ELSA-2026-500150

Описание

[6.12.0-205.92.4.2]

• net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39844842]
• x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD)) [Orabug: 39844812] {CVE-2026-68480}
• KVM: x86: Check for invalid/obsolete root after making MMU pages available (Sean Christopherson) [Orabug: 39844799] {CVE-2026-64561}

[6.12.0-205.92.4.1]

• net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada) [Orabug: 39816011] {CVE-2026-64531}
• Revert 'arm64: acpi: Enable ACPI CCEL support' (Will Deacon) [Orabug: 39812699]
• virtio_pci: fix vq info pointer lookup via wrong index (Ammar Faizi) [Orabug: 39812697]
• xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) [Orabug: 39812085]

[6.12.0-205.92.4]

• f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() (Yongpeng Yang)
• ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (Ji'an Zhou)
• MIPS: smp: report dying CPU to RCU in stop_this_cpu() (Jonas Jelonek)
• LoongArch: Report dying CPU to RCU in stop_this_cpu() (Huacai Chen)
• Revert 'net: bonding: fix use-after-free in bond_xmit_broadcast()' (Kevin Berry)
• block: fix handling of dead zone write plugs (Damien Le Moal)
• Bluetooth: MGMT: Fix backward compatibility with userspace (Luiz Augusto von Dentz)
• Revert 'PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support' (Sasha Levin)
• apparmor: fix use-after-free in rawdata dedup loop (Ruslan Valiyev)
• mmc: dw_mmc-rockchip: Add missing private data for very old controllers (Heiko Stuebner)
• sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long)
• net: ipv6: Make udp_tunnel6_xmit_skb() void (Petr Machata)
• dm cache policy smq: check allocation under invalidate lock (Guangshuo Li)
• locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)
• locking/mutex: Remove wakeups from under mutex::wait_lock (Peter Zijlstra)
• ksmbd: fix out-of-bounds read in smb_check_perm_dacl() (Hem Parekh)
• ipv4: account for fraggap on the paged allocation path (Wongi Lee) [Orabug: 39738617]
• inet: add indirect call wrapper for getfrag() calls (Eric Dumazet) [Orabug: 39738617]
• net/mlx5: Add vhca_id_type support to IPsec alias creation (Patrisious Haddad) [Orabug: 39653091]
• net/mlx5: Add vhca_id_type bit to alias context (Patrisious Haddad) [Orabug: 39653091]
• scripts/sorttable: Fix endianness handling in build-time mcount sort (Vasily Gorbik) [Orabug: 39489132]
• scripts/sorttable: Allow matches to functions before function entry (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Steven Rostedt) [Orabug: 39489132]
• ftrace: Check against is_kernel_text() instead of kaslr_offset() (Steven Rostedt) [Orabug: 39489132]
• ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Steven Rostedt) [Orabug: 39489132]
• ftrace: Do not over-allocate ftrace memory (Guenter Roeck) [Orabug: 39489132]
• ftrace: Have ftrace pages output reflect freed pages (Steven Rostedt) [Orabug: 39489132]
• ftrace: Update the mcount_loc check of skipped entries (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Zero out weak functions in mcount_loc table (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Always use an array for the mcount_loc sorting (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Have mcount rela sort use direct values (Steven Rostedt) [Orabug: 39489132]
• arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Use a structure of function pointers for elf helpers (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Move code from sorttable.h into sorttable.c (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Use uint64_t for mcount sorting (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Add helper functions for Elf_Sym (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Add helper functions for Elf_Shdr (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Add helper functions for Elf_Ehdr (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Convert Elf_Sym MACRO over to a union (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Replace Elf_Shdr Macro with a union (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Convert Elf_Ehdr to union (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Make compare_extable() into two functions (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Have the ORC code use the _r() functions to read (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Remove unneeded Elf_Rel (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Remove unused write functions (Steven Rostedt) [Orabug: 39489132]
