linux-azure-fde (7.0.0-1013.13) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1013.13 -proposed tracker (LP: #2162393)

  [ Ubuntu-azure: 7.0.0-1014.14 ]

  * resolute/linux-azure: 7.0.0-1014.14 -proposed tracker (LP: #2162394)
  * Backport of VM Freeze Fix – "Avoid DMA Queue Allocation Failure Under
    Memory Fragmentation (LP: #2163445)
    - net: mana: Route ring-buffer access through offset-based helpers
    - net: mana: Fall back to scattered pages for GDMA queues

 -- John Cabaj <john.cabaj@canonical.com>  Fri, 14 Aug 2026 10:16:00 -0500

linux-azure-fde (7.0.0-1012.12) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1012.12 -proposed tracker (LP: #2162393)

  [ Ubuntu-azure: 7.0.0-1013.13 ]

  * resolute/linux-azure: 7.0.0-1013.13 -proposed tracker (LP: #2162394)
  * porting patch: net: mana: Expose hardware diagnostic info via debugfs
    (LP: #2156616)
    - net: mana: Expose hardware diagnostic info via debugfs
  [ Ubuntu: 7.0.0-31.31 ]
  * resolute/linux: 7.0.0-31.31 -proposed tracker (LP: #2162413)
  * Backport: "firmware: arm_ffa: Respect firmware advertised RX/TX buffer
    size limits" (LP: #2162012)
    - firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
  * Backlight regression (LP: #2161309)
    - Revert "drm/i915/backlight: Remove try_vesa_interface"
  * Resolute real-time patchset: 7.0.1-rt2 (LP: #2161757)
    - SAUCE: Reapply "serial: 8250: Switch to nbcon console"
    - SAUCE: Reapply "serial: 8250: Revert "drop lockdep annotation from
      serial8250_clear_IER()""
    - Real-time patchset 7.0.1-rt2
  * Delta_Ubuntu24.04_Ubuntu (Waston)_Suspend(S3) Stress Test Fail when the
    A400 is on by remote controller . (LP: #2161385)
    - SAUCE: drm/amd/display: Tear down dangling pipe on boot to fix s0i3
  * Camera output is vague and color is abnormal (LP: #2156972)
    - media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for
      overlapping ranges
  * [SRU] Fix incorrect boot_display reporting on multi-GPU systems
    (LP: #2161036)
    - x86/video: Only fall back to vga_default_device() without screen info
  * Backport: complete perf_allow_* trio and use in drm/xe (LP: #2160654)
    - perf/core: out-of-line and export perf_allow_cpu/tracepoint()
    - drm/xe: gate observation streams with perf_allow_cpu()
  * Fix noise of audio output on Dell Pro QCM1255 after reboot (LP: #2160666)
    - ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255
  * Drop DEP-8 tests from kernel packages (LP: #2160302)
    - [Packaging] Drop DEP-8 tests from kernel source
  * The screen will show garbages by running glxgears fullscreen.
    (LP: #2158605)
    - SAUCE: drm/xe/display: skip FORCE_WC and vm_bound check for external
      dma-bufs
  * Audio shows Dummy Output on systems with Cirrus Logic cs42l43 codec
    (LP: #2156313)
    - ASoC: sdw_utils: fix missing component_name for cs42l43 part_id 0x2A3B
  * TPM2 key creation commands time out on some Infineon modules
    (LP: #2158883)
    - tpm: restore timeout for key creation commands
  * Fix Mic Mute LED no function on HP EliteBook (LP: #2158860)
    - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2i Laptops
  * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure
    (LP: #2158462)
    - SAUCE: (no-up) hv: Fix supplied vendor ID
  * [SRU]Enable Realtek ALC287 + Cirrus CS35L56 Audio for Lenovo Yoga Pro 7
    (LP: #2156867)
    - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio
    - ALSA: hda/realtek:ALC269 fixup for Yoga Pro 7 15ASH11 mic mute LED
    - ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11
  * iwlwifi failed to handle oversized command 0xC05 (LP: #2152688)
    - wifi: iwlwifi: mld: add support for iwl_mcc_allowed_ap_type_cmd v2
    - wifi: iwlwifi: mvm: avoid oversized UATS command copy
  * MT7925 wifi is hard blocked on Dell's machine (LP: #2158229)
    - SAUCE: Revert "wifi: mt76: mt7925: add rfkill_poll for hardware rfkill"
  * Resolute update: upstream stable patchset 2026-07-21 (LP: #2161462)
    - rust: str: use the "kernel vertical" imports style
    - rust: str: clean unused import for Rust >= 1.98
    - userfaultfd: gate must_wait writability check on pte_present()
    - device property: initialize the remaining fields of fwnode_handle in
      fwnode_init()
    - f2fs: fix potential deadlock in f2fs_balance_fs()
    - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
    - f2fs: fix listxattr handling of corrupted xattr entries
    - net/sched: dualpi2: fix GSO backlog accounting
    - mm/khugepaged: write all dirty file folios when collapsing
    - slab: recognize @GFP parameter as optional in kernel-doc
    - perf trace beauty fcntl: Fix build with older kernel headers
    - KVM: x86: Move update_cr8_intercept() to lapic.c
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest
      mode
    - KVM: x86: Unconditionally recompute CR8 intercept on PPR update
    - ACPI: CPPC: Suppress UBSAN warning caused by field misuse
    - ACPI: NFIT: core: Fix possible NULL pointer dereference
    - platform/x86: intel-hid: Protect ACPI notify handler against recursion
    - LoongArch: Add PIO for early access before ACPI PCI root register
    - rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
    - rust: block: fix GenDisk cleanup paths
    - rust: doctest: fix incorrect pattern in replacement
    - rust: Kbuild: set frame-pointer llvm module flag for
      CONFIG_FRAME_POINTER
    - futex/requeue: Revert "Prevent NULL pointer dereference in
      remove_waiter() on self-deadlock""
    - perf/core: Detach event groups during remove_on_exec
    - rust: kasan: KASAN+RUST requires clang
    - fscrypt: Replace mk_users keyring with simple list
    - usb: gadget: function: rndis: add length check to response query
    - usb: gadget: function: rndis: add length check for header
    - iio: accel: bmc150: clamp the device-reported FIFO frame count
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
    - iio: adc: ad7380: select REGMAP
    - iio: adc: ad7768-1: Select GPIOLIB
    - iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
    - iio: adc: ad_sigma_delta: fix clear_pending_event for registerless
      devices
    - iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
    - iio: adc: lpc32xx: Initialize completion before requesting IRQ
    - iio: adc: spear: Initialize completion before requesting IRQ
    - iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
    - iio: adc: ti-ads124s08: Return reset GPIO lookup errors
    - iio: backend: fix uninitialized data in debugfs
    - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
    - iio: common: st_sensors: honour channel endianness in read_axis_data
    - iio: core: fix uninitialized data in debugfs
    - iio: dac: ad3552r-hs: fix uninitialized data ni
      ad3552r_hs_write_data_source()
    - iio: event: Fix event FIFO reset race
    - iio: gyro: bmg160: bail out when bandwidth/filter is not in table
    - iio: gyro: bmg160: wait full startup time after mode change at probe
    - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
    - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
    - iio: imu: inv_icm42600: fix timestamp clock period by using lower value
    - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
    - iio: imu: st_lsm6dsx: deselect shub page before reading whoami
    - iio: light: al3000a: add missing REGMAP_I2C to Kconfig
    - iio: light: al3010: add missing REGMAP_I2C to Kconfig
    - iio: light: al3010: fix incorrect scale for the highest gain range
    - iio: light: al3010: read both ALS ADC registers again
    - iio: light: al3320a: add missing REGMAP_I2C to Kconfig
    - iio: light: al3320a: read both ALS ADC registers again
    - iio: light: gp2ap002: fix runtime PM leak on read error
    - iio: light: opt3001: fix missing state reset on timeout
    - iio: light: tsl2591: return actual error from probe IRQ failure
    - iio: light: veml6030: fix channel type when pushing events
    - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
    - iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
    - iio: pressure: mpl115: fix runtime PM leak on read error
    - iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
    - iio: resolver: ad2s1210: notify trigger and clear state on fault read
      error
    - iio: temperature: Build mlx90635 with CONFIG_MLX90635
    - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
    - iio: temperature: ltc2983: Fix reinit_completion() called after
      conversion start
    - iio: temperature: tmp006: use devm_iio_trigger_register
    - ALSA: usx2y: us144mkii: fix work UAF on disconnect
    - ALSA: virtio: Add missing 384 kHz PCM rate mapping
    - ALSA: virtio: Validate control metadata from the device
    - ALSA: ymfpci: check snd_ctl_new1() return value
    - ALSA: aoa: check snd_ctl_new1() return value
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input
      parser
    - ALSA: cmipci: check snd_ctl_new1() return value
    - ALSA: compress: Fix task creation error unwind
    - ALSA: es1938: check snd_ctl_new1() return value
    - ALSA: FCP: Add Focusrite ISA C8X support
    - ALSA: firewire: isight: bound the sample count to the packet payload
    - ALSA: gus: check snd_ctl_new1() return value
    - ALSA: hda/cs35l41: Fix firmware load work teardown
    - ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
    - ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
    - ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
    - ALSA: ice1712: check snd_ctl_new1() return value
    - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
    - ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts
      anchor list on each resubmission
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match
    - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
    - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch
      put callbacks
    - ALSA: usb-audio: Roll back quirk control caches on write errors
    - ALSA: usb-audio: Update Babyface Pro control caches only after
      successful writes
    - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful
      writes
    - vfio/pci: Use a private flag to prevent power state change with VFs
    - vfio/pci: Latch disable_idle_d3 per device
    - vfio/pci: Release the VGA arbiter client on register_device() failure
    - vfio/pci: Fix racy bitfields and tighten struct layout
    - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
    - vfio: Remove device debugfs before releasing devres
    - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
    - Bluetooth: btusb: fix use-after-free on registration failure
    - Bluetooth: btusb: fix use-after-free on marvell probe failure
    - Bluetooth: btusb: fix wakeup source leak on probe failure
    - binder: fix UAF in binder_thread_release()
    - binder: fix UAF in binder_free_transaction()
    - rust_binder: use a u64 stride when cleaning up the offsets array
    - rust_binder: reject context manager self-transaction
    - rust_binder: synchronize Rust Binder stats with freeze commands
    - rust_binder: clear freeze listener on node removal
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams()
    - xhci: sideband: fix ring sg table pages leak
    - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
    - PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000
      series
    - PCI: altera: Do not dispose parent IRQ mapping
    - PCI: altera: Fix resource leaks on probe failure
    - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
    - PCI: host-common: Request bus reassignment when not probe-only
    - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable
    - PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
    - PCI/IOV: Skip VF Resizable BAR restore on read error
    - tcp: restore RCU grace period in tcp_ao_destroy_sock
    - mm/damon/ops-common: handle extreme intervals in damon_hot_score()
    - netfilter: ipset: fix race between dump and ip_set_list resize
    - virtio_pci: fix vq info pointer lookup via wrong index
    - virtio-mmio: fix device release warning on module unload
    - hwrng: virtio: clamp device-reported used.len at copy_data()
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
    - usb: dwc3: run gadget disconnect from sleepable suspend context
    - usb: misc: usbio: fix disconnect UAF in client teardown
    - 6lowpan: fix NHC entry use-after-free on error path
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
    - staging: vme_user: bound slave read/write to the kern_buf size
    - smb: client: restrict implied bcc[0] exemption to responses without data
      area
    - staging: vme_user: fix location monitor leak in fake bridge
    - staging: vme_user: fix location monitor leak in tsi148 bridge
    - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
    - staging: media: atomisp: reduce load_primary_binaries() stack usage
    - staging: media: ipu7: fix double-free and use-after-free in error paths
    - staging: rtl8723bs: fix heap buffer overflow in
      rtw_cfg80211_set_wpa_ie()
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
    - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
    - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and
      join_cmd_hdl()
    - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
    - staging: rtl8723bs: fix OOB write in HT_caps_handler()
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe()
    - crypto: krb5 - filter out async aead implementations at alloc
    - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then
      SMB2_CANCEL
    - net: af_key: initialize alg_key_len for IPComp states
    - audit: Fix data races of skb_queue_len() readers on audit_queue
    - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
    - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
    - coresight: etb10: restore atomic_t for shared reading state
    - debugobjects: Plug race against a concurrent OOM disable
    - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
    - NTB: epf: Avoid calling pci_irq_vector() from hardirq context
    - gpio: eic-sprd: use raw_spinlock_t in the irq startup path
    - gpio: sch: use raw_spinlock_t in the irq startup path
    - io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
    - io_uring/rw: preserve partial result for iopoll
    - netpoll: fix a use-after-free on shutdown path
    - ipv4: igmp: remove multicast group from hash table on device destruction
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success
    - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
    - mm: shrinker: fix shrinker_info teardown race with expansion
    - mm: shrinker: fix NULL pointer dereference in debugfs
    - mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless
      host
    - mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent
      softlockup
    - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
    - netfilter: handle unreadable frags
    - netfilter: ebtables: zero chainstack array
    - netfilter: ebtables: module names must be null-terminated
    - netfilter: ebtables: terminate table name before find_table_lock()
    - netfilter: flowtable: fix offloaded ct timeout never being extended
    - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
    - Bluetooth: bnep: pin L2CAP connection during netdev registration
    - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in
      nxp_recv_fw_req_v3()
    - Bluetooth: fix UAF in bt_accept_dequeue()
    - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
    - Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
    - Bluetooth: L2CAP: validate option length before reading conf opt value
    - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
    - smb: client: resolve SWN tcon from live registrations
    - smb/client: Fix error code in smb2_aead_req_alloc()
    - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
    - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
    - ksmbd: serialize QUERY_DIRECTORY requests per file
    - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock
      cancellation
    - ksmbd: require source read access for duplicate extents
    - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
    - ksmbd: run set info with opener credentials
    - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
    - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
    - ksmbd: use opener credentials for delete-on-close
    - ksmbd: use opener credentials for ADS I/O
    - smb: client: fix query directory replay double-free
    - smb: client: fix query_info() replay double-free
    - smb: client: fix double-free in SMB2_ioctl() replay
    - smb: client: fix change notify replay double-free
    - smb: client: fix double-free in SMB2_flush() replay
    - smb: client: fix double-free in SMB2_open() replay
    - smb: client: fix double-free in SMB2_close() replay
    - smb: client: Fix next buffer leak in receive_encrypted_standard()
    - smb: client: use unaligned reads in parse_posix_ctxt()
    - smb: client: harden POSIX SID length parsing
    - smb: client: fix atime clamp check in read completion
    - smb: client: mask server-provided mode to 07777 in modefromsid
    - writeback: fix race between cgroup_writeback_umount() and
      inode_switch_wbs()
    - OPP: of: Fix potential memory leak in opp_parse_supplies()
    - cpufreq: qcom-cpufreq-hw: Fix possible double free
    - firmware_loader: fix device reference leak in firmware_upload_register()
    - libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
    - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
    - cpufreq: intel_pstate: Sync policy->cur during CPU offline
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
    - cpufreq: Fix hotplug-suspend race during reboot
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
    - time/jiffies: Register jiffies clocksource before usage
    - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog
      instances
    - s390: Revert support for DCACHE_WORD_ACCESS
    - [Config] Disable DCACHE_WORK_ACCESS for s390x
    - perf/arm-cmn: Fix DVM node events
    - X.509: Fix validation of ASN.1 certificate header
    - mm/slab: do not limit zeroing to orig_size when only red zoning is
      enabled
    - tools/mm/slabinfo: Fix trace disable logic inversion
    - tools/mm/slabinfo: fix total_objects attribute name
    - HID: hid-goodix-spi: validate report size to prevent stack buffer
      overflow
    - HID: uhid: convert to hid_safe_input_report()
    - HID: wacom: stop hardware after post-start probe failures
    - HID: pidff: Use correct effect type in effect update
    - HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
    - HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
    - HID: letsketch: fix UAF on inrange_timer at driver unbind
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags
    - HID: appleir: fix UAF on pending key_up_timer in remove()
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free
    - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte
      reads
    - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
    - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
    - media: mtk-jpeg: cancel workqueue on release for supported platforms
      only
    - serial: 8250_mid: Disable DMA for selected platforms
    - xfs: use null daddr for unset first bad log block
    - xfs: release dquot buffer after dqflush failure
    - xfs: fix unreachable BIGTIME check in dquot flush validation
    - xfs: fix pointer arithmetic error on 32-bit systems
    - xfs: fix exchmaps reservation limit check
    - xfs: fix memory leak in xfs_dqinode_metadir_create()
    - bpf: Reject fragmented frames in devmap
    - bpf: Restore sysctl new-value from 1 to 0
    - bpf: Validate BTF repeated field counts before expansion
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
    - usb: cdc_acm: Add quirk for Uniden BC125AT scanner
    - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
    - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
    - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
    - usb: free iso schedules on failed submit
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
    - usb: gadget: udc: Fix use-after-free in gadget_match_driver
    - usb: gadget: f_printer: take kref only for successful open
    - USB: idmouse: fix use-after-free on disconnect race
    - USB: ldusb: fix use-after-free on disconnect race
    - USB: iowarrior: fix use-after-free on disconnect
    - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
    - USB: legousbtower: fix use-after-free on disconnect race
    - usb: sl811-hcd: disable controller wakeup on remove
    - USB: storage: include US_FL_NO_SAME in quirks mask
    - usb: misc: usbio: bound bulk IN response length to the received transfer
    - USB: misc: uss720: unregister parport on probe failure
    - usb: mtu3: unmap request DMA on queue failure
    - USB: serial: keyspan_pda: fix information leak
    - USB: serial: option: add Telit Cinterion FE990D50 compositions
    - USB: serial: digi_acceleport: fix broken rx after throttle
    - USB: serial: digi_acceleport: fix hard lockup on disconnect
    - USB: serial: digi_acceleport: fix write buffer corruption
    - USB: ulpi: fix memory leak on registration failure
    - USB: usb-storage: ene_ub6250: restore media-ready check
    - usbip: tools: support SuperSpeedPlus devices
    - usbip: vudc: fix NULL deref in vep_dequeue()
    - usb: typec: anx7411: use devm_pm_runtime_enable()
    - usb: typec: class: drop PD lookup reference
    - usb: typec: tcpm: Fix VDM type for Enter Mode commands
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
    - usb: typec: ucsi: Invert DisplayPort role assignment
    - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt
      mode
    - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
    - usb: typec: ucsi: cancel pending work on system suspend
    - usb: gadget: f_fs: Fix DMA fence leak
    - block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
    - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when
      SNC enabled
    - ontext]
    - rust_binder: fix BINDER_GET_EXTENDED_ERROR
    - bpf: Support for hardening against JIT spraying
    - x86/bugs: Enable IBPB flush on BPF JIT allocation
    - bpf: Restrict JIT predictor flush to cBPF
    - bpf: Skip redundant IBPB in pack allocator
    - bpf: Prefer packs that won't trigger an IBPB flush on allocation
    - bpf: Prefer dirty packs for eBPF allocations
    - udf: validate free block extents against the partition length
    - udf: validate VAT header length against the VAT inode size
    - udf: validate sparing table length as an entry count, not a byte count
    - hwrng: jh7110 - fix refcount leak in starfive_trng_read()
    - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
    - nvme: target: rdma: fix ndev refcount leak on queue connect
    - block: partitions: fix of_node refcount leak in of_partition()
    - dm-ioctl: report an error if a device has no table
    - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace
      disks
    - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
    - nvmet-auth: validate reply message payload bounds against transfer
      length
    - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
    - btrfs: do not trim a device which is not writeable
    - partitions: aix: bound the pp_count scan to the ppe array
    - isofs: bound Rock Ridge symlink components to the SL record
    - crypto: af_alg - Remove zero-copy support from skcipher and aead
    - crypto: caam - use print_hex_dump_devel to guard key hex dumps
    - crypto: caam - use print_hex_dump_devel to guard key hex dumps again
    - crypto: chacha20poly1305 - validate poly1305 template argument
    - crypto: crypto4xx - Remove insecure and unused rng_alg
    - crypto: ecc - Fix carry overflow in vli multiplication
    - crypto: hisi-trng - Remove crypto_rng interface
    - crypto: pcrypt - restore callback for non-parallel fallback
    - crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
    - crypto: loongson - Select CRYPTO_RNG
    - crypto: ccp - Do not initialize SNP for SEV ioctls
    - crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
    - crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
    - crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
    - crypto: drbg - Fix returning success on failure in CTR_DRBG
    - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
    - crypto: drbg - Fix the fips_enabled priority boost
    - crypto: qat - centralize bus master enable
    - crypto: qat - handle sysfs-triggered reset callbacks
    - crypto: qat - keep VFs enabled during reset
    - crypto: qat - notify fatal error before AER reset preparation
    - crypto: qat - protect service table iterations with service_lock
    - crypto: qat - skip restart for down devices
    - crypto: qat - validate RSA CRT component lengths
    - crypto: qat - factor out AER reset helpers
    - crypto: talitos - use dma_sync_single_for_cpu() before reading
      descriptor header
    - crypto: talitos - add chaining of arbitrary number of descriptor for the
      SEC1
    - crypto: talitos - move dma unmapping code in flush_channel() into a
      standalone dma_unmap_request() function
    - crypto: talitos - move dma mapping code in talitos_submit() into a
      standalone dma_map_request() function
    - crypto: talitos - move code in current_desc_hdr() into a standalone
      function
    - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove
      additional descriptor
    - crypto: talitos/hash - use descriptor chaining for SEC1 instead of
      workqueue
    - crypto: talitos/hash - drop workqueue mechanism for SEC1
    - crypto: talitos/hash - rename first_desc/last_desc to
      first_request/last_request
    - crypto: talitos/hash - remove useless wrapper
    - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
    - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with
      dmaengine_terminate_sync()
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
    - x86/mm: Fix freeing of PMD-sized vmemmap pages
    - EDAC/i10nm: Don't fail probing if ADXL is missing
    - watchdog: apple: Add "apple,t8103-wdt" compatible
    - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
    - i2c: core: fix hang on adapter registration failure
    - perf/aux: Fix page UAF in map_range()
    - tracing: Prevent out-of-bounds read in glob matching
    - audit: fix potential integer overflow in audit_log_n_hex()
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
    - rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
    - module: decompress: check return value of module_extend_max_pages()
    - exfat: bound uniname advance in exfat_find_dir_entry()
    - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
    - riscv: mm: Define DIRECT_MAP_PHYSMEM_END
    - riscv: mm: Unconditionally sfence.vma for spurious fault
    - mm: fix mmap errno value when MAP_DROPPABLE is not supported
    - selftests: mm: fix and speedup "droppable" test
    - mm: page_ext: add count limit to page_ext_iter_next to prevent invalid
      PFN access
    - mm: do file ownership checks with the proper mount idmap
    - selftests/mm: pagemap_ioctl: use the correct page size for
      transact_test()
    - crypto: loongson - Remove broken and unused loongson-rng
    - iommu/vt-d: Avoid WARNING in sva unbind path
    - iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
    - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
    - iommufd: Fix data_len byte-count vs element-count mismatch
    - iommufd: Set veventq_depth upper bound
    - iommufd: Rewind header length in done if iommufd_veventq_fops_read()
      fails
    - iommufd: Reject invalid read count in iommufd_veventq_fops_read()
    - iommufd: Reject invalid read count in iommufd_fault_fops_read()
    - iommufd: Break the loop on failure in iommufd_fault_fops_read()
    - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
    - iommufd: Set upper bounds on cache invalidation entry_num and entry_len
    - audit: fix removal of dangling executable rules
    - landlock: Set audit_net.sk for socket access checks
    - selftests/landlock: Filter dealloc records in audit_count_records()
    - KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
    - LoongArch: KVM: Add missing slots_lock for device register/unregister
    - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
    - KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
    - KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually
      supports
    - KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are
      accelerated
    - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
    - KVM: VMX: Handle bad values on proxied writes to LBR MSRs
    - KVM: x86: Ensure vendor's exit handler runs before fastpath userspace
      exits
    - KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
    - udmabuf: fix DMA direction mismatch in release_udmabuf()
    - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
    - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
    - i2c: core: fix irq domain leak on adapter registration failure
    - i2c: core: fix NULL-deref on adapter registration failure
    - i2c: core: fix adapter probe deferral loop
    - i2c: core: fix adapter debugfs creation
    - i2c: core: fix adapter deregistration race
    - i2c: mpc: Fix timeout calculations
    - i2c: davinci: Unregister cpufreq notifier on probe failure
    - i2c: stm32f7: truncate clock period instead of rounding it
    - i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
    - i2c: i801: fix hardware state machine corruption in error path
    - Input: synaptics-rmi4 - unregister function handlers on physical driver
      registration failure
    - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
    - Input: elan_i2c - prevent division by zero and arithmetic underflow
    - Input: goodix - clamp the device-reported contact count
    - Input: iforce - bound the device-reported force-feedback effect index
    - Input: mms114 - fix touch indexing for MMS134S and MMS136
    - Input: ads7846 - don't use scratch for tx_buf when clearing register
    - Input: touchwin - reset the packet index on every complete packet
    - Input: mms114 - reject an oversized device packet size
    - Input: gscps2 - advance receive buffer write index
    - Input: maplemouse - fix NULL pointer dereference in open()
    - Input: mms114 - fix multi-touch slot corruption
    - Input: maple_keyb - set driver data before registering input device
    - Input: maplemouse - set driver data before registering input device
    - Input: maplecontrol - set driver data before registering input device
    - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
    - RDMA/core: Fix broadcast address falsely detected as local
    - RDMA/siw: bound Read Response placement to the RREAD length
    - fuse: back uncached readdir buffers with pages
    - fuse: avoid 32-bit prune notification count wrap
    - fuse: fix device node leak in cuse_process_init_reply()
    - fuse: re-lock request before returning from fuse_ref_folio()
    - fuse: fix io-uring background queue dispatch on request completion
    - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
    - fuse-uring: fix EFAULT clobber in fuse_uring_commit
    - fuse-uring: fix data races on ring->ready
    - fuse-uring: fix moving cancelled entry to ent_in_userspace list
    - fuse-uring: end fuse_req on io-uring cancel task work
    - fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
    - fuse-uring: Avoid queue->stopped races and set/read that value under
      lock
    - fuse-uring: make a fuse_req on SQE commit only findable after memcpy
    - fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL
      deref
    - usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction
      checks
    - timekeeping: Register default clocksource before taking tk_core.lock
    - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote
      netdev
    - smb: client: reject overlapping data areas in SMB2 responses
    - xfs: fix null pointer dereference in tracepoint
    - xfs: fail recovery on a committed log item with no regions
    - xfs: resample the data fork mapping after cycling ILOCK
    - xfs: don't wrap around quota ids in dqiterate
    - xfs: grab rtrmap btree when checking rgsuper
    - xfs: use the rt version of the cow staging checker
    - xfs: set xfarray killable sort correctly
    - xfs: handle non-inode owners for rtrmap record checking
    - xfs: clamp timestamp nanoseconds correctly
    - xfs: fully check the parent handle when it points to the rootdir
    - xfs: don't zap bmbt forks if they are MAXLEVELS tall
    - xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
    - xfs: write the rg superblock when fixing it
    - xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
    - rust: pci: use 'static lifetime for PCI BAR resource names
    - iio: adc: ad4062: add GPIOLIB dependency
    - iio: adc: nxp-sar-adc: Fix the delay calculation in
      nxp_sar_adc_wait_for()
    - ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8
    - vfio/mlx5: Fix racy bitfields and tighten struct layout
    - riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllers
    - PCI: imx6: Configure REF_USE_PAD before PHY reset for i.MX95
    - PCI: imx6: Assert ref_clk_en after reference clock stabilizes on i.MX95
    - PCI: Skip Resizable BAR restore on read error
    - tracing: Fix NULL pointer dereference in func_set_flag()
    - staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()
    - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(),
      rtw_get_wapi_ie(), and rtw_get_wps_attr()
    - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
    - media: nxp: imx8-isi: Fix use-after-free on remove
    - netfilter: flowtable: IPIP tunnel hardware offload is not yet support
    - ksmbd: prevent path traversal bypass by restricting caseless retry
    - ksmbd: centralize ksmbd_conn final release to plug transport leak
    - ksmbd: track the connection owning a byte-range lock
    - ksmbd: validate NTLMv2 response before updating session key
    - smb/client: fix chown/chgrp with SMB3 POSIX Extensions
    - smb/server: do not require delete access for non-replacing links
    - proc: protect ptrace_may_access() with exec_update_lock (FD links)
    - proc: protect ptrace_may_access() with exec_update_lock (part 1)
    - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
    - xfs: pass back updated nb from xfs_growfs_compute_deltas
    - xfs: only log freed extents for the current RTG in zoned growfs
    - xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
    - bpf: Keep dynamic inner array lookups nullable
    - bpf: Allow LPM map access from sleepable BPF programs
    - USB: iowarrior: fix use-after-free on disconnect race
    - usb: typec: ps883x: Fix DP+USB3 configuration
    - usb: gadget: f_fs: initialize reset_work at allocation time
    - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
    - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
    - crypto: atmel-sha204a - fail on hwrng registration error in probe path
    - btrfs: fix false IO failure after falling back to buffered write
    - btrfs: fix incorrect buffered IO fallback for append direct writes
    - crypto: drbg - Fix misaligned writes in CTR_DRBG and HASH_DRBG
    - crypto: drbg - Fix ineffective sanity check
    - crypto: qat - fix restarting state leak on allocation failure
    - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name
      length
    - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION
      calls with invalid length
    - exfat: fix incorrect directory checksum after rename to shorter name
    - exfat: preserve benign secondary entries during rename and move
    - lib/test_hmm: use kvfree() to free kvcalloc() allocations
    - selftests/mm: fix ksft_process_madv.sh test category
    - nouveau/vmm: fix another SPT/LPT race
    - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
      uninitialized
    - iommufd: Move vevent memory allocation outside spinlock
    - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch()
    - selftests/landlock: Fix socket file descriptor leaks in audit helpers
    - selftests/landlock: Explicitly disable audit in teardowns
    - landlock: Account all audit data allocations to user space
    - selftests/landlock: Increase default audit socket timeout
    - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
    - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest
    - KVM: SEV: Don't terminate SNP VMs on #VMGEXIT without a registered GHCB
    - KVM: TDX: Account all non-transient page allocations for per-TD
      structures
    - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
    - Revert "fuse: fix conversion of fuse_reverse_inval_entry() to
      start_removing()"
    - fuse: do not use start_removing_noperm()
    - ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY
    - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
    - Upstream stable to v6.18.39, v7.1.4
  * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733)
    - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command
      Completion support"
    - batman-adv: tp_meter: keep unacked list in ascending ordered
    - batman-adv: tp_meter: initialize dup_acks explicitly
    - batman-adv: tp_meter: initialize dec_cwnd explicitly
    - batman-adv: tp_meter: avoid window underflow
    - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
    - batman-adv: tp_meter: fix fast recovery precondition
    - batman-adv: tp_meter: handle seqno wrap-around for fast recovery
      detection
    - batman-adv: tp_meter: add only finished tp_vars to lists
    - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
    - batman-adv: prevent ELP transmission interval underflow
    - batman-adv: tp_meter: initialize last_recv_time during init
    - batman-adv: gw: don't deselect gateway with active hardif
    - batman-adv: ensure bcast is writable before modifying TTL
    - batman-adv: fix (m|b)cast csum after decrementing TTL
    - batman-adv: frag: ensure fragment is writable before modifying TTL
    - batman-adv: frag: avoid underflow of TTL
    - batman-adv: v: prevent OGM aggregation on disabled hardif
    - batman-adv: tp_meter: restrict number of unacked list entries
    - batman-adv: tp_meter: annotate last_recv_time access with
      READ/WRITE_ONCE
    - batman-adv: tp_meter: prevent parallel modifications of last_recv
    - batman-adv: tp_meter: handle overlapping packets
    - batman-adv: tt: don't merge change entries with different VIDs
    - batman-adv: tt: track roam count per VID
    - batman-adv: dat: prevent false sharing between VLANs
    - batman-adv: tvlv: enforce 2-byte alignment
    - batman-adv: tvlv: avoid race of cifsnotfound handler state
    - ipv4: account for fraggap on the paged allocation path
    - ntfs3: reject direct userspace writes to reserved $LX* xattrs
    - wifi: mt76: add wcid publish check in mt76_sta_add
    - mac802154: llsec: add skb_cow_data() before in-place crypto
    - net: skmsg: preserve sg.copy across SG transforms
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
    - apparmor: mediate the implicit connect of TCP fast open sendmsg
    - apparmor: fix use-after-free in rawdata dedup loop
    - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG
      share BAR
    - fbdev: fix use-after-free in store_modes()
    - kernel/fork: clear PF_BLOCK_TS in copy_process()
    - block: invalidate cached plug timestamp after task switch
    - KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
    - err.h: use __always_inline on all error pointer helpers
    - gcov: use atomic counter updates to fix concurrent access crashes
    - KEYS: fix overflow in keyctl_pkey_params_get_2()
    - keys: Pin request_key_auth payload in instantiate paths
    - userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
    - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
    - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
    - wifi: ath11k: fix warning when unbinding
    - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
    - wifi: rtw88: increase TX report timeout to fix race condition
    - wifi: rtw88: usb: fix memory leaks on USB write failures
    - wifi: iwlwifi: mvm: fix race condition in PTP removal
    - wifi: iwlwifi: mld: fix race condition in PTP removal
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session
      handlers
    - f2fs: pass correct iostat type for single node writes
    - f2fs: validate orphan inode entry count
    - f2fs: validate compress cache inode only when enabled
    - f2fs: fix to round down start offset of fallocate for pin file
    - f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
    - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
    - f2fs: keep atomic write retry from zeroing original data
    - block: Avoid mounting the bdev pseudo-filesystem in userspace
    - bpf: use kvfree() for replaced sysctl write buffer
    - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
    - exfat: fix potential use-after-free in exfat_find_dir_entry()
    - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping
      level
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with
      get_unaligned()
    - crypto: nx - fix nx_crypto_ctx_exit argument
    - gfs2: fix use-after-free in gfs2_qd_dealloc
    - pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
    - hdlc_ppp: sync per-proto timers before freeing hdlc state
    - blk-cgroup: fix UAF in __blkcg_rstat_flush()
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
    - LoongArch: Report dying CPU to RCU in stop_this_cpu()
    - pNFS: Fix use-after-free in pnfs_update_layout()
    - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup
      on remove
    - fpga: region: fix use-after-free in child_regions_with_firmware()
    - rpmsg: char: Fix use-after-free on probe error path
    - ocfs2: reject oversized group bitmap descriptors
    - 9p: avoid putting oldfid in p9_client_walk() error path
    - MIPS: smp: report dying CPU to RCU in stop_this_cpu()
    - KVM: x86: hyper-v: Bound the bank index when querying sparse banks
    - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
    - power: reset: linkstation-poweroff: fix use-after-free in the
      linkstation_poweroff_init()
    - riscv: mm: Extract helper mark_new_valid_map()
    - riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
    - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in
      fb_videomode_to_var
    - fbdev: modedb: fix a possible UAF in fb_find_mode()
    - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
    - i2c: core: fix adapter registration race
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup
    - nfsd: fix posix_acl leak on SETACL decode failure
    - nfsd: fix inverted cp_ttl check in async copy reaper
    - nfsd: check get_user() return when reading princhashlen
    - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
    - nfsd: reset write verifier on deferred writeback errors
    - NFSv4/flexfiles: reject zero filehandle version count
    - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
    - NFSv4: clear exception state on successful mkdir retry
    - NFS: Prevent resource leak in nfs_alloc_server()
    - ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
    - net/tcp-ao: fix use-after-free of key in del_async path
    - apparmor: advertise the tcp fast open fix is applied
    - PCI/P2PDMA: Add Intel QAT, DSA, IAA devices to whitelist
    - fscrypt: Fix key setup in edge case with multiple data unit sizes
    - wifi: rtl8xxxu: Detect the maximum supported channel width
    - f2fs: fix missing read bio submission on large folio error
    - f2fs: reject setattr size changes on large folio files
    - f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
    - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
    - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
    - Revert "f2fs: remove non-uptodate folio from the page cache in
      move_data_block"
    - f2fs: read COW data with the original inode during atomic write
    - sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path
    - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
    - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
    - fbdev: omap2: fix use-after-free in omapfb_mmap
    - nfsd: release layout stid on setlease failure
    - nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
    - nfsd: fix dead ACL conflict guard in nfsd4_create
    - Upstream stable to v6.18.38, v7.1.3
  * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //
    CVE-2026-53361
    - af_unix: Set gc_in_progress to true in unix_gc().
  * Resolute update: upstream stable patchset 2026-07-15 (LP: #2160733) //
    CVE-2026-53362
    - ipv6: account for fraggap on the paged allocation path
  * Resolute update: v7.0.14 upstream stable release (LP: #2158815)
    - io_uring/net: Avoid msghdr on op_connect/op_bind async data
    - arm64/entry: Fix arm64-specific rseq brokenness
    - lockd: fix TEST handling when not all permissions are available.
    - firmware: exynos-acpm: Count number of commands in acpm_xfer
    - firmware: exynos-acpm: Count acpm_xfer buffers with __counted_by_ptr
    - firmware: samsung: acpm: Fix cross-thread RX length corruption
    - firmware: samsung: acpm: Fix false timeouts and Use-After-Free in
      polling
    - firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
    - fuse: re-lock request before replacing page cache folio
    - Revert "NFSD: Defer sub-object cleanup in export put callbacks"
    - RDMA/bnxt_re: zero shared page before exposing to userspace
    - i2c: stub: Reject I2C block transfers with invalid length
    - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
    - rose: fix dev_put() leak in rose_loopback_timer()
    - rose: hold loopback neighbour reference across timer callback
    - rose: fix race between loopback timer and module removal
    - rose: clear neighbour pointer after rose_neigh_put() in state machines
    - rose: guard rose_neigh_put() against NULL in timer expiry
    - rose: fix netdev double-hold in rose_rx_call_request()
    - rose: fix notifier unregistered too early in rose_exit()
    - rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
    - rose: disconnect orphaned STATE_2 sockets when device is gone
    - rose: fix netdev double-hold in rose_make_new()
    - rose: release netdev ref and destroy orphaned incoming sockets
    - rose: drop CALL_REQUEST in loopback timer when device is not running
    - rose: cancel neighbour timers in rose_neigh_put() before freeing
    - rose: clear neighbour pointer in rose_kill_by_device()
    - rose: don't free fd-owned sockets when reaping in the heartbeat
    - net: export netif_open for self_test usage
    - net: net_failover: Fix the deadlock in slave register
    - iio: light: veml6075: add bounds check to veml6075_it_ms index
    - iio: adc: ti-ads1298: add bounds check to pga_settings index
    - crypto: qat - remove unused character device and IOCTLs
    - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent
      vcs_write
    - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
    - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
    - drivers/base/memory: set mem->altmap after successful device
      registration
    - ksmbd: reject non-VALID session in compound request branch
    - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
    - virtiofs: fix UAF on submount umount
    - Linux 7.0.14
  * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //
    CVE-2026-53325
    - agp/amd64: Fix broken error propagation in agp_amd64_probe()
  * Resolute update: v7.0.14 upstream stable release (LP: #2158815) //
    CVE-2026-52938
    - bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
  * Resolute update: v7.0.13 upstream stable release (LP: #2158003)
    - bpf: Free reuseport cBPF prog after RCU grace period.
    - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
    - Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer
    - ipv6: mcast: Fix use-after-free when processing MLD queries
    - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
    - tee: optee: prevent use-after-free when the client exits before the
      supplicant
    - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
    - arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and
      reserve its pins
    - ARM: dts: microchip: sam9x7: fix GMAC clock configuration
    - soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
    - tee: fix tee_ioctl_object_invoke_arg padding
    - tee: qcomtee: add missing va_end in early return
      qcomtee_object_user_init()
    - s390/bug: Always emit format word in __BUG_ENTRY
    - ARM: dts: gemini: Fix partition offsets
    - erofs: fix use-after-free on sbi->sync_decompress
    - wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
    - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
    - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
    - ipvs: clear the svc scheduler ptr early on edit
    - netfilter: synproxy: add mutex to guard hook reference counting
    - netfilter: conntrack_irc: fix possible out-of-bounds read
    - netfilter: nft_ct: bail out on template ct in get eval
    - netfilter: bridge: make ebt_snat ARP rewrite writable
    - dm cache policy smq: check allocation under invalidate lock
    - net/sched: act_api: use RCU with deferred freeing for action lifecycle
    - 6lowpan: fix off-by-one in multicast context address compression
    - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
    - devlink: Release nested relation on devlink free
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
    - wifi: mac80211: limit injected antenna index in
      ieee80211_parse_tx_radiotap
    - pcnet32: stop holding device spin lock during napi_complete_done
    - net: Annotate sk->sk_write_space() for UDP SOCKMAP.
    - hsr: Remove WARN_ONCE() in hsr_addr_is_self().
    - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
    - net: lan743x: permit VLAN-tagged packets up to configured MTU
    - net: fec: fix pinctrl default state restore order on resume
    - ipv6: anycast: insert aca into global hash under idev->lock
    - wifi: fix leak if split 6 GHz scanning fails
    - wifi: cfg80211: add support to handle incumbent signal detected event
      from mac80211/driver
    - wifi: nl80211: split out UHR operation information
    - wifi: cfg80211: enforce HE/EHT cap/oper consistency
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
    - Bluetooth: MGMT: validate advertising TLV before type checks
    - Bluetooth: RFCOMM: validate skb length in MCC handlers
    - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame()
      extension handling
    - Bluetooth: bnep: reject short frames before parsing
    - Bluetooth: fix memory leak in error path of hci_alloc_dev()
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
    - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
    - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
    - Bluetooth: MGMT: Fix backward compatibility with userspace
    - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
    - octeontx2-pf: Fix NDC sync operation errors
    - octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
    - af_unix: Fix inq_len update problem in partial read
    - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
    - ptp: vclock: Switch from RCU to SRCU
    - net: airoha: Fix use-after-free in metadata dst teardown
    - geneve: fix length used in GRO hint UDP checksum adjustment
    - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
    - vxlan: vnifilter: send notification on VNI add
    - vxlan: vnifilter: fix spurious notification on VNI update
    - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
    - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
    - bonding: annotate data-races arcound churn variables
    - fwctl/bnxt_en: Move common definitions to include/linux/bnxt/
    - fwctl/bnxt_en: Refactor aux bus functions to be more generic
    - Reapply "bnxt_en: bring back rtnl_lock() in the bnxt_open() path"
    - Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
    - drm/hyperv: During panic do VMBus unload after frame buffer is flushed
    - selftests: harness: fix pidfd leak in __wait_for_test
    - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
    - regulator: mt6363: select CONFIG_IRQ_DOMAIN
    - hyperv: Clean up and fix the guest ID comment in hvgdk.h
    - VFS: fix possible failure to unlock in nfsd4_create_file()
    - crypto: s390 - add select CRYPTO_AEAD for aes
    - rseq: Fix using an uninitialized stack variable in
      rseq_exit_user_update()
    - time: Fix off-by-one in settimeofday() usec validation
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked
      streams
    - ALSA: seq: dummy: fix UMP event stack overread
    - x86/resctrl: Only check Intel systems for SNC
    - cpufreq/amd-pstate: drop stale @epp_cached kdoc
    - rtla: Fix parsing of multi-character short options
    - tools/rv: Ensure monitor name and desc are NUL-terminated
    - tools/rv: Fix substring match bug in monitor name search
    - tools/rv: Fix substring match when listing container monitors
    - tools/rv: Fix cleanup after failed trace setup
    - verification/rvgen: Fix options shared among commands
    - verification/rvgen: Fix ltl2k writing True as a literal
    - riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
    - riscv: cfi: reject unknown flags in PR_SET_CFI
    - xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
    - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
    - dma-debug: fix physical address retrieval in
      debug_dma_sync_sg_for_device
    - xfrm: policy: fix use-after-free on inexact bin in
      xfrm_policy_bysel_ctx()
    - ice: fix missing priority callbacks for U.FL DPLL pins
    - idpf: fix mailbox capability for set device clock time
    - net: ena: PHC: Add missing barrier
    - bnge: fix context mem iteration
    - netlabel: validate unlabeled address and mask attribute lengths
    - gpio: mvebu: fix NULL pointer dereference in suspend/resume
    - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
    - tcp: restrict SO_ATTACH_FILTER to priv users
    - net: add pskb_may_pull() to skb_gro_receive_list()
    - net/mlx4: avoid GCC 10 __bad_copy_from() false positive
    - net: ibm: emac: Fix use-after-free during device removal
    - netdev: fix double-free in netdev_nl_bind_rx_doit()
    - net: phy: clean the sfp upstream if phy probing fails
    - net: phy: remove phy ports upon probe failure
    - net: phy: Clean the phy_ports after unregistering the downstream SFP bus
    - net: phy: don't try to setup PHY-driven SFP cages when using genphy
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
    - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
    - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
    - net/mlx5: Use effective affinity mask for IRQ selection
    - net: openvswitch: fix possible kfree_skb of ERR_PTR
    - r8152: handle the return value of usb_reset_device()
    - gpio: zynq: fix runtime PM leak on remove
    - gpio: rockchip: fix generic IRQ chip leak on remove
    - net: mctp: usb: fix race between urb completion and rx_retry
      cancellation
    - net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
    - esp: fix page frag reference leak on skb_to_sgvec failure
    - ASoC: SOF: amd: fix for ipc flags check
    - ip6_vti: set netns_immutable on the fallback device.
    - net: guard timestamp cmsgs to real error queue skbs
    - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic
      completion
    - tun: zero the whole vnet header in tun_put_user()
    - ptp: ocp: fix resource freeing order
    - rds: mark snapshot pages dirty in rds_info_getsockopt()
    - spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
    - netfilter: revalidate bridge ports
    - netfilter: nf_conntrack: destroy stale expectfn expectations on
      unregister
    - netfilter: x_tables: avoid leaking percpu counter pointers
    - netfilter: nf_log: validate MAC header was set before dumping it
    - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
    - net: mvpp2: sync RX data at the hardware packet offset
    - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
    - net: txgbe: initialize module info buffer
    - net: txgbe: distinguish module types by checking identifier
    - net: txgbe: initialize PHY interface to 0
    - ipv6: Fix a potential NPD in cleanup_prefix_route()
    - ASoC: SDCA: fix NULL pointer dereference in
      sdca_dev_unregister_functions
    - clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting
      parked
    - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
    - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
    - drm/i915/edp: Check supported link rates DPCD read
    - drm/virtio: Fix driver removal with disabled KMS
    - drm/vc4: fix krealloc() memory leak
    - drm/colorop: Remove read-only comments from interpolation fields
    - drm/colorop: make lut(1/3)d_interpolation props correctly behave as
      mutable
    - drm/atomic: track individual colorop updates
    - drm/amd/display: use plane color_mgmt_changed to track colorop changes
    - drm/xe: fix refcount leak in xe_range_fence_insert()
    - drm/xe: fix job timeout recovery for unstarted jobs and kernel queues
    - accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
    - namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories
    - netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
    - tee: shm: fix shm leak in register_shm_helper()
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
    - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
    - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
    - mm/memory-failure: fix hugetlb_lock AA deadlock in
      get_huge_page_for_hwpoison
    - Revert "drm/xe/nvls: Define GuC firmware for NVL-S"
    - accel/ivpu: Add bounds check for firmware runtime memory
    - accel/ivpu: Add bounds checks for firmware log indices
    - firmware: stratix10-svc: Don't fail probe when async ops unsupported
    - firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported
    - firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in
      probe
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl
    - accel/ivpu: Fix signed integer truncation in IPC receive
    - tracing: Fix CFI violation in probestub being called by tprobes
    - tracing/probes: Point the error offset correctly for eprobe argument
      error
    - cgroup/cpuset: Use effective_xcpus in partcmd_update add/del mask
      calculation
    - Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during
      suspend"
    - rust: x86: support Rust >= 1.98.0 target spec
    - ARM: Do not select HAVE_RUST when KASAN is enabled
    - rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
    - rust: kasan/kbuild: fix rustc-option when cross-compiling
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
    - cfi: Include uaccess.h for get_kernel_nofault()
    - mshv: add a missing padding field
    - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
    - KVM: SEV: Decouple the need to sync the GHCB SA from the need to free
      the SA
    - KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
    - KVM: arm64: Correctly identify executable PTEs at stage-2
    - KVM: arm64: Restore POR_EL0 access to host EL0
    - drm/i915/gem: Fix phys BO pread/pwrite with offset
    - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
    - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
    - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
    - xfrm: espintcp: do not reuse an in-progress partial send
    - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
    - USB: serial: io_ti: fix heap overflow in get_manuf_info()
    - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
    - USB: serial: option: add usb-id for Dell Wireless DW5826e-m
    - USB: serial: kl5kusb105: fix bulk-out buffer overflow
    - ALSA: timer: Forcibly close timer instances at closing
    - ALSA: timer: Fix UAF at snd_timer_user_params()
    - io_uring/wait: fix min_timeout behavior
    - io_uring/kbuf: don't truncate end buffer for bundles
    - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
    - drm/virtio: fix dma_fence refcount leak on error in
      virtio_gpu_dma_fence_wait()
    - drm/amd/display: Reject gpio_bitshift >= 32 in
      bios_parser_get_gpio_pin_info()
    - mm/huge_memory: update file PMD counter before folio_put()
    - mm/damon/ops-common: call folio_test_lru() after folio_get()
    - mm/huge_memory: update file PUD counter before folio_put()
    - RDMA/core: Validate the passed in fops for ib_get_ucaps()
    - RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
    - zram: fix use-after-free in zram_bvec_write_partial()
    - udp: clear skb->dev before running a sockmap verdict
    - ARM: socfpga: Fix OF node refcount leak in SMP setup
    - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
    - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
    - arm64: mm: call pagetable dtor when freeing hot-removed page tables
    - mptcp: fix missing wakeups in edge scenarios
    - mptcp: fix retransmission loop when csum is enabled
    - mptcp: close TOCTOU race while computing rcv_wnd
    - mptcp: allow subflow rcv wnd to shrink
    - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
    - mptcp: check desc->count in read_sock
    - mptcp: sockopt: check timestamping ret value
    - mptcp: sockopt: set sockopt on all subflows
    - selftests: mptcp: add test for extra_subflows underflow on userspace PM
    - mptcp: add-addr: always drop other suboptions
    - xfs: fix error returns in CoW fork repair
    - xfs: fix rtgroup cleanup in CoW fork repair
    - wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
    - wifi: nl80211: reject oversized EMA RNR lists
    - vsock/vmci: fix sk_ack_backlog leak on failed handshake
    - timers/migration: Fix livelock in tmigr_handle_remote_up()
    - spi: qcom-geni: Fix cs_change handling on the last transfer
    - staging: rtl8723bs: fix buffer over-read in rtw_update_protection
    - staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length
      subtraction
    - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
    - bnxt_en: Fix NULL pointer dereference
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
    - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
    - hv: utils: handle and propagate errors in kvp_register
    - pidfd: refuse access to tasks that have started exiting harder
    - accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
    - accel/ethosu: fix IFM region index out-of-bounds in command stream
      parser
    - accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85
    - accel/ethosu: fix arithmetic issues in dma_length()
    - accel/ethosu: reject DMA commands with uninitialized length
    - accel/ethosu: reject NPU_OP_RESIZE commands from userspace
    - fs/qnx6: fix pointer arithmetic in directory iteration
    - fuse: reject fuse_notify() pagecache ops on directories
    - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
    - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on
      self-deadlock
    - i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
    - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
    - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
    - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
    - i2c: tegra: Fix NOIRQ suspend/resume
    - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
    - iomap: avoid potential null folio->mapping deref during error reporting
    - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
    - ipc/shm: serialize orphan cleanup with shm_nattch updates
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
    - memcg: use round-robin victim selection in refill_stock
    - memory: atmel-ebi: Allow deferred probing
    - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
    - misc: fastrpc: fix use-after-free race in fastrpc_map_create
    - misc: fastrpc: fix DMA address corruption due to find_vma misuse
    - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
    - firmware: samsung: acpm: Fix mailbox channel leak on probe error
    - net/mlx5: Reorder completion before putting command entry in
      cmd_work_handler
    - net: airoha: Add NULL check for of_reserved_mem_lookup() in
      airoha_qdma_init_hfwd_queues()
    - net: bonding: fix NULL pointer dereference in bond_do_ioctl()
    - net: mv643xx: fix OF node refcount
    - net: phonet: free phonet_device after RCU grace period
    - net: rds: clear i_sends on setup unwind
    - net: sfp: initialize i2c_block_size at adapter configure time
    - nvmem: core: fix use-after-free bugs in error paths
    - nvmem: layouts: onie-tlv: fix hang on unknown types
    - octeontx2-af: fix memory leak in rvu_setup_hw_resources()
    - pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
    - mm/cma: fix reserved page leak on activation failure
    - mm/cma_debug: fix invalid accesses for inactive CMA areas
    - mm/damon/lru_sort: handle ctx allocation failure
    - mm/damon/reclaim: handle ctx allocation failure
    - mm/huge_memory: use correct flags for device private PMD entry
    - mm/hugetlb: avoid false positive lockdep assertion
    - mm/hugetlb: restore reservation on error in hugetlb folio copy paths
    - mm/list_lru: drain before clearing xarray entry on reparent
    - mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
    - mmc: core: Fix host controller programming for fixed driver type
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
    - mmc: sdhci-of-dwcmshc: Fix reset, clk, and SDIO support for Eswin
      EIC7700
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host
    - pmdomain: imx: fix OF node refcount
    - pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup
      source
    - rtase: Avoid sleeping in get_stats64()
    - rtase: Reset TX subqueue when clearing TX ring
    - sctp: diag: reject stale associations in dump_one path
    - sctp: stream: fully roll back denied add-stream state
    - thunderbolt: Reject zero-length property entries in validator
    - thunderbolt: Bound root directory content to block size
    - thunderbolt: Clamp XDomain response data copy to allocation size
    - thunderbolt: Validate XDomain request packet size before type cast
    - thunderbolt: Limit XDomain response copy to actual frame size
    - slimbus: qcom-ngd-ctrl: fix OF node refcount
    - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
    - slimbus: qcom-ngd-ctrl: Fix probe error path ordering
    - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
    - slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
    - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
    - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
    - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
    - drm/gem: Try to fix change_handle ioctl, attempt 4
    - drm/i915: Fix color blob reference handling in intel_plane_state
    - drm/amdkfd: fix NULL dereference in get_queue_ids()
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on
      GFX11
    - drm/xe/display: fix oops in suspend/shutdown without display
    - drm/xe/multi_queue: skip submit when primary queue is suspended
    - drm/xe: Clear pending_disable before signaling suspend fence
    - drm/v3d: Wait for pending L2T flush before cleaning caches
    - drm/v3d: Fix global performance monitor reference counting
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
    - drm/v3d: Skip CSD when it has zeroed workgroups
    - drm/amdgpu: fix waiting for all submissions for userptrs
    - drm/amdgpu: restart the CS if some parts of the VM are still invalidated
    - drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
    - drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems
    - drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload
    - drm/amd/pm: fix smu13 power limit default/cap calculation
    - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
    - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in
      set_soft_freq_limited_range
    - drm/amd/display: Bound VBIOS record-chain walk loops
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
    - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
    - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve()
    - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
    - driver core: faux: fix root device registration
    - driver core: reject devices with unregistered buses
    - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
    - netfilter: nft_fib: fix stale stack leak via the OIFNAME register
    - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
    - wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-
      strict mode
    - wifi: mac80211: tests: mark HT check strict
    - RDMA/umem: fix kernel-doc warnings
    - RDMA: Move DMA block iterator logic into dedicated files
    - RDMA/umem: Fix truncation for block sizes >= 4G
    - vsock/virtio: fix potential unbounded skb queue
    - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
    - debugobjects: Do not fill_pool() if pi_blocked_on
    - debugobjects: Don't call fill_pool() in early boot hardirq context
    - arm64: cputype: Add C1-Ultra definitions
    - arm64: cputype: Add C1-Premium definitions
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
    - [Config] Add TLBI Erratum for Azure Cobalt 100.
    - vsock/virtio: fix skb overhead overflow on 32-bit builds
    - Linux 7.0.13
  * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //
    CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
  * Resolute update: v7.0.13 upstream stable release (LP: #2158003) //
    CVE-2026-46300: when fragments backed by read-only page-cache pages are
    - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
  * CVE-2026-64531
    - net: openvswitch: reject oversized nested action attrs
  * CVE-2026-46331
    - net/sched: fix pedit partial COW leading to page cache corruption
  * CVE-2026-53212
    - netfilter: nft_tunnel: fix use-after-free on object destroy
  * CVE-2026-53359
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role
  * CVE-2026-53131
    - netfilter: require Ethernet MAC header before using eth_hdr()
  * CVE-2026-53151
    - rxrpc: Fix the ACK parser to extract the SACK table for parsing
  * CVE-2026-53175
    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
  * CVE-2026-53176
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
  * CVE-2026-53186
    - RDMA/srp: bound SRP_RSP sense copy by the received length
  * CVE-2026-53215
    - net: mvpp2: refill RX buffers before XDP or skb use
  * CVE-2026-53216
    - net: mvpp2: limit XDP frame size to the RX buffer
  * CVE-2026-53221
    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
  * CVE-2026-53224
    - sctp: validate embedded INIT chunk and address list lengths in cookie
  * CVE-2026-53225
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
  * CVE-2026-53228
    - ipv6: sit: reload inner IPv6 header after GSO offloads
  * CVE-2026-52924
    - sctp: purge outqueue on stale COOKIE-ECHO handling
  * CVE-2026-53246
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
  * CVE-2026-53247
    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
  * CVE-2026-53260
    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
  * INVALID or PRIVATE BUG (LP: #2158267)
    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 13 Aug 2026 11:33:02 -0500

linux-azure-fde (7.0.0-1011.11) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1011.11 -proposed tracker (LP: #2162166)

