ELSA-2025-20551

Описание

[6.12.0-103.40.4.1.el10uek]

• netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38361037]

[6.12.0-103.40.4.el10uek]

• rds: Fix NULL ptr deref in xas_start (Hakon Bugge) [Orabug: 38169301]
• KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]

[6.12.0-103.40.3.el10uek]

• enic: get max rq & wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
• enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
• enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
• enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
• enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
• enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
• enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
• enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
• enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
• enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
• enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
• enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
• enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
• enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
• enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
• enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
• enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
• enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
• enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
• enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
• enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
• enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
• enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
• RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
• RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
• Revert 'RDMA/mlx5: Fix CC counters query for MPV' (Qing Huang) [Orabug: 38161799]
• block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
• dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
• md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
• md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
• block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
• ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
• net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
• net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
• net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]

[6.12.0-103.40.2.el10uek]

• arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
• arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
• scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
• scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
• scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
• scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
• fnic: treewide: Switch/rename to timer_delete_sync (Thomas Gleixner) [Orabug: 38226429]
• LTS version: v6.12.40 (Jack Vogel)
• KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
• iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
• smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
• drm/xe: Move page fault init after topology init (Matthew Brost)
• drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
• sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
• i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
• i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
• i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
• i2c: omap: Add support for setting mux (Jayesh Choudhary)
• selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
• rust: use #[used(compiler)] to fix build and modpost with Rust >= 1.89.0 (Miguel Ojeda)
• net: libwx: fix multicast packets received count (Jiawen Wu)
• usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
• usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
• usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
• usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
• usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
• btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
• clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
• efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
• libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
• drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
• drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
• Revert 'cgroup_freezer: cgroup_freezing: Check if not frozen' (Chen Ridong)
• rxrpc: Fix transmission of an abort in response to an abort (David Howells)
• rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
• net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
• net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
• net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
• tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
• virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
• hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
• Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
• drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
• drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
• drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
• netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
• net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
• ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
• net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
• Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
• Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
• Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
• Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
• Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
• Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
• riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
• riscv: Enable interrupt during exception handling (Nam Cao)
• loop: use kiocb helpers to fix lockdep warning (Ming Lei)
• usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
• ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
• ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
• hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
• selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
• can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
• can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
• wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
• nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
• nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
• net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
• smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
• nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
• nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
• fix a leak in fcntl_dirnotify() (Al Viro)
• smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
• rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
• block: fix kobject leak in blk_unregister_queue (Ming Lei)
• net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
• cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
• selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
• bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
• arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
• soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
• soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
• arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
• arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
• comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
• comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
• comedi: Fix some signed shift left operations (Ian Abbott)
• comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
• comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
• comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
• comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
• comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
• iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
• iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
• iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
• iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
• iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
• iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
• iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
• soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
• soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
• smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
• s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
• pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
• net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
• net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
• net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
• net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blochl)
• mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
• mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
• mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
• memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
• isofs: Verify inode mode when loading from disk (Jan Kara)
• dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
• cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
• Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
• af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
• af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
• arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
• arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
• arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
• arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
• arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
• arm64: dts: add big-endian property back into watchdog node (Meng Li)
• arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
• net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
• phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
• mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
• mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
• mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
• io_uring/poll: fix POLLERR handling (Pavel Begunkov)
• ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
• ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
• drm/amd/display: Free memory allocation (Clayton King)
• drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
• drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
• drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
• objtool/rust: add one more noreturn Rust function for Rust 1.89.0 (Miguel Ojeda)
• tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
• tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
• tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
• HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
• HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
• HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
• dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
• spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
• pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
• Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
• nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
• nvmem: imx-ocotp: fix MAC address byte length (Steffen Batz)
• Revert 'staging: vchiq_arm: Create keep-alive thread during probe' (Stefan Wahren)
• thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
• thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
• i2c: stm32f7: unmap DMA mapped buffer (Clement Le Goffic)
• i2c: stm32: fix the device used for the DMA map (Clement Le Goffic)
• usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
• usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
• usb: musb: fix gadget state on disconnect (Drew Hamilton)
• USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
• USB: serial: option: add Foxconn T99W640 (Slark Xiao)
• USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
• phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
• phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
• phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
• LTS version: v6.12.39 (Jack Vogel)
• KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
• rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
• crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
• arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
• ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
• kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
• net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
• erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
• selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
• HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
• HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
• HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
• riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
• bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
• vt: add missing notification when switching back to text mode (Nicolas Pitre)
• btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
• net: mana: Record doorbell physical address in PF mode (Long Li)
• HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
• driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
• net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
• ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
• ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
• ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
• io_uring: make fallocate be hashed work (Fengnan Chang)
• ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
• ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
• um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
• atm: idt77252: Add missing dma_map_error() (Thomas Fourier)
• ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
• bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
• bnxt_en: Fix DCB ETS validation (Shravya Kn)
• net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
• net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
• net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
• can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
• drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
• selftests: net: lib: fix shift count out of range (Hangbin Liu)
• selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
• net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
• net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
• ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
• net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
• netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
• erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
• erofs: refine readahead tracepoint (Gao Xiang)
• erofs: tidy up zdata.c (Gao Xiang)
• erofs: get rid of z_erofs_next_pcluster_t (Gao Xiang)
• erofs: free pclusters if no cached folio is attached (Chunhai Guo)
• drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
• nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
• wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
• drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
• wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
• wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
• wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
• raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
• md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
• drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
• wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
• wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
• netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
• netlink: make sure we allow at least one dump skb (Jakub Kicinski)
• netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
• ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
• erofs: address D-cache aliasing (Gao Xiang)
• erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
• ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
• smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
• clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
• x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
• x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
• clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
• rust: init: allow dead_code warnings for Rust >= 1.89.0 (Miguel Ojeda)
• lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
• mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
• scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
• scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
• scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
• mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
• maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
• kallsyms: fix build without execinfo (Achill Gilgenast)
• Revert 'PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()' (Zhe Qiao)
• Revert 'ACPI: battery: negate current when discharging' (Rafael J. Wysocki)
• drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
• drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
• Revert 'usb: gadget: u_serial: Add null pointer check in gs_start_io' (Kuen-Han Tsai)
• usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
• Revert 'drm/xe/xe2: Enable Indirect Ring State support for Xe2' (Matthew Brost)
• drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
• drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
• drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian Konig)
• drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
• drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
• drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
• drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
• wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
• wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
• wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
• wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
• wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
• wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
• pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-Konig)
• pwm: Fix invalid state detection (Uwe Kleine-Konig)
• pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
• net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
• gre: Fix IPv6 multicast route creation. (Guillaume Nault)
• ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
• ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
• KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
• KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
• KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
• KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
• x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
• x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
• x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
• x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
• x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
• ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
• rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
• rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
• net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
• net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
• atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
• atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
• atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
• atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
• net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
• net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
• net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
• net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
• vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also transport_local (Michal Luczaj)
• vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
• vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
• tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
• tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
• vsock: fix vsock_proto declaration (Stefano Garzarella)
• netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
• net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
• net: phy: qcom: move the WoL function to shared library (Luo Jie)
• arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
• bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
• sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
• fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
• pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
• Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
• Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
• ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
• perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
• sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
• irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
• perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
• ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
• ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
• ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
• ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
• ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
• ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
• ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
• ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
• drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
• crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
• drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
• drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
• drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
• eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
• LTS version: v6.12.38 (Jack Vogel)
• x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
• LTS version: v6.12.37 (Jack Vogel)
• x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
• x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
• KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
• x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
• x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
• x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
• Revert 'x86/bugs: Rename MDS machinery to something more generic' (Boris Ostrovsky) [Orabug: 38264060]
• Revert 'x86/bugs: Add a Transient Scheduler Attacks mitigation' (Boris Ostrovsky) [Orabug: 38264060]
• Revert 'KVM: SVM: Advertize TSA CPUID bits to guests' (Boris Ostrovsky) [Orabug: 38264060]
• Revert 'x86/process: Move the buffer clearing before MONITOR' (Boris Ostrovsky) [Orabug: 38264060]
• Revert 'Add Zen34 clients' (Boris Ostrovsky) [Orabug: 38264060]
• Revert 'x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()' (Boris Ostrovsky) [Orabug: 38264060]
• mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
• mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
• powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
• usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
• platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
• platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
• platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
• riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
• powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
• iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
• optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
• Logitech C-270 even more broken (Oliver Neukum)
• i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
• dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian Konig)
• cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
• smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
• usb: acpi: fix device link removal (Krogerus Heikki)
• usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
• usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
• usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
• usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
• Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
• Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
• xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
• xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
• xhci: dbctty: disable ECHO flag by default (Lukasz Bartosik)
• usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
• Revert 'usb: xhci: Implement xhci_handshake_check_state() helper' (Roy Luo)
• usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
• NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
• drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
• drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
• IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
• RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
• fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
• module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
• add a string-to-qstr constructor (Al Viro)
• rcu: Return early if callback is not specified (Uladzislau Rezki)
• mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
• ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
• wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
• wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
• aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
• scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
• regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
• ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
• powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
• genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
• platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
• ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
• ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
• ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
• ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
• ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
• drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
• drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
• scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag (Ewan D. Milne)
• sched_ext: Make scx_group_set_weight() always update tg->scx.weight (Tejun Heo)
• drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
• arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
• drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
• drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
• drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
• drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
• drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
• selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
• drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
• drm/xe/guc: Dead CT helper (John Harrison)
• drm/xe: Replace double space with single space after comma (Gote, Nitin R)
• drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
• drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
• drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
• drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
• drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
• mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
• netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
• remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
• remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
• remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
• remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
• remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
• remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
• ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
• arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
• arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
• arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
• arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
• arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
• arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
• bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
• bpf: use common instruction history across all states (Andrii Nakryiko)
• hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
• hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
• scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
• f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
• f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
• f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
• iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
• RDMA/rxe: Fix 'trying to register non-static key in rxe_qp_do_cleanup' bug (Zhu Yanjun)
• wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
• wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
• wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
• bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
• ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
• ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
• ASoC: tas2764: Reinit cache on part reset (Martin Poviser)
• ASoC: tas2764: Extend driver to SN012776 (Martin Poviser)
• gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
• gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
• sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
• sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
• sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
• btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
• btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
• gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
• gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
• gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
• gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
• gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
• gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
• gfs2: Prevent inode creation race (Andreas Gruenbacher)
• gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
• gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher)
• gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
• kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
• kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weissschuh)
• kunit: qemu_configs: sparc: use Zilog console (Thomas Weissschuh)
• crypto: zynqmp-sha - Add locking (Herbert Xu)
• spinlock: extend guard with spinlock_bh variants (Christian Marangi)
• crypto: iaa - Do not clobber req->base.data (Herbert Xu)
• crypto: iaa - Remove dst_null support (Herbert Xu)
• arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
• smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
• amd-xgbe: do not double read link status (Raju Rangoju)
• net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
• nui: Fix dma_mapping_error() check (Thomas Fourier)
• rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
• enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
• amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
• lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
• netfs: Fix i_size updating (David Howells)
• smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
• smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
• smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
• igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
• idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
• idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
• drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
• drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
• net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
• smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
• drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
• platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
• platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
• platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weissschuh)
• platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
• platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weissschuh)
• platform/x86: firmware_attributes_class: Simplify API (Thomas Weissschuh)
• platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weissschuh)
• platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
• platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weissschuh)
• platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
• nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
• nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
• drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
• spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
• drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
• dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
• ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
• btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
• btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
• btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
• btrfs: fix inode lookup error handling during log replay (Filipe Manana)
• btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
• btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
• btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
• btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
• btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
• Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
• platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
• platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
• RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
• scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
• scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
• scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
• scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
• NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
• nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
• RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
• RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
• platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
• arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
• firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
• firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
• firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
• drm/v3d: Disable interrupts before resetting the GPU (Maira Canal) [Orabug: 38253819] {CVE-2025-38371}
• mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
• mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
• mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
• usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
• Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
• regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
• iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
• Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
• Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
• Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
• Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
• mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
• Revert 'mmc: sdhci: Disable SD card clock before changing parameters' (Ulf Hansson)
• mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
• net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
• vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
• net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
• s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
• s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
• virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
• virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
• rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jonczyk)
• rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
• rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)

[6.12.0-103.36.1.el10uek]

• rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
• mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
• memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
• mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
• net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
• net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]