ELSA-2026-50160

Описание

[6.12.0-200.74.27]

• Revert 'uek-rpm: update kABI for FIPS regarding crypto_user' (Saeed Mirzamohammadi) [Orabug: 39033195]
• Revert 'fips: remove crypto_user from the FIPS module' (Saeed Mirzamohammadi) [Orabug: 39033195]
• Revert 'crypto_user: use FIPS algorithm list when FIPS module is enabled' (Saeed Mirzamohammadi) [Orabug: 39033195]
• RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init() (Abhijit Gangurde) [Orabug: 39006240]
• uek-rpm: enable ionic rdma module build in UEK (Qing Huang) [Orabug: 38331822]
• RDMA/ionic: Fix memory leak of admin q_wr (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Use ether_addr_copy instead of memcpy (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Fix build failure on SPARC due to xchg() operand size (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Add Makefile/Kconfig to kernel build environment (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Implement device stats ops (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Register device ops for miscellaneous functionality (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Register device ops for datapath (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Register device ops for control path (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Create device queues to support admin operations (Abhijit Gangurde) [Orabug: 38331822]
• RDMA/ionic: Register auxiliary module for ionic ethernet adapter (Abhijit Gangurde) [Orabug: 38331822]
• RDMA: Add IONIC to rdma_driver_id definition (Abhijit Gangurde) [Orabug: 38331822]
• net: ionic: Provide doorbell and CMB region information (Abhijit Gangurde) [Orabug: 38331822]
• net: ionic: Provide interrupt allocation support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
• net: ionic: Provide RDMA reset support for the RDMA driver (Abhijit Gangurde) [Orabug: 38331822]
• net: ionic: Export the APIs from net driver to support device commands (Abhijit Gangurde) [Orabug: 38331822]
• net: ionic: Update LIF identity with additional RDMA capabilities (Abhijit Gangurde) [Orabug: 38331822]
• net: ionic: Create an auxiliary device for rdma driver (Abhijit Gangurde) [Orabug: 38331822]

[6.12.0-200.74.26]

• pds_core: init viftype default in declaration (Shannon Nelson) [Orabug: 38467343]
• pds_core: smaller adminq poll starting interval (Shannon Nelson) [Orabug: 38467343]
• pds_core: Allocate pdsc_viftype_defaults copy with ARRAY_SIZE() (Kees Cook) [Orabug: 38467343]
• pds_fwctl: Fix type and endian complaints (Shannon Nelson) [Orabug: 38467343]
• x86/kexec: add a sanity check on previous kernel's ima kexec buffer (Harshit Mogalapalli) [Orabug: 38608974]
• of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() (Harshit Mogalapalli) [Orabug: 38608974]
• ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli) [Orabug: 38608974]
• rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870356]
• uek-rpm: set default kfence sampling interval to 0 (Imran Khan) [Orabug: 38913539]
• Revert 'NFS: Avoid changing nlink when file removes and attribute updates race' (Samasth Norway Ananda) [Orabug: 38925844]
• crypto_user: use FIPS algorithm list when FIPS module is enabled (Saeed Mirzamohammadi) [Orabug: 38934207]
• uek-rpm: update kABI for FIPS regarding crypto_user (Saeed Mirzamohammadi) [Orabug: 38934207]
• fips: remove crypto_user from the FIPS module (Saeed Mirzamohammadi) [Orabug: 38934207]
• alloc_tag: prevent enabling memory profiling if it was shut down (Suren Baghdasaryan) [Orabug: 38945943]
• alloc_tag: avoid current->alloc_tag manipulations when profiling is disabled (Suren Baghdasaryan) [Orabug: 38945943]
• mm/codetag: fix arg in pgalloc_tag_copy alloc_tag_sub (Sourav Panda) [Orabug: 38945943]
• uek-rpm: fips: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38949665]
• selftests/mm: skip pkey_sighandler_tests if support is missing (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: rename pkey register macro (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: use sys_pkey helpers consistently (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: ensure non-global pkey symbols are marked static (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: remove empty pkey helper definition (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: ensure pkey-*.h define inline functions only (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: define types using typedef in pkey-helpers.h (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: remove unused pkey helpers (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: fix -Warray-bounds warnings in pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: Define PKEY_UNRESTRICTED for pkey_sighandler_tests (Harshit Mogalapalli) [Orabug: 38969139]
• selftests/mm: Use generic pkey register manipulation (Harshit Mogalapalli) [Orabug: 38969139]
• ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977643]