  [ Ubuntu-azure: 7.0.0-1012.12 ]

  * resolute/linux-azure: 7.0.0-1012.12 -proposed tracker (LP: #2162167)
  * hv modules missing from initrd on 26.04 (LP: #2158024)
    - [Config] azure: Set CONFIG_HYPERV_NET to 'y'
  [ Ubuntu: 7.0.0-30.30 ]
  * resolute/linux: 7.0.0-30.30 -proposed tracker (LP: #2162185)
  * CVE-2026-64531
    - net: openvswitch: reject oversized nested action attrs

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 06 Aug 2026 13:40:46 -0500

linux-azure-fde (7.0.0-1010.10) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1010.10 -proposed tracker (LP: #2160763)

  * Packaging resync (LP: #1786013)
    - [Packaging] update variants

  [ Ubuntu-azure: 7.0.0-1011.11 ]

  * resolute/linux-azure: 7.0.0-1011.11 -proposed tracker (LP: #2160764)
  * Packaging resync (LP: #1786013)
    - [Packaging] update variants
  [ Ubuntu: 7.0.0-29.29 ]
  * resolute/linux: 7.0.0-29.29 -proposed tracker (LP: #2160781)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
  * CVE-2026-46331
    - net/sched: fix pedit partial COW leading to page cache corruption
  * CVE-2026-53212
    - netfilter: nft_tunnel: fix use-after-free on object destroy
  * CVE-2026-53359
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role
  * CVE-2026-53131
    - netfilter: require Ethernet MAC header before using eth_hdr()
  * CVE-2026-53151
    - rxrpc: Fix the ACK parser to extract the SACK table for parsing
  * CVE-2026-53175
    - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
  * CVE-2026-53176
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
  * CVE-2026-53186
    - RDMA/srp: bound SRP_RSP sense copy by the received length
  * CVE-2026-53215
    - net: mvpp2: refill RX buffers before XDP or skb use
  * CVE-2026-53216
    - net: mvpp2: limit XDP frame size to the RX buffer
  * CVE-2026-53221
    - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
  * CVE-2026-53224
    - sctp: validate embedded INIT chunk and address list lengths in cookie
  * CVE-2026-53225
    - sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
  * CVE-2026-53228
    - ipv6: sit: reload inner IPv6 header after GSO offloads
  * CVE-2026-52924
    - sctp: purge outqueue on stale COOKIE-ECHO handling
  * CVE-2026-53246
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
  * CVE-2026-53247
    - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
  * CVE-2026-53260
    - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
  * Performance regression causes SDXL inference slowdown (~42x) (LP: #2158267)
    - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages

 -- Ian Whitfield <ian.whitfield@canonical.com>  Wed, 22 Jul 2026 20:31:18 -0400

linux-azure-fde (7.0.0-1009.9) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1009.9 -proposed tracker (LP: #2157502)

  [ Ubuntu-azure: 7.0.0-1010.10 ]