• scripts/sorttable: Remove unused macro defines (Steven Rostedt) [Orabug: 39489132]
• xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang) [Orabug: 39262397] {CVE-2026-31663}
• xfrm: hold device only for the asynchronous decryption (Jianbo Liu) [Orabug: 39262397]
• KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (Hyunwoo Kim) [Orabug: 39531622] {CVE-2026-46316}
• fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang) [Orabug: 39681042]
• mm: enforce resource limits for reserved VA mappings (Jianfeng Wang) [Orabug: 39681042]
• ipv6: account for fraggap on the paged allocation path (Wongi Lee) [Orabug: 39686467] {CVE-2026-53362}
• xen/ovmapi: terminate values passed to xenbus_write (Joe Jin) [Orabug: 39726311]
• xen/ovmapi: free queued events on release (Joe Jin) [Orabug: 39726311]
• xen/ovmapi: prevent duplicate app registration (Joe Jin) [Orabug: 39726311]
• xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin) [Orabug: 39726311]
• xen/ovmapi: reject oversized posted event payloads (Joe Jin) [Orabug: 39726311]

[6.12.0-205.92.3]

• soc/pensando/bsm: add read-only access to A35 BSM from N1 (Hiren Mehta) [Orabug: 39710757]
• uek-rpm: update Salina emb4 drivers (Joseph Dobosenski) [Orabug: 39692334]
• Enable psci on UEK8 emb4 platform (Joseph Dobosenski) [Orabug: 39692334]
• arm64: amd: add dtb Makefile entries and Pensando defconfigs (Brad Larson) [Orabug: 39692334]
• arm64: dts: amd: add Salina SoC and boards (Brad Larson) [Orabug: 39692334]
• arm64: dts: amd: add Elba, Giglio and Deschutes boards (Brad Larson) [Orabug: 39692334]
• perf: arm-cmn: enable CMN PMU on AMD Pensando Salina (Brad Larson) [Orabug: 39692334]
• net: mctp-i2c: fix dynamic debug logging (Brad Larson) [Orabug: 39692334]
• hwmon: pmbus: add LTC3888 and TPS53659 support (Brad Larson) [Orabug: 39692334]
• mmc: sdhci-cadence: add AMD Pensando bounce buffer and HS400-ES support (Brad Larson) [Orabug: 39692334]
• spi: add AMD Pensando CPLD SPI multiplexer and Salina dw support (Brad Larson) [Orabug: 39692334]
• spi: cadence-quadspi: fix indirect write timeout on AMD Pensando (Brad Larson) [Orabug: 39692334]
• i2c: add AMD Pensando CPLD RD1173 SPI-to-I2C driver (Brad Larson) [Orabug: 39692334]
• i2c: designware: add AMD Pensando support (Brad Larson) [Orabug: 39692334]
• uio: add AMD Pensando UIO drivers (Brad Larson) [Orabug: 39692334]
• rtc: add AMD Pensando ELBA CPLD RTC (Brad Larson) [Orabug: 39692334]
• reset: add AMD Pensando ELBASR reset controller (Brad Larson) [Orabug: 39692334]
• mfd: add AMD Pensando ELBASR CPLD (Brad Larson) [Orabug: 39692334]
• EDAC: add AMD Pensando Elba and Salina memory controllers (Brad Larson) [Orabug: 39692334]
• irqchip: add AMD Pensando SoC interrupt controller (Brad Larson) [Orabug: 39692334]
• soc: pensando: add AMD Pensando SoC service drivers (Brad Larson) [Orabug: 39692334]
• arm64: traps: report AMD Pensando async SError as SIGBUS (Brad Larson) [Orabug: 39692334]
• dt-bindings: add AMD Pensando Elba, Giglio and Salina SoCs (Brad Larson) [Orabug: 39692334]
• Revert 'mmc: sdhci-cadence: Support ADMA with bounce buffers' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'hwmon: (pmbus/ltc2978) Add support for ltc3888' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'hwmon: (pmbus/tps53679) Add support for tps53659' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'i2c: rd1173: Add Lattice SPI to I2C bus driver' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'arm64: dts: Add AMD Pensando SoC support' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'soc/pensando: Add AMD Pensando SoC drivers' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'arm64: defconfig: Add AMD Pensando defconfig' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'arm64: Add AMD Pensando UIO support' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'irqchip/pensando: Add AMD Pensando IRQ driver' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'mtd: spi-nor: winbond: Add support for W25Q02NW' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'EDAC/elba: Add AMD Pensando Elba/Giglio SoC EDAC driver' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'mfd: Add AMD Pensando system