• Octeontx2-af: Add proper checks for fwdata (Hariprasad Kelam) [Orabug: 38988497]
• genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001909]
• LTS version: v6.12.74 (Jack Vogel)
• USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
• f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (Yongpeng Yang)
• f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
• iommu/arm-smmu-qcom: do not register driver in probe() (Danilo Krummrich)
• f2fs: fix to avoid mapping wrong physical block for swapfile (Chao Yu)
• f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
• f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly (Chao Yu)
• f2fs: fix to add gc count stat in f2fs_gc_range (Zhiguo Niu)
• fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
• fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
• cpuset: Fix missing adaptation for cpuset_is_populated (Chen Ridong)
• Revert 'wireguard: device: enable threaded NAPI' (Daniel Borkmann)
• LoongArch: Rework KASAN initialization for PTW-enabled systems (Tiezhu Yang)
• mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (David Hildenbrand)
• mm/hugetlb: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
• mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
• mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Jane Chu)
• gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
• ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
• drm/amd/display: remove assert around dpp_base replacement (Melissa Wen)
• drm/amd/display: extend delta clamping logic to CM3 LUT helper (Melissa Wen)
• tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (Deepanshu Kartikey)
• ASoC: cs42l43: Correct handling of 3-pole jack load detection (Charles Keepax)
• platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
• platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro (Gongqi)
• ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 (Breno Baptista)
• ASoC: amd: yc: Add quirk for HP 200 G2a 16 (Dirk Su)
• ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 (Tagir Garaev)
• platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
• drm/tegra: hdmi: sor: Fix error: variable 'j' set but not used (Brahmajit Das)
• romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
• ALSA: hda/realtek - fixed speaker no sound (Kailang Yang)
• ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Ricardo Rivera-Matos)
• ALSA: hda/realtek: Add quirk for Inspur S14-G1 (Zhang Heng)
• gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
• ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list (Anatolii Shirykalov)
• ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
• bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
• bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
• bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code (Arnd Bergmann)
• bnxt_en: Change FW message timeout warning (Michael Chan)
• scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
• LTS version: v6.12.73 (Jack Vogel)
• Revert 'driver core: enforce device_lock for driver_match_device()' (Greg Kroah-Hartman)
• LTS version: v6.12.72 (Jack Vogel)
• gpio: omap: do not register driver in probe() (Danilo Krummrich)
• wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
• PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
• xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
• erofs: fix UAF issue for file-backed mounts w/ directio option (Chao Yu)
• mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
• bus: mhi: host: pci_generic: Add Telit FE990B40 modem support (Daniele Palmas)
• scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
• scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
• scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
• scsi: qla2xxx: Allow recovery for tape devices (Shreyas Deodhar)
• scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
• wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
• nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
• crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
• crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
• crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
• crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
• crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug: 38997976] {CVE-2025-71231}
• Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB (Zenm Chen)
• driver core: enforce device_lock for driver_match_device() (Gui-Dong Han)
• smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
• ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (Namjae Jeon)
• smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug: 38998059] {CVE-2026-23230}
• LTS version: v6.12.71 (Jack Vogel)
• vsock/test: verify socket options after setting them (Konstantin Shkolnyy)
• io_uring/rw: recycle buffers manually for non-mshot reads (Jens Axboe)
• LTS version: v6.12.70 (Jack Vogel)
• gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (Andy Shevchenko)
• ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. (Werner Sembach)
• spi: tegra114: Preserve SPI mode bits in def_command1_reg (Vishwaroop A)
• spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
• spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
• spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
• spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
• spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
• spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
• ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
• ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (Sergey Shtylyov)
• ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
• netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 38970170] {CVE-2026-23111}
• hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
• drm/xe/pm: Disable D3Cold for BMG only on specific platforms (Karthik Poosa)
• drm/xe/pm: Also avoid missing outer rpm warning on system suspend (Rodrigo Vivi)
• drm/xe/query: Fix topology query pointer advance (Shuicheng Lin)
• drm/mgag200: fix mgag200_bmc_stop_scanout() (Jacob Keller)
• net: gro: fix outer network offset (Paolo Abeni)
• net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() (Chen Ni)
• drm/amd/display: fix wrong color value mapping on MCM shaper LUT (Melissa Wen)
• tipc: use kfree_sensitive() for session key material (Daniel Hodges)
• net: don't touch dev->stats in BPF redirect paths (Jakub Kicinski)
• net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
• macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
• net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module (Marek Behun)
• net: sfp: convert sfp quirks to modify struct sfp_module_support (Russell King)
• net: sfp: pre-parse the module support (Russell King)
• net: phy: add phy_interface_copy() (Russell King)
• net: phy: add phy_interface_weight() (Russell King)
• dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
• net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
• net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
• net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
• dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
• net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
• net: add skb_header_pointer_careful() helper (Eric Dumazet)
• smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
• platform/x86/intel/tpmi/plr: Make the file domain/status writeable (Ricardo Neri)
• platform/x86: hp-bioscfg: Skip empty attribute names (Mario Limonciello)
• platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
• platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
• ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio (Martin Hamilton)
• btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
• wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
• wifi: mac80211: correctly check if CSA is active (Miri Korenblit)
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985169] {CVE-2026-23216}
• ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970453] {CVE-2026-23193}
• wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
• regmap: maple: free entry on mas_store_gfp() failure (Kaushlendra Kumar)
• spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization (Devyn Liu)
• ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
• ASoC: amd: yc: Fix microphone on ASUS M6500RE (Radhi Bajahaw)
• nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
• nvme-fc: release admin tagset if init fails (Chaitanya Kulkarni)
• ASoC: simple-card-utils: Check device node before overwrite direction (Shengjiu Wang)
• ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
• wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
• HID: logitech: add HID++ support for Logitech MX Anywhere 3S (Dennis Marttinen)
• ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Ma Wupeng)
• drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
• HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe Da Conceicao Alves)
• HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
• HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
• netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
• PCI: qcom: Remove ASPM L0s support for MSM8996 SoC (Manivannan Sadhasivam)
• ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
• ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 (Matous Lansky)
• HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
• HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
• riscv: Sanitize syscall table indexing under speculation (Lukas Gerlach)
• btrfs: fix reservation leak in some error paths when inserting inline extent (Filipe Manana)
• HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (Daytoncl)
• HID: intel-ish-hid: Update ishtp bus match to support device ID table (Zhang Lixu)
• smb/server: fix refcount leak in parse_durable_handle_context() (Zhangguodong)