  * resolute/linux-azure: 7.0.0-1010.10 -proposed tracker (LP: #2157503)
  * Fix MANA RX queue creation/error-cleanup path issues when RXQ
    initialization fails partway through (LP: #2156920)
    - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
    - net: mana: Skip WQ object destruction for uninitialized RXQ
    - net: mana: remove double CQ cleanup in mana_create_rxq error path
  * net: mana: Avoid queue struct allocation failure under memory
    fragmentation (LP: #2155434)
    - net: mana: Use kvmalloc for large RX queue and buffer allocations
    - net: mana: Use per-queue allocation for tx_qp to reduce allocation size
  * [hyperv] Ensure MMIO Mapping is Correct for Kexec / kdump kernel on Azure
    v6 Instance Types (LP: #2155222)
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
  * Patch: net: mana: Add support for PF device 0x00C1 (LP: #2156555)
    - net: mana: Add support for PF device 0x00C1
  * Hairpinning Issue on AKS with Latest Linux Stable Kernels (LP: #2070072)
    - SAUCE: Revert "netfilter: br_netfilter: skip conntrack input hook for
      promisc packets"
  [ Ubuntu: 7.0.0-28.28 ]
  * resolute/linux: 7.0.0-28.28 -proposed tracker (LP: #2157520)
  * Backport ASoC SDCA, AMD SoundWire, and RT722 audio fixes (LP: #2154418)
    - ASoC: amd: acp-sdw-legacy: rename the dmic component name
    - SAUCE: ASoC: rt722-sdca: add FU06 Playback Switch for speaker mute
      control
  * MIPI camera of a BBG809N3A_B sensor SKU of the DELL Pro 14 Premium PA14260
    renders upside-down (LP: #2155837)
    - SAUCE: media: ipu-bridge: correct platform handling for DELL Pro 14
      Premium PA14260
  * resolute ubuntu_kernel_selftests:seccomp_build test compilation issue
    (LP: #2154174)
    - SAUCE: selftests/seccomp fix compilation issue for amd64
  * [Ubuntu 26.04] Severe Performance Degradation on kernel 7.0.0-15
    (LP: #2154748)
    - s390: Remove GENERIC_LOCKBREAK Kconfig option
    - UBUNTU [Config]: Remove GENERIC_LOCKBREAK in s390x
  * Fix no sound output device on Dell GhostRider PTL no camera SKU
    (LP: #2156559)
    - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally
  * Fix no audio from right built-in speaker on HP ZBook with TAS2781
    amplifier (LP: #2156556)
    - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block
      data processing
  * Installer fails internally with a RSync error due to page fault
    (LP: #2150640)
    - ovl: keep err zero after successful ovl_cache_get()
  * Internal display black screen on Intel Lunar Lake with eDP panel
    (LP: #2156312)
    - drm/i915/alpm: Allow LOBF only for platform that have Always on VRR TG
  * Thunderbolt DP tunnel torn down during boot with LUKS Full Disk Encryption
    (LP: #2155096)
    - SAUCE: thunderbolt: Defer DP tunnel teardown until display driver is
      ready
  * watchdog: lenovo_se10_wdt: Add SE10 Gen 2 support (LP: #2154715)
    - watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform
    - watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
  * [Ubuntu 26.04] KVM: IBM Test Accelerator for Z (TAZ) not working properly
    (LP: #2153159)
    - KVM: s390: only deliver service interrupt with payload
    - KVM: s390: vsie: Allow non-zarch guests
    - KVM: s390: vsie: Disable some bits when in ESA mode
    - KVM: s390: vsie: Accommodate ESA prefix pages
    - KVM: s390: Add KVM capability for ESA mode guests
  * ubuntu_bpf failed to build on Resolute (error: expected ‘:’, ‘,’, ‘;’, ‘}’
    or ‘__attribute__’ before ‘__counted_by’) (LP: #2150071)
    - tools/headers: Regenerate stddef.h to fix BPF selftests
  * ubuntu_bpf: FTBFS with clang 23 / gcc 15 (LP: #2154343)
    - selftests/bpf: Fix const qualifier warning in fexit_bpf2bpf.c
  * ALSA: hda/tas2781 Audio Fix for the front-right speacker (LP: #2149770)
    - ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device
  * Fix bad audio record quality when volume above 50% on Framework PTL
    (LP: #2153155)
    - ALSA: hda/realtek: fix mic boost on Framework PTL
  * Patchset for TUXEDO devices (LP: #2152570)
    - drm/i915/vbt: Add edp pipe joiner enable/disable bits
    - drm/i915/dp: Avoid joiner for eDP if not enabled in VBT
    - drm/amd/display: Add Idle state manager(ISM)
    - drm/i915/backlight: Remove try_vesa_interface
    - drm/i915/backlight: Use intel_panel variable instead of intel_connector
    - drm/i915/backlight: Take luminance_set into account for VESA backlight
    - drm/i915/backlight: Check luminance_set when disabling PWM via AUX VESA
      backlight
    - drm/i915/backlight: Short circuit intel_dp_aux_supports_hdr_backlight
    - drm/i915/backlight: Update debug log during backlight setup
    - drm/i915/backlight: Check if VESA backlight is possible
    - drm/i915/backlight: Provide clear description on how backlight level is
      controlled
    - drm/i915/backlight: Fix VESA backlight possible check condition
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636)
    - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
    - ACPI: button: Fix ACPI GPE handler leak during removal
    - ACPI: button: Enable wakeup GPEs for ACPI buttons at probe time
    - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
    - net/sched: sch_sfb: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
    - bcache: fix uninitialized closure object
    - nfc: llcp: Fix use-after-free in llcp_sock_release()
    - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
    - xfrm: Check for underflow in xfrm_state_mtu
    - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems
    - tools/bootconfig: Fix buf leaks in apply_xbc
    - HID: remove duplicate hid_warn_ratelimited definition
    - kunit: fix use-after-free in debugfs when using kunit.filter
    - accel/rocket: fix UAF via dangling GEM handle in create_bo
    - netfilter: synproxy: refresh tcphdr after skb_ensure_writable
    - netfilter: xt_cpu: prefer raw_smp_processor_id
    - netfilter: ebtables: fix OOB read in compat_mtw_from_user
    - netfilter: nf_tables: fix dst corruption in same register operation
    - vsock: keep poll shutdown state consistent
    - net: netlink: fix sending unassigned nsid after assigned one
    - net: netlink: don't set nsid on local notifications
    - net/smc: Do not re-initialize smc hashtables
    - net/iucv: fix locking in .getsockopt
    - scsi: core: Run queues for all non-SDEV_DEL devices from
      scsi_run_host_queues
    - scsi: scsi_debug: Add missing newline in scsi_debug_device_reset()
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after
      unregister_net_sysctl_table()
    - ALSA: hda: cs35l56: Fix system name string leaks
    - ALSA: pcm: oss: Fix setup list UAF on proc write error
    - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
    - net/mlx5: HWS: Reject unsupported remove-header action
    - net: hsr: fix potential OOB access in supervision frame handling
    - accel/ivpu: prevent uninitialized data bug in debugfs
    - gpio: mxc: fix irq_high handling
    - drm/i915/aux: use polling when irqs are unavailable
    - net: Avoid checksumming unreadable skb tail on trim
    - ethtool: rss: avoid modifying the RSS context response
    - ethtool: rss: add missing errno on RSS context delete
    - ethtool: rss: fix falsely ignoring indir table updates
    - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
    - ethtool: rss: fix hkey leak when indir_size is 0
    - ethtool: rss: avoid device context leak on reply-build failure
    - ethtool: module: call ethnl_ops_complete() on module flash errors
    - ethtool: module: avoid leaking a netdev ref on module flash errors
    - ethtool: module: avoid racy updates to dev->ethtool bitfield
    - ethtool: module: check fw_flash_in_progress under rtnl_lock
    - ethtool: module: fix cleanup if socket used for flashing multiple
      devices
    - ethtool: cmis: require exact CDB reply length
    - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
    - ethtool: cmis: validate start_cmd_payload_size from module
    - ethtool: cmis: validate fw->size against start_cmd_payload_size
    - cxl/test: Update mock dev array before calling platform_device_add()
    - blk-mq: reinsert cached request to the list
    - tunnels: load network headers after skb_cow() in
      iptunnel_pmtud_build_icmp[v6]()
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
    - ksmbd: fix FSCTL permission bypass by adding a permission check for
      FSCTL_SET_SPARSE
    - ASoC: codecs: simple-mux: Fix enum control bounds check
    - drm/xe: Restore IDLEDLY regiter on engine reset
    - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
    - bonding: refuse to enslave CAN devices
    - bridge: Fix sleep in atomic context in netlink path
    - bridge: Fix sleep in atomic context in sysfs path
    - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
    - ethtool: tsconfig: fix reply error handling
    - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup
      error
    - ethtool: pse-pd: fix missing ethnl_ops_complete()
    - ethtool: tsconfig: fix missing ethnl_ops_complete()
    - ethtool: tsinfo: fix uninitialized stats on the by-PHC path
    - ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
    - ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
    - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during
      fallback
    - ethtool: eeprom: add more safeties to EEPROM Netlink fallback
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
    - net/sched: Revert "net/sched: Restrict conditions for adding duplicating
      netems to qdisc tree"
    - net/sched: fix packet loop on netem when duplicate is on
    - net: Introduce skb tc depth field to track packet loops
    - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
    - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack
      overflow
    - net/sched: act_mirred: Fix return code in early mirred redirect error
      paths
    - net: hibmcge: disable Relaxed Ordering to fix RX packet corruption
    - net: hibmcge: move dma_rmb() after dma_sync_single_for_cpu() in RX path
    - net/handshake: Use spin_lock_bh for hn_lock
    - nvme-tcp: store negative errno in queue->tls_err
    - net/handshake: Pass negative errno through handshake_complete()
    - net/handshake: hand off the pinned file reference to accept_doit
    - net/handshake: Take a long-lived file reference at submit
    - net/handshake: Drain pending requests at net namespace exit
    - dpll: zl3073x: detect DPLL channel count from chip ID at runtime
    - dpll: zl3073x: add die temperature reporting for supported chips
    - dpll: export __dpll_device_change_ntf() for use under dpll_lock
    - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work
    - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
    - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
    - Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
    - gpio: adnp: fix flow control regression caused by scoped_guard()
    - gpio: virtuser: Fix uninitialized data bug in
      gpio_virtuser_direction_do_write()
    - gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
    - gpio: rockchip: teardown bugs and resource leaks
    - net: mana: Add NULL guards in teardown path to prevent panic on attach
      failure
    - net: mana: Skip redundant detach on already-detached port
    - sctp: fix race between sctp_wait_for_connect and peeloff
    - net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
    - vsock/virtio: bind uarg before filling zerocopy skb
    - ipv6: fix possible infinite loop in rt6_fill_node()
    - ipv6: fix possible infinite loop in fib6_select_path()
    - net: skbuff: fix pskb_carve leaking zcopy pages
    - Revert "ipv6: preserve insertion order for same-scope addresses"
    - Revert "x86/fpu: Refine and simplify the magic number check during
      signal return"
    - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
    - drm/i915/psr: Read Intel DPCD workaround register
    - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
    - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
    - iio: imu: adis16550: fix stack leak in trigger handler
    - iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
    - usb: typec: ucsi: ccg: reject firmware images without a ':' record
      header
    - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
    - usb: typec: tcpm: bound altmode_desc[] per iteration in
      svdm_consume_modes()
    - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload
      VDO
    - usb: typec: altmodes/displayport: validate count before reading Status
      Update VDO
    - usb: typec: wcove: don't write past struct pd_message in
      wcove_read_rx_buffer()
    - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
    - usb: typec: ucsi: validate connector number in ucsi_connector_change()
    - USB: serial: safe_serial: fix memory corruption with small endpoint
    - media: rc: igorplugusb: fix control request setup packet
    - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
    - USB: serial: cypress_m8: fix memory corruption with small endpoint
    - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse
    - Bluetooth: btusb: Allow firmware re-download when version matches
    - mm/vmalloc: do not trigger BUG() on BH disabled context
    - hpfs: fix a crash if hpfs_map_dnode_bitmap fails
    - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
    - ipc: limit next_id allocation to the valid ID range
    - mm: memcontrol: propagate NMI slab stats to memcg vmstats
    - mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
    - memfd: deny writeable mappings when implying SEAL_WRITE
    - zram: fix use-after-free in zram_writeback_endio
    - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
    - auxdisplay: line-display: fix OOB read on zero-length message_store()
    - smb: client: fix uninitialized variable in smb2_writev_callback
    - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
    - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report()
    - Bluetooth: ISO: fix UAF in iso_recv_frame
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
    - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
    - Input: xpad - fix out-of-bounds access for Share button
    - parport: Fix race between port and client registration
    - rust_binder: Avoid holding lock when dropping delivered_death
    - rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN
    - USB: cdc-acm: Fix bit overlap and move quirk definitions to header
    - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
    - KVM: arm64: PMU: Preserve AArch32 counter low bits
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
    - KVM: SEV: Ignore Port I/O requests of length '0'
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC
      requests
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area
    - KVM: SEV: Check PSC request indices against the actual size of the
      buffer
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()
    - gpio: shared: undo the vote of the proxy on GPIO free
    - gpio: shared: fix deadlock on shared proxy's parent removal
    - gpio: shared: fix lockdep false positive by removing unneeded lock
    - Disable -Wattribute-alias for clang-23 and newer
    - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux
    - iio: adc: npcm: fix unbalanced clk_disable_unprepare()
    - iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
    - iio: dac: max5821: fix return value check in powerdown sync
    - iio: dac: ad5686: fix ref bit initialization for single-channel parts
    - iio: dac: ad5686: fix input raw value check
    - iio: dac: ad5686: acquire lock when doing powerdown control
    - iio: dac: ad5686: fix powerdown control on dual-channel devices
    - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
    - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
    - iio: adc: ad4695: Fix call ordering in offload buffer postenable
    - iio: adc: nxp-sar-adc: fix division by zero in write_raw
    - iio: adc: nxp-sar-adc: Avoid division by zero
    - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
    - iio: gyro: itg3200: fix i2c read into the wrong stack location
    - iio: gyro: adis16260: fix division by zero in write_raw
    - iio: ssp_sensors: cancel delayed work_refresh on remove
    - iio: temperature: tsys01: fix broken PROM checksum validation
    - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
    - iio: light: veml6070: Fix resource leak in probe error path
    - iio: Fix iio_multiply_value use in iio_read_channel_processed_scale
    - iio: chemical: mhz19b: reject oversized serial replies
    - iio: chemical: scd30: fix division by zero in write_raw
    - iio: light: cm3323: fix reg_conf not being initialized correctly
    - iio: buffer: hw-consumer: fix use-after-free in error path
    - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()
    - USB: serial: omninet: fix memory corruption with small endpoint
    - usb: cdns3: gadget: fix request skipping after clearing halt
    - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy
      acquisition failure
    - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently
      leaks the runtime PM usage counter across bind/unbind cycles
    - usb: dwc2: Fix use after free in debug code
    - Input: elan_i2c - validate firmware size before use
    - i2c: davinci: fix division by zero on missing clock-frequency
    - x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
    - wireguard: send: append trailer after expanding head
    - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
    - macsec: fix replay protection at XPN lower-PN wrap
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
    - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
    - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
    - ipv6: exthdrs: refresh nh after handling HAO option
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
    - ipv6: validate extension header length before copying to cmsg
    - xfrm: input: hold netns during deferred transport reinjection
    - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
    - ip6: vti: Use ip6_tnl.net in vti6_changelink().
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers
    - spi: spi-mem: avoid mutating op template in spi_mem_supports_op()
    - HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
    - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings
    - nfc: hci: fix out-of-bounds read in HCP header parsing
    - xfrm: route MIGRATE notifications to caller's netns
    - xfrm: ipcomp: Free destination pages on acomp errors
    - xfrm: ah: use skb_to_full_sk in async output callbacks
    - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417
    - ALSA: firewire-motu: Protect register DSP event queue positions
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without
      direction check
    - ASoC: qcom: q6asm-dai: close stream only when running
    - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger
      callbacks
    - xfrm: esp: restore combined single-frag length gate
    - ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP
    - xfrm: iptfs: reset runtime state when cloning SAs
    - dma-buf: fix UAF in dma_buf_fd() tracepoint
    - Input: xpad - add "Nova 2 Lite" from GameSir
    - Input: xpad - add support for ASUS ROG RAIKIRI II
    - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops
    - misc: rp1: Send IACK on IRQ activate to fix kdump/kexec
    - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
    - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490
    - dt-bindings: usb: Fix EIC7700 USB reset's issue
    - comedi: comedi_test: fix check for valid scan_begin_src in
      waveform_ai_cmdtest()
    - comedi: comedi_test: Fix limiting of convert_arg in
      waveform_ai_cmdtest()
    - counter: Fix refcount leak in counter_alloc() error path
    - tty: serial: pch_uart: add check for dma_alloc_coherent()
    - tty: serial: samsung: Remove redundant port lock acquisition in rx
      helpers
    - uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory
    - usb: chipidea: core: convert ci_role_switch to local variable
    - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
    - usb: dwc3: xilinx: fix error handling in zynqmp init error paths
    - usb: musb: omap2430: Fix use-after-free in omap2430_probe()
    - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub
      controllers
    - usb: storage: Add quirks for PNY Elite Portable SSD
    - usbip: vudc: Fix use after free bug in vudc_remove due to race condition
    - usb: usbtmc: check URB actual_length for interrupt-IN notifications
    - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize
    - usb: typec: tipd: Fix error code in tps6598x_probe()
    - usb: typec: tcpm: improve handling of DISCOVER_MODES failures
    - usb: typec: ucsi: Check if power role change actually happened before
      handling
    - usb: typec: ucsi: Don't update power_supply on power role change if not
      connected
    - USB: serial: option: add MeiG SRM813Q
    - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL
    - USB: serial: belkin_sa: validate interrupt status length
    - USB: serial: cypress_m8: validate interrupt packet headers
    - USB: serial: digi_acceleport: fix memory corruption with small endpoints
    - USB: serial: keyspan: fix missing indat transfer sanity check
    - USB: serial: mxuport: fix memory corruption with small endpoint
    - USB: serial: mct_u232: fix memory corruption with small endpoint
    - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
    - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
    - usb: gadget: net2280: Fix double free in probe error path
    - usb: gadget: f_hid: fix device reference leak in hidg_alloc()
    - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
    - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports
    - usb: gadget: f_fs: copy only received bytes on short ep0 read
    - usb: gadget: f_fs: serialize DMABUF cancel against request completion
    - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
    - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
    - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
    - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
    - scsi: target: iscsi: Fix CRC overread and double-free in
      iscsit_handle_text_cmd()
    - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode
    - drm/hyperv: validate resolution_count and fix WIN8 fallback
    - drm/hyperv: validate VMBus packet size in receive callback
    - drm/gem: fix race between change_handle and handle_delete
    - drm/i915/color: Fix HDR pre-CSC LUT programming loop
    - drm/i915/psr: Block DC states on vblank enable when Panel Replay
      supported
    - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable
    - drm/i915: Fix potential UAF in TTM object purge
    - drm/amd/pm/si: Disregard vblank time when no displays are connected
    - serial: altera_jtaguart: handle uart_add_one_port() failures
    - serial: qcom-geni: fix UART_RX_PAR_EN bit position
    - serial: qcom_geni: fix kfifo underflow when flush precedes DMA
      completion IRQ
    - serial: sh-sci: fix memory region release in error path
    - serial: zs: Fix swapped RI/DSR modem line transition counting
    - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma
    - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
    - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
    - drm/amdkfd: Check for pdd drm file first in CRIU restore path
    - drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
    - drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages
    - drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    - serial: dz: Fix bootconsole message clobbering at chip reset
    - serial: dz: Fix bootconsole handover lockup
    - serial: dz: Convert to use a platform device
    - serial: zs: Fix bootconsole handover lockup
    - serial: zs: Switch to using channel reset
    - serial: zs: Convert to use a platform device
    - serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
    - serial: 8250: dispatch SysRq character in serial8250_handle_irq()
    - serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()
    - platform/x86/intel/vsec: Refactor base_addr handling
    - platform/x86/intel/vsec: Make driver_data info const
    - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery
    - rxrpc: Fix RESPONSE packet verification to extract skb to a linear
      buffer
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx
    - ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook
      X
    - arm64: tlb: Flush walk cache when unsharing PMD tables
    - i2c: tegra: make tegra_i2c_mutex_unlock() return void
    - hwmon: (pmbus) Add support for guarded PMBus lock
    - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with
      pmbus_lock
    - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock
    - net: phy: micrel: fix LAN8814 QSGMII soft reset
    - xhci: tegra: Fix ghost USB device on dual-role port unplug
    - mailbox: Fix NULL message support in mbox_send_message()
    - usb: core: Fix SuperSpeed root hub wMaxPacketSize
    - tools: ynl: add scope qualifier for definitions
    - Linux 7.0.12
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46318
    - Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46322
    - tun: free page on build_skb failure in tun_xdp_one()
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46320
    - tap: free page on error paths in tap_get_user_xdp()
  * Resolute update: v7.0.12 upstream stable release (LP: #2156636) //
    CVE-2026-46321
    - tun: free page on short-frame rejection in tun_xdp_one()
  * CVE-2026-46316 // CVE-2026-46317
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock
  * CVE-2026-46316
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the
      erased entry
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection
      and AT emulation
  * Resolute update: v7.0.11 upstream stable release (LP: #2156390)
    - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
    - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
    - ksmbd: close durable scavenger races against m_fp_list lookups
    - ata: libata-scsi: improve readability of ata_scsi_qc_issue()
    - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
    - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
    - ata: libata-scsi: do not needlessly defer commands when using PMP with
      FBS
    - sysfs: don't remove existing directory on update failure
    - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()
    - ksmbd: fix null pointer dereference in compare_guid_key()
    - ksmbd: fix null pointer dereference in proc_show_files()
    - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow
    - ksmbd: validate SID in parent security descriptor during ACL inheritance
    - regulator: tps65219: fix irq_data.rdev not being assigned
    - x86/mm: Disable broadcast TLB flush when PCID is disabled
    - scripts/gdb: mm: cast untyped symbols in x86_page_ops
    - smb: client: require net admin for CIFS SWN netlink
    - smb: client: protect tc_count increment in
      smb2_find_smb_sess_tcon_unlocked()
    - smb: client: use data_len for SMB2 READ encrypted folioq copy
    - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close
    - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
    - ALSA: ua101: Reject too-short USB descriptors
    - ALSA: pcm: Don't setup bogus iov_iter for silencing
    - ALSA: asihpi: Fix potential OOB array access at reading cache
    - ALSA: scarlett2: Allow flash writes ending at segment boundary
    - ACPI: battery: Fix system wakeup on critical battery status
    - efi: Allocate runtime workqueue before ACPI init
    - spi: amd: Set correct bus number in ACPI probe path
    - io_uring/waitid: clear waitid info before copying it to userspace
    - drivers/base/memory: fix memory block reference leak in poison
      accounting
    - ipv6: ioam: refresh hdr pointer before ioam6_event()
    - mm/memory: fix spurious warning when unmapping device-private/exclusive
      pages
    - mm: fix __vm_normal_page() to handle missing support for
      pmd_special()/pud_special()
    - mm/memory_hotplug: fix memory block reference leak on remove
    - mm/page_alloc: fix initialization of tags of the huge zero folio with
      init_on_free
    - mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page
    - selftests/mm: run_vmtests.sh: fix destructive tests invocation
    - mm/damon: fix damos_stat tracepoint format for sz_applied
    - net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
    - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START
    - Bluetooth: bnep: Fix UAF read of dev->name
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init
      paths
    - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer
    - Bluetooth: hci_qca: Convert timeout from jiffies to ms
    - Bluetooth: MGMT: validate Add Extended Advertising Data length
    - Bluetooth: serialize accept_q access
    - phonet/pep: disable BH around forwarded sk_receive_skb()
    - net: bcmgenet: keep RBUF EEE/PM disabled
    - net: devmem: reject dma-buf bind with non-page-aligned size or SG length
    - net: phy: skip EEE advertisement write when autoneg is disabled
    - net: hsr: defer node table free until after RCU readers
    - net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover
    - net: ifb: report ethtool stats over num_tx_queues
    - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis()
    - netfilter: ip6t_hbh: reject oversized option lists
    - netfilter: nf_queue: hold bridge skb->dev while queued
    - netfilter: ipset: stop hash:* range iteration at end
    - net: ethtool: fix NULL pointer dereference in phy_reply_size
    - net: ethtool: phy: avoid NULL deref when PHY driver is unbound
    - ACPI: driver: Check ACPI_COMPANION() against NULL during probe
    - sched_ext: Fix missing warning in scx_set_task_state() default case
    - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
    - l2tp: use list_del_rcu in l2tp_session_unhash
    - qed: fix double free in qed_cxt_tables_alloc()
    - ring-buffer: Fix reporting of missed events in iterator
    - ring-buffer: Flush and stop persistent ring buffer on panic
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
    - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()
    - selftests: mptcp: drop nanoseconds width specifier
    - mptcp: pm: fix ADD_ADDR timer infinite retry on option space
      insufficient
    - vsock/vmci: fix UAF when peer resets connection during handshake
    - vsock/virtio: reset connection on receiving queue overflow
    - ice: fix VF queue configuration with low MTU values
    - wifi: ath11k: clear shared SRNG pointer state on restart
    - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
    - wifi: iwlwifi: mld: stop TX during firmware restart
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5
    - ixgbevf: fix use-after-free in VEPA multicast source pruning
    - rbd: eliminate a race in lock_dwork draining on unmap
    - mptcp: do not drop partial packets
    - mptcp: reset rcv wnd on disconnect
    - lsm: hold cred_guard_mutex for lsm_set_self_attr()
    - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
    - octeontx2-pf: fix double free in rvu_rep_rsrc_init()
    - igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
    - ice: fix locking around wait_event_interruptible_locked_irq
    - ice: fix setting promisc mode while adding VID filter
    - ice: restore PTP Rx timestamp config after ethtool set-channels
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
    - af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
    - wifi: mac80211: consume only present negotiated TTLM maps
    - octeontx2-pf: avoid double free of pool->stack on AQ init failure
    - cifs: Fix busy dentry used after unmounting
    - tracing: Do not call map->ops->elt_free() if elt_alloc() fails
    - ASoC: codecs: pcm512x: fix null-ptr dereference in
      pcm512x_overclock_xxx_put()
    - arm64: probes: Handle probes on hinted conditional branch instructions
    - KVM: arm64: vgic-its: Reject restored DTE with out-of-range
      num_eventid_bits
    - KVM: arm64: vgic: Free private_irqs when init fails after allocation
    - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum
      #1235)
    - riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM
    - riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM
    - virt: sev-guest: Explicitly leak pages in unknown state
    - i2c: tegra: fix pm_runtime leak on mutex_lock failure
    - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe
    - spi: qup: fix error pointer deref after DMA setup failure
    - phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870
    - phy: tegra: xusb: Fix per-pad high-speed termination calibration
    - phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4
      fix
    - phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables
    - phy: qcom: edp: Add eDP/DP mode switch support
    - phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
    - scsi: isci: Fix use-after-free in device removal path
    - spi: ep93xx: fix error pointer deref after DMA setup failure
    - spi: sprd: fix error pointer deref after DMA setup failure
    - spi: ti-qspi: fix use-after-free after DMA setup failure
    - mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math
    - s390/cio: Restore GFP_DMA for CHSC allocation
    - s390/pai: Disable duplicate read of kernel PAI counter value
    - s390/pai: Fix missing PAI counter increments under heavy load
    - fwctl: pds: Validate RPC input size before parsing
    - LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions
    - LoongArch: Remove unused code to avoid build warning
    - cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E
    - device property: set fwnode->secondary to NULL in fwnode_init()
    - drm/i915/display: Copy color pipeline from plane in the primary joiner
      pipe
    - drm/msm: Fix shrinker deadlock
    - drm/v3d: Fix use-after-free of CPU job query arrays on error path
    - drm/v3d: Release indirect CSD GEM reference on CPU job free
    - drm/virtio: use uninterruptible resv lock for plane updates
    - drm/xe/multi_queue: Fix secondary queue error case
    - drm/amdgpu/vpe: Force collaborate sync after TRAP
    - drm/bridge: it66121: acquire reset GPIO in probe
    - drm/bridge: megachips: remove bridge when irq request fails
    - drm/amd/display: Fix integer overflow in bios_get_image()
    - drm/amd/display: Validate GPIO pin LUT table size before iterating
    - drm/amd/display: Validate payload length and link_index in
      dc_process_dmub_aux_transfer_async
    - batman-adv: v: stop OGMv2 on disabled interface
    - batman-adv: tvlv: abort OGM send on tvlv append failure
    - batman-adv: tvlv: reject oversized TVLV packets
    - batman-adv: iv: recover OGM scheduling after forward packet error
    - batman-adv: mcast: fix use-after-free in orig_node RCU release
    - batman-adv: clear current gateway during teardown
    - batman-adv: dat: handle forward allocation error
    - batman-adv: fix fragment reassembly length accounting
    - batman-adv: fix tp_meter counter underflow during shutdown
    - batman-adv: frag: disallow unicast fragment in fragment
    - batman-adv: bla: fix report_work leak on backbone_gw purge
    - batman-adv: bla: avoid double decrement of bla.num_requests
    - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
    - batman-adv: tp_meter: avoid use of uninit sender vars
    - batman-adv: tp_meter: directly shut down timer on cleanup
    - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown
    - batman-adv: tp_meter: fix race condition in send error reporting
    - batman-adv: tp_meter: avoid role confusion in tp_list
    - batman-adv: tt: fix TOCTOU race for reported vlans
    - batman-adv: tt: reject oversized local TVLV buffers
    - batman-adv: tt: avoid empty VLAN responses
    - batman-adv: tt: fix negative last_changeset_len
    - batman-adv: tt: fix negative tt_buff_len
    - batman-adv: tt: prevent TVLV entry number overflow
    - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
    - hwmon: (pmbus/adm1266) reject implausible blackbox record_count
    - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer
    - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized
      buffer
    - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR
    - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in
      get_multiple
    - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()
    - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO
      accessors
    - pinctrl: mediatek: moore: implement gpio_chip::get_direction()
    - pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
    - arm64: dts: renesas: r8a78000: Fix SCIF brg_int clocks
    - ARM: dts: renesas: genmai: Drop superfluous cells
    - ARM: dts: renesas: rskrza1: Drop superfluous cells
    - pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high
      pins during suspend/resume
    - pinctrl: renesas: rzg2l: Fix SMT register cache handling
    - pinctrl: meson: amlogic-a4: fix deadlock issue
    - pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
    - kho: skip KHO for crash kernel
    - mm/memfd_luo: report error when restoring a folio fails mid-loop
    - HID: intel-thc-hid: Intel-quickspi: Fix some error codes
    - HID: uclogic: Fix regression of input name assignment
    - firmware: arm_ffa: Check for NULL FF-A ID table while driver
      registration
    - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
    - firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
    - firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
    - riscv: errata: Fix bitwise vs logical AND in MIPS errata patching
    - riscv: Fix register corruption from uninitialized cregs on error
    - riscv: mm: Fixup no5lvl failure when vaddr is invalid
    - kunit: config: Enable KUNIT_DEBUGFS by default
    - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS
    - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
    - firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
    - firmware: arm_ffa: Keep framework RX release under lock
    - firmware: arm_ffa: Validate framework notification message layout
    - firmware: arm_ffa: Align RxTx buffer size before mapping
    - firmware: arm_ffa: Snapshot notifier callbacks under lock
    - firmware: arm_ffa: Fix sched-recv callback partition lookup
    - ARM: integrator: Fix early initialization
    - ALSA: hda: cs35l56: Put ACPI device after setting companion
    - ALSA: hda: cs35l41: Put ACPI device on missing physical node
    - btrfs: tracepoints: fix sleep while in atomic context in
      btrfs_sync_file()
    - netfilter: x_tables: allow initial table replace without emitting audit
      log message
    - netfilter: x_tables: allocate hook ops while under mutex
    - netfilter: x_tables: unregister the templates first
    - netfilter: x_tables: add and use xt_unregister_table_pre_exit
    - netfilter: x_tables: add and use xtables_unregister_table_exit
    - netfilter: ebtables: move to two-stage removal scheme
    - netfilter: ebtables: close dangling table module init race
    - netfilter: x_tables: close dangling table module init race
    - netfilter: bridge: eb_tables: close module init race
    - netfilter: nf_conntrack_expect: restore helper propagation via
      expectation
    - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist()
    - test_kprobes: clear kprobes between test runs
    - tcp: Fix imbalanced icsk_accept_queue count.
    - net: napi: Avoid gro timer misfiring at end of busypoll
    - net: shaper: Reject reparenting of existing nodes
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
    - ice: fix setting RSS VSI hash for E830
    - ice: fix locking in ice_dcb_rebuild()
    - ice: dpll: fix rclk pin state get for E810
    - ice: dpll: fix misplaced header macros
    - net: lan966x: avoid unregistering netdev on register failure
    - net: ti: icssm-prueth: fix eth_ports_node leak in probe
    - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register
      access
    - phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()
    - NFSD: Fix infinite loop in layout state revocation
    - ASoC: sdw_utils: Add quirk to ignore RT712 CODEC_MIC
    - ASoC: sdw_utils: Add quirk to ignore RT721 CODEC_MIC
    - fprobe: Fix unregister_fprobe() to wait for RCU grace period
    - fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
    - fs: Fix return in jfs_mkdir and orangefs_mkdir
    - irqchip/ath79-cpu: Remove unused function
    - fs: fix forced iversion increment on lazytime timestamp updates
    - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter
      validation
    - nsfs: fix wrong error code returned for pidns ioctls
    - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
    - nvme: fix bio leak on mapping failure
    - nvme-pci: fix use-after-free in nvme_free_host_mem()
    - zonefs: handle integer overflow in zonefs_fname_to_fno
    - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
    - ASoC: SOF: amd: Fix error code handling in psp_send_cmd()
    - powerpc: 82xx: fix uninitialized pointers with free attribute
    - powerpc: fix dead default for GUEST_STATE_BUFFER_TEST
    - powerpc/hv-gpci: fix preempt count leak in sysfs show paths
    - netfs: Fix cancellation of a DIO and single read subrequests
    - netfs: Fix missing locking around retry adding new subreqs
    - netfs: Fix missing barriers when accessing stream->subrequests
      locklessly
    - netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
    - netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
    - netfs: Fix zeropoint update where i_size > remote_i_size
    - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call
    - netfs: Fix overrun check in netfs_extract_user_iter()
    - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes
      gone
    - netfs: Defer the emission of trace_netfs_folio()
    - netfs: Fix streaming write being overwritten
    - netfs: Fix potential deadlock in write-through mode
    - netfs: Fix read-gaps to remove netfs_folio from filled folio
    - netfs: Fix write streaming disablement if fd open O_RDWR
    - netfs: Fix early put of sink folio in netfs_read_gaps()
    - netfs: Fix leak of request in netfs_write_begin() error handling
    - netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
    - netfs: Fix partial invalidation of streaming-write folio
    - netfs: Fix folio->private handling in netfs_perform_write()
    - netfs: Fix netfs_read_folio() to wait on writeback
    - netfs, afs: Fix write skipping in dir/link writepages
    - afs: Fix the locking used by afs_get_link()
    - net: ethernet: cortina: Make RX SKB per-port
    - net: ethernet: cortina: Drop half-assembled SKB
    - net: ethernet: cortina: Carry over frag counter
    - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
    - wifi: ath11k: fix error path leaks in some WMI WOW calls
    - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
    - wifi: ath10k: skip WMI and beacon transmission when device is wedged
    - net: shaper: flip the polarity of the valid flag
    - net: shaper: fix trivial ordering issue in net_shaper_commit()
    - net: shaper: reject duplicate leaves in GROUP request
    - net: shaper: set ret to -ENOMEM when genlmsg_new() fails in group_doit
    - net: shaper: fix undersized reply skb allocation in GROUP command
    - net: shaper: enforce singleton NETDEV scope with id 0
    - net: shaper: reject QUEUE scope handle with missing id
    - block: don't overwrite bip_vcnt in bio_integrity_copy_user()
    - block: recompute nr_integrity_segments in blk_insert_cloned_request
    - HID: quirks: really enable the intended work around for appledisplay
    - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
    - accel/qaic: Add overflow check to remap_pfn_range during mmap
    - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
    - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics
    - drm/msm/dpu: fix UV scanlines calculation for YUV UBWC formats
    - drm/msm/dpu: Fix Kaanapali CWB register configuration
    - drm/msm/dsi: don't dump registers past the mapped region
    - drm/msm/dpu: don't mix devm and drmm functions
    - block: rename struct gendisk zone_wplugs_lock field
    - block: allow submitting all zone writes from a single context
    - block: fix handling of dead zone write plugs
    - selftests: ublk: cap nthreads to kernel's actual nr_hw_queues
    - x86/mce: Restore MCA polling interval halving
    - Documentation: intel_pstate: Fix description of asymmetric packing with
      SMT
    - drm/msm: Fix GMEM_BASE for A650
    - drm/msm/a6xx: Add soft fuse detection support
    - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
    - drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
    - drm/msm/a6xx: Restore sysprof_active
    - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
    - drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table
    - ASoC: intel: sof_sdw: Prepare for configuration without a jack
    - ASoC: sdw_utils: cs42l43: allow spk component names to be combined
    - ASoC: sdw_utils: Check speaker component string allocation
    - riscv: Docs: fix unmatched quote warning
    - powerpc/time: Remove redundant preempt_disable|enable() calls from
      arch_irq_work_raise()
    - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
    - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
    - net: tls: prevent chain-after-chain in plain text SG
    - net: phy: DP83TC811: add reading of abilities
    - ovpn: tcp - use cached peer pointer in ovpn_tcp_close()
    - ovpn: respect peer refcount in CMD_NEW_PEER error path
    - ovpn: fix race between deleting interface and adding new peer
    - cifs: client: stage smb3_reconfigure() updates and restore ctx on
      failure
    - phy: apple: atc: Fix typec switch/mux leak on unbind
    - gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE
    - x86/xen: Fix xen_e820_swap_entry_with_ram()
    - vfio/pci: Check BAR resources before exporting a DMABUF
    - ovpn: disable BHs when updating device stats
    - tls: Preserve sk_err across recvmsg() when data has been copied
    - net/mlx5: Do not restore destination-less TC rules
    - net/mlx5: Skip disabled vports when setting max TX speed
    - scsi: sd: Fix return code handling in sd_spinup_disk()
    - ASoC: codecs: fs210x: fix possible buffer overflow
    - iommupt: Directly call iommupt's unmap_range()
    - iommupt: Avoid rewalking during map
    - iommu: Fix loss of errno on map failure for classic ops
    - iommu: Fix up map/unmap debugging for iommupt domains
    - iommu: Handle unmap error when iommu_debug is enabled
    - iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap
    - iommupt: Fix the end_index calculation in __map_range_leaf()
    - ALSA: scarlett2: Add missing error check when initialise Autogain Status
    - ALSA: hda/ca0132: Disable auto-detect on manual output select
    - cachefiles: Fix error return when vfs_mkdir() fails
    - io_uring/net: punt IORING_OP_BIND async if it needs file create
    - vsock/virtio: fix zerocopy completion for multi-skb sends
    - btrfs: check for subvolume before deleting squota qgroup
    - btrfs: fix squota accounting during enable generation
    - ASoC: amd: acp-sdw-legacy: check CPU DAI name before logging
    - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
    - netfilter: nft_inner: release local_lock before re-enabling softirqs
    - ALSA: hda/realtek: Use ALC287_FIXUP_TXNW2781_I2C for ASUS Strix Gxx5
    - drm/msm/snapshot: fix dumping of the unaligned regions
    - hwmon: (lm90) Stop work before releasing hwmon device
    - hwmon: (lm90) Add lock protection to lm90_alert
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is
      disabled
    - wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
    - dma-mapping: move dma_map_resource() sanity check into debug code
    - drm/gem: Make the GEM LRU lock part of drm_device
    - drm/xe/gsc: Fix double-free of managed BO in error path
    - drm/xe/vf: Fix signature of print functions
    - drm/xe/pf: Fix CFI failure in debugfs access
    - drm/xe: Consolidate workaround entries for Wa_14019988906
    - drm/xe: Consolidate workaround entries for Wa_18033852989
    - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1
    - drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p
    - drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4
    - wifi: ath11k: fix peer resolution on rx path when peer_id=0
    - wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing
    - drm/mediatek: mtk_hdmi_ddc_v2: Fix non-static global variable
    - drm/mediatek: mtk_hdmi_v2: Fix non-static global variable
    - drm/mediatek: mtk_cec: Fix non-static global variable
    - drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable
    - io_uring: propagate array_index_nospec opcode into req->opcode
    - srcu: Don't queue workqueue handlers to never-online CPUs
    - cgroup/rstat: validate cpu before css_rstat_cpu() access
    - net/mlx5e: xsk: Fix unlocked writing to ICOSQ
    - cifs: Fix undefined variables
    - ice: ptp: serialize E825 PHY timer start with PTP lock
    - ice: ptp: use primary NAC semaphore on E825
    - igc: set tx buffer type for SMD frames
    - drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
    - phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
    - kbuild: pacman-pkg: make "rc" releases adhere to pacman versioning
      scheme
    - net: dsa: mt7530: fix FDB entries not aging out with short timeout
    - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
    - platform/surface: aggregator_registry: omit battery & AC nodes on
      Surface Laptop 7
    - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
    - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
    - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
    - platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
    - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
    - platform/x86: uniwill-laptop: Properly initialize charging threshold
    - platform/x86: uniwill-laptop: Accept charging threshold of 0
    - platform/x86: uniwill-laptop: Fix behavior of "force" module param
    - platform/x86: asus-armoury: fix mini-LED mode get/set on MODE2 devices
    - ASoC: soc-utils: Add missing va_end in snd_soc_ret()
    - drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on Tahiti (v2)
    - drm/amdgpu/vce1: Check that the GPU address is < 128 MiB
    - drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
    - RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port
    - RDMA/rtrs: Fix use-after-free in path file creation cleanup
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port
    - net: phy: honor eee_disabled_modes in phy_support_eee()
    - net: phy: honor eee_disabled_modes in phy_advertise_eee_all()
    - net: airoha: Fix NPU RX DMA descriptor bits
    - pds_core: fix error handling in pdsc_devcmd_wait
    - pds_core: fix debugfs_lookup dentry leak and error handling
    - erofs: fix managed cache race for unaligned extents
    - erofs: harden h_shared_count in erofs_init_inode_xattrs()
    - erofs: fix metabuf leak in inode xattr initialization
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
    - wifi: mac80211: fix MLE defragmentation
    - wifi: mac80211: fix multi-link element inheritance
    - wifi: wilc1000: fix dma_buffer leak on bus acquire failure
    - ALSA: seq: Serialize UMP output teardown with event_input
    - cgroup: rstat: relax NMI guard after switch to try_cmpxchg
    - tracing: Avoid NULL return from hist_field_name() on truncation
    - Bluetooth: hci_sync: Fix not setting mask for
      HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE
    - Bluetooth: btintel_pcie: Fix incorrect MAC access programming
    - Bluetooth: btmtk: fix urb->setup_packet leak in error paths
    - udp: gso: Fix handling checksum in __udp_gso_segment
    - udp: Fix UDP length on last GSO_PARTIAL segment
    - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA
    - net: shaper: annotate the data races
    - net: shaper: rework the VALID marking (again)
    - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
    - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
    - net: ag71xx: check error for platform_get_irq
    - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
    - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
    - net: stmmac: eswin: fix HSP CSR init ordering after clock enable
    - net: stmmac: eswin: clear TXD and RXD delay registers during
      initialization
    - net: stmmac: eswin: correct RGMII delay granularity to 20 ps
    - net: stmmac: eswin: validate RGMII delay values
    - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
    - gpio: aggregator: fix a potential use-after-free
    - gpio: aggregator: stop using dev-sync-probe
    - gpio: aggregator: remove the software node when deactivating the
      aggregator
    - gpio: aggregator: lock device when calling device_is_bound()
    - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
    - drm/xe/oa: Fix exec_queue leak on width check in stream open
    - ASoC: cs-amp-lib: Fix wrong sizeof() in
      _cs_amp_set_efi_calibration_data()
    - ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
    - selftests: net: Fix checksums in xdp_native
    - nvme-pci: fix dma_vecs leak on p2p memory
    - nvme-pci: fix dma mapping leak on data setup error
    - octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs
    - net: mana: validate rx_req_idx to prevent out-of-bounds array access
    - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    - net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback
    - pds_core: ensure null-termination for firmware version strings
    - net: enetc: fix missing error code when pf->vf_state allocation fails
    - io_uring/nop: pass all errors to userspace
    - blk-mq: pop cached request if it is usable
    - ksmbd: fix durable reconnect error path file lifetime
    - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions
    - block: avoid use-after-free in disk_free_zone_resources()
    - Documentation: laptops: Update documentation for uniwill laptops
    - platform/x86: uniwill-laptop: Do not enable the charging limit even when
      forced
    - drm/msm: Restore second parameter name in purge() and evict()
    - security/keys: fix missed RCU read section on lookup
    - Linux 7.0.11
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385)
    - blk-cgroup: wait for blkcg cleanup before initializing new disk
    - md: suppress spurious superblock update error message for dm-raid
    - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
    - fs/mbcache: cancel shrink work before destroying the cache
    - md/raid1: fix the comparing region of interval tree
    - fs: fix archiecture-specific compat_ftruncate64
    - drbd: Balance RCU calls in drbd_adm_dump_devices()
    - loop: fix partition scan race between udev and loop_reread_partitions()
    - block: fix zones_cond memory leak on zone revalidation error paths
    - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
    - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
    - pstore/ram: fix resource leak when ioremap() fails
    - erofs: include the trailing NUL in FS_IOC_GETFSLABEL
    - md: fix array_state=clear sysfs deadlock
    - ublk: reset per-IO canceled flag on each fetch
    - blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()
    - erofs: handle 48-bit blocks/uniaddr for extra devices
    - md: remove unused static md_wq workqueue
    - md: wake raid456 reshape waiters before suspend
    - dcache: permit dynamic_dname()s up to NAME_MAX
    - btrfs: fix the inline compressed extent check in inode_need_compress()
    - btrfs: fix deadlock between reflink and transaction commit when using
      flushoncommit
    - btrfs: do not reject a valid running dev-replace
    - OPP: debugfs: Use performance level if available to distinguish between
      rates
    - OPP: Move break out of scoped_guard in dev_pm_opp_xlate_required_opp()
    - ACPI: x86: cmos_rtc: Clean up address space handler driver
    - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
    - devres: fix missing node debug info in devm_krealloc()
    - thermal/drivers/spear: Fix error condition for reading st,thermal-flags
    - debugfs: check for NULL pointer in debugfs_create_str()
    - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
    - soundwire: debugfs: initialize firmware_file to empty string
    - amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()
    - amd-pstate: Update cppc_req_cached in fast_switch case
    - cpufreq: Pass the policy to cpufreq_driver->adjust_perf()
    - PCI: use generic driver_override infrastructure
    - platform/wmi: use generic driver_override infrastructure
    - vdpa: use generic driver_override infrastructure
    - s390/cio: use generic driver_override infrastructure
    - s390/ap: use generic driver_override infrastructure
    - bus: fsl-mc: use generic driver_override infrastructure
    - locking/mutex: Rename mutex_init_lockep()
    - locking/mutex: Fix wrong comment for CONFIG_DEBUG_LOCK_ALLOC
    - irqchip/irq-pic32-evic: Address warning related to wrong printf()
      formatter
    - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns()
    - hrtimer: Reduce trace noise in hrtimer_start()
    - locking: Fix rwlock and spinlock lock context annotations
    - signal: Fix the lock_task_sighand() annotation
    - ww-mutex: Fix the ww_acquire_ctx function annotations
    - perf/amd/ibs: Account interrupt for discarded samples
    - perf/amd/ibs: Preserve PhyAddrVal bit when clearing PhyAddr MSR
    - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
    - x86/tdx: Fix the typo in TDX_ATTR_MIGRTABLE
    - rust: sync: atomic: Remove bound `T: Sync` for `Atomic::from_ptr()`
    - sparc64: vdso: Link with -z noexecstack
    - scripts/gdb: timerlist: Adapt to move of tk_core
    - locking: Fix rwlock support in <linux/spinlock_up.h>
    - sched/topology: Compute sd_weight considering cpuset partitions
    - x86/irqflags: Preemptively move include paravirt.h directive where it
      belongs
    - sched/topology: Fix sched_domain_span()
    - irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()
    - ASoC: Intel: avs: Check maximum valid CPUID leaf
    - ASoC: Intel: avs: Include CPUID header at file scope
    - x86/vdso: Clean up remnants of VDSO32_NOTE_MASK
    - firmware: dmi: Correct an indexing error in dmi.h
    - fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm
    - sched: Make class_schedulers avoid pushing current, and get rid of
      proxy_tag_curr()
    - sched/rt: Skip group schedulable check with rt_group_sched=0
    - wifi: ath11k: fix memory leaks in beacon template setup
    - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
    - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished
      irq_prepare_bcn_tasklet
    - bpf: test_run: Fix the null pointer dereference issue in
      bpf_lwt_xmit_push_encap
    - wifi: ath12k: account TX stats only when ACK/BA status is present
    - wifi: ath12k: Fix legacy rate mapping for monitor mode capture
    - selftests/bpf: Handle !CONFIG_SMC in bpf_smc.c
    - wifi: ieee80211: fix definition of EHT-MCS 15 in MRU
    - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH
    - [Config] Disable CONFIG_FSL_DPAA2_SWITCH on armhf and ppc64el
    - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n
    - s390/bpf: Zero-extend bpf prog return values and kfunc arguments
    - powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
    - powerpc/64s: Fix unmap race with PMD migration entries
    - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n
    - wifi: libertas: use USB anchors for tracking in-flight URBs
    - wifi: libertas: don't kill URBs in interrupt context
    - bpf: Do not allow deleting local storage in NMI
    - selftests/nolibc: fix test_file_stream() on musl libc
    - selftests/nolibc: Fix build with host headers and libc
    - tools/nolibc/printf: Change variables 'c' to 'ch' and 'tmpbuf[]' to
      'outbuf[]'
    - tools/nolibc/printf: Move snprintf length check to callback
    - tools/nolibc: MIPS: fix clobbers of 'lo' and 'hi' registers on different
      ISAs
    - tools/nolibc: avoid -Wundef warning for __STDC_VERSION__
    - wifi: mt76: mt7996: fix the behavior of radar detection
    - wifi: mt76: mt7996: fix iface combination for different chipsets
    - wifi: mt76: mt7996: Set mtxq->wcid just for primary link
    - wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in
      mt7996_vif_link_remove()
    - wifi: mt76: mt7996: Switch to the secondary link if the default one is
      removed
    - wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()
    - wifi: mt76: mt7996: Reset ampdu_state state in case of failure in
      mt7996_tx_check_aggr()
    - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in
      mt76_connac2_tx_check_aggr()
    - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
    - wifi: mt76: mt7615: fix use_cts_prot support
    - wifi: mt76: mt7915: fix use_cts_prot support
    - wifi: mt76: mt7925: prevent NULL pointer dereference in
      mt7925_tx_check_aggr()
    - wifi: mt76: mt7925: prevent NULL vif dereference in
      mt7925_mac_write_txwi
    - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
    - wifi: mt76: mt7921: Place upper limit on station AID
    - wifi: mt76: Fix memory leak destroying device
    - wifi: mt76: mt7996: Fix NPU stop procedure
    - wifi: mt76: npu: Add missing rx_token_size initialization
    - wifi: mt76: mt7925: drop puncturing handling from BSS change path
    - wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
    - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
    - wifi: mt76: mt7925: fix tx power setting failure after chip reset
    - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
    - wifi: mt76: fix deadlock in remain-on-channel
    - wifi: mt76: fix backoff fields and max_power calculation
    - arm64: cpufeature: Make PMUVer and PerfMon unsigned
    - bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI
    - wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP
    - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
    - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
    - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
    - wifi: mt76: mt7921: fix 6GHz regulatory update on connection
    - wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property
    - wifi: mt76: mt7996: Remove link pointer dependency in
      mt7996_mac_sta_remove_links()
    - wifi: mt76: mt7996: Decrement sta counter removing the link in
      mt7996_mac_reset_sta_iter()
    - wifi: mt76: fix multi-radio on-channel scanning
    - wifi: mt76: support upgrading passive scans to active
    - wifi: mt76: mt7996: fix RRO EMU configuration
    - bpf: Fix refcount check in check_struct_ops_btf_id()
    - selftests/bpf: Fix sockmap_multi_channels reliability
    - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
    - bpf: Fix variable length stack write over spilled pointers
    - arm_mpam: Ensure in_reset_state is false after applying configuration
    - arm_mpam: Reset when feature configuration bit unset
    - bpf,arc_jit: Fix missing newline in pr_err messages
    - wifi: rtw89: phy: fix uninitialized variable access in
      rtw89_phy_cfo_set_crystal_cap()
    - drivers/vfio_pci_core: Change PXD_ORDER check from switch case to
      if/else block
    - r8152: fix incorrect register write to USB_UPHY_XTAL
    - selftests/tracing: Fix to make --logdir option work again
    - selftests/tracing: Fix to check awk supports non POSIX strtonum()
    - powerpc/crash: fix backup region offset update to elfcorehdr
    - powerpc/crash: Update backup region offset in elfcorehdr on memory
      hotplug
    - bpf: Fix abuse of kprobe_write_ctx via freplace
    - macvlan: annotate data-races around port->bc_queue_len_used
    - bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK
    - bpf: Fix stale offload->prog pointer after constant blinding
    - net: ethernet: ti-cpsw:: rename soft_reset() function
    - net: ethernet: ti-cpsw: fix linking built-in code to modules
    - wifi: brcmfmac: Fix error pointer dereference
    - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
    - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable
      hooks
    - bpf: Prefer vmlinux symbols over module symbols for unqualified kprobes
    - wifi: ath10k: fix station lookup failure during disconnect
    - bpf: Fix linked reg delta tracking when src_reg == dst_reg
    - net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT
    - net: plumb drop reasons to __dev_queue_xmit()
    - net: qdisc_pkt_len_segs_init() cleanup
    - net: pull headers in qdisc_pkt_len_segs_init()
    - arm64: entry: Don't preempt with SError or Debug masked
    - ACPI: AGDI: fix missing newline in error message
    - arm64: kexec: Remove duplicate allocation for trans_pgd
    - bpf: Propagate error from visit_tailcall_insn
    - bpf: Fix ld_{abs,ind} failure path analysis in subprogs
    - bpf: Remove static qualifier from local subprog pointer
    - mptcp: better mptcp-level RTT estimator
    - bpf: Fix use-after-free in offloaded map/prog info fill
    - macsec: Support VLAN-filtering lower devices
    - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
    - net: bcmgenet: fix leaking free_bds
    - net: bcmgenet: fix racing timeout handler
    - net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process()
    - eth: fbnic: Use wake instead of start
    - netfilter: xt_socket: enable defrag after all other checks
    - netfilter: nft_fwd_netdev: check ttl/hl before forwarding
    - bpf: fix mm lifecycle in open-coded task_vma iterator
    - bpf: switch task_vma iterator from mmap_lock to per-VMA locks
    - bpf: return VMA snapshot from task_vma iterator
    - bpf: Fix RCU stall in bpf_fd_array_map_clear()
    - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
    - net: airoha: Fix FE_PSE_BUF_SET configuration if PPE2 is available
    - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
    - selftests/bpf: fix __jited_unpriv tag name
    - net/sched: cls_fw: fix NULL dereference of "old" filters before change()
    - net/sched: act_ct: Only release RCU read lock after ct_ft
    - selftests: netfilter: nft_tproxy.sh: adjust to socat changes
    - net: mana: Use pci_name() for debugfs directory naming
    - net: mana: Move current_speed debugfs file to mana_init_port()
    - net: airoha: Add missing RX_CPU_IDX() configuration in
      airoha_qdma_cleanup_rx_queue()
    - net_sched: fix skb memory leak in deferred qdisc drops
    - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
    - bpf: Allow instructions with arena source and non-arena dest registers
    - selftests/bpf: Fix reg_bounds to match new tnum-based refinement
    - net/rds: Optimize rds_ib_laddr_check
    - net/rds: Restrict use of RDS/IB to the initial network namespace
    - bpf: Fix OOB in pcpu_init_value
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
    - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
    - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
    - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110
    - net: phy: fix a return path in get_phy_c45_ids()
    - net/mlx5e: Fix features not applied during netdev registration
    - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic()
    - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers
    - net: fix skb_ext_total_length() BUILD_BUG_ON with
      CONFIG_GCOV_PROFILE_ALL
    - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
    - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds
      MTU
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
    - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to
      sco_pi(sk)->codec
    - net: phy: qcom: at803x: Use the correct bit to disable extended next
      page
    - udp: Force compute_score to always inline
    - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init().
    - sctp: fix missing encap_port propagation for GSO fragments
    - sctp: disable BH before calling udp_tunnel_xmit_skb()
    - selftests/namespaces: remove unused utils.h include from
      listns_efault_test
    - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master
    - net: airoha: Fix VIP configuration for AN7583 SoC
    - net: airoha: Add missing PPE configurations in airoha_ppe_hw_init()
    - drm/panel: ilitek-ili9882t: Select DRM_DISPLAY_DSC_HELPER
    - selftests/futex: Fix incorrect result reporting of futex_requeue test
      item
    - drm/komeda: fix integer overflow in AFBC framebuffer size check
    - dma-fence: Fix sparse warnings due __rcu annotations
    - drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()
    - drm/virtio: Allow importing prime buffers when 3D is enabled
    - ASoC: soc-compress: use function to clear symmetric params
    - PCI/TPH: Allow TPH enable for RCiEPs
    - PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind
    - PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested
    - PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
    - drm/sun4i: mixer: Fix layer init code
    - drm/sun4i: backend: fix error pointer dereference
    - drm/xe: Consolidate workaround entries for Wa_14019877138
    - drm/xe: Consolidate workaround entries for Wa_14019386621
    - drm/xe/xe2_hpg: Drop invalid workaround Wa_15010599737
    - gpu: nova-core: gsp: use empty slices instead of [0..0] ranges
    - gpu: nova-core: gsp: fix improper handling of empty slot in cmdq
    - drm/amdkfd: Removed commented line for MQD queue priority
    - PCI: imx6: Fix device node reference leak in imx_pcie_probe()
    - crypto: inside-secure/eip93 - fix register definition
    - ASoC: sti: Return errors from regmap_field_alloc()
    - ASoC: sti: use managed regmap_field allocations
    - dm cache: fix null-deref with concurrent writes in passthrough mode
    - dm cache: fix write path cache coherency in passthrough mode
    - dm cache: fix write hang in passthrough mode
    - dm cache policy smq: fix missing locks in invalidating cache blocks
    - dm cache: fix concurrent write failure in passthrough mode
    - dm cache: fix dirty mapping checking in passthrough mode switching
    - dm-mpath: don't stop probing paths at presuspend
    - drm/amd/ras: Fix type size of remainder argument
    - dt-bindings: mmc: dwcmshc-sdhci: Fix resets array validation
    - drm/amdgpu: GFX12.1 scratch memory limit up to 57-bit
    - platform/chrome: chromeos_tbmc: Drop wakeup source on remove
    - gpu: nova-core: use checked arithmetic in FWSEC firmware parsing
    - gpu: nova-core: create falcon firmware DMA objects lazily
    - gpu: nova-core: falcon: rename load parameters to reflect DMA dependency
    - gpu: nova-core: firmware: fix and explain v2 header offsets computations
    - PCI: dwc: ep: Fix MSI-X Table Size configuration in
      dw_pcie_ep_set_msix()
    - PCI: dwc: ep: Mirror the max link width and speed fields to all
      functions
    - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq()
    - dm cache metadata: fix memory leak on metadata abort retry
    - dm log: fix out-of-bounds write due to region_count overflow
    - iopoll: fix function parameter names in read_poll_timeout_atomic()
    - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier
      in atomic_enable()
    - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to
      drm_bridge_funcs
    - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge
      atomic check
    - spi: nxp-xspi: Use reinit_completion() for repeated operations
    - spi: nxp-fspi: Use reinit_completion() for repeated operations
    - spi: fsl-qspi: Use reinit_completion() for repeated operations
    - spi: axiado: Remove redundant pm_runtime_mark_last_busy() call
    - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe
    - media: synopsys: VIDEO_DW_MIPI_CSI2RX should depend on ARCH_ROCKCHIP
    - [Config] VIDEO_DW_MIPI_CSI2RX depends on ARCH_ROCKCHIP
    - drm/amd/pm: Fix xgmi max speed reporting
    - spi: atcspi200: fix mutex initialization order
    - selftests/sched_ext: Add missing error check for exit__load()
    - drm/v3d: Handle error from drm_sched_entity_init()
    - drm/sun4i: Fix resource leaks
    - crypto: inside-secure/eip93 - register hash before authenc algorithms
    - PCI: rzg3s-host: Fix reset handling in probe error path
    - PCI: rzg3s-host: Reorder reset assertion during suspend
    - dt-bindings: PCI: renesas,r9a08g045s33-pcie: Fix naming properties
    - iommu/riscv: Add IOTINVAL after updating DDT/PDT entries
    - iommu/riscv: Skip IRQ count check when using MSI interrupts
    - iommu/riscv: Add missing GENERIC_MSI_IRQ
    - iommu/riscv: Stop polling when CQCSR reports an error
    - drm/amdkfd: Update queue properties for metadata ring
    - drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()
    - drm/amdgpu: Add default case in DVI mode validation
    - regulator: dt-bindings: fp9931: Make vin-supply property as required
    - regulator: fp9931: Fix handling of mandatory "vin" supply
    - drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp()
    - drm/amdgpu: Drop redundant queue NULL check in hang detect worker
    - drm/amdgpu: Remove dead negative offset check in
      amdgpu_virt_init_critical_region()
    - dm init: ensure device probing has finished in dm-mod.waitfor=
    - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build
      break
    - crypto: simd - reject compat registrations without __ prefixes
    - crypto: tegra - Disable softirqs before finalizing request
    - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs
    - padata: Remove cpu online check from cpu add and removal
    - padata: Put CPU offline callback in ONLINE section to allow failure
    - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the
      documentation
    - accel/amdxdna: fix missing newline in pr_err message
    - drm/amd/ras: Remove redundant NULL check in pending bad-bank list
      iteration
    - drm/amdgpu/gfx10: look at the right prop for gfx queue priority
    - drm/amdgpu/gfx11: look at the right prop for gfx queue priority
    - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo
    - PCI: sky1: Fix missing cleanup of ECAM config on probe failure
    - drm/imagination: Switch reset_reason fields from enum to u32
    - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
    - iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement
    - drm/msm: add missing MODULE_DEVICE_ID definitions
    - drm/msm/dpu: fix mismatch between power and frequency
    - drm/msm/dsi: add the missing parameter description
    - drm/msm/dpu: don't try using 2 LMs if only one DSC is available
    - drm/msm/dsi: fix bits_per_pclk
    - drm/msm/dsi: fix hdisplay calculation for CMD mode panel
    - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0
    - ASoC: rockchip: rockchip_sai: Set slot width for non-TDM mode
    - tools/sched_ext: scx_pair: fix pair_ctx indexing for CPU pairs
    - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first
    - drm/panel: simple: Correct G190EAN01 prepare timing
    - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion
      support
    - PCI: Prevent shrinking bridge window from its required size
    - PCI: Fix premature removal from realloc_head list during resource
      assignment
    - crypto: hisilicon/sec2 - prevent req used-after-free for sec
    - PCI: Fix alignment calculation for resource size larger than align
    - iommu/riscv: Fix signedness bug
    - ALSA: core: Validate compress device numbers without dynamic minors
    - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
    - ASoC: amd: acp: update dmic_num logic for acp pdm dmic
    - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
    - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs
    - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock
    - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
    - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
    - drm/amd/pm/ci: Fill DW8 fields from SMC
    - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board
    - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
    - PCI/DPC: Log AER error info for DPC/EDR uncorrectable errors
    - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback
    - ALSA: hda/realtek: fix bad indentation for alc269
    - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace
      '}')
    - ASoC: SOF: Intel: hda: Place check before dereference
    - drm/msm/vma: Avoid lock in VM_BIND fence signaling path
    - drm/msm/a6xx: Add missing aperture_lock init
    - drm/msm: Reject fb creation from _NO_SHARE objs
    - drm/msm: Fix VM_BIND UNMAP locking
    - drm/msm/a6xx: Fix HLSQ register dumping
    - drm/msm/shrinker: Fix can_block() logic
    - drm/msm/a6xx: Fix dumping A650+ debugbus blocks
    - drm/msm/a6xx: Use barriers while updating HFI Q headers
    - drm/msm/a8xx: Fix the ticks used in submit traces
    - drm/msm/a6xx: Switch to preemption safe AO counter
    - drm/msm/a6xx: Correct OOB usage
    - drm/msm/adreno: Implement gx_is_on() for A8x
    - drm/msm/a6xx: Fix gpu init from secure world
    - ALSA: hda/cmedia: Remove duplicate pin configuration parsing
    - pmdomain: ti: omap_prm: Fix a reference leak on device node
    - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe()
    - PM: domains: De-constify fields in struct dev_pm_domain_attach_data
    - drm/msm/dpu: drop INTF_0 on MSM8953
    - ASoC: fsl_micfil: Add access property for "VAD Detected"
    - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable()
    - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode()
    - ASoC: fsl_micfil: Fix event generation in micfil_range_set()
    - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state()
    - ASoC: fsl_micfil: Fix event generation in micfil_quality_set()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put()
    - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put()
    - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits()
    - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits()
    - ASoC: fsl_easrc: Change the type for iec958 channel status controls
    - iommu/amd: Fix clone_alias() to use the original device's devid
    - iommu/riscv: Remove overflows on the invalidation path
    - ASoC: qcom: qdsp6: topology: check widget type before accessing data
    - PCI: dwc: Fix type mismatch for kstrtou32_from_user() return value
    - crypto: qat - disable 4xxx AE cluster when lead engine is fused off
    - crypto: qat - disable 420xx AE cluster when lead engine is fused off
    - crypto: qat - fix compression instance leak
    - crypto: qat - fix type mismatch in RAS sysfs show functions
    - crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()
    - crypto: qat - use swab32 macro
    - ALSA: hda: Notify IEC958 Default PCM switch state changes
    - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]
    - PCI: Enable AtomicOps only if Root Port supports them
    - PCI: imx6: Keep Root Port MSI capability with iMSI-RX to work around
      hardware bug
    - PCI: aspeed: Fix IRQ domain leak on platform_get_irq() failure
    - dt-bindings: PCI: imx6q-pcie: Fix maxItems of clocks and clock-names
    - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found
    - gpu: nova-core: bitfield: fix broken Default implementation
    - selftests/mm: skip migration tests if NUMA is unavailable
    - Documentation: fix a hugetlbfs reservation statement
    - Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name
    - Docs/mm/damon/index: fix typo: autoamted -> automated
    - zram: do not permit params change after init
    - selftest: memcg: skip memcg_sock test if address family not supported
    - gpu: nova-core: remove redundant `.as_ref()` for `dev_*` print
    - gpu: nova-core: fix missing colon in SEC2 boot debug message
    - ALSA: scarlett2: Add missing sentinel initializer field
    - ASoC: qcom: audioreach: explicitly enable speaker protection modules
    - ASoC: SOF: compress: return the configured codec from get_params
    - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports
    - tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing
    - ASoC: soc-component: re-add pcm_new()/pcm_free()
    - ASoC: amd: name back to pcm_new()/pcm_free()
    - ASoC: amd: ps: fix the pcm device numbering for acp pdm dmic
    - ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_stream
    - PCI: tegra194: Fix polling delay for L2 state
    - PCI: tegra194: Increase LTSSM poll time on surprise link down
    - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link
      down
    - PCI: tegra194: Don't force the device into the D0 state before L2
    - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode
    - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-
      select"
    - PCI: tegra194: Disable direct speed change for Endpoint mode
    - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint
      mode
    - PCI: tegra194: Allow system suspend when the Endpoint link is not up
    - PCI: tegra194: Free up Endpoint resources during remove()
    - PCI: tegra194: Use DWC IP core version
    - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well
    - PCI: tegra194: Disable L1.2 capability of Tegra234 EP
    - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
    - drm/fb-helper: Fix a locking bug in an error path
    - PCI: cadence: Add flags for disabling ASPM capability for broken Root
      Ports
    - PCI: sg2042: Avoid L0s and L1 on Sophgo 2042 PCIe Root Ports
    - ASoC: SDCA: Fix cleanup inversion in class driver