controller' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'rtc: elbacpld: Support RTC in AMD Pensando system controller' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'spi: dw-mmio: Add AMD Pensando Salina SoC support' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'arm64: Enable platform SError handler' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'perf/arm-cmn: Enable AMD Pensando Salina SoC CMN PMU driver' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'i2c: designware: Support stuck SDA line recovery' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'mmc: core: Use HPI to interrupt lengthy cache flush (#495)' (Joseph Dobosenski) [Orabug: 39692334]
• Revert 'irqchip/pensando: Fix partial of_iomap() leak on error (#505)' (Joseph Dobosenski) [Orabug: 39692334]
• KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673856,39686459] {CVE-2026-53359}
• Revert 'net/rds: poll eq during user-reset' (Praveen Kumar Kannoju) [Orabug: 39659418]
• net/rds: expand kref coverage to rds_notifier->n_conn (Sharath Srinivasan) [Orabug: 39652107]
• net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn (Sharath Srinivasan) [Orabug: 39652107]
• net/mlx5: Fix EQ IRQ affinity notifier debug messages uek8 (Praveen Kumar Kannoju) [Orabug: 39594873]
• netfs: Fix read-gaps to remove netfs_folio from filled folio (David Howells) [Orabug: 39580474]
• net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug: 39567285,39668752] {CVE-2026-46331}
• net_sched: act_pedit: use RCU in tcf_pedit_dump() (Eric Dumazet) [Orabug: 39567285] {CVE-2026-46331}
• uek: kabi: update x86_64/aarch64 kABI files for new symbols (Saeed Mirzamohammadi) [Orabug: 39531375]
• tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil) [Orabug: 39480767]
• eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• eventpoll: move epi_fget() up (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• eventpoll: kill __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• eventpoll: split __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
• mm/truncate: make partial truncation folio split aware of min_order (Jane Chu) [Orabug: 39215509]
• mm/memory-failure: improve large block size folio handling (Jane Chu) [Orabug: 39215509]
• mm/huge_memory: add split_huge_page_to_order() (Jane Chu) [Orabug: 39215509]
• fs/kernfs: raise sb->maxbytes to MAX_LFS_FILESIZE (Jane Chu) [Orabug: 39209761]

[6.12.0-205.92.2]

• bnxt_en: bring back rtnl lock in bnxt_shutdown (Stanislav Fomichev) [Orabug: 39589466]
• eth: bnxt: add missing netdev lock management to bnxt_dl_reload_up (Stanislav Fomichev) [Orabug: 39589466]
• eth: bnxt: request unconditional ops lock (Stanislav Fomichev) [Orabug: 39589466]
• eth: bnxt: switch to netif_close (Stanislav Fomichev) [Orabug: 39589466]
• md: fix array_state=clear sysfs deadlock (Yu Kuai) [Orabug: 39190489,39668924] {CVE-2026-53125}
• md: fix return value of mddev_trylock (Xiao Ni) [Orabug: 39190489]
• md: avoid repeated calls to del_gendisk (Xiao Ni) [Orabug: 39190489,39668918] {CVE-2025-68373}
• md: delete mddev kobj before deleting gendisk kobj (Xiao Ni) [Orabug: 39190489]
• md: add legacy_async_del_gendisk mode (Xiao Ni) [Orabug: 39190489]
• md: fix create on open mddev lifetime regression (Yu Kuai) [Orabug: 39190489]
• md: Don't clear MD_CLOSING until mddev is freed (Xiao Ni) [Orabug: 39190489]
• md: call del_gendisk in control path (Xiao Ni) [Orabug: 39190489]
• net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39619387,39639984,39656679] {CVE-2026-52943}

[6.12.0-205.92.1]

• uek-rpm: generate symtypes during early FIPS module build (Saeed Mirzamohammadi) [Orabug: 39576442]
• net/rds: Wait for rdma_cm_event background work to finish (Gerd Rausch) [Orabug: 38111998]
• Revert 'rds: ib: Add cm_id generation scheme in order to detect new ones' (Sharath Srinivasan) [Orabug: 39084664]
• uek-rpm: Enable MLXREG_DPU module (Alexandre Chartre) [Orabug: 38667152]
• net/mlx5: Fix crash when moving to switchdev mode (Patrisious Haddad) [Orabug: 38667152,39344020] {CVE-2026-43467}
• net/mlx5: Fix double unregister of HCA_PORTS component (Gerd Bayer) [Orabug: 38667152,39590860] {CVE-2025-68790}
• net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad) [Orabug: 38667152,38730559] {CVE-2025-40238}
• net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Lama Kayal) [Orabug: 38667152]