• LoongArch: Enable exception fixup for specific ADE subcode (Duan Chenghao)
• smb/server: fix refcount leak in smb2_open() (Zhangguodong)
• md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
• LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED (Huacai Chen)
• smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (Zhangguodong)
• block,bfq: fix aux stat accumulation destination (Shechenglong)
• net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
• wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
• wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
• tracing: Fix ftrace event field alignments (Steven Rostedt)
• procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
• KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures (Zhiquan Li)
• binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
• binder: fix BR_FROZEN_REPLY error log (Carlos Llamas)
• hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
• ublk: fix deadlock when reading partition table (Ming Lei)
• tools/power turbostat: fix GCC9 build regression (Todd Brandt)
• PCI/ERR: Ensure error recoverability at all times (Lukas Wunner)
• KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
• Revert 'drm/amd: Check if ASPM is enabled from PCIe subsystem' (Bert Karwatzki)
• mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
• gve: Correct ethtool rx_dropped calculation (Max Yuan)
• gve: Fix stats report corruption on queue count change (Debarghya Kundu)
• ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug: 38970590] {CVE-2026-23201}
• ARM: 9468/1: fix memset64() on big-endian (Thomas Weissschuh)
• rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
• ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
• mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
• pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (Xu Yang)
• pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup (Xu Yang)
• pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset (Jacky Bai)
• pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup (Xu Yang)
• pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state (Gabor Juhos)
• ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
• platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)
• x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
• x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
• nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
• LTS version: v6.12.69 (Jack Vogel)
• bpf/selftests: test_select_reuseport_kern: Remove unused header (Alexis Lothore)
• RDMA/mana_ib: Handle net event for pointing to the current netdev (Long Li)
• net: mana: Change the function signature of mana_get_primary_netdev_rcu (Long Li)
• pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
• drm/amdgpu/gfx11: adjust KGQ reset sequence (Alex Deucher)
• writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
• perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
• perf: Simplify get_perf_callchain() user logic (Josh Poimboeuf)
• mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
• pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins (Krzysztof Kozlowski)
• net/sched: act_ife: convert comma to semicolon (Chen Ni)
• btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
• Revert 'drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)' (John Ogness)
• wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
• mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
• libbpf: Fix -Wdiscarded-qualifiers under C23 (Mikhail Gavrilov)
• ksmbd: smbd: fix dma_unmap_sg() nents (Thomas Fourier)
• rxrpc: Fix data-race warning and potential load/store tearing (David Howells)
• cgroup: Fix kernfs_node UAF in css_free_rwork_fn (T.J. Mercier)
• rust: kbuild: support -Cjump-tables=n for Rust 1.93.0 (Miguel Ojeda)
• gpiolib: acpi: Fix potential out-of-boundary left shift (Andy Shevchenko)
• drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (Alex Deucher)
• drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug: 38970348] {CVE-2026-23163}
• drm/amdgpu/gfx12: fix wptr reset in KGQ init (Alex Deucher)
• drm/amdgpu/gfx11: fix wptr reset in KGQ init (Alex Deucher)
• drm/amdgpu/gfx10: fix wptr reset in KGQ init (Alex Deucher)
• drm/amdgpu/soc21: fix xclk for APUs (Alex Deucher)
• drm/imx/tve: fix probe device leak (Johan Hovold)
• drm/msm/a6xx: fix bogus hwcg register updates (Johan Hovold)
• scripts: generate_rust_analyzer: Add compiler_builtins -> core dep (Tamir Duberstein)
• scripts: generate_rust_analyzer: compile sysroot with correct edition (Tamir Duberstein)
• scripts: generate_rust_analyzer: remove sysroot assertion (Onur Ozkan)
• net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
• mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
• flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
• selftests: mptcp: join: fix local endp not being tracked (Matthieu Baerts)
• selftests: mptcp: check subflow errors in close events (Matthieu Baerts)