    - spi: rzv2h-rspi: Fix invalid SPR=0/BRDV=0 clock configuration
    - spi: mtk-snfi: unregister ECC engine on probe failure and remove()
      callback
    - ALSA: sc6000: Keep the programmed board state in card-private data
    - dm cache: fix missing return in invalidate_committed's error path
    - sched_ext: Track @p's rq lock across set_cpus_allowed_scx ->
      ops.set_cpumask
    - sched_ext: Fix ops.cgroup_move() invocation kf_mask and rq tracking
    - spi: cadence-qspi: Revert the filtering of certain opcodes in ODTR
    - crypto: jitterentropy - replace long-held spinlock with mutex
    - ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP
    - ALSA: hda/realtek - fixed speaker no sound update
    - gfs2: Call unlock_new_inode before d_instantiate
    - fanotify: avoid/silence premature LSM capability checks
    - fanotify: call fanotify_events_supported() before path_permission() and
      security_path_notify()
    - fuse: fix uninit-value in fuse_dentry_revalidate()
    - ktest: Avoid undef warning when WARNINGS_FILE is unset
    - ktest: Honor empty per-test option overrides
    - ktest: Run POST_KTEST hooks on failure and cancellation
    - vfio: selftests: fix crash in vfio_dma_mapping_mmio_test
    - rtla/utils: Fix resource leak in set_comm_sched_attr()
    - tools/rtla: Generate optstring from long options
    - rtla: Fix segfault on multiple SIGINTs
    - vfio: selftests: Build tests on aarch64
    - gfs2: less aggressive low-memory log flushing
    - quota: Fix race of dquot_scan_active() with quota deactivation
    - vfio: unhide vdev->debug_root
    - gfs2: add some missing log locking
    - gfs2: prevent NULL pointer dereference during unmount
    - efi/capsule-loader: fix incorrect sizeof in phys array reallocation
    - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
    - arm64: dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon
    - ARM: dts: mediatek: mt7623: fix efuse fallback compatible
    - memory: tegra124-emc: Fix dll_change check
    - memory: tegra30-emc: Fix dll_change check
    - arm64: dts: imx8-apalis: Fix LEDs name collision
    - arm64: dts: imx91-11x11-evk: change usdhc tuning step for eMMC and SD
    - riscv: dts: spacemit: pcie: fix missing power regulator
    - arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model string
    - arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
    - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO
      (M.2 W_DISABLE1)
    - iommufd: vfio compatibility extension check for noiommu mode
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove board-id
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Correct reserved memory ranges
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Remove extcon
    - arm64: dts: qcom: sm6125-xiaomi-ginkgo: Fix reserved gpio ranges
    - arm64: dts: qcom: qcs6490-rubikpi3: Use lt9611 DSI Port B
    - arm64: dts: qcom: talos: Add missing clock-names to GCC
    - arm64: dts: ti: k3-am62l: include WKUP_UART0 in wakeup peripheral window
    - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count
    - arm64: dts: mediatek: mt7981b: Fix gpio-ranges pin count
    - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count
    - iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
    - arm64: dts: imx8mp-kontron: Fix touch reset configuration on DL devices
    - arm64: dts: imx8mp-kontron: Drop vmmc-supply to fix SD card on SMARC
      eval carrier
    - arm64: dts: imx8mp-hummingboard-pulse/cubox-m: fix vmmc gpio polarity
    - arm64: dts: imx8mp-hummingboard-pulse: fix mini-hdmi dsi port reference
    - ARM: dts: BCM5301X: Drop extra NAND controller compatible
    - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value
    - arm64: dts: qcom: msm8937-xiaomi-land: correct wled ovp value
    - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight
    - firmware: qcom_scm: don't opencode kmemdup
    - soc: qcom: ubwc: disable bank swizzling for Glymur platform
    - arm64: dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi
    - Revert "arm64: dts: rockchip: add SPDIF audio to Beelink A1"
    - arm64: dts: rockchip: Correct Fan Supply for Gameforce Ace
    - arm64: dts: rockchip: Correct Joystick Axes on Gameforce Ace
    - soc: qcom: ocmem: make the core clock optional
    - soc: qcom: ocmem: register reasons for probe deferrals
    - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available
    - riscv: dts: spacemit: drop incorrect pinctrl for combo PHY
    - arm64: dts: rockchip: Fix RK3562 EVB2 model name
    - arm64: dts: rockchip: Add mphy reset to ufshc node
    - bus: rifsc: fix RIF configuration check for peripherals
    - arm64: dts: qcom: arduino-imola: fix faulty spidev node
    - Revert "UBUNTU: SAUCE: arm64: dts: add missing denali-oled.dtb to
      Makefile"
    - arm64: dts: qcom: add missing denali-oled.dtb to Makefile
    - arm64: dts: qcom: hamoa: correct Iris corners for the MXC rail
    - arm64: dts: qcom: lemans: correct Iris corners for the MXC rail
    - arm64: dts: qcom: monaco: correct Iris corners for the MXC rail
    - arm64: dts: qcom: sm8550: correct Iris corners for the MXC rail
    - arm64: dts: qcom: sm8650: correct Iris corners for the MXC rail
    - arm64: dts: qcom: sm8750: correct Iris corners for the MXC rail
    - arm64: dts: qcom: kaanapali: Fix GIC_ITS range length
    - arm64: dts: qcom: milos: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8450: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8550: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8650: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8750: Fix GIC_ITS range length
    - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host
      controller
    - arm64: dts: qcom: sm8650: Fix xo clock supply of SD host controller
    - arm64: dts: qcom: hamoa: Fix xo clock supply of platform SD host
      controller
    - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes
    - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
    - arm64: dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes
    - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl
    - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered
      during boot
    - arm64: dts: qcom: msm8917-xiaomi-riva: Fix board-id for all bootloader
    - arm64: dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins
    - arm64: dts: ti: k3-am62l3-evm: Disable MMC1 internal pulls on data pins
    - arm64: dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins
    - arm64: dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label
    - arm64: dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS
      muxing
    - arm64: dts: imx91: Remove TMU's superfluous sensor ID
    - arm64: dts: imx8mp-kontron: Fix boot order for PMIC and RTC
    - arm64: dts: imx8dxl-evk: Use audio-graph-card2 for wm8960-2 and wm8960-3
    - arm64: dts: imx8mp-evk: Specify ADV7535 register addresses
    - arm64: dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit
    - arm64: dts: lx2160a: remove duplicate pinmux nodes
    - arm64: dts: lx2160a: rename pinmux nodes for readability
    - arm64: dts: lx2160a: add sda gpio references for i2c bus recovery
    - arm64: dts: lx2160a: change zeros to hexadecimal in pinmux nodes
    - arm64: dts: lx2160a: complete pinmux for rcwsr12 configuration word
    - arm64: dts: imx8qm-mek: switch Type-C connector power-role to dual
    - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual
    - soc/tegra: cbb: Set ERD on resume for err interrupt
    - soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables
    - soc/tegra: cbb: Fix cross-fabric target timeout lookup
    - arm64: tegra: Fix RTC aliases
    - soc/tegra: pmc: Add kerneldoc for reboot notifier
    - soc/tegra: pmc: Correct function names in kerneldoc
    - soc/tegra: pmc: Add kerneldoc for wake-up variables
    - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts()
      failure
    - ocfs2/dlm: validate qr_numregions in dlm_match_regions()
    - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
    - soc: qcom: llcc: fix v1 SB syndrome register offset
    - soc: qcom: aoss: compare against normalized cooling state
    - arm64: dts: qcom: milos: Add missing CX power domain to GCC
    - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP
    - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX
    - arm64/xor: fix conflicting attributes for xor_block_template
    - lib: kunit_iov_iter: fix memory leaks
    - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended
    - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP
    - fwctl: Fix class init ordering to avoid NULL pointer dereference on
      device removal
    - ocfs2: fix listxattr handling when the buffer is full
    - ocfs2: validate bg_bits during freefrag scan
    - ocfs2: validate group add input before caching
    - dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis
    - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void
      function
    - phy: apple: apple: Use local variable for ioremap return value
    - soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
    - soundwire: Intel: test bus.bpt_stream before assigning it
    - dmaengine: mxs-dma: Fix missing return value from
      of_dma_controller_register()
    - soundwire: cadence: Clear message complete before signaling waiting
      thread
    - tracing: move __printf() attribute on __ftrace_vbprintk()
    - tracing: Rebuild full_name on each hist_field_name() call
    - hte: tegra194: remove Kconfig dependency on Tegra194 SoC
    - [Config] Enable CONFIG_HTE_TEGRA194 on armhf
    - remoteproc: xlnx: Fix sram property parsing
    - stop_machine: Fix the documentation for a NULL cpus argument
    - remoteproc: imx_rproc: Check return value of regmap_attach_dev() in
      imx_rproc_mmio_detect_mode()
    - ima: check return value of crypto_shash_final() in boot aggregate
    - HID: asus: make asus_resume adhere to linux kernel coding standards
    - HID: asus: do not abort probe when not necessary
    - workqueue: devres: Add device-managed allocate workqueue
    - power: supply: max77705: Drop duplicated IRQ error message
    - power: supply: max77705: Free allocated workqueue and fix removal order
    - mtd: physmap_of_gemini: Fix disabled pinctrl state check
    - ima_fs: Correctly create securityfs files for unsupported hash algos
    - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range
    - mtd: spi-nor: core: correct the op.dummy.nbytes when check read
      operations
    - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
    - mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for
      mt35xu512aba
    - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
    - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path
    - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions
    - cxl/pci: Check memdev driver binding status in cxl_reset_done()
    - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
    - mtd: spinand: winbond: Clarify when to enable the HS bit
    - HID: usbhid: fix deadlock in hid_post_reset()
    - ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init()
    - ext4: call deactivate_super() in extents_kunit_exit()
    - ext4: fix the error handling process in extents_kunit_init).
    - ext4: fix possible null-ptr-deref in extents_kunit_exit()
    - ext4: fix possible null-ptr-deref in mbt_kunit_exit()
    - bpf, arm64: Reject out-of-range B.cond targets
    - bpf, arm64: Fix off-by-one in check_imm signed range check
    - bpf, arm64: Remove redundant bpf_flush_icache() after pack allocator
      finalize
    - bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator
      finalize
    - bpf, sockmap: Fix af_unix iter deadlock
    - bpf, sockmap: Fix af_unix null-ptr-deref in proto update
    - bpf, sockmap: Take state lock for af_unix iter
    - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
    - bpf: Fix NULL deref in map_kptr_match_type for scalar regs
    - bpf: allow UTF-8 literals in bpf_bprintf_prepare()
    - libbpf: Prevent double close and leak of btf objects
    - bpf: Validate node_id in arena_alloc_pages()
    - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
    - perf trace: Fix IS_ERR() vs NULL check bug
    - dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: add missing items
      keyword
    - pinctrl: pinctrl-pic32: Fix resource leak
    - perf trace: Avoid an ERR_PTR in syscall_stats
    - pinctrl: microchip-mssio: Fix missing return in probe
    - perf test type profiling: Remote typedef on struct
    - pinctrl: cy8c95x0: remove duplicate error message
    - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe()
    - pinctrl: cy8c95x0: Avoid returning positive values to user space
    - perf branch: Avoid incrementing NULL
    - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE
      trace
    - pinctrl: pinconf-generic: Fully validate 'pinmux' property
    - pinctrl: realtek: Fix function signature for config argument
    - pinctrl: abx500: Fix type of 'argument' variable
    - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT}
      registers
    - tools build: Correct link flags for libopenssl
    - perf lock: Fix option value type in parse_max_stack
    - perf stat: Fix opt->value type for parse_cache_level
    - memblock: reserve_mem: fix end caclulation in
      reserve_mem_release_by_name()
    - perf stat: Fix crash on arm64
    - perf tools: Fix module symbol resolution for non-zero .text sh_addr
    - perf test: Fix ratio_to_prev event parsing test
    - perf test: Skip perf data type profiling tests for s390
    - perf expr: Return -EINVAL for syntax error in expr__find_ids()
    - perf metrics: Make common stalled metrics conditional on having the
      event
    - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
    - ipmi: ssif_bmc: fix message desynchronization after truncated response
    - ipmi: ssif_bmc: change log level to dbg in irq callback
    - perf cgroup: Update metric leader in evlist__expand_cgroup
    - pinctrl: sophgo: pinctrl-sg2042: Fix wrong module description
    - pinctrl: sophgo: pinctrl-sg2044: Fix wrong module description
    - perf maps: Fix fixup_overlap_and_insert that can break sorted by name
      order
    - perf maps: Fix copy_from that can break sorted by name order
    - perf util: Kill die() prototype, dead for a long time
    - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback
    - i3c: master: dw-i3c: Balance PM runtime usage count on probe failure
    - i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()
    - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers()
    - i3c: master: adi: Fix error propagation for CCCs
    - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status
    - fs/ntfs3: prevent uninitialized lcn caused by zero len
    - backlight: sky81452-backlight: Check return value of
      devm_gpiod_get_optional() in sky81452_bl_parse_dt()
    - platform/surface: surfacepro3_button: Drop wakeup source on remove
    - leds: lgm-sso: Remove duplicate assignments for priv->mmap
    - usb: typec: Fix error pointer dereference
    - tty: hvc_iucv: fix off-by-one in number of supported devices
    - usb: typec: ps883x: Fix Oops at unbind
    - platform/x86: panasonic-laptop: Fix OPTD notifier registration and
      cleanup
    - platform/x86: barco-p50-gpio: normalize return value of gpio_get
    - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
    - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
    - nfs/blocklayout: Fix compilation error (`make W=1`) in
      bl_write_pagelist()
    - sunrpc: Kill RPC_IFDEBUG()
    - sunrpc: Fix compilation error (`make W=1`) when dprintk() is no-op
    - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg
    - nfsd: use dynamic allocation for oversized NFSv4.0 replay cache
    - RDMA/umem: Use consistent DMA attributes when unmapping entries
    - greybus: raw: fix use-after-free on cdev close
    - greybus: raw: fix use-after-free if write is called after disconnect
    - platform/x86: asus-wmi: adjust screenpad power/brightness handling
    - platform/x86: asus-wmi: fix screenpad brightness range
    - tty: serial: ip22zilog: Fix section mispatch warning
    - fs/ntfs3: terminate the cached volume label after UTF-8 conversion
    - platform/x86: hp-wmi: fix ignored return values in fan settings
    - platform/x86: hp-wmi: avoid cancel_delayed_work_sync from work handler
    - platform/x86: hp-wmi: use mod_delayed_work to reset keep-alive timer
    - platform/x86: hp-wmi: fix u8 underflow in gpu_delta calculation
    - platform/x86: hp-wmi: add locking for concurrent hwmon access
    - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write()
    - platform/x86: dell-wmi-sysman: bound enumeration string aggregation
    - RDMA/core: Prefer NLA_NUL_STRING
    - platform/x86: hp-wmi: fix fan table parsing
    - dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur
    - clk: qcom: gcc-glymur: Add video axi clock resets for glymur
    - clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source
    - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source
    - clk: renesas: r9a09g057: Fix ordering of module clocks array
    - clk: renesas: r9a09g056: Fix ordering of module clocks array
    - clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock
    - scsi: sg: Fix sysctl sg-big-buff register during sg_init()
    - scsi: sg: Resolve soft lockup issue when opening /dev/sgX
    - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from
      byte_div_clk_src dividers
    - clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting
    - clk: qcom: dispcc-kaanapali: Fix DSI byte clock rate setting
    - clk: qcom: dispcc-milos: Fix DSI byte clock rate setting
    - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting
    - clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting
    - clk: renesas: r9a09g057: Remove entries for WDT{0,2,3}
    - scsi: target: core: Fix integer overflow in UNMAP bounds check
    - scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item
    - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Add missing GDSCs
    - clk: qcom: gcc-sc8180x: Use retention for USB power domains
    - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains
    - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk
    - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks
    - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()
    - clk: imx: imx6q: Fix device node reference leak in
      of_assigned_ldb_sels()
    - clk: imx8mq: Correct the CSI PHY sels
    - um: Fix potential race condition in TLB sync
    - x86/um: fix vDSO installation
    - clk: qoriq: avoid format string warning
    - clk: xgene: Fix mapping leak in xgene_pllclk_init()
    - clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()
    - f2fs: avoid reading already updated pages during GC
    - printk_ringbuffer: Fix get_data() size sanity check
    - clk: qcom: gdsc: Fix error path on registration of multiple pm
      subdomains
    - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()
    - f2fs: fix data loss caused by incorrect use of nat_entry flag
    - f2fs: fix to preserve previous reserve_{blocks,node} value when remount
    - scsi: hpsa: Enlarge controller and IRQ name buffers
    - drm/amd/display: Fix parameter mismatch in panel self-refresh helper
    - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON
    - clk: visconti: pll: initialize clk_init_data to zero
    - f2fs: allow empty mount string for Opt_usr|grp|projjquota
    - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
    - drm/i915/wm: Verify the correct plane DDB entry
    - virt: arm-cca-guest: fix error check for RSI_INCOMPLETE
    - crypto: eip93 - fix hmac setkey algo selection
    - crypto: sa2ul - Fix AEAD fallback algorithm names
    - crypto: ccp - copy IV using skcipher ivsize
    - sh: Include <linux/io.h> in dac.h
    - erofs: unify lcn as u64 for 32-bit platforms
    - tools: hv: Fix cross-compilation
    - Drivers: hv: vmbus: fix hyperv_cpuhp_online variable shadowing
    - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for
      PMIC_nINT
    - arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for
      PMIC_nINT
    - PCMCIA: Fix garbled log messages for KERN_CONT
    - reset: amlogic: t7: Fix null reset ops
    - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT
    - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT
    - arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's
      phy-names
    - pwm: stm32: Fix rounding issue for requests with inverted polarity
    - net/sched: act_mirred: fix wrong device for mac_header_xmit check in
      tcf_blockcast_redir
    - macvlan: fix macvlan_get_size() not reserving space for
      IFLA_MACVLAN_BC_CUTOFF
    - net/sched: sch_cake: fix NAT destination port not being updated in
      cake_update_flowkeys
    - nexthop: fix IPv6 route referencing IPv4 nexthop
    - net: airoha: Wait for NPU PPE configuration to complete in
      airoha_ppe_offload_setup()
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule
      switch
    - net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
    - net: enetc: correct the command BD ring consumer index
    - net: enetc: fix NTMP DMA use-after-free issue
    - ksmbd: fix use-after-free in smb2_open during durable reconnect
    - tcp: move tp->chrono_type next tp->chrono_stat[]
    - tcp: inline tcp_chrono_start()
    - tcp: annotate data-races in tcp_get_info_chrono_stats()
    - tcp: add data-race annotations around tp->data_segs_out and
      tp->total_retrans
    - tcp: add data-races annotations around tp->reordering, tp->snd_cwnd
    - tcp: annotate data-races around tp->snd_ssthresh
    - tcp: annotate data-races around tp->delivered and tp->delivered_ce
    - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
    - tcp: annotate data-races around tp->bytes_sent
    - tcp: annotate data-races around tp->bytes_retrans
    - tcp: annotate data-races around tp->dsack_dups
    - tcp: annotate data-races around tp->reord_seen
    - tcp: annotate data-races around tp->srtt_us
    - tcp: annotate data-races around tp->timeout_rehash
    - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
    - tcp: annotate data-races around tp->plb_rehash
    - ice: fix 'adjust' timer programming for E830 devices
    - ice: update PCS latency settings for E825 10G/25Gb modes
    - ice: fix double-free of tx_buf skb
    - ice: fix PHY config on media change with link-down-on-close
    - ice: fix ICE_AQ_LINK_SPEED_M for 200G
    - ice: fix race condition in TX timestamp ring cleanup
    - ice: fix potential NULL pointer deref in error path of
      ice_set_ringparam()
    - i40e: don't advertise IFF_SUPP_NOFCS
    - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2
    - e1000e: Unroll PTP in probe error handling
    - ipv6: fix possible UAF in icmpv6_rcv()
    - af_unix: Drop all SCM attributes for SOCKMAP.
    - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
    - pppoe: drop PFC frames
    - net/mlx5: Fix HCA caps leak on notifier init failure
    - net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()
    - netfilter: nft_osf: restrict it to ipv4
    - netfilter: conntrack: remove sprintf usage
    - netfilter: xtables: restrict several matches to inet family
    - netfilter: nat: use kfree_rcu to release ops
    - ipvs: fix MTU check for GSO packets in tunnel mode
    - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
    - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
    - net/sched: sch_dualpi2: drain both C-queue and L-queue in
      dualpi2_change()
    - arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0
    - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number
    - vfio/pci: Clean up DMABUFs before disabling function
    - pwm: atmel-tcb: Cache clock rates and mark chip as atomic
    - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()
    - ksmbd: destroy async_ida in ksmbd_conn_free()
    - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
    - ksmbd: scope conn->binding slowpath to bound sessions only
    - net: validate skb->napi_id in RX tracepoints
    - bnge: fix initial HWRM sequence
    - bnge: remove unsupported backing store type
    - sctp: fix sockets_allocated imbalance after sk_clone()
    - net/rds: zero per-item info buffer before handing it to visitors
    - ice: fix timestamp interrupt configuration for E825C
    - ice: perform PHY soft reset for E825C ports at initialization
    - ice: fix ready bitmap check for non-E822 devices
    - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
    - net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
    - net/sched: sch_pie: annotate data-races in pie_dump_stats()
    - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
    - net/sched: sch_red: annotate data-races in red_dump_stats()
    - net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
    - net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
    - net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
    - net: dsa: realtek: rtl8365mb: fix mode mask calculation
    - net: airoha: Move ndesc initialization at end of
      airoha_qdma_init_rx_queue()
    - net: airoha: Rework the code flow in airoha_remove() and in
      airoha_probe() error path
    - net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()
    - net: mana: Init link_change_work before potential error paths in probe
    - net: mana: Init gf_stats_work before potential error paths in probe
    - net: mana: Guard mana_remove against double invocation
    - net: mana: Don't overwrite port probe error with add_adev result
    - net: mana: Fix EQ leak in mana_remove on NULL port
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting
    - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via
      VQ_PAIRS_SET
    - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
    - tcp: send a challenge ACK on SEG.ACK > SND.NXT
    - tipc: fix double-free in tipc_buf_append()
    - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
    - nstree: fix func. parameter kernel-doc warnings
    - eventpoll: use hlist_is_singular_node() in __ep_remove()
    - eventpoll: split __ep_remove()
    - eventpoll: kill __ep_remove()
    - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()
    - eventpoll: move epi_fget() up
    - fs/adfs: validate nzones in adfs_validate_bblk()
    - rtc: abx80x: Disable alarm feature if no interrupt attached
    - kbuild: builddeb - avoid recompiles for non-cross-compiles
    - tools/power turbostat: Fix AMD RAPL regression on big systems
    - fbdev: offb: fix PCI device reference leak on probe failure
    - tools/power turbostat: Fix unrecognized option '-P'
    - tools/power turbostat: Fix --cpu-set 0 regression on HT systems
    - tools/power turbostat: Fix --cpu-set 1 regression on HT systems
    - kbuild: Never respect CONFIG_WERROR / W=e to fixdep
    - mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate()
    - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
    - mailbox: mailbox-test: free channels on probe error
    - sched/psi: fix race between file release and pressure write
    - cgroup/rdma: fix integer overflow in rdmacg_try_charge()
    - cgroup/cpuset: record DL BW alloc CPU for attach rollback
    - mailbox: add sanity check for channel array
    - mailbox: mailbox-test: handle channel errors consistently
    - mailbox: mailbox-test: don't free the reused channel
    - mailbox: mailbox-test: initialize struct earlier
    - mailbox: mailbox-test: make data_ready a per-instance variable
    - fsnotify: fix inode reference leak in fsnotify_recalc_mask()
    - btrfs: fix bytes_may_use leak in move_existing_remap()
    - btrfs: fix bytes_may_use leak in do_remap_reloc_trans()
    - btrfs: don't clobber errors in add_remap_tree_entries()
    - btrfs: fix double-decrement of bytes_may_use in
      submit_one_async_extent()
    - tracing: branch: Fix inverted check on stat tracer registration
    - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
    - netfilter: nf_tables: use list_del_rcu for netlink hooks
    - rculist: add list_splice_rcu() for private lists
    - netfilter: nf_tables: join hook list via splice_list_rcu() in commit
      phase
    - netfilter: nf_tables: add hook transactions for device deletions
    - nvme-pci: fix missed admin queue sq doorbell write
    - drm/amdgpu: avoid double drm_exec_fini() in userq validate
    - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM
    - drm/amd/pm: fix missing fine-grained dpm table flag on aldebaran
    - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
    - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated
    - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
    - drm/amdgpu: Only send RMA CPER when threshold is exceeded
    - netfilter: xt_policy: fix strict mode inbound policy matching
    - netfilter: nf_conntrack_sip: don't use simple_strtoul
    - spi: rzv2h-rspi: Fix silent failure in clock setup error path
    - ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED
    - ASoC: SOF: Intel: add an empty adr_link
    - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ
    - ASoC: tas2764: Mark die temp register as volatile
    - ASoC: tas2770: Fix order of operations for temperature calculation
    - drm/sysfb: ofdrm: fix PCI device reference leaks
    - drm/color-mgmt: Typo s/R332/RGB332/
    - arm64/scs: Fix potential sign extension issue of advance_loc4
    - spi: spi-mem: Add a packed command operation
    - mtd: spinand: Add support for packed read data ODTR commands
    - mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW
    - mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW
    - ACPICA: Provide #defines for EINJV2 error types
    - ACPI: APEI: EINJ: Fix EINJV2 memory error injection
    - cdrom, scsi: sr: propagate read-only status to block layer via
      set_disk_ro()
    - spi: axiado: replace usleep_range() with udelay() in IRQ path
    - netdevsim: zero initialize struct iphdr in dummy sk_buff
    - net/sched: netem: fix probability gaps in 4-state loss model
    - net/sched: netem: fix queue limit check to include reordered packets
    - net/sched: netem: only reseed PRNG when seed is explicitly provided
    - net/sched: netem: validate slot configuration
    - net/sched: netem: fix slot delay calculation overflow
    - net/sched: netem: check for negative latency and jitter
    - net: airoha: fix BQL imbalance in TX path
    - net: airoha: stop net_device TX queue before updating CPU index
    - net: airoha: fix typo in function name
    - net: airoha: Do not wake all netdev TX queues in
      airoha_qdma_wake_netdev_txqs()
    - net: airoha: Do not read uninitialized fragment address in
      airoha_dev_xmit()
    - net/sched: sch_choke: annotate data-races in choke_dump_stats()
    - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()
    - vrf: Fix a potential NPD when removing a port from a VRF
    - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
    - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
    - spi: amlogic-spisg: initialize completion before requesting IRQ
    - NFC: trf7970a: Ignore antenna noise when checking for RF field
    - net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
    - neigh: let neigh_xmit take skb ownership
    - tcp: make probe0 timer handle expired user timeout
    - netpoll: fix IPv6 local-address corruption
    - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams
    - sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue
    - sched/fair: Clear rel_deadline when initializing forked entities
    - net: mctp i2c: check length before marking flow active
    - md/raid1,raid10: don't fail devices for invalid IO errors
    - md: add fallback to correct bitmap_ops on version mismatch
    - md: factor bitmap creation away from sysfs handling
    - md/md-bitmap: split bitmap sysfs groups
    - md/md-bitmap: add a none backend for bitmap grow
    - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()
    - net: phy: dp83869: fix setting CLK_O_SEL field.
    - drm/amd/display: properly handle family setting for early GC 11.5.4
    - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
    - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring
    - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
    - drm/amd/pm: Add fine grained flag to SMU v13.0.6
    - io_uring/napi: cap busy_poll_to 10 msec
    - ASoC: cs35l56: Fix illegal writes to OTP_MEM registers
    - net: psp: check for device unregister when creating assoc
    - net: psp: require admin permission for dev-set and key-rotate
    - ASoC: codecs: ab8500: Fix casting of private data
    - netfilter: skip recording stale or retransmitted INIT
    - sctp: discard stale INIT after handshake completion
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (I)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (II)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV)
    - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
    - netconsole: return count instead of strnlen(buf, count) from store
      callbacks
    - netconsole: avoid clobbering userdatum value on truncated write
    - netconsole: propagate device name truncation in dev_name_store()
    - netconsole: restore userdatum value on update_userdata() failure
    - ALSA: hda/conexant: Fix missing error check for jack detection
    - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()
    - ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0
      pages >1
    - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
    - drm/amd/display: Allow embedded connectors without DDC
    - drm/amd/display: Allow DCE link encoder without AUX registers
    - drm/amd/display: Allow constructing DCE6 link encoder without DDC
    - drm/amd/display: Allow constructing DCE8 link encoder without DDC
    - drm/amd/display: Read EDID from VBIOS embedded panel info
    - drm/amd/display: Use EDID from VBIOS embedded panel info
    - drm/xe: Use XE_WEDGED_MODE_UPON_ANY_HANG_NO_RESET enum instead of magic
      number
    - drm/xe: Drop registration of guc_submit_wedged_fini from
      xe_guc_submit_wedge()
    - drm/xe/debugfs: Correct printing of register whitelist ranges
    - drm/xe: Fix potential NULL deref in
      xe_exec_queue_tlb_inval_last_fence_put_unlocked
    - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
    - drm/xe/eustall: Fix drm_dev_put called before stream disable in close
    - drm/xe/gsc: Fix BO leak on error in query_compatibility_version()
    - drm/xe/xelp: Fix Wa_18022495364
    - net: airoha: Do not return err in ndo_stop() callback
    - bonding: print churn state via netlink
    - bonding: 3ad: implement proper RCU rules for port->aggregator
    - page_pool: fix memory-provider leak in page_pool_create_percpu() error
      path
    - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
    - iavf: stop removing VLAN filters from PF on interface down
    - iavf: wait for PF confirmation before removing VLAN filters
    - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
    - ice: fix NULL pointer dereference in ice_reset_all_vfs()
    - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
    - ice: fix missing SMA pin initialization in DPLL subsystem
    - ice: fix SMA and U.FL pin state changes affecting paired pin
    - ice: fix missing dpll notifications for SW pins
    - dpll: export __dpll_pin_change_ntf() for use under dpll_lock
    - ice: add dpll peer notification for paired SMA and U.FL pins
    - net: tls: fix strparser anchor skb leak on offload RX setup failure
    - sfc: fix error code in efx_devlink_info_running_versions()
    - net/sched: cls_flower: revert unintended changes
    - kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition
    - arm64: Reserve an extra page for early kernel mapping
    - futex: Drop CLONE_THREAD requirement for private default hash alloc
    - PCI: Initialize temporary device in new_id_store()
    - workqueue: fix devm_alloc_workqueue() va_list misuse
    - net/sched: sch_pie: annotate more data-races in pie_dump_stats()
    - sched/fair: Fix wakeup_preempt_fair() for not waking up task
    - crypto: af_alg - Cap AEAD AD length to 0x80000000
    - i40e: Cleanup PTP pins on probe failure
    - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path
    - net: ena: PHC: Fix potential use-after-free in get_timestamp
    - cgroup/cpuset: Reset DL migration state on can_attach() failure
    - netfilter: nf_conntrack_sip: get helper before allocating expectation
    - audit: fix incorrect inheritable capability in CAPSET records
    - net: ena: PHC: Check return code before setting timestamp output
    - cgroup/dmem: Return -ENOMEM on failed pool preallocation
    - idpf: fix double free and use-after-free in aux device error paths
    - cgroup/cpuset: Reserve DL bandwidth only for root-domain moves
    - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to
      warn"
    - netfilter: nft_ct: fix missing expect put in obj eval
    - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled
    - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
    - cgroup/cpuset: Return only actually allocated CPUs during partition
      invalidation
    - KVM: x86: Swap the dst and src operand for MOVNTDQA
    - KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
    - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer
      arithmetic
    - KVM: x86: Fix Xen hypercall tracepoint argument assignment
    - HID: pass the buffer size to hid_report_raw_event
    - HID: core: introduce hid_safe_input_report()
    - rseq: Revert to historical performance killing behaviour
    - rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode
    - rseq: Reenable performance optimizations conditionally
    - HID: core: Fix size_t specifier in hid_report_raw_event()
    - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands
    - media: staging: imx: configure src_mux in csi_start
    - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events
    - nvme-apple: Reset q->sq_tail during queue init
    - smb/client: fix possible infinite loop and oob read in symlink_data()
    - drm/loongson: Use managed KMS polling
    - drm: Replace old pointer to new idr
    - drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup
    - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
    - drm/amd/display: Wrap DCN32 phantom-plane allocation in
      DC_RUN_WITH_PREEMPTION_ENABLED
    - drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
    - platform/x86: intel: Move debugfs register before creating devices
    - platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers
    - platform/x86: lenovo-wmi-helpers: Fix memory leak in
      lwmi_dev_evaluate_int()
    - platform/x86: lenovo-wmi-other: Balance IDA id allocation and free
    - platform/x86: lenovo-wmi-other: Balance component bind and unbind
    - platform/x86: lenovo-wmi-other: Zero initialize WMI arguments
    - platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members
    - platform/x86: lenovo-wmi-other: Add Attribute ID helper functions
    - platform/x86: lenovo-wmi-other: Limit adding attributes to supported
      devices
    - accel/rocket: Fix prep_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx
    - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone
    - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
    - ALSA: usb-audio: Bound MIDI endpoint descriptor scans
    - ALSA: usb-audio: qcom: Check offload mapping failures
    - btrfs: only release the dirty pages io tree after successful writes
    - ceph: fix a buffer leak in __ceph_setxattr()
    - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
    - ceph: put folios not suitable for writeback
    - io-wq: check that the predecessor is hashed in io_wq_remove_pending()
    - iommu/amd: Bounds-check devid in __rlookup_amd_iommu()
    - x86/kexec: Push kjump return address even for non-kjump kexec
    - xfs: fix memory leak on error in xfs_alloc_zone_info()
    - virt: sev-guest: Do not use host-controlled page order in cleanup path
    - powerpc/warp: Fix error handling in pika_dtm_thread
    - netfs: fix error handling in netfs_extract_user_iter()
    - nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled
    - nfsd: fix file change detection in CB_GETATTR
    - nfsd: update mtime/ctime on CLONE in presense of delegated attributes
    - nfsd: update mtime/ctime on COPY in presence of delegated attributes
    - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining
    - irqchip/meson-gpio: Use the correct register in
      meson_s4_gpio_irq_set_type()
    - irqchip/gic-v5: Move LPI allocation into the LPI domain
    - irqchip/gic-v5: Support range allocation for LPIs
    - irqchip/gic-v5: Allocate ITS parent LPIs as a range
    - libceph: Fix potential out-of-bounds access in osdmap_decode()
    - libceph: Fix potential null-ptr-deref in decode_choose_args()
    - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
    - libceph: Fix potential out-of-bounds access in crush_decode()
    - libceph: handle rbtree insertion error in decode_choose_args()
    - iommu/vt-d: Disable DMAR for Intel Q35 IGFX
    - iommu/vt-d: Fix oops due to out of scope access
    - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
    - iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()
    - iommu: Replace per-group resetting_domain with per-gdev blocked flag
    - iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset
    - iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()
    - iommu: Fix nested pci_dev_reset_iommu_prepare/done()
    - iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()
    - drm/i915: skip __i915_request_skip() for already signaled requests
    - drm/panfrost: Fix wait_bo ioctl leaking positive return from
      dma_resv_wait_timeout()
    - drm/xe/dma-buf: handle empty bo and UAF races
    - drm/xe/dma-buf: fix UAF with retry loop
    - drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
    - drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC
    - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
    - drm/gma500/oaktrail_lvds: fix hang on init failure
    - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
    - arm_mpam: Fix monitor instance selection when checking for hardware NRDY
    - arm_mpam: Pretend that NRDY is always hardware managed
    - arm_mpam: Improve check for whether or not NRDY is hardware managed
    - arm_mpam: Fix false positive assert failure during mpam_disable()
    - arm_mpam: Check whether the config array is allocated before destroying
      it
    - eventfs: Simplify code using guard()s
    - eventfs: Use list_add_tail_rcu() for SRCU-protected children list
    - smb: client: Use FullSessionKey for AES-256 encryption key derivation
    - spi: sifive: Simplify clock handling with devm_clk_get_enabled()
    - spi: sifive: fix controller deregistration
    - tracefs: Removed unused 'ret' variable in eventfs_iterate()
    - workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
    - selftests/bpf: Remove test_access_variable_array
    - netfs: Fix potential uninitialised var in netfs_extract_user_iter()
    - Linux 7.0.10
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45846
    - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45845
    - net/sched: taprio: fix NULL pointer dereference in class dump
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45844
    - netfilter: arp_tables: fix IEEE1394 ARP payload parsing
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-46242
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45843
    - slip: bound decode() reads against the compressed packet length
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45842
    - slip: reject VJ receive packets on instances with no rstate array
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45841
    - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45840
    - openvswitch: cap upcall PID array size and pre-size vport replies
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45839
    - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
  * Resolute update: v7.0.10 upstream stable release (LP: #2156385) //
    CVE-2026-45838
    - bpf: fix end-of-list detection in cgroup_storage_get_next_key()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006)
    - Linux 7.0.8
    - HID: pidff: Fix integer overflow in pidff_rescale
    - media: uvcvideo: Enable VB2_DMABUF for metadata stream
    - drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
    - media: rzv2h-ivc: Avoid double job scheduling
    - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
    - media: rzv2h-ivc: Write AXIRX_PIXFMT once
    - media: rzv2h-ivc: Fix FM_STOP register write
    - media: rzv2h-ivc: Fix concurrent buffer list access
    - media: mali-c55: Initialize the ISP in enable_streams()
    - media: mali-c55: Fix Iridix bypass macros
    - media: renesas: vsp1: Fix NULL pointer deref on module unload
    - media: renesas: vin: Fix RAW8 (again)
    - media: i2c: ov8856: free control handler on error in
      ov8856_init_controls()
    - media: dt-bindings: rockchip,vdec: Add alternative reg-names order for
      RK35{76,88}
    - media: dt-bindings: rockchip,vdec: Mark reg-names required for
      RK35{76,88}
    - media: chips-media: wave5: fix a potential memory leak in
      wave5_vdi_init()
    - media: chips-media: wave5: add missing spinlock protection for
      send_eos_event()
    - media: chips-media: wave5: add missing spinlock protection for
      handle_dynamic_resolution_change()
    - arm64: dts: freescale: imx95-toradex-smarc: fix PMIC_SD2_VSEL label
      position
    - drm/gpusvm: Allow device pages to be mapped in mixed mappings after
      system pages
    - drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
    - spi: bcm63xx: fix controller deregistration
    - spi: atmel: fix controller deregistration
    - arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
    - regulator: mt6357: fix OF node reference imbalance
    - spi: st-ssc4: fix controller deregistration
    - regulator: max77650: fix OF node reference imbalance
    - media: ti: vpe: Add missing v4l2_device_unregister in vip_remove()
    - media: rc: streamzap: Error handling in probe
    - media: i2c: imx283: Enter full standby when stopping streaming
    - regulator: bq257xx: fix OF node reference imbalance
    - regulator: rk808: fix OF node reference imbalance
    - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
    - media: mali-c55: Fully reset the ISP configuration
    - media: intel/ipu6: fix error pointer dereference
    - media: i2c: imx283: Fix hang when going from large to small resolution
    - regulator: act8945a: fix OF node reference imbalance
    - regulator: s2dos05: fix OF node reference imbalance
    - regulator: bd9571mwv: fix OF node reference imbalance
    - spi: lantiq-ssc: fix controller deregistration
    - spi: meson-spicc: fix controller deregistration
    - spi: qup: fix controller deregistration
    - arm64: dts: ti: k3-am69-aquila-clover: Fix DP regulator enable GPIO
    - spi: at91-usart: fix controller deregistration
    - media: ipu-bridge: Add upside-down sensor DMI quirk for Dell XPS 13 9340
      and XPS 14 9440
    - spi: amlogic-spisg: fix controller deregistration
    - spi: aspeed-smc: fix controller deregistration
    - drm/colorop: Preserve bypass value in duplicate_state()
    - drm/atomic: Add affected colorops with affected planes
    - platform/x86: hp-wmi: Ignore backlight and FnLock events
    - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to
      copy
    - arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for
      pinctrl/pinctrl_aon
    - arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt
    - media: pci: zoran: fix potential memory leak in zoran_probe()
    - media: dib8000: avoid division by 0 in dib8000_set_dds()
    - media: i2c: imx412: Assert reset GPIO during probe
    - media: staging: imx: request mbus_config in csi_start
    - media: i2c: ov08d10: fix image vertical start setting
    - media: i2c: ov08d10: fix runtime PM handling in probe
    - media: omap3isp: drop the use count of v4l2 pipeline
    - media: iris: fix QCOM_MDT_LOADER dependency
    - media: qcom: camss: Fix csid clock configuration for sa8775p
    - media: qcom: camss: Fix csid IRQ offset for sa8775p
    - media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on
      SC7280
    - media: venus: fix QCOM_MDT_LOADER dependency
    - media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
    - media: iris: switch to hardware mode after firmware boot
    - media: qcom: camss: Add missing clocks for VFE lite on sa8775p
    - spi: mxs: fix controller deregistration
    - spi: mt65xx: fix controller deregistration
    - spi: dln2: fix controller deregistration
    - spi: s3c64xx: fix controller deregistration
    - spi: fsl-espi: fix controller deregistration
    - spi: omap2-mcspi: fix controller deregistration
    - spi: pic32: fix controller deregistration
    - spi: ep93xx: fix controller deregistration
    - spi: mtk-nor: fix controller deregistration
    - spi: pl022: fix controller deregistration
    - spi: sh-hspi: fix controller deregistration
    - spi: bcmbca-hsspi: fix controller deregistration
    - spi: coldfire-qspi: fix controller deregistration
    - spi: npcm-pspi: fix controller deregistration
    - spi: cavium-thunderx: fix controller deregistration
    - spi: pic32-sqi: fix controller deregistration
    - spi: sprd: fix controller deregistration
    - spi: sh-msiof: fix controller deregistration
    - spi: slave-mt27xx: fix controller deregistration
    - spi: img-spfi: fix controller deregistration
    - spi: mpfs: fix controller deregistration
    - spi: octeon: fix controller deregistration
    - spi: imx: fix runtime pm leak on probe deferral
    - spi: mxic: fix controller deregistration
    - spi: orion: fix controller deregistration
    - spi: orion: fix runtime pm leak on unbind
    - spi: orion: fix clock imbalance on registration failure
    - spi: cadence: fix controller deregistration
    - spi: cadence-quadspi: fix controller deregistration
    - spi: cadence: fix unclocked access on unbind
    - spi: cadence: fix clock imbalance on probe failure
    - spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure
    - spi: cadence-quadspi: fix clock imbalance on probe failure
    - spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind
    - drm/colorop: Fix blob property reference tracking in state lifecycle
    - drm/imx: parallel-display: Prefer bus format set via legacy "interface-
      pix-fmt" DT property
    - drm/msm: always recover the gpu
    - drm/v3d: Reject empty multisync extension to prevent infinite loop
    - drm/i915/psr: Init variable to avoid early exit from et alignment loop
    - drm/amd/display: fix math_mod() using arg1 instead of arg2
    - drm/amd: Add missing firmware declaration for PSP v15.0.0
    - drm/amdgpu: Use NBIF offset for register RCC_STRAP0_RCC_DEV0_EPF0_STRAP0
      .
    - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
    - drm/amdgpu: gate VM CPU HDP flush on reset lock
    - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
    - drm/amdkfd: Add upper bound check for num_of_nodes
    - drm/amdgpu/vce: Prevent partial address patches
    - drm/amd/display: Change dither policy for 10 bpc output back to
      dithering
    - drm/appletbdrm: Use kvzalloc for big allocations
    - drm/amdgpu: Avoid reset in AMDGPU unload path for APUs with GFX V11 and
      higher.
    - drm/udl: Increase GET_URB_TIMEOUT
    - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
    - drm/xe/bo: Fix bo leak on unaligned size validation in
      xe_bo_init_locked()
    - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
    - drm/radeon: add missing revision check for CI
    - drm/amdgpu: zero-initialize GART table on allocation
    - drm/exynos: remove bridge when component_add fails
    - drm/amdgpu/userq: fix access to stale wptr mapping
    - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
    - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
    - drm/bridge: tda998x: Use __be32 for audio port OF property pointer
    - drm/sti: remove bridge when sti_hda component_add fails
    - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
    - drm/amdkfd: Make all TLB-flushes heavy-weight
    - drm/amdgpu/pm: add missing revision check for CI
    - drm/amdgpu/pm: align Hawaii mclk workaround with radeon
    - arm64: dts: qcom: kodiak: Fix PCIe1 PHY ref clock voting
    - arm64: dts: qcom: lemans: Correct QUP interrupt numbers
    - arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
    - arm64: dts: ti: k3-am69-aquila-dev: Fix DP regulator enable GPIO
    - batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    - sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation
    - usb: typec: tcpm: reset internal port states on soft reset AMS
    - io_uring/zcrx: use guards for locking
    - io_uring/zcrx: warn on freelist violations
    - kho: fix error handling in kho_add_subtree()
    - EDAC/versalnet: Refactor memory controller initialization and cleanup
    - spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
    - spi: uniphier: fix controller deregistration
    - cgroup: Increment nr_dying_subsys_* from rmdir context
    - sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()
    - perf build: fix "argument list too long" in second location
    - mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()
    - vsock/virtio: fix length and offset in tap skb for split packets
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check
    - drm/amdgpu/vcn4: Avoid overflow on msg bound check
    - Linux 7.0.9
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46214
    - vsock/virtio: fix accept queue count leak on transport mismatch
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46207
    - vsock/virtio: fix empty payload in tap skb for non-linear buffers
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46234
    - vsock: fix buffer size clamping order
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46223
    - cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46221
    - EDAC/versalnet: Fix device name memory leak
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46231
    - batman-adv: bla: put backbone reference on failed claim hash insert
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46233
    - batman-adv: bla: only purge non-released claims
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46212
    - batman-adv: bla: prevent use-after-free when deleting claims
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46238
    - batman-adv: stop caching unowned originator pointers in BAT IV
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46208
    - batman-adv: stop tp_meter sessions during mesh teardown
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46206
    - batman-adv: reject new tp_meter sessions during teardown
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46198
    - batman-adv: fix integer overflow on buff_pos
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46227
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in
      SCTP_SENDALL
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46220
    - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46215
    - drm: Set old handle to NULL before prime swap in change_handle
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46201
    - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46224
    - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46197
    - drm/amdkfd: validate SVM ioctl nattr against buffer size
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46209
    - drm/gem: Fix inconsistent plane dimension calculation in
      drm_gem_fb_init_with_funcs()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46230
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46199
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46204
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46218
    - drm/amdgpu: Add bounds checking to ib_{get,set}_value
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46229
    - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46211
    - drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46203
    - spi: cadence-quadspi: fix unclocked access on unbind
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46219
    - spi: mpc52xx: fix use-after-free on unbind
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46200
    - spi: mpc52xx: fix controller deregistration
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46241
    - spi: mpc52xx: fix use-after-free on registration failure
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46225
    - spi: rspi: fix controller deregistration
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46226
    - spi: fsl: fix controller deregistration
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46228
    - spi: ch341: fix devres lifetime
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46216
    - drm/xe/hdcp: Add NULL check for media_gt in
      intel_hdcp_gsc_check_status()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46210
    - media: iris: fix use-after-free of fmt_src during MBPF check
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46240
    - media: iris: Fix use-after-free in iris_release_internal_buffers()
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46235
    - media: saa7164: add ioremap return checks and cleanups
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46222
    - media: rockchip: rkcif: Add missing MUST_CONNECT flag to pads
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46239
    - media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrl
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46236
    - media: rc: xbox_remote: heed DMA restrictions
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46205
    - staging: media: atomisp: Disallow all private IOCTLs
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46202
    - HID: appletb-kbd: run inactivity autodim from workqueues
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46213
    - HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
  * Resolute update: v7.0.9 upstream stable release (LP: #2156006) //
    CVE-2026-46232
    - HID: playstation: Clamp num_touch_reports
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988)
    - ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states
    - ACPI: scan: Use acpi_dev_put() in object add error paths
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO
    - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug
    - ACPI: video: force native backlight on HP OMEN 16 (8A44)
    - iommufd: Fix a race with concurrent allocation and unmap
    - wifi: mt76: mt7925: fix incorrect TLV length in CLC command
    - spi: rockchip: fix controller deregistration
    - ksmbd: rewrite stop_sessions() with restartable iteration
    - flow_dissector: do not dissect PPPoE PFC frames
    - smb: client/smbdirect: fix MR registration for coalesced SG lists
    - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
    - wifi: mt76: mt7925: fix incorrect length field in txpower command
    - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
    - wifi: ath5k: do not access array OOB
    - ALSA: usb-audio: midi2: Restart output URBs on resume
    - ALSA: usb-audio: Fix UAC3 cluster descriptor size check
    - usb: dwc3: Move GUID programming after PHY initialization
    - USB: omap_udc: DMA: Don't enable burst 4 mode
    - USB: serial: option: add Telit Cinterion LE910Cx compositions
    - usb: typec: tcpm: fix debug accessory mode detection for sink ports
    - ALSA: hda: cs35l56: Propagate ASP TX source control errors
    - ALSA: hda/realtek: Fix speaker silence after S3 resume on Xiaomi Mi
      Laptop Pro 15
    - ALSA: firewire-tascam: Do not drop unread control events
    - ALSA: core: Serialize deferred fasync state checks
    - ALSA: seq: Fix UMP group 16 filtering
    - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o
    - x86/efi: Restore IRQ state in EFI page fault handler
    - xfrm: provide message size for XFRM_MSG_MAPPING
    - selinux: fix avdcache auditing
    - selinux: don't reserve xattr slot when we won't fill it
    - selinux: shrink critical section in sel_write_load()
    - selinux: prune /sys/fs/selinux/checkreqprot
    - selinux: prune /sys/fs/selinux/disable
    - selinux: prune /sys/fs/selinux/user
    - selinux: allow multiple opens of /sys/fs/selinux/policy
    - io_uring/kbuf: support min length left for incremental buffers
    - io_uring/tw: serialize ctx->retry_llist with ->uring_lock
    - LoongArch: KVM: Fix missing EMULATE_FAIL in kvm_emu_mmio_read()
    - rust: drm: gem: clean up GEM state in init failure case
    - rust: allow `clippy::collapsible_match` globally
    - rust: allow `clippy::collapsible_if` globally
    - rust: pin-init: internal: move alignment check to `make_field_check`
    - spi: syncuacer: fix controller deregistration
    - spi: sun4i: fix controller deregistration
    - spi: zynq-qspi: fix controller deregistration
    - spi: ti-qspi: fix controller deregistration
    - spi: sun6i: fix controller deregistration
    - spi: tegra114: fix controller deregistration
    - spi: zynqmp-gqspi: fix controller deregistration
    - spi: tegra20-sflash: fix controller deregistration
    - spi: s3c64xx: fix NULL-deref on driver unbind
    - staging: rtl8723bs: os_dep: avoid NULL pointer dereference in
      rtw_cbuf_alloc
    - staging: vme_user: fix root device leak on init failure
    - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter
    - arm64: signal: Preserve POR_EL0 if poe_context is missing
    - mm/hugetlb_cma: round up per_node before logging it
    - LoongArch: Fix SYM_SIGFUNC_START definition for 32BIT
    - LoongArch: KVM: Compile switch.S directly into the kernel
    - mptcp: pm: ADD_ADDR rtx: skip inactive subflows
    - perf/x86/intel: Improve validation and configuration of ACR masks
    - selftests/rseq: Don't run tests with runner scripts outside of the
      scripts
    - rseq: Set rseq::cpu_id_start to 0 on unregistration
    - rseq: Protect rseq_reset() against interrupts
    - rseq: Don't advertise time slice extensions if disabled
    - selftests/rseq: Make registration flexible for legacy and optimized mode
    - selftests/rseq: Skip tests if time slice extensions are not available
    - selftests/rseq: Validate legacy behavior
    - selftests/rseq: Expand for optimized RSEQ ABI v2
    - pseries/papr-hvpipe: Fix race with interrupt handler
    - pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
    - pseries/papr-hvpipe: Fix the usage of copy_to_user()
    - net: libwx: use request_irq for VF misc interrupt
    - netpoll: pass buffer size to egress_dev() to avoid MAC truncation
    - ovl: fix verity lazy-load guard broken by fsverity_active() semantic
      change
    - parisc: Fix IRQ leak in LASI driver
    - x86/efi: Fix graceful fault handling after FPU softirq changes
    - hwmon: (ltc2992) Clamp threshold writes to hardware range
    - hwmon: (ltc2992) Fix u32 overflow in power read path
    - clk: rk808: fix OF node reference imbalance
    - hwmon: (corsair-psu) Close HID device on probe errors
    - af_unix: Reject SIOCATMARK on non-stream sockets
    - arm64/fpsimd: ptrace: zero target's fpsimd_state, not the tracer's
    - pmdomain: mediatek: fix use-after-free in
      scpsys_get_bus_protection_legacy()
    - block: fix zone write plug removal
    - block: only read from sqe on initial invocation of blkdev_uring_cmd()
    - cifs: abort open_cached_dir if we don't request leases
    - cifs: change_conf needs to be called for session setup
    - extcon: ptn5150: handle pending IRQ events during system resume
    - gpio: of: clear OF_POPULATED on hog nodes in remove path
    - hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
    - hv_sock: fix ARM64 support
    - hv_sock: Report EOF instead of -EIO for FIN
    - hv_sock: Return -EIO for malformed/short packets
    - spi: microchip-core-qspi: fix controller deregistration
    - spi: microchip-core-spi: fix controller deregistration
    - tracefs: Fix default permissions not being applied on initial mount
    - udf: reject descriptors with oversized CRC length
    - x86/boot/e820: Re-enable BIOS fallback if e820 table is empty
    - thermal: core: Free thermal zone ID later during removal
    - thermal/drivers/sprd: Fix temperature clamping in
      sprd_thm_temp_to_rawdata
    - thermal/drivers/sprd: Fix raw temperature clamping in
      sprd_thm_rawdata_to_temp
    - spi: topcliff-pch: fix controller deregistration
    - spi: topcliff-pch: fix use-after-free on unbind
    - tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
    - tracing/fprobe: Remove fprobe from hash in failure path
    - tracing/fprobe: Unregister fprobe even if memory allocation fails
    - tracing/probes: Limit size of event probe to 3K
    - tracing/fprobe: Check the same type fprobe on table as the unregistered
      one
    - clk: imx: imx8-acm: fix flags for acm clocks
    - clk: microchip: mpfs-ccc: fix out of bounds access during output
      registration
    - cpuidle: powerpc: avoid double clear when breaking snooze
    - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk
      table
    - ASoC: ES8389: convert to devm_clk_get_optional() to get clock
    - ASoC: fsl_easrc: fix comment typo
    - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error
    - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop
    - ASoC: qcom: q6apm: remove child devices when apm is removed
    - btrfs: do not mark inode incompressible after inline attempt fails
    - dm: don't report warning when doing deferred remove
    - dm: fix a buffer overflow in ioctl processing
    - dm-verity-fec: correctly reject too-small FEC devices
    - dm-verity-fec: correctly reject too-small hash devices
    - dm-verity-fec: fix corrected block count stat
    - dm-verity-fec: fix the size of dm_verity_fec_io::erasures
    - isofs: validate Rock Ridge CE continuation extent against volume size
    - iommufd: Fix return value of iommufd_fault_fops_write()
    - iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
    - iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update
    - lib/crc: tests: Make crc_kunit test only the enabled CRC variants
    - lib/scatterlist: fix temp buffer in extract_user_to_sg()
    - nvme-apple: drop invalid put of admin queue reference count
    - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
    - pmdomain: core: Fix detach procedure for virtual devices in genpd
    - psp: strip variable-length PSP header in psp_dev_rcv()
    - s390/debug: Reject zero-length input in debug_input_flush_fn()
    - s390/debug: Reject zero-length input before trimming a newline
    - KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
    - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
    - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
    - mm/damon/stat: detect and use fresh enabled value
    - PCI: Update saved_config_space upon resource assignment
    - PCI/AER: Clear only error bits in PCIe Device Status
    - PCI/AER: Stop ruling out unbound devices as error source
    - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage
    - power: supply: max17042: avoid overflow when determining health
    - perf/x86/intel: Always reprogram ACR events to prevent stale masks
    - perf/x86/intel: Disable PMI for self-reloaded ACR events
    - perf/x86/intel: Enable auto counter reload for DMR
    - RDMA/ionic: bound node_desc sysfs read with %.64s
    - RDMA/ionic: Fix typo in format string
    - remoteproc: imx_rproc: Fix NULL vs IS_ERR() bug in imx_rproc_addr_init()
    - remoteproc: k3: Fix NULL vs IS_ERR() bug in k3_reserved_mem_init()
    - sched_ext: idle: Recheck prev_cpu after narrowing allowed mask
    - sched_ext: Use dsq->first_task instead of list_empty() in
      dispatch_enqueue() FIFO-tail
    - selftests: mptcp: check output: catch cmd errors
    - selftests: mptcp: pm: restrict 'unknown' check to pm_nl_ctl
    - mptcp: fastclose msk when linger time is 0
    - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure
    - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure
    - mptcp: sockopt: set timestamp flags on subflow socket, not msk
    - mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf
    - mptcp: fix rx timestamp corruption on fastopen
    - mptcp: pm: prio: skip closed subflows
    - mptcp: pm: kernel: reset fullmesh counter after flush
    - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0
    - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker
    - mptcp: pm: ADD_ADDR rtx: return early if no retrans
    - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode()
    - f2fs: fix false alarm of lockdep on cp_global_sem lock
    - f2fs: fix fiemap boundary handling when read extent cache is incomplete
    - f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
    - f2fs: fix incorrect file address mapping when inline inode is unwritten
    - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks()
    - f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
    - f2fs: refactor f2fs_move_node_folio function
    - f2fs: fix inline data not being written to disk in writeback path
    - KVM: arm64: Wake-up from WFI when iqrchip is in userspace
    - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value
    - KVM: arm64: Fix initialisation order in __pkvm_init_finalise()
    - KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer
    - KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer
    - LoongArch: KVM: Cap KVM_CAP_NR_VCPUS by KVM_CAP_MAX_VCPUS
    - LoongArch: KVM: Fix "unreliable stack" for kvm_exc_entry
    - LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by
      software
    - LoongArch: KVM: Move unconditional delay into timer clear scenery
    - LoongArch: KVM: Use kvm_set_pte() in kvm_flush_pte()
    - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup
    - mmc: core: Adjust MDT beyond 2025
    - mmc: core: Add quirk for incorrect manufacturing date
    - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs
    - crypto: qat - fix indentation of macros in qat_hal.c
    - crypto: qat - fix firmware loading failure for GEN6 devices
    - hfsplus: fix held lock freed on hfsplus_fill_super()
    - 8021q: use RCU for egress QoS mappings
    - printk: add print_hex_dump_devel()
    - crypto: caam - guard HMAC key hex dumps in hash_digest_key
    - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
    - rust: pin-init: fix incorrect accessor reference lifetime
    - Linux 7.0.7
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43490
    - ksmbd: validate inherited ACE SID length
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46174
    - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op
      cache
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46110
    - net: stmmac: Prevent NULL deref when RX memory exhausted
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46153
    - 8021q: delete cleared egress QoS mappings
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46169
    - hfsplus: fix uninit-value by validating catalog record size
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46188
    - octeon_ep_vf: add NULL check for napi_build_skb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45837
    - bpf: Fix use-after-free in arena_vm_close on fork
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46156
    - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46147
    - KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46175
    - f2fs: fix fsck inconsistency caused by FGGC of node block
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46194
    - f2fs: fix node_cnt race between extent node destroy and writeback
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46170
    - mptcp: pm: ADD_ADDR rtx: free sk if last
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46158
    - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46168
    - mptcp: fix scheduling with atomic in timestamp sockopt
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46189
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46133
    - RDMA/rxe: Reject unknown opcodes before ICRC processing
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46114
    - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46127
    - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46176
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46178
    - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46181
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46145
    - RDMA/mana: Validate rx_hash_key_len
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46117
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46126
    - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46144
    - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46141
    - powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46183
    - mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46121
    - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46131
    - KVM: x86: check for nEPT/nNPT in slow flush hypercalls
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46139
    - smb: client: use kzalloc to zero-initialize security descriptor buffer
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46105
    - scsi: mpt3sas: Limit NVMe request size to 2 MiB
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46171
    - riscv: kvm: fix vector context allocation leak
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46112
    - RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46165
    - openvswitch: vport: fix self-deadlock on release of tunnel ports
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46161
    - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43492
    - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46124
    - isofs: validate block number from NFS file handle in isofs_export_iget
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46130
    - dm-verity-fec: fix reading parity bytes split across blocks (take 3)
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46106
    - eventfs: Hold eventfs_mutex and SRCU when remount walks events
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46107
    - dm-thin: fix metadata refcount underflow
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46160
    - btrfs: fix missing last_unlink_trans update when removing a directory
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46164
    - btrfs: fix double free in create_space_info_sub_group() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46129
    - btrfs: fix double free in create_space_info() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46159
    - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to
      info-leak
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46143
    - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46148
    - spi: microchip-core-qspi: control built-in cs manually
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46192
    - spi: microchip-core-qspi: don't attempt to transmit during emulated
      read-only dual/quad operations
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46162
    - ice: fix double free in ice_sf_eth_activate() error path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46273
    - ibmveth: Disable GSO for packets with small MSS
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46191
    - fbcon: Avoid OOB font access if console rotation fails
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46134
    - platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43495
    - net: wwan: t7xx: validate port_count against message length in
      t7xx_port_enum_msg_handler
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43502
    - net/rds: handle zerocopy send cleanup before the message is queued
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46120
    - ip6_gre: Use cached t->net in ip6erspan_changelink().
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46142
    - net: libwx: fix VF illegal register access
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46118
    - pseries/papr-hvpipe: Fix null ptr deref in
      papr_hvpipe_dev_create_handle()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46182
    - pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46184
    - sound: ua101: fix division by zero at probe
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43498
    - accel/ivpu: Disallow re-exporting imported GEM objects
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46132
    - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in
      rtnl_fill_vfinfo
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46190
    - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46150
    - fanotify: fix false positive on permission events
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45836
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45834
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-45835
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46138
    - Bluetooth: hci_event: Fix OOB read and infinite loop in
      hci_le_create_big_complete_evt
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46111
    - Bluetooth: hci_conn: fix potential UAF in create_big_sync
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46140
    - Bluetooth: btmtk: validate WMT event SKB length before struct access
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46186
    - Bluetooth: virtio_bt: validate rx pkt_type header length
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46123
    - Bluetooth: virtio_bt: clamp rx length before skb_put
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46104
    - selinux: use sk blob accessor in socket permission helpers
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46193
    - xfrm: ah: account for ESN high bits in async callbacks
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46172
    - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46116
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46154
    - sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46157
    - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46109
    - usb: ulpi: fix memory leak on ulpi_register() error paths
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46146
    - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46167
    - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46151
    - usb: usblp: fix heap leak in IEEE 1284 device ID via short response
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46180
    - wifi: brcmfmac: Fix potential use-after-free issue when stopping
      watchdog task
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46122
    - wifi: b43: enforce bounds check on firmware key index in b43_rx()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46125
    - wifi: mac80211: remove station if connection prep fails
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46166
    - wifi: mac80211: use safe list iteration in radar detect work
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46187
    - wifi: rsi: fix kthread lifetime race between self-exit and external-stop
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46152
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46163
    - wifi: b43legacy: enforce bounds check on firmware key index in RX path
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46136
    - wifi: mt76: mt7921: fix a potential clc buffer length underflow
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46173
    - exit: prevent preemption of oopsing TASK_DEAD task
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43496
    - net/sched: sch_red: Replace direct dequeue call with peek and
      qdisc_dequeue_peeked
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46113
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46179
    - ASoC: SOF: Don't allow pointer operations on unconfigured streams
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46196
    - tracepoint: balance regfunc() on func_add() failure in
      tracepoint_add_func()
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-43497
    - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46108
    - ipmi:si: Return state to normal if message allocation fails
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46128
    - ipmi: Check event message buffer response for bad data
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46177
    - ipmi: Add limits to event and receive message requests
  * Resolute update: v7.0.7 upstream stable release (LP: #2155988) //
    CVE-2026-46149
    - scsi: target: configfs: Bound snprintf() return in
      tg_pt_gp_members_show()
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] Disable NOVA_CORE
  * CVE-2026-46244
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync
  * CVE-2026-46137
    - mptcp: pm: ADD_ADDR rtx: allow ID 0
    - mptcp: pm: ADD_ADDR rtx: fix potential data-race
  * CVE-2026-46185
    - smb/client: fix out-of-bounds read in symlink_data()
  * CVE-2026-46195
    - smb: client: validate dacloffset before building DACL pointers
  * CVE-2026-46289
    - lib/scatterlist: fix length calculations in extract_kvec_to_sg
  * CVE-2026-46119
    - libceph: Fix slab-out-of-bounds access in auth message processing
  * CVE-2026-46135
    - nvmet-tcp: fix race between ICReq handling and queue teardown
  * CVE-2026-46155
    - smb/client: fix out-of-bounds read in smb2_compound_op()
  * CVE-2026-46115
    - block: add pgmap check to biovec_phys_mergeable
  * CVE-2026-46243
    - smb: client: reject userspace cifs.spnego descriptions