• net/mlx5: HWS, prevent rehash from filling up the queues (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, fix complex rules rehash error flow (Yevgeny Kliteynik) [Orabug: 38667152,39590850] {CVE-2025-39768}
• net/mlx5: HWS, fix simple rules rehash error flow (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, Rearrange to prevent forward declaration (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, Track matcher sizes individually (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Decouple matcher RX and TX sizes (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Create STEs directly from matcher (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Export rule skip logic (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: Refactor devcom to return NULL on failure (Patrisious Haddad) [Orabug: 38667152]
• net/mlx5: Add net namespace support to devcom (Shay Drory) [Orabug: 38667152]
• net/mlx5: Lag, move devcom registration to LAG layer (Shay Drory) [Orabug: 38667152]
• net/mlx5: Refactor devcom to use match attributes (Shay Drory) [Orabug: 38667152]
• platform/mellanox: Fix spelling and comment clarity in Mellanox drivers (Alok Tiwari) [Orabug: 38667152]
• net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Dan Carpenter) [Orabug: 38667152]
• RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup (Arnd Bergmann) [Orabug: 38667152]
• net/mlx5: HWS, make sure the uplink is the last destination (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Init mutex on the correct path (Vlad Dogaru) [Orabug: 38667152]
• mlxsw: core_thermal: Constify struct thermal_zone_device_ops (Christophe Jaillet) [Orabug: 38667152]
• net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Dan Carpenter) [Orabug: 38667152]
• net/mlx5e: Allow setting MAC address of representors (Mark Bloch) [Orabug: 38667152]
• RDMA/mlx5: Avoid flexible array warning (Leon Romanovsky) [Orabug: 38667152]
• i2c: mlxbf: avoid 64-bit division (Arnd Bergmann) [Orabug: 38667152]
• i2c-mlxbf: Improve I2C bus timing configuration (Chris Babroski) [Orabug: 38667152]
• i2c-mlxbf: Add repeated start condition support (Chris Babroski) [Orabug: 38667152]
• net/mlx5e: Don't drop RTNL during firmware flash (Cosmin Ratiu) [Orabug: 38667152]
• net/mlx5: HWS, handle modify header actions dependency (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, fix typo - 'nope' to 'nop' (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, register reformat actions with fw (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: SWS, fix reformat id error handling (Vlad Dogaru) [Orabug: 38667152]
• selftests: net: validate team flags propagation (Stanislav Fomichev) [Orabug: 38667152]
• vfio/mlx5: Enable the DMA link API (Leon Romanovsky) [Orabug: 38667152]
• vfio/mlx5: Rewrite create mkey flow to allow better code reuse (Leon Romanovsky) [Orabug: 38667152]
• vfio/mlx5: Explicitly use number of pages instead of allocated length (Leon Romanovsky) [Orabug: 38667152]
• i2c: mlxbf: Use str_read_write() helper (Fengwei) [Orabug: 38667152]
• RDMA/mlx5: Add support for 200Gbps per lane speeds (Patrisious Haddad) [Orabug: 38667152]
• net/mlx5: Use to_delayed_work() (Chen Ni) [Orabug: 38667152]
• net: mlxsw: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Vladimir Oltean) [Orabug: 38667152]
• net/mlx5: HWS, dump bad completion details (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, rework rehash loop (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, fix redundant extension of action templates (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, fix counting of rules in the matcher (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, force rehash when rule insertion failed (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, support complex matchers (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, introduce isolated matchers (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, expose polling function in header file (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, add definer function to get field name str (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Yevgeny Kliteynik) [Orabug: 38667152]
• net/mlx5: support software TX timestamp (Stanislav Fomichev) [Orabug: 38667152]
• RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage (Leon Romanovsky) [Orabug: 38667152]
