-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 30 Apr 2026 13:38:11 +0200
Source: linux
Binary: bpftool bpftool-dbgsym hyperv-daemons hyperv-daemons-dbgsym intel-sdsi intel-sdsi-dbgsym libcpupower-dev libcpupower1 libcpupower1-dbgsym linux-bpf-dev linux-config-6.12 linux-cpupower linux-cpupower-dbgsym linux-headers-6.12.85+deb13-amd64 linux-headers-6.12.85+deb13-cloud-amd64 linux-headers-6.12.85+deb13-rt-amd64 linux-image-6.12.85+deb13-amd64-dbg linux-image-6.12.85+deb13-amd64-unsigned linux-image-6.12.85+deb13-cloud-amd64-dbg linux-image-6.12.85+deb13-cloud-amd64-unsigned linux-image-6.12.85+deb13-rt-amd64-dbg linux-image-6.12.85+deb13-rt-amd64-unsigned linux-image-amd64-dbg linux-image-amd64-signed-template linux-image-cloud-amd64-dbg linux-image-rt-amd64-dbg linux-kbuild-6.12.85+deb13 linux-kbuild-6.12.85+deb13-dbgsym linux-perf linux-perf-dbgsym rtla rtla-dbgsym usbip usbip-dbgsym
Architecture: amd64
Version: 6.12.85-1
Distribution: trixie-security
Urgency: high
Maintainer: amd64 Build Daemon (x86-grnet-01) <buildd_amd64-x86-grnet-01@buildd.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
 bpftool    - Inspection and simple manipulation of BPF programs and maps
 hyperv-daemons - Support daemons for Linux running on Hyper-V
 intel-sdsi - Intel On Demand (SDSi) provisioning tool
 libcpupower-dev - CPU frequency and voltage scaling tools for Linux (development fi
 libcpupower1 - CPU frequency and voltage scaling tools for Linux (libraries)
 linux-bpf-dev - Headers for BPF development
 linux-config-6.12 - Debian kernel configurations for Linux 6.12
 linux-cpupower - CPU power management tools for Linux
 linux-headers-6.12.85+deb13-amd64 - Header files for Linux 6.12.85+deb13-amd64
 linux-headers-6.12.85+deb13-cloud-amd64 - Header files for Linux 6.12.85+deb13-cloud-amd64
 linux-headers-6.12.85+deb13-rt-amd64 - Header files for Linux 6.12.85+deb13-rt-amd64
 linux-image-6.12.85+deb13-amd64-dbg - Debug symbols for linux-image-6.12.85+deb13-amd64
 linux-image-6.12.85+deb13-amd64-unsigned - Linux 6.12 for 64-bit PCs
 linux-image-6.12.85+deb13-cloud-amd64-dbg - Debug symbols for linux-image-6.12.85+deb13-cloud-amd64
 linux-image-6.12.85+deb13-cloud-amd64-unsigned - Linux 6.12 for x86-64 cloud
 linux-image-6.12.85+deb13-rt-amd64-dbg - Debug symbols for linux-image-6.12.85+deb13-rt-amd64
 linux-image-6.12.85+deb13-rt-amd64-unsigned - Linux 6.12 for 64-bit PCs, PREEMPT_RT
 linux-image-amd64-dbg - Debugging symbols for Linux amd64 configuration (meta-package)
 linux-image-amd64-signed-template - Template for signed linux-image packages for amd64
 linux-image-cloud-amd64-dbg - Debugging symbols for Linux cloud-amd64 configuration (meta-packa
 linux-image-rt-amd64-dbg - Debugging symbols for Linux rt-amd64 configuration (meta-package)
 linux-kbuild-6.12.85+deb13 - Kbuild infrastructure for Linux 6.12.85+deb13
 linux-perf - Performance analysis tools for Linux
 rtla       - Real-Time Linux Analysis tools
 usbip      - USB device sharing system over IP network
Closes: 1127612 1130930 1132622
Changes:
 linux (6.12.85-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75
     - RDMA/siw: Fix potential NULL pointer dereference in header processing
     - RDMA/umad: Reject negative data_len in ib_umad_write
     - auxdisplay: arm-charlcd: fix release_mem_region() size
     - hfsplus: return error when node already exists in hfs_bnode_create
     - rcu: Refactor expedited handling check in rcu_read_unlock_special()
     - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler()
     - rcu: Fix rcu_read_unlock() deadloop due to softirq
     - audit: move the compat_xxx_class[] extern declarations to audit_arch.h
     - i3c: Move device name assignment after i3c_bus_init
     - fs: add <linux/init_task.h> for 'init_fs'
     - i3c: master: Update hot-join flag only on success
     - gfs2: Retries missing in gfs2_{rename,exchange}
     - gfs2: Fix slab-use-after-free in qd_put
     - gfs2: Fix use-after-free in iomap inline data write path
     - i3c: dw: Initialize spinlock to avoid upsetting lockdep
     - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()
     - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
     - tpm: st33zp24: Fix missing cleanup on get_burstcount() error
     - erofs: get rid of raw bi_end_io() usage
     - erofs: handle end of filesystem properly for file-backed mounts
     - btrfs: qgroup: return correct error when deleting qgroup relation item
     - btrfs: fix block_group_tree dirty_list corruption
     - smb: client: fix potential UAF and double free in smb2_open_file()
     - block: add a bio_add_virt_nofail helper
     - rnbd-srv: use bio_add_virt_nofail
     - rnbd-srv: Fix server side setting of bi_size for special IOs
     - xen/virtio: Don't use grant-dma-ops when running as Dom0
     - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED
     - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
     - io_uring/sync: validate passed in offset
     - cpuidle: governors: menu: Always check timers with tick stopped
     - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature
     - md/raid5: fix raid5_run() to return error when log_init() fails
     - md/raid10: fix any_working flag handling in raid10_sync_request
     - OPP: Return correct value in dev_pm_opp_get_level
     - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()
     - iomap: fix submission side handling of completion side errors
     - thermal/of: Fix reference leak in thermal_of_cm_lookup()
     - ublk: Validate SQE128 flag before accessing the cmd
     - Partial revert "x86/xen: fix balloon target initialization for PVH dom0"
     - md/raid1: fix memory leak in raid1_run() if no active rdev
     - md/raid1: fix memory leak in raid1_run()
     - PM: wakeup: Handle empty list in wakeup_sources_walk_start()
     - perf: arm_spe: Properly set hw.state on failures
     - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not
       possible
     - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races
     - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel()
     - [amd64] perf/x86/core: Do not set bit width for unavailable counters
     - crypto: qat - fix warning on adf_pfvf_pf_proto.c
     - libbpf: Fix OOB read in btf_dump_get_bitfield_value
     - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable
     - [arm64] crypto: cavium - fