sdm630: fix gpu_speed_bin size (Dmitry Baryshkov) - clk: qcom: Return correct error code in qcom_cc_probe_by_index() (Xu Wang) - arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings (Alexander Stein) - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings (Alexander Stein) - firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET (Sudeep Holla) - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() (Dan Carpenter) - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() (Dan Carpenter) - soc: qcom: smem: handle ENOMEM error during probe (Jorge Ramirez-Ortiz) - pstore/ram: fix buffer overflow in persistent_ram_save_old() (Pwnverse) - hwrng: core - use RCU and work_struct to fix race condition (Lianjie Wang) - hwrng: core - Allow runtime disabling of the HW RNG (Jonathan Mcdowell) - crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req() (Zilin Guan) - fs/tests: exec: drop duplicate bprm_stack_limits test vectors (Titouan Ameline de Cadeville) - sched/rt: Skip currently executing CPU in rto_next_cpu() (Chen Jinghuang) - sched/deadline: Clear the defer params (Joel Fernandes) - media: pci: mg4b: Use IRQF_NO_THREAD (Sebastian Andrzej Siewior) - mfd: wm8350-core: Use IRQF_ONESHOT (Sebastian Andrzej Siewior) - EDAC/altera: Remove IRQF_ONESHOT (Sebastian Andrzej Siewior) - scsi: efct: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior) - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler (Sebastian Andrzej Siewior) - platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() (Sebastian Andrzej Siewior) - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Sebastian Andrzej Siewior) - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Paul Chaignon) - crypto: caam - fix netdev memory leak in dpaa2_caam_probe (Jianpeng Chang) - crypto: hisilicon/trng - support tfms sharing the device (Weili Qian) - x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path (Jiri Olsa) - x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe (Jiri Olsa) - tracing: Add ftrace_fill_perf_regs() for perf event (Masami Hiramatsu) - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs (Masami Hiramatsu) - fgraph: Replace fgraph_ret_regs with ftrace_regs (Masami Hiramatsu) - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value (Masami Hiramatsu) - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros (Masami Hiramatsu) - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs (Steven Rostedt) - ftrace: Make ftrace_regs abstract from direct use (Steven Rostedt) - tracing: Add a comment about ftrace_regs definition (Masami Hiramatsu) - bpf, sockmap: Fix FIONREAD for sockmap (Jiayuan Chen) - bpf, sockmap: Fix incorrect copied_seq calculation (Jiayuan Chen) - crypto: ccp - narrow scope of snp_range_list (Tycho Andersen) - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Ashish Kalra) - hrtimer: Fix trace oddity (Thomas Gleixner) - selftests/bpf: Fix resource leak in serial_test_wq on attach failure (Kery Qi) - bpf: Preserve id of register in sync_linked_regs() (Puranjay Mohan) - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable (Qi Tao) - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function (Chenghai Huang) - crypto: octeontx - fix dma_free_coherent() size (Thomas Fourier) - crypto: cavium - fix dma_free_coherent() size (Thomas Fourier) - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable (Thomas Weißschuh) - libbpf: Fix OOB read in btf_dump_get_bitfield_value (Varun R Mallya) - selftests/bpf: veristat: fix printing order in output_stats() (Puranjay Mohan) - crypto: qat - fix warning on adf_pfvf_pf_proto.c (Giovanni Cabiddu) - perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das) - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (Salah Triki) - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races (Gui-Dong Han) - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible (Yaxiong Tian) - perf: arm_spe: Properly set hw.state on failures (Leo Yan) - PM: wakeup: Handle empty list in wakeup_sources_walk_start() (Sam Wu) - md/raid1: fix memory leak in raid1_run() (Zilin Guan) - md/raid1: fix memory leak in raid1_run() if no active rdev (Zheng Qixing) - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" (Roger Pau Monné) - ublk: Validate SQE128 flag before accessing the cmd (Govindarajulu Varadarajan) - thermal/of: Fix reference leak in thermal_of_cm_lookup() (Felix Gu) - iomap: fix submission side handling of completion side errors (Christoph Hellwig) - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() (Felix Gu) - OPP: Return correct value in dev_pm_opp_get_level (Aleks Todorov) - md/raid10: fix any_working flag handling in raid10_sync_request (Li Nan) - md/raid5: fix raid5_run() to return error when log_init() fails (Yu Kuai) - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature (Rafael J. Wysocki) - cpuidle: governors: menu: Always check timers with tick stopped (Rafael J. Wysocki) - io_uring/sync: validate passed in offset (Jens Axboe) - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov) - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED (Caleb Sander) - xen/virtio: Don't use grant-dma-ops when running as Dom0 (Teddy Astie) - rnbd-srv: Fix server side setting of bi_size for special IOs (Florian-Ewald Mueller) - rnbd-srv: use bio_add_virt_nofail (Christoph Hellwig) - block: add a bio_add_virt_nofail helper (Christoph Hellwig) - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara) - btrfs: fix block_group_tree dirty_list corruption (Boris Burkov) - btrfs: qgroup: return correct error when deleting qgroup relation item (Filipe Manana) - erofs: handle end of filesystem properly for file-backed mounts (Gao Xiang) - erofs: get rid of raw bi_end_io() usage (Gao Xiang) - tpm: st33zp24: Fix missing cleanup on get_burstcount() error (Alper Ak) - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (Alper Ak) - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() (Zilin Guan) - i3c: dw: Initialize spinlock to avoid upsetting lockdep (Fredrik Markstrom) - gfs2: Fix use-after-free in iomap inline data write path (Deepanshu Kartikey) - gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher) - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) - i3c: master: Update hot-join flag only on success (Adrian Hunter) for 'init_fs' (Ben Dooks) - i3c: Move device name assignment after i3c_bus_init (Billy Tsai) - audit: move the compat_xxx_class[] extern declarations to audit_arch.h (Ben Dooks) - rcu: Fix rcu_read_unlock() deadloop due to softirq (Yao Kai) - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() (Zqiang) - rcu: Refactor expedited handling check in rcu_read_unlock_special() (Joel Fernandes) - hfsplus: return error when node already exists in hfs_bnode_create (Shardul Bankar) - auxdisplay: arm-charlcd: fix release_mem_region() size (Thomas Fourier) - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103108] {CVE-2026-23243} - RDMA/siw: Fix potential NULL pointer dereference in header processing (Yunje Shin)