• RDMA/umem: Store ODP access mask information in PFN (Leon Romanovsky) [Orabug: 38667152]
• platform/mellanox: mlxreg-dpu: Fix smatch warnings (Vadim Pasternak) [Orabug: 38667152]
• platform: mellanox: nvsw-sn2200: Fix .items in nvsw_sn2201_busbar_hotplug (Nathan Chancellor) [Orabug: 38667152]
• platform: mellanox: nvsw-sn2200: Add support for new system flavour (Vadim Pasternak) [Orabug: 38667152]
• platform: mellanox: mlx-platform: Add support for new Nvidia system (Vadim Pasternak) [Orabug: 38667152]
• platform: mellanox: Cosmetic changes to improve code style (Vadim Pasternak) [Orabug: 38667152]
• platform: mellanox: Introduce support of Nvidia smart switch (Vadim Pasternak) [Orabug: 38667152]
• platform/mellanox: mlxreg-dpu: Add initial support for Nvidia DPU (Vadim Pasternak) [Orabug: 38667152]
• net/mlx4_core: Adjust allocation type for buddy->bits (Kees Cook) [Orabug: 38667152]
• net/mlx5: HWS, Disallow matcher IP version mixing (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Colin Ian King) [Orabug: 38667152]
• net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kees Cook) [Orabug: 38667152]
• bonding: Fix multiple long standing offload races (Cosmin Ratiu) [Orabug: 38667152]
• xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free} (Cosmin Ratiu) [Orabug: 38667152]
• xfrm: Remove unneeded device check from validate_xmit_xfrm (Cosmin Ratiu) [Orabug: 38667152]
• xfrm: Use xdo.dev instead of xdo.real_dev (Cosmin Ratiu) [Orabug: 38667152]
• net: ptp: introduce .supported_perout_flags to ptp_clock_info (Jacob Keller) [Orabug: 38667152]
• net: ptp: introduce .supported_extts_flags to ptp_clock_info (Jacob Keller) [Orabug: 38667152]
• igb: reject invalid external timestamp requests for 82580-based HW (Jacob Keller) [Orabug: 38667152]
• platform/mellanox: Rename field to improve code readability (Vadim Pasternak) [Orabug: 38667152]
• net/mlx5: HWS, Export action STE tables to debugfs (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Free unused action STE tables (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Cleanup matcher action STE table (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Use the new action STE pool (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Implement action STE pool (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Fix pool size optimization (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Add fullness tracking to pool (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Cleanup after pool refactoring (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Refactor pool implementation (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Make pool single resource (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Remove unused element array (Vlad Dogaru) [Orabug: 38667152]
• net/mlx5: HWS, Fix matcher action template attach (Vlad Dogaru) [Orabug: 38667152]
• RDMA: Replace msecs_to_jiffies with secs_to_jiffies for timeout (Peng Jiang) [Orabug: 38667152]
• RDMA/mlx5: convert timeouts to secs_to_jiffies() (Easwar Hariharan) [Orabug: 38667152]
• gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Joshua Washington) [Orabug: 38667152]
• net: lan743x: reject unsupported external timestamp requests (Jacob Keller) [Orabug: 38667152]
• renesas: reject PTP_STRICT_FLAGS as unsupported (Jacob Keller) [Orabug: 38667152]
• eth: bnxt: remove most dependencies on RTNL (Stanislav Fomichev) [Orabug: 38667152]
• dma-mapping: remove an outdated comment from dma-map-ops.h (Sui Jingfeng) [Orabug: 38667152]
• Revert 'RDMA/core: Silence oversized kvmalloc() warning' (Mikhael Goikhman) [Orabug: 38667152]
• eth: bnxt: fix deadlock when xdp is attached or detached (Taehee Yoo) [Orabug: 38667152]
• xdp: create locked/unlocked instances of xdp redirect target setters (Joshua Washington) [Orabug: 38667152]
• gve: introduce config-based allocation for XDP (Joshua Washington) [Orabug: 38667152]
• gve: Add RSS cache for non RSS device option scenario (Ziwei Xiao) [Orabug: 38667152]
• virtio_pci: drop kernel.h (Michael S. Tsirkin) [Orabug: 38667152]
• dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings (Pranjal Shrivastava) [Orabug: 38667152]
• macsec: sync features on RTM_NEWLINK (Stanislav Fomichev) [Orabug: 38667152,39590858] {CVE-2025-39874}
• net: dev_ioctl: take ops lock in hwtstamp lower paths (Carolina Jubran) [Orabug: 38667152,39590854] {CVE-2025-39908}