• selftests: mptcp: check no dup close events after error (Matthieu Baerts)
• mptcp: only reset subflow errors when propagated (Matthieu Baerts)
• gpio: rockchip: Stop calling pinctrl for set_direction (Robin Murphy)
• nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
• efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
• scsi: qla2xxx: edif: Fix dma_free_coherent() size (Thomas Fourier)
• gpio: pca953x: mask interrupts in irq shutdown (Martin Larsson)
• ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO (Zhang Heng)
• scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() (Haoxiang Li)
• ASoC: fsl: imx-card: Do not force slot width to sample width (Fabio Estevam)
• rust: kbuild: give --config-path to rustfmt in .rsi target (Miguel Ojeda)
• rust: rbtree: fix documentation typo in CursorMut peek_next method (Hang Shu)
• riscv: compat: fix COMPAT_UTS_MACHINE definition (Han Gao)
• pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
• sched/deadline: Fix 'stuck' dl_server (Peter Zijlstra)
• sched/deadline: Document dl_server (Peter Zijlstra)
• dma/pool: distinguish between missing and exhausted atomic pools (Sai Sree Kartheek Adivi)
• bcache: fix I/O accounting leak in detached_dev_do_request (Shida Zhang)
• bcache: use bio cloning for detached device requests (Shida Zhang)
• bcache: fix improper use of bi_end_io (Shida Zhang)
• gpio: virtuser: fix UAF in configfs release path (Yuhao Huang)
• gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler (Denis Sergeev)
• ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (Tagir Garaev)
• scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() (Kery Qi)
• net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Jianbo Liu)
• net/mlx5: Fix vhca_id access call trace use before alloc (Parav Pandit)
• net/mlx5: Initialize events outside devlink lock (Cosmin Ratiu)
• net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Shay Drory)
• net: phy: micrel: fix clk warning when removing the driver (Wei Fang)
• net: bridge: fix static key check (Martin Kaiser)
• nfc: nci: Fix race between rfkill and nci_unregister_device(). (Kuniyuki Iwashima)
• net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
• ice: stop counting UDP csum mismatch as rx_errors (Jesse Brandeburg)
• ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
• nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (Kuniyuki Iwashima)
• rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
• net: wwan: t7xx: fix potential skb->frags overflow in RX path (Kery Qi)
• ipv6: use the right ifindex when replying to icmpv6 from localhost (Fernando Fernandez Mancera)
• net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() (Zilin Guan)
• bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
• octeon_ep: Fix memory leak in octep_device_setup() (Zilin Guan)
• net: bcmasp: fix early exit leak with fixed phy (Justin Chen)
• can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (Marc Kleine-Budde)
• net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Zilin Guan)
• Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
• Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
• can: at91_can: Fix memory leak in at91_can_probe() (Zilin Guan)
• LTS version: v6.12.68 (Jack Vogel)
• vsock/virtio: Fix message iterator handling on transmit path (Will Deacon)
• net: Introduce skb_copy_datagram_from_iter_full() (Will Deacon)
• vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (Will Deacon)
• vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers (Will Deacon)
• vsock/virtio: Rename virtio_vsock_skb_rx_put() (Will Deacon)
• vsock/virtio: Move SKB allocation lower-bound check to callers (Will Deacon)
• vsock/virtio: Rename virtio_vsock_alloc_skb() (Will Deacon)
• vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() (Will Deacon)
• wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
• btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
• accel/ivpu: Fix race condition when unbinding BOs (Tomasz Rusinowicz)
• fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
• sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
• exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
• iio: adc: exynos_adc: fix OF populate on driver rebind (Johan Hovold)
• iio: core: add separate lockdep class for info_exist_lock (Rasmus Villemoes)
• iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Andy Shevchenko)
• iio: core: add missing mutex_destroy in iio_dev_release() (Andy Shevchenko)
• arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s (Geraldo Nascimento)
• bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
• selftests/bpf: Check for timeout in perf_link test (Ihor Solodrai)
• can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
• dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA (Siddharth Vadapalli)
• migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
• gpio: cdev: Correct return code on memory allocation failure (Tzung-Bi Shih)