 -- John Cabaj <john.cabaj@canonical.com>  Tue, 30 Jun 2026 13:32:52 -0500

linux-azure-fde (7.0.0-1008.8) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1008.8 -proposed tracker (LP: #2157097)

  [ Ubuntu-azure: 7.0.0-1009.9 ]

  * resolute/linux-azure: 7.0.0-1009.9 -proposed tracker (LP: #2157098)
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] azure: Disable NOVA_CORE
  [ Ubuntu: 7.0.0-27.27 ]
  * resolute/linux: 7.0.0-27.27 -proposed tracker (LP: #2157114)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] Disable NOVA_CORE
  * CVE-2026-46316
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the
      erased entry
  * CVE-2026-46244
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync
  * CVE-2026-46137
    - mptcp: pm: ADD_ADDR rtx: allow ID 0
    - mptcp: pm: ADD_ADDR rtx: fix potential data-race
  * CVE-2026-46185
    - smb/client: fix out-of-bounds read in symlink_data()
  * CVE-2026-46195
    - smb: client: validate dacloffset before building DACL pointers
  * CVE-2026-46289
    - lib/scatterlist: fix length calculations in extract_kvec_to_sg
  * CVE-2026-46119
    - libceph: Fix slab-out-of-bounds access in auth message processing
  * CVE-2026-46135
    - nvmet-tcp: fix race between ICReq handling and queue teardown
  * CVE-2026-46155
    - smb/client: fix out-of-bounds read in smb2_compound_op()
  * CVE-2026-46115
    - block: add pgmap check to biovec_phys_mergeable
  * CVE-2026-46243
    - smb: client: reject userspace cifs.spnego descriptions

 -- John Cabaj <john.cabaj@canonical.com>  Fri, 19 Jun 2026 09:42:01 -0500

linux-azure-fde (7.0.0-1007.7) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1007.7 -proposed tracker (LP: #2152013)

  * Miscellaneous Ubuntu changes
    - [Packaging] azure-fde: Don't hard-code lmm zfs dependency

  [ Ubuntu-azure: 7.0.0-1008.8 ]