• hamradio: ignore ops-locked netdevs (Stanislav Fomichev) [Orabug: 38667152]
• net: lapbether: ignore ops-locked netdevs (Stanislav Fomichev) [Orabug: 38667152]
• macsec: set IFF_UNICAST_FLT priv flag (Stanislav Fomichev) [Orabug: 38667152]
• team: replace team lock with rtnl lock (Stanislav Fomichev) [Orabug: 38667152,39590857] {CVE-2025-39733}
• net: prevent a NULL deref in rtnl_create_link() (Eric Dumazet) [Orabug: 38667152,39590851] {CVE-2025-38271}
• hv_netvsc: fix potential deadlock in netvsc_vf_setxdp() (Saurabh Singh Sengar) [Orabug: 38667152]
• virtio-pci: Fix result size returned for the admin command completion (Israel Rukshin) [Orabug: 38667152,39590859] {CVE-2025-38314}
• af_packet: move notifier's packet_dev_mc out of rcu critical section (Stanislav Fomichev) [Orabug: 38667152]
• team: grab team lock during team_change_rx_flags (Stanislav Fomichev) [Orabug: 38667152]
• net: devmem: fix kernel panic when netlink socket close after module unload (Taehee Yoo) [Orabug: 38667152]
• net: Lock lower level devices when updating features (Cosmin Ratiu) [Orabug: 38667152]
• net: add missing instance lock to dev_set_promiscuity (Stanislav Fomichev) [Orabug: 38667152]
• net: Lock netdevices during dev_shutdown (Cosmin Ratiu) [Orabug: 38667152]
• net: fix the missing unlock for detached devices (Jakub Kicinski) [Orabug: 38667152]
• virtio_pci: Use self group type for cap commands (Daniel Jurgens) [Orabug: 38667152]
• net: don't try to ops lock uninitialized devs (Jakub Kicinski) [Orabug: 38667152]
• net: don't mix device locking in dev_close_many() calls (Jakub Kicinski) [Orabug: 38667152]
• bonding: hold ops lock around get_link (Stanislav Fomichev) [Orabug: 38667152]
• rtnetlink: Fix bad unlock balance in do_setlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• bpf: add missing ops lock around dev_xdp_attach_link (Stanislav Fomichev) [Orabug: 38667152]
• eth: gve: add missing netdev locks on reset and shutdown paths (Jakub Kicinski) [Orabug: 38667152]
• net: fix use-after-free in the netdev_nl_sock_priv_destroy() (Taehee Yoo) [Orabug: 38667152]
• net: lapbether: use netdev_lockdep_set_classes() helper (Eric Dumazet) [Orabug: 38667152]
• net: move replay logic to tc_modify_qdisc (Stanislav Fomichev) [Orabug: 38667152]
• hamradio: use netdev_lockdep_set_classes() helper (Eric Dumazet) [Orabug: 38667152]
• bpf: fix a possible NULL deref in bpf_map_offload_map_alloc() (Eric Dumazet) [Orabug: 38667152]
• net: Prevent use after free in netif_napi_set_irq_locked() (Dan Carpenter) [Orabug: 38667152]
• iavf: fix circular lock dependency with netdev_lock (Jacob Keller) [Orabug: 38667152]
• s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH (Alexandra Winter) [Orabug: 38667152]
• iavf: Fix a locking bug in an error path (Bart Van Assche) [Orabug: 38667152]
• wifi: mt76: move napi_enable() from under BH (Jakub Kicinski) [Orabug: 38667152]
• eth: via-rhine: fix calling napi_enable() in atomic context (Jakub Kicinski) [Orabug: 38667152]
• eth: niu: fix calling napi_enable() in atomic context (Jakub Kicinski) [Orabug: 38667152]
• eth: 8139too: fix calling napi_enable() in atomic context (Jakub Kicinski) [Orabug: 38667152]
• net: mvneta: fix locking in mvneta_cpu_online() (Harshit Mogalapalli) [Orabug: 38667152]
• net: destroy dev->lock later in free_netdev() (Eric Dumazet) [Orabug: 38667152]
• rtnetlink: fix rtnl_dump_ifinfo() error path (Eric Dumazet) [Orabug: 38667152]
• rtnetlink: Fix an error handling path in rtnl_newlink() (Christophe Jaillet) [Orabug: 38667152]
• xdp: double protect netdev->xdp_flags with netdev->lock (Jakub Kicinski) [Orabug: 38667152]
• netdev: add 'ops compat locking' helpers (Jakub Kicinski) [Orabug: 38667152]
• net: designate XSK pool pointers in queues as 'ops protected' (Jakub Kicinski) [Orabug: 38667152]
• net: avoid potential race between netdev_get_by_index_lock() and netns switch (Jakub Kicinski) [Orabug: 38667152]
• net: hold instance lock during NETDEV_REGISTER/UP (Stanislav Fomichev) [Orabug: 38667152]
• net: switch to netif_disable_lro in inetdev_init (Stanislav Fomichev) [Orabug: 38667152]
• net: protect rxq->mp_params with the instance lock (Jakub Kicinski) [Orabug: 38667152]
• net: designate queue -> napi linking as 'ops protected' (Jakub Kicinski) [Orabug: 38667152]