• drm/amdgpu: remove frame cntl for gfx v12 (Likun Gao)
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
• can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
• can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930881] {CVE-2026-23061}
• can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
• net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick (Hamza Mahfooz)
• irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
• perf/x86/intel: Do not enable BTS for guests (Fernand Sieber)
• pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (Ming Qian)
• platform/x86: hp-bioscfg: Fix automatic module loading (Mario Limonciello)
• netrom: fix double-free in nr_route_frame() (Jeongjun Park)
• uacce: ensure safe queue release with state management (Chenghai Huang)
• uacce: implement mremap in uacce_vm_ops to return -EPERM (Yang Shen)
• uacce: fix isolate sysfs check condition (Chenghai Huang)
• uacce: fix cdev handling in the cleanup path (Wenkai Lin)
• s390/ap: Fix wrong APQN fill calculation (Harald Freudenberger)
• mei: trace: treat reg parameter as string (Alexander Usyskin)
• intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
• tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
• slimbus: core: fix device reference leak on report present (Johan Hovold)
• slimbus: core: fix runtime PM imbalance on report present (Johan Hovold)
• octeontx2: Fix otx2_dma_map_page() error return code (Thomas Fourier)
• arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
• arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
• wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
• wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (Dan Carpenter)
• wifi: ath12k: fix dma_free_coherent() pointer (Thomas Fourier)
• wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
• drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (Lyude Paul)
• mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (Shawn Lin)
• mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (Matthew Schwartz)
• ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
• ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
• iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (Andreas Kubrich)
• iio: chemical: scd4x: fix reported channel endianness (Fiona Klute)
• iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot (Thorsten Blum)
• iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (Pei Xiao)
• iio: adc: ad9467: fix ad9434 vref mask (Tomas Melin)
• iio: accel: iis328dq: fix gain values (Markus Koeniger)
• iio: accel: adxl380: fix handling of unavailable 'INT1' interrupt (Francesco Lavra)
• of: platform: Use default match table for /firmware (Rob Herring)
• of: fix reference count leak in of_alias_scan() (Weigang He)
• leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
• keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal (Srish Srinivasan)
• tpm: Compare HMAC values in constant time (Eric Biggers)
• x86: make page fault handling disable interrupts properly (Cedric Xing)
• dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
• net/sched: act_ife: avoid possible NULL deref (Eric Dumazet)
• vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
• vsock/test: fix seqpacket message bounds test (Stefano Garzarella)
• vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug: 38930919] {CVE-2026-23069}
• net: openvswitch: fix data race in ovs_vport_get_upcall_stats (David Yang)
• octeontx2-af: Fix error handling (Ratheesh Kannoth)
• net: dsa: fix off-by-one in maximum bridge ID determination (Vladimir Oltean)
• bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
• selftests: net: amt: wait longer for connection before sending packets (Taehee Yoo)
• be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
• drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (Alex Ramirez)
• drm/nouveau: add missing DCB connector types (Alex Ramirez)
• drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (Timur Kristof)
• drm/amd/pm: Don't clear SI SMC table when setting power limit (Timur Kristof)
• sched/fair: Fix pelt clock sync when entering idle (Vincent Guittot)
• clocksource: Reduce watchdog readout delay limit to prevent false positives (Thomas Gleixner)
• usbnet: limit max_mtu based on device's hard_mtu (Laurent Vivier)
• ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
• mISDN: annotate data-race around dev->work (Eric Dumazet)
• net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue (Jijie Shao)
• net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M (Jijie Shao)
• be2net: fix data race in be_get_new_eqd (David Yang)
• net: hns3: fix data race in hns3_fetch_stats (David Yang)
• ice: Fix persistent failure in ice_get_rxfh (Cody Haas)
• netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
• drm/imagination: Wait for FW trace update command completion (Brajesh Gupta)
• ALSA: usb: Increase volume range that triggers a warning (Arun Raghavan)
• scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
• scsi: core: Wake up the error handler when final completions race against each other (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
• platform/x86/amd: Fix memory leak in wbrf_record() (Zilin Guan)
• riscv: clocksource: Fix stimecmp update hazard on RV32 (Naohiko Shimizu)
• kconfig: fix static linking of nconf (Arusekk)
• regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
• spi: spi-sprd-adi: Fix double free in probe error path (Felix Gu)
• interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug: 38970218] {CVE-2026-23123}
• iio: adc: ad7280a: handle spi_setup() errors in probe() (Pavel Zhigulin)
• iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (Francesco Lavra)
• io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
• mm/rmap: fix two comments related to huge_pmd_unshare() (David Hildenbrand)
• platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug: 38930890] {CVE-2026-23062}
• platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug: 38970247] {CVE-2026-23131}
• comedi: Fix getting range information for subdevices 16 to 255 (Ian Abbott)
• x86/kfence: avoid writing L1TF-vulnerable PTEs (Andrew Cooper)
• arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro (Ondrej Jirman)
• arm64: dts: rockchip: remove dangerous max-link-speed from helios64 (Geraldo Nascimento)
• scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
• scsi: storvsc: Process unsupported MODE_SENSE_10 (Long Li)
• Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (Feng)
• Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (Gongqi)
• Revert 'nfc/nci: Add the inconsistency check between the input data length and count' (Thadeu Lima de Souza Cascardo)
• w1: fix redundant counter decrement in w1_attach_slave_device() (Haoxiang Li)
• w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
• comedi: dmm32at: serialize use of paged registers (Ian Abbott)
• serial: 8250_pci: Fix broken RS485 for F81504/508/512 (Marnix Rijnart)
• wifi: mac80211: don't perform DA check on S1G beacon (Lachlan Hodges)
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug: 38930874] {CVE-2026-23060}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
• net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
• octeontx2: cn10k: fix RX flowid TCAM mask handling (Alok Tiwari)
• ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
• l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
• veth: fix data race in veth_get_ethtool_stats (David Yang)
• fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima)
• tools: ynl: Specify --no-line-number in ynl-regen.sh. (Kuniyuki Iwashima)
• gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
• amd-xgbe: avoid misleading per-packet error log (Raju Rangoju)
• sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
• can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
• selftests: net: fib-onlink-tests: Convert to use namespaces by default (Ricardo B. Marliere)
• l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
• bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
• net: usb: dm9601: remove broken SR9700 support (Ethan Nelson-Moore)
• vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}
• igc: fix race condition in TX timestamp read for register 0 (Chwee Lin Choong)
• igc: Restore default Qbv schedule when changing channels (Kurt Kanzenbach)
• ice: Fix incorrect timeout ice_release_res() (Ding Hui)
• ice: Avoid detrimental cleanup for bond during interface stop (Dave Ertman)
• ice: initialize ring_stats->syncp (Jacob Keller)
• ata: libata: Print features also for ATAPI devices (Niklas Cassel)
• ata: libata: Call ata_dev_config_lpm() for ATAPI devices (Niklas Cassel)
• ata: libata-core: Introduce ata_dev_config_lpm() (Damien Le Moal)
• ata: libata: Add cpr_log to ata_dev_print_features() early return (Niklas Cassel)
• ata: libata-sata: Improve link_power_management_supported sysfs attribute (Niklas Cassel)
• ata: ahci: Do not read the per port area for unimplemented ports (Niklas Cassel)
• btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE (Mark Harmstone)
• Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() (Michael Kelley)
• arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links (Konrad Dybcio)
• pmdomain: qcom: rpmhpd: Add MXC to SC8280XP (Konrad Dybcio)
• dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO (Konrad Dybcio)
• dt-bindings: power: qcom-rpmpd: split RPMh domains definitions (Dmitry Baryshkov)
• dt-bindings: power: qcom,rpmpd: add Turbo L5 corner (Akhil P Oommen)
• dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains (Taniya Das)
• testptp: Add option to open PHC in readonly mode (Wojtek Wasko)
• selftest/ptp: update ptp selftest to exercise the gettimex options (Mahesh Bandewar)
• ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. (Wojtek Wasko)
• posix-clock: Store file pointer in struct posix_clock_context (Wojtek Wasko)