  * resolute/linux-azure: 7.0.0-1008.8 -proposed tracker (LP: #2152014)
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] azure: Disable DRM_NOVA
  * Miscellaneous Ubuntu changes
    - [Packaging] azure: Don't hard-code lmm zfs dependency
  [ Ubuntu: 7.0.0-26.26 ]
  * resolute/linux: 7.0.0-26.26 -proposed tracker (LP: #2154530)
  * Packaging resync (LP: #1786013)
    - Revert "UBUNTU: SAUCE: import Huawei ES3000_V2 (2.1.0.23)"
    - [Packaging] debian.master/dkms-versions -- remove dkms-versions
      (main/2026.05.18)
  * Fix mic mute  led on a HP EliteBook 6 G2a platform (LP: #2150065)
    - ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2a Laptops
  * ov08x40 module mounted upside down on a certain DELL platforms
    (LP: #2146517)
    - SAUCE: media: ipu-bridge: Add DMI quirk for new Dell XPS laptops with
      upside down sensors
    - SAUCE: media: ipu-bridge: Add DMI quirk for Dell 14 laptops with upside
      down sensors
  * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor
    (LP: #2147409)
    - SAUCE: media: ipu-bridge: Add 900MHz for OV05C10
    - SAUCE: platform/x86: int3472: increase handshake delay to 50ms for
      OV05C10
  * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)
    - SAUCE: media: ipu-bridge: Support s5k3j1 sensor
  * [SRU] ASoC: enable rt1320 speaker amp and DMIC on PTL SoundWire platforms
    (LP: #2150196)
    - ASoC: Intel: soc-acpi-intel-ptl-match: drop rt722 monolithic match
      tables
    - ASoC: SOF: Intel: Add a is_amp flag to fix the wrong name prefix
    - ASoC: sdw_utils: add rt1320 and rt1321 dmic dai in codec_info_list
  * powerpc-build in ubuntu_kernel_selftests fails to build due to
    uninitialized value (LP: #2129844)
    - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15
  * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,
    conflicting with nouveau (LP: #2150845)
    - [Config] Disable DRM_NOVA
  * Resolute update: v7.0.6 upstream stable release (LP: #2152558)
    - Linux 7.0.6
    - Upstream stable to v7.0.6
  * Resolute update: v7.0.5 upstream stable release (LP: #2152556)
    - Linux 7.0.5
    - Upstream stable to v7.0.5
  * Resolute update: v7.0.4 upstream stable release (LP: #2152552)
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
    - ALSA: usb-audio: Avoid false E-MU sample-rate notifications
    - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
    - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable()
    - usb: chipidea: otg: not wait vbus drop if use role_switch
    - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS
      change
    - ALSA: usb-audio: Evaluate packsize caps at the right place
    - LoongArch: Add spectre boundry for syscall dispatch table
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
    - leds: qcom-lpg: Check for array overflow when selecting the high
      resolution
    - greybus: gb-beagleplay: bound bootloader receive buffering
    - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()
    - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
    - ibmasm: fix OOB reads in command_file_write due to missing size checks
    - ibmasm: fix heap over-read in ibmasm_send_i2o_message()
    - sysfs: attribute_group: Respect is_visible_const() when changing owner
    - driver core: Don't let a device probe until it's ready
    - device property: Make modifications of fwnode "flags" thread safe
    - drm/nouveau: fix nvkm_device leak on aperture removal failure
    - rust: dma: remove DMA_ATTR_NO_KERNEL_MAPPING from public attrs
    - kbuild: rust: allow `clippy::uninlined_format_args`
    - fs: afs: revert mmap_prepare() change
    - firmware: google: framebuffer: Do not mark framebuffer as busy
    - lib: test_hmm: evict device pages on file close to avoid use-after-free
    - arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
    - arm64: mm: Fix rodata=full block mapping support for realm guests
    - mm: migrate: requeue destination folio on deferred split queue
    - mm: prevent droppable mappings from being locked
    - mm: fix deferred split queue races during migration
    - ocfs2: split transactions in dio completion to avoid credit exhaustion
    - Input: edt-ft5x06 - fix use-after-free in debugfs teardown
    - zram: do not forget to endio for partial discard requests
    - wifi: rtw88: check for PCI upstream bridge existence
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
    - vfio: selftests: Fix VLA initialisation in vfio_pci_irq_set()
    - vfio/xe: Add a missing vfio_pci_core_release_dev()
    - vfio/virtio: Convert list_lock from spinlock to mutex
    - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
    - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
    - um: drivers: call kernel_strrchr() explicitly in cow_user.c
    - thermal: core: Fix thermal zone governor cleanup issues
    - spi: imx: fix use-after-free on unbind
    - spi: ch341: fix memory leaks on probe failures
    - crypto: algif_aead - snapshot IV for async AEAD requests
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests
    - dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock
      constraints
    - of: unittest: fix use-after-free in of_unittest_changeset()
    - of: unittest: fix use-after-free in testdrv_probe()
    - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt
    - EDAC/versalnet: Fix device_node leak in mc_probe()
    - PCI: imx6: Skip waiting for L2/L3 Ready on i.MX6SX
    - media: amphion: Fix race between m2m job_abort and device_run
    - ALSA: control: Validate buf_len before strnlen() in
      snd_ctl_elem_init_enum_names()
    - net: caif: clear client service pointer on teardown
    - net: strparser: fix skb_head leak in strp_abort_strp()
    - media: mtk-jpeg: fix use-after-free in release path due to uncancelled
      work
    - crypto: atmel-sha204a - Fix OTP sysfs read and error handling
    - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
    - Revert "ALSA: usb: Increase volume range that triggers a warning"
    - phy: qcom: m31-eusb2: clear PLL_EN during init
    - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete
    - lib/ts_kmp: fix integer overflow in pattern length calculation
    - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in
      imx219_probe()
    - net: qrtr: ns: Fix use-after-free in driver remove()
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
    - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()
    - ALSA: aoa: i2sbus: clear stale prepared state
    - ALSA: aoa: i2sbus: fix OF node lifetime handling
    - ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF
    - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents
    - ipmi:ssif: Clean up kthread on errors
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke()
    - KVM: selftests: Fix reserved value WRMSR testcase for multi-feature MSRs
    - md/raid10: fix deadlock with check operation and nowait requests
    - media: rc: igorplugusb: heed coherency rules
    - media: rockchip: rkcif: fix off by one bugs
    - media: rockchip: rkcif: comply with minimum number of buffers
      requirement
    - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused
    - mm/alloc_tag: clear codetag for pages allocated before page_ext
      initialization
    - mm/damon/core: fix damon_call() vs kdamond_fn() exit race
    - mm/damon/core: fix damos_walk() vs kdamond_fn() exit race
    - mm/hugetlb: fix early boot crash on parameters without '=' separator
    - mtd: docg3: fix use-after-free in docg3_release()
    - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4
    - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set
    - parisc: _llseek syscall is only available for 32-bit userspace
    - parisc: Drop ip_fast_csum() inline assembly implementation
    - PCI: cadence: Use cdns_pcie_read_sz() for byte or word read access
    - PCI: imx6: Fix reference clock source selection for i.MX95
    - perf annotate: Use jump__delete when freeing LoongArch jumps
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy
    - remoteproc: xlnx: Only access buffer information if IPI is buffered
    - reset: rzv2h-usb2phy: Keep PHY clock enabled for entire device lifetime
    - sched: Use u64 for bandwidth ratio calculations
    - selftests/mqueue: Fix incorrectly named file
    - landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()
    - landlock: Allow TSYNC with LOG_SUBDOMAINS_OFF and fd=-1
    - selftests/landlock: Drain stale audit records on init
    - selftests/landlock: Fix format warning for __u64 in net_test
    - selftests/landlock: Fix snprintf truncation checks in audit helpers
    - selftests/landlock: Skip stale records in audit_match_record()
    - rbd: fix null-ptr-deref when device_add_disk() fails
    - mm/zone_device: do not touch device folio after calling ->folio_free()
    - block: fix zone write plugs refcount handling in
      disk_zone_wplug_schedule_bio_work()
    - io_uring/zcrx: return back two step unregistration
    - io_uring/timeout: check unused sqe fields
    - block: relax pgmap check in bio_add_page for compatible zone device
      pages
    - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned()
    - io_uring/register: fix ring resizing with mixed/large SQEs/CQEs
    - io_uring/zcrx: fix user_struct uaf
    - io_uring/poll: fix signed comparison in io_poll_get_ownership()
    - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
    - module.lds,codetag: force 0 sh_addr for sections
    - module.lds.S: Fix modules on 32-bit parisc architecture
    - ALSA: core: Fix potential data race at fasync handling
    - ALSA: caiaq: Fix control_put() result and cache rollback
    - ALSA: caiaq: Handle probe errors properly
    - ALSA: 6fire: Fix input volume change detection
    - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx
    - ALSA: pcmtest: fix reference leak on failed device registration
    - ALSA: pcmtest: Fix resource leaks in module init error paths
    - iio: adc: ad7768-1: fix one-shot mode data acquisition
    - iio: adc: ad7768-1: remove switch to one-shot mode
    - rxrpc: Fix memory leaks in rxkad_verify_response()
    - rxrpc: Fix rxkad crypto unalignment handling
    - rxrpc: Fix error handling in rxgk_extract_token()
    - rxrpc: Fix re-decryption of RESPONSE packets
    - EDAC/versalnet: Fix memory leak in remove and probe error paths
    - tools/accounting: handle truncated taskstats netlink messages
    - net: txgbe: fix RTNL assertion warning when remove module
    - arm64: dts: marvell: uDPU: add ethernet aliases
    - net: qrtr: ns: Limit the maximum server registration per node
    - net: qrtr: ns: Limit the maximum number of lookups
    - net: qrtr: ns: Free the node during ctrl_cmd_bye()
    - net: qrtr: ns: Limit the total number of nodes
    - net: rds: fix MR cleanup on copy error
    - net: txgbe: fix firmware version check
    - net/smc: avoid early lgr access in smc_clc_wait_msg
    - net: ks8851: Reinstate disabling of BHs around IRQ handler
    - net: bridge: use a stable FDB dst snapshot in RCU readers
    - netconsole: avoid out-of-bounds access on empty string in trim_newline()
    - net: mctp: fix don't require received header reserved bits to be zero
    - net: ks8851: Avoid excess softirq scheduling
    - drm/arcpgu: fix device node leak
    - slub: fix data loss and overflow in krealloc()
    - tracing/fprobe: Reject registration of a registered fprobe before init
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
    - printf: Compile the kunit test with DISABLE_BRANCH_PROFILING
      DISABLE_BRANCH_PROFILING
    - ipv4: icmp: validate reply type before using icmp_pointers
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
    - spi: fix resource leaks on device setup failure
    - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE'
    - tpm: avoid -Wunused-but-set-variable
    - LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist
    - LoongArch: Show CPU vulnerabilites correctly
    - fbdev: defio: Disconnect deferred I/O from the lifetime of struct
      fb_info
    - power: supply: axp288_charger: Do not cancel work before initializing it
    - hwmon: (isl28022) Fix integer overflow in power calculation on 32-bit
    - hwmon: (powerz) Avoid cacheline sharing for DMA buffer
    - media: rzv2h-ivc: Revise default VBLANK formula
    - media: rzv2h-ivc: Fix AXIRX_VBLANK register write
    - fs: prepare for adding LSM blob to backing_file
    - lsm: add backing_file LSM hooks
    - selinux: fix overlayfs mmap() and mprotect() access checks
    - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()
    - randomize_kstack: Maintain kstack_offset per task
    - mmc: block: use single block write in retry
    - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration
    - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins
    - crypto: qat - fix IRQ cleanup on 6xxx probe failure
    - xfs: start gc on zonegc_low_space attribute updates
    - xfs: fix a resource leak in xfs_alloc_buftarg()
    - firmware: google: framebuffer: Do not unregister platform device
    - firmware: exynos-acpm: Drop fake 'const' on handle pointer
    - crypto: talitos - fix SEC1 32k ahash request limitation
    - crypto: talitos - rename first/last to first_desc/last_desc
    - pwm: imx-tpm: Count the number of enabled channels in probe
    - tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
    - tpm: Fix auth session leak in tpm2_get_random() error path
    - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
    - tpm: tpm_tis: add error logging for data transfer
    - tpm: tpm_tis: stop transmit if retries are exhausted
    - rtc: ntxec: fix OF node reference imbalance
    - mm/vmalloc: take vmap_purge_lock in shrinker
    - mm/memfd_luo: fix physical address conversion in put_folios cleanup
    - mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()
    - mm/damon/stat: fix memory leak on damon_start() failure in
      damon_stat_start()
    - mm/damon/core: validate damos_quota_goal->nid for
      node_mem_{used,free}_bp
    - mm/damon/core: validate damos_quota_goal->nid for
      node_memcg_{used,free}_bp
    - mm/damon/core: use time_in_range_open() for damos quota window start
    - mm/damon/core: disallow time-quota setting zero esz
    - mm/damon/core: disallow non-power of two min_region_sz on damon_start()
    - userfaultfd: allow registration of ranges below mmap_min_addr
    - LoongArch: KVM: Use CSR_CRMD_PLV in kvm_arch_vcpu_in_kernel()
    - KVM: x86: Defer non-architectural deliver of exception payload to
      userspace read
    - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state
    - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
    - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts
    - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode
    - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
    - KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
    - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT
    - KVM: arm64: Account for RESx bits in __compute_fgt()
    - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
    - KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
    - KVM: SVM: Switch svm_copy_lbrs() to a macro
    - KVM: SVM: Add missing save/restore handling of LBR MSRs
    - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN
    - KVM: nSVM: Refactor checking LBRV enablement in vmcb12 into a helper
    - KVM: nSVM: Refactor writing vmcb12 on nested #VMEXIT as a helper
    - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
    - KVM: nSVM: Triple fault if mapping VMCB12 fails on nested #VMEXIT
    - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID)
    - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT
    - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT
    - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS
    - KVM: nSVM: Drop the non-architectural consistency check for NP_ENABLE
    - KVM: nSVM: Add missing consistency check for nCR3 validity
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
    - KVM: nSVM: Always intercept VMMCALL when L2 is active
    - ARM: 9472/1: fix race condition on PG_dcache_clean in
      __sync_icache_dcache()
    - ring-buffer: Do not double count the reader_page
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
    - udf: fix partition descriptor append bookkeeping
    - mtd: spi-nor: sst: Fix write enable before AAI sequence
    - mtd: spinand: winbond: Declare the QE bit on W25NxxJW
    - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2
    - md/md-llbitmap: skip reading rdevs that are not in_sync
    - md/md-llbitmap: raise barrier before state machine transition
    - md/raid5: fix soft lockup in retry_aligned_read()
    - md/raid5: validate payload size before accessing journal metadata
    - check-uapi: link into shared objects
    - mm, swap: speed up hibernation allocation and writeout
    - HID: apple: ensure the keyboard backlight is off if suspending
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked()
      fails
    - x86/cpu: Disable FRED when PTI is forced on
    - x86/shstk: Prevent deadlock during shstk sigreturn
    - wifi: rtl8xxxu: fix potential use of uninitialized value
    - tcp: call sk_data_ready() after listener migration
    - taskstats: set version in TGID exit notifications
    - mptcp: sync the msk->sndbuf at accept() time
    - mfd: core: Preserve OF node when ACPI handle is present
    - 9p: fix access mode flags being ORed instead of replaced
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
    - bus: mhi: host: pci_generic: Switch to async power up to avoid boot
      delays
    - can: ucan: fix devres lifetime
    - crypto: acomp - fix wrong pointer stored by acomp_save_req()
    - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit
    - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
    - crypto: atmel-ecc - Release client on allocation failure
    - crypto: hisilicon - Fix dma_unmap_single() direction
    - crypto: ccree - fix a memory leak in cc_mac_digest()
    - crypto: atmel-tdes - fix DMA sync direction
    - crypto: atmel-sha204a - Fix error codes in OTP reads
    - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
    - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error
    - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
    - crypto: nx - fix context leak in nx842_crypto_free_ctx
    - crypto: nx - Fix packed layout in struct nx842_crypto_header
    - dm mirror: fix integer overflow in create_dirty_log()
    - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
    - ceph: fix num_ops off-by-one when crypto allocation fails
    - ceph: only d_add() negative dentries when they are unhashed
    - gtp: disable BH before calling udp_tunnel_xmit_skb()
    - IB/core: Fix zero dmac race in neighbor resolution
    - ktest: Fix the month in the name of the failure directory
    - NFSv4.1: Apply session size limits on clone path
    - ntfs3: add buffer boundary checks to run_unpack()
    - ntfs3: fix integer overflow in run_unpack() volume boundary check
    - rtmutex: Use waiter::task instead of current in remove_waiter()
    - rxgk: Fix potential integer overflow in length check
    - sched_ext: Documentation: Clarify ops.dispatch() role in task lifecycle
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
    - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
    - perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND
    - iio: frequency: admv1013: add dev variable
    - iio: frequency: admv1013: fix NULL pointer dereference on str
    - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
    - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
    - mm: various small mmap_prepare cleanups
    - mm: avoid deadlock when holding rmap on mmap_prepare error
    - mei: me: use PCI_DEVICE_DATA macro
    - mei: me: add nova lake point H DID
    - crypto: authencesn - reject short ahash digests during instance creation
    - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
    - ALSA: caiaq: Don't abort when no input device is available
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
    - drm/amdgpu: fix zero-size GDS range init on RDNA4
    - drm/imagination: Fix segfault when updating ftrace mask
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure
    - ALSA: aloop: Fix peer runtime UAF during format-change stop
    - vmalloc: fix buffer overflow in vrealloc_node_align()
    - mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI
      on UP
    - mm/slab: return NULL early from kmalloc_nolock() in NMI on UP
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
    - netfilter: reject zero shift in nft_bitwise
    - ipmi:ssif: Remove unnecessary indention
    - ipmi:ssif: NULL thread on error
    - Linux 7.0.4
    - Upstream stable to v7.0.4
  * Resolute update: v7.0.3 upstream stable release (LP: #2152550)
    - Buffer overflow in drivers/xen/sys-hypervisor.c
    - xen/privcmd: fix double free via VMA splitting
    - Linux 7.0.3
    - Upstream stable to v7.0.3
  * Resolute update: v7.0.2 upstream stable release (LP: #2150553)
    - crypto: authencesn - Fix src offset when decrypting in-place
    - pwm: th1520: fix `CLIPPY=1` warning
    - drm/amdgpu: replace PASID IDR with XArray
    - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch
    - crypto: krb5enc - fix async decrypt skipping hash verification
    - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
    - ksmbd: validate owner of durable handle on reconnect
    - scripts: generate_rust_analyzer.py: define scripts
    - scripts/dtc: Remove unused dts_version in dtc-lexer.l
    - fs/ntfs3: validate rec->used in journal-replay file record check
    - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally
    - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in
      f2fs_write_end_io()
    - f2fs: fix to avoid memory leak in f2fs_rename()
    - f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
    - fuse: reject oversized dirents in page cache
    - fuse: abort on fatal signal during sync init
    - fuse: Check for large folio with SPLICE_F_MOVE
    - fuse: quiet down complaints in fuse_conn_limit_write
    - fuse: fuse_dev_ioctl_clone() should wait for device file to be
      initialized
    - ksmbd: require minimum ACE size in smb_check_perm_dacl()
    - smb: server: fix active_num_conn leak on transport allocation failure
    - smb: client: fix dir separator in SMB1 UNIX mounts
    - smb: server: fix max_connections off-by-one in tcp accept path
    - smb: client: require a full NFS mode SID before reading mode bits
    - smb: client: validate the whole DACL before rewriting it in cifsacl
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
    - ksmbd: validate response sizes in ipc_validate_msg()
    - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
    - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
    - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
    - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()
    - writeback: Fix use after free in inode_switch_wbs_work_fn()
    - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
    - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
    - ALSA: hda/realtek: Add quirk for Legion S7 15IMH
    - ALSA: caiaq: take a reference on the USB device in create_card()
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
      failed
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command
      failed
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
    - mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER
    - Linux 7.0.2
  * Resolute update: v7.0.1 upstream stable release (LP: #2150547)
    - Revert "UBUNTU: SAUCE: cdc-acm: Exclude Exar USB serial ports"
    - nfc: llcp: add missing return after LLCP_CLOSED checks
    - x86/CPU: Fix FPDSS on Zen1
    - can: raw: fix ro->uniq use-after-free in raw_rcv()
    - i2c: s3c24xx: check the size of the SMBUS message before using it
    - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
    - HID: alps: fix NULL pointer dereference in alps_raw_event()
    - HID: core: clamp report_size in s32ton() to avoid undefined shift
    - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
    - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
    - drm/vc4: platform_get_irq_byname() returns an int
    - bnge: return after auxiliary_device_uninit() in error path
    - ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0
    - ALSA: fireworks: bound device-supplied status before string array lookup
    - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
    - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
    - usb: gadget: renesas_usb3: validate endpoint index in standard request
      handlers
    - smb: client: fix off-by-8 bounds check in check_wsl_eas()
    - smb: client: fix OOB reads parsing symlink error response
    - ksmbd: validate EaNameLength in smb2_get_ea()
    - ksmbd: require 3 sub-authorities before reading sub_auth[2]
    - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
    - smb: client: avoid double-free in smbd_free_send_io() after
      smbd_send_batch_flush()
    - smb: server: avoid double-free in smb_direct_free_sendmsg after
      smb_direct_flush_send_list()
    - usbip: validate number_of_packets in usbip_pack_ret_submit()
    - usb: typec: fusb302: Switch to threaded IRQ handler
    - usb: storage: Expand range of matched versions for VL817 quirks entry
    - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
    - usb: gadget: f_hid: don't call cdev_init while cdev in use
    - usb: port: add delay after usb_hub_set_port_power()
    - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
    - scripts/gdb/symbols: handle module path parameters
    - scripts: generate_rust_analyzer.py: avoid FD leak
    - wifi: rtw88: fix device leak on probe failure
    - staging: sm750fb: fix division by zero in ps_to_hz()
    - selftests/mm: hmm-tests: don't hardcode THP size to 2MB
    - USB: serial: option: add Telit Cinterion FN990A MBIM composition
    - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
      race
    - Docs/admin-guide/mm/damon/lru_sort: warn commit_inputs vs param updates
      race
    - ALSA: ctxfi: Limit PTP to a single page
    - dcache: Limit the minimal number of bucket to two
    - vfio/xe: Reorganize the init to decouple migration from reset
    - arm64: mm: Handle invalid large leaf mappings correctly
    - media: vidtv: fix NULL pointer dereference in
      vidtv_channel_pmt_match_sections
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
    - ocfs2: handle invalid dinode in ocfs2_group_extend
    - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in
      epf_ntb_epc_cleanup
    - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
    - KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES
      migrate test
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted
      vCPU
    - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
    - KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created
    - KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION
    - mm: call ->free_folio() directly in folio_unmap_invalidate()
    - checkpatch: add support for Assisted-by tag
    - x86-64: rename misleadingly named '__copy_user_nocache()' function
    - x86: rename and clean up __copy_from_user_inatomic_nocache()
    - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values
    - ASoC: qcom: q6apm: move component registration to unmanaged version
    - mm/kasan: fix double free for kasan pXds
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
    - media: vidtv: fix nfeeds state corruption on start_streaming failure
    - media: mediatek: vcodec: fix use-after-free in encoder release path
    - media: em28xx: fix use-after-free in em28xx_v4l2_open()
    - hwmon: (powerz) Fix use-after-free on USB disconnect
    - ALSA: 6fire: fix use-after-free on disconnect
    - bcache: fix cached_dev.sb_bio use-after-free and crash
    - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in
      pre_exit
    - media: as102: fix to not free memory after the device is registered in
      as102_usb_probe()
    - nilfs2: fix NULL i_assoc_inode dereference in
      nilfs_mdt_save_to_shadow_map
    - media: vidtv: fix pass-by-value structs causing MSAN warnings
    - media: hackrf: fix to not free memory after the device is registered in
      hackrf_probe()
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation
    - clockevents: Add missing resets of the next_event_forced flag
    - Linux 7.0.1
  * GRO managed-frag use-after-free leading to local privilege escalation
    (LP: #2154172)
    - net: gro: don't merge zcopy skbs
  * AppArmor Vulnerabilities  (LP: #2151747)
    - SAUCE: apparmor: pass big_resp to handler
    - SAUCE: apparmor: remove redundant kref_init for listener->count
    - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47337
    - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47334
    - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47333
    - SAUCE: apparmor: fix dfa unpacking size of the notification filter
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47332
    - SAUCE: apparmor: fix size check against type instead of pointer
  * apparmor: LLVM/clang build failure due to uninitialized variable in
    notify.c (LP: #2148809) // CVE-2026-47330
    - SAUCE: apparmor: initialize variable used in uninitialized context
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47329
    - SAUCE: apparmor: fix name validation bypass on notification
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47327 //
    CVE-2026-47328
    - SAUCE: apparmor: fix glob memory leak after kstrdup
  * AppArmor Vulnerabilities  (LP: #2151747) // CVE-2026-47326
    - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags

 -- John Cabaj <john.cabaj@canonical.com>  Fri, 29 May 2026 16:17:55 -0500

linux-azure-fde (7.0.0-1006.6) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1006.6 -proposed tracker (LP: #2154470)

  [ Ubuntu-azure: 7.0.0-1007.7 ]

  * resolute/linux-azure: 7.0.0-1007.7 -proposed tracker (LP: #2154468)

  [ Ubuntu-azure: 7.0.0-1006.6 ]

  * Fixing issue in Azure packaging lmm dependency 
    and moving out of release

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 28 May 2026 10:23:26 -0500

linux-azure-fde (7.0.0-1005.5) resolute; urgency=medium

  * Miscellaneous Ubuntu changes
    - [Packaging] azure-fde: Don't hard-code lmm zfs dependency

  [ Ubuntu-azure: 7.0.0-1005.5 ]

  * Miscellaneous Ubuntu changes
    - [Packaging] azure: Don't hard-code lmm zfs dependency
  [ Ubuntu: 7.0.0-22.22 ]
  * GRO managed-frag use-after-free leading to local privilege escalation
    (LP: #2154172)
    - net: gro: don't merge zcopy skbs
  [ Ubuntu: 7.0.0-20.20 ]
  * apparmor (LP: #2151747)
    - SAUCE: apparmor: pass big_resp to handler
    - SAUCE: apparmor: remove redundant kref_init for listener->count
    - SAUCE: apparmor: fix NULL pointer dereference in unpack_pdb
  * apparmor (LP: #2151747) // CVE-2026-47337
    - SAUCE: apparmor: fix NULL pointer dereference in bind_map_addr
  * apparmor (LP: #2151747) // CVE-2026-47334
    - SAUCE: apparmor: fix sleep prone memory allocation under a spin_lock
  * apparmor (LP: #2151747) // CVE-2026-47333
    - SAUCE: apparmor: fix dfa unpacking size of the notification filter
  * apparmor (LP: #2151747) // CVE-2026-47332
    - SAUCE: apparmor: fix size check against type instead of pointer
  * apparmor: LLVM/clang build failure due to uninitialized variable in
    notify.c (LP: #2148809) // CVE-2026-47330
    - SAUCE: apparmor: initialize variable used in uninitialized context
  * apparmor (LP: #2151747) // CVE-2026-47329
    - SAUCE: apparmor: fix name validation bypass on notification
  * apparmor (LP: #2151747) // CVE-2026-47327 // CVE-2026-47328
    - SAUCE: apparmor: fix glob memory leak after kstrdup
  * apparmor (LP: #2151747) // CVE-2026-47326
    - SAUCE: apparmor: fix inverted NULL check after aa_get_buffer
  [ Ubuntu: 7.0.0-19.19 ]
  * resolute/linux: 7.0.0-19.19 -proposed tracker (LP: #2153786)
  * Packaging resync (LP: #1786013)
    - [Packaging] update annotations scripts
    - [Packaging] debian.master/dkms-versions -- remove dkms-versions
      (main/s2026.05.11)
  * CVE-2026-46300
    - net: skbuff: preserve shared-frag marker during coalescing
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers
  * net/rds: reset op_nents when zerocopy page pin fails (LP: #2153962)
    - net/rds: reset op_nents when zerocopy page pin fails
  * CVE-2026-46333
    - ptrace: slightly saner 'get_dumpable()' logic
  * CVE-2026-43500
    - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
    - rxrpc: Fix potential UAF after skb_unshare() failure
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  * CVE-2026-43284
    - xfrm: esp: avoid in-place decrypt on shared skb frags
  [ Ubuntu: 7.0.0-15.15 ]
  * resolute/linux: 7.0.0-15.15 -proposed tracker (LP: #2148866)
  * Qualcomm X1E: Speaker overdrive causes hardware protection shutdown
    (LP: #2149808)
    - SAUCE: ASoC: qcom: x1e80100: limit speaker volumes
  * intel-ipu7 / intel-ipu7-isys modules are shipped unsigned in latest
    Resolute kernels, breaking Secure Boot systems  (LP: #2148718)
    - [packaging] add intel-ipu7 to signature inclusion list

 -- John Cabaj <john.cabaj@canonical.com>  Wed, 27 May 2026 15:42:18 -0500

linux-azure-fde (7.0.0-1004.4) resolute; urgency=medium

  * resolute/linux-azure-fde: 7.0.0-1004.4 -proposed tracker (LP: #2148568)

  * Please make dracut the default initrd generator (LP: #2142775)
    - [Packaging] azure-fde: recommends dracut instead of initramfs-tools

  * Miscellaneous Ubuntu changes
    - [Packaging] azure-fde: Updating dependencies and packages from master
    - [Packaging] azure-fde: Add linux-main-modules-zfs to linux-modules
      depends
    - [Packaging] azure-fde: Removing modules-extra

  [ Ubuntu-azure: 7.0.0-1004.4 ]

  * resolute/linux-azure: 7.0.0-1004.4 -proposed tracker (LP: #2148172)
  * Please make dracut the default initrd generator (LP: #2142775)
    - [Packaging] recommends dracut instead of initramfs-tools
  * Miscellaneous Ubuntu changes
    - [Packaging] azure: Removing modules-extra
    - [Packaging] azure: Add linux-main-modules-zfs to linux-modules depends
    - [Packaging] azure: Updating dependencies and packages from master
    - [Config] azure: Reducing config to limited annotations
  [ Ubuntu: 7.0.0-14.14 ]
  * resolute/linux: 7.0.0-14.14 -proposed tracker (LP: #2148159)
  * support vflip/hflip for Sony IMX471 camera sensor (LP: #2138841)
    - SAUCE: media: ipu-bridge: add TBE20A0 ACPI id for Sony IMX471
  * AA: disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED (LP: #2147533)
    - [Config] disable SECURITY_APPARMOR_PACKET_MEDIATION_ENABLED
  * System doesn't response with mt76 call trace (LP: #2137448)
    - wifi: mt76: mt792x: Fix a potential deadlock in high-load situations
  * The second tbt storage plugged on the dock will not be recognized
    (LP: #2139572)
    - SAUCE: thunderbolt: Fix PCIe device enumeration with delayed rescan
  * dma-buf filesystem flags fix (LP: #2139656)
    - SAUCE: dma-buf: set SB_I_NOEXEC and SB_I_NODEV on dmabuf filesystem
  * Bluetooth device (MT7925) not detected on USB bus with linux-oem-6.17
    (LP: #2145164)
    - SAUCE: USB: hub: call ACPI _PRR reset during port power-cycle on
      enumeration failure
  * drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port during
    long HPD pulse (LP: #2143879)
    - SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active DP-alt TC port
      during long HPD pulse
  * i915 WARN_ON call trace during CB/WB on MTL/ARL platforms (LP: #2144537)
    - SAUCE: drm/i915/xelpdp/tc: Convert TCSS power check WARN to a debug
      message
  * Miscellaneous Ubuntu changes
    - [Packaging] Add support for per-flavour depends
    - [Packaging] Don't hard-code lmm zfs dependency
    - [Config] updateconfigs following v7.0 release
  [ Ubuntu: 7.0.0-13.13 ]
  * resolute/linux: 7.0.0-13.13 -proposed tracker (LP: #2147403)
  * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)
    - SAUCE increase socat timeout in gre_gso.sh
  * Canonical Kmod 2025 key rotation (LP: #2147447)
    - [Packaging] ubuntu-compatible-signing -- make Ubuntu-Compatible-Signing
      extensible
    - [Packaging] ubuntu-compatible-signing -- allow consumption of positive
      certs
    - [Packaging] ubuntu-compatible-signing -- report the livepatch:2025 key
    - [Config] prepare for Canonical Kmod key rotation
    - [Packaging] ubuntu-compatible-signing -- report the kmod:2025 key
    - [Packaging] ensure our cert rollups are always fresh
  * On Dell system, the internal OLED display drops to a visibly low FPS after
    suspend/resume (LP: #2144712)
    - drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk
    - drm/i915/psr: Fixes for Dell XPS DA14260 quirk
  * Realtek RTL8116AF SFP option module fails to get connected (LP: #2116144)
    - SAUCE: r8169: add quirk for RTL8116af SerDes
  * Miscellaneous Ubuntu changes
    - [Config] updateconfigs following v7.0-rc7 rebase

 -- John Cabaj <john.cabaj@canonical.com>  Thu, 16 Apr 2026 10:11:35 -0500

# For older changelog entries, run 'apt-get changelog linux-azure-fde-tools-7.0.0-1013'