• net: designate queue counts as 'double ops protected' by instance lock (Jakub Kicinski) [Orabug: 38667152]
• net: explain 'protection types' for the instance lock (Jakub Kicinski) [Orabug: 38667152]
• net: constify dev pointer in misc instance lock helpers (Jakub Kicinski) [Orabug: 38667152]
• net: remove netif_set_real_num_rx_queues() helper for when SYSFS=n (Jakub Kicinski) [Orabug: 38667152]
• net: bubble up taking netdev instance lock to callers of net_devmem_unbind_dmabuf() (Jakub Kicinski) [Orabug: 38667152]
• net: reorder dev_addr_sem lock (Stanislav Fomichev) [Orabug: 38667152]
• Revert 'net: replace dev_addr_sem with netdev instance lock' (Stanislav Fomichev) [Orabug: 38667152]
• net: drop rtnl_lock for queue_mgmt operations (Stanislav Fomichev) [Orabug: 38667152]
• net: add granular lock for the netdev netlink socket (Stanislav Fomichev) [Orabug: 38667152]
• net: create netdev_nl_sock to wrap bindings list (Stanislav Fomichev) [Orabug: 38667152]
• net: add helpers for setting a memory provider on an rx queue (David Wei) [Orabug: 38667152]
• net: page_pool: add memory provider helpers (Pavel Begunkov) [Orabug: 38667152]
• net: prepare for non devmem TCP memory providers (Pavel Begunkov) [Orabug: 38667152]
• net: page_pool: add a mp hook to unregister_netdevice* (Pavel Begunkov) [Orabug: 38667152]
• net: page_pool: add callback for mp info printing (Pavel Begunkov) [Orabug: 38667152]
• netdev: add io_uring memory provider info (David Wei) [Orabug: 38667152]
• net: generalise net_iov chunk owners (Pavel Begunkov) [Orabug: 38667152]
• net: prefix devmem specific helpers (Pavel Begunkov) [Orabug: 38667152]
• page_pool: disable sync for cpu for dmabuf memory provider (Mina Almasry) [Orabug: 38667152]
• net: page_pool: create page_pool_alloc_netmem (Mina Almasry) [Orabug: 38667152]
• net: page_pool: rename page_pool_alloc_netmem to *_netmems (Mina Almasry) [Orabug: 38667152]
• net: move misc netdev_lock flavors to a separate header (Jakub Kicinski) [Orabug: 38667152]
• net: add option to request netdev instance lock (Stanislav Fomichev) [Orabug: 38667152]
• net: replace dev_addr_sem with netdev instance lock (Stanislav Fomichev) [Orabug: 38667152]
• net: hold netdev instance lock during ndo_bpf (Stanislav Fomichev) [Orabug: 38667152]
• net: disallow setup single buffer XDP when tcp-data-split is enabled. (Taehee Yoo) [Orabug: 38667152]
• net: ethtool: add hds_config member in ethtool_netdev_state (Taehee Yoo) [Orabug: 38667152]
• net: hold netdev instance lock during sysfs operations (Stanislav Fomichev) [Orabug: 38667152]
• net: hold netdev instance lock during ioctl operations (Stanislav Fomichev) [Orabug: 38667152]
• net: hold netdev instance lock during rtnetlink operations (Stanislav Fomichev) [Orabug: 38667152]
• net: hold netdev instance lock during queue operations (Stanislav Fomichev) [Orabug: 38667152]
• net: move aRFS rmap management and CPU affinity to core (Ahmed Zaki) [Orabug: 38667152]
• net: warn if NAPI instance wasn't shut down (Jakub Kicinski) [Orabug: 38667152]
• net: protect napi->irq with netdev_lock() (Jakub Kicinski) [Orabug: 38667152]
• bnxt: Add support for persistent NAPI config (Joe Damato) [Orabug: 38667152]
• gve: Map NAPI instances to queues (Joe Damato) [Orabug: 38667152]
• gve: Map IRQs to NAPI instances (Joe Damato) [Orabug: 38667152]
• net: devmem: don't call queue stop / start when the interface is down (Jakub Kicinski) [Orabug: 38667152]
• net: refactor netdev_rx_queue_restart() to use local qops (Jakub Kicinski) [Orabug: 38667152]
• net: hold netdev instance lock during qdisc ndo_setup_tc (Stanislav Fomichev) [Orabug: 38667152]
• net: sched: wrap doit/dumpit methods (Stanislav Fomichev) [Orabug: 38667152]
• net: hold netdev instance lock during nft ndo_setup_tc (Stanislav Fomichev) [Orabug: 38667152]
• net: hold netdev instance lock during ndo_open/ndo_stop (Stanislav Fomichev) [Orabug: 38667152]
• net: plumb extack in __dev_change_net_namespace() (Nicolas Dichtel) [Orabug: 38667152]
• net: advertise netns_immutable property via netlink (Nicolas Dichtel) [Orabug: 38667152]
• net: protect threaded status of NAPI with netdev_lock() (Jakub Kicinski) [Orabug: 38667152]
• net: protect NAPI enablement with netdev_lock() (Jakub Kicinski) [Orabug: 38667152]
• net: protect netdev->napi_list with netdev_lock() (Jakub Kicinski) [Orabug: 38667152]
• net: make sure we retain NAPI ordering on netdev->napi_list (Jakub Kicinski) [Orabug: 38667152]
• net: add netdev->up protected by netdev_lock() (Jakub Kicinski) [Orabug: 38667152]
• net: add helpers for lookup and walking netdevs under netdev_lock() (Jakub Kicinski) [Orabug: 38667152]
• net: warn during dump if NAPI list is not sorted (Jakub Kicinski) [Orabug: 38667152]
• net: make netdev_lock() protect netdev->reg_state (Jakub Kicinski) [Orabug: 38667152]
• net: add netdev_lock() / netdev_unlock() helpers (Jakub Kicinski) [Orabug: 38667152]
• eth: iavf: extend the netdev_lock usage (Jakub Kicinski) [Orabug: 38667152]
• net: cleanup init_dummy_netdev_core() (Jakub Kicinski) [Orabug: 38667152]
• net: remove init_dummy_netdev() (Jakub Kicinski) [Orabug: 38667152]
• rtnetlink: Protect struct rtnl_af_ops with SRCU. (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Return int from rtnl_af_register(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Call rtnl_link_get_net_capable() in do_setlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Clean up rtnl_setlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Clean up rtnl_dellink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Fetch IFLA_LINK_NETNSID in rtnl_newlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Call rtnl_link_get_net_capable() in rtnl_newlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Protect struct rtnl_link_ops with SRCU. (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Move ops->validate to rtnl_newlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Move rtnl_link_ops_get() and retry to rtnl_newlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Move simple validation from __rtnl_newlink() to rtnl_newlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Factorise do_setlink() path from __rtnl_newlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Call validate_linkmsg() in do_setlink(). (Kuniyuki Iwashima) [Orabug: 38667152]
• rtnetlink: Allocate linkinfo[] as struct rtnl_newlink_tbs. (Kuniyuki Iwashima) [Orabug: 38667152]
• iavf: add support to exchange qos capabilities (Sudheer Mogilappagari) [Orabug: 38667152]
• testing: net-drv: add basic shaper test (Paolo Abeni) [Orabug: 38667152]
• iavf: Add net_shaper_ops support (Sudheer Mogilappagari) [Orabug: 38667152]
• mm/hmm: provide generic DMA managing logic (Leon Romanovsky) [Orabug: 38667152]
• mm/hmm: let users to tag specific PFN with DMA mapped bit (Leon Romanovsky) [Orabug: 38667152]
• docs: core-api: document the IOVA-based API (Christoph Hellwig) [Orabug: 38667152]
• dma-mapping: add a dma_need_unmap helper (Christoph Hellwig) [Orabug: 38667152]
• dma-mapping: Implement link/unlink ranges API (Leon Romanovsky) [Orabug: 38667152]
• iommu/dma: Factor out a iommu_dma_map_swiotlb helper (Christoph Hellwig) [Orabug: 38667152]
• dma-mapping: Provide an interface to allow allocate IOVA (Leon Romanovsky) [Orabug: 38667152]
• iommu: add kernel-doc for iommu_unmap_fast (Leon Romanovsky) [Orabug: 38667152]
• iommu: generalize the batched sync after map interface (Christoph Hellwig) [Orabug: 38667152]
• dma-mapping: move the PCI P2PDMA mapping helpers to pci-p2pdma.h (Christoph Hellwig) [Orabug: 38667152]
• PCI/P2PDMA: Refactor the p2pdma mapping helpers (Christoph Hellwig) [Orabug: 38667152]
• net: ethtool: Adjust exactly ETH_GSTRING_LEN-long stats to use memcpy (Kees Cook) [Orabug: 38667152]
• compiler_types: Introduce __nonstring_array (Kees Cook) [Orabug: 38667152]
• net: freescale: use ethtool string helpers (Rosen Penev) [Orabug: 38667152]
• vfio/pci: drop nth_page() usage within SG entry (David Hildenbrand) [Orabug: 38667152]
• mm: alloc_pages_bulk: rename API (Luiz Capitulino) [Orabug: 38667152]
• mm: alloc_pages_bulk_noprof: drop page_list argument (Luiz Capitulino) [Orabug: 38667152]
• vfio/virtio: Add PRE_COPY support for live migration (Yishai Hadas) [Orabug: 38667152]
• vfio/virtio: Add support for the basic live migration functionality (Yishai Hadas) [Orabug: 38667152]
• virtio-pci: Introduce APIs to execute device parts admin commands (Yishai Hadas) [Orabug: 38667152]
• virtio: Manage device and driver capabilities via the admin commands (Yishai Hadas) [Orabug: 38667152]
• virtio: Extend the admin command to include the result size (Yishai Hadas) [Orabug: 38667152]
• virtio_pci: Introduce device parts access commands (Yishai Hadas) [Orabug: 38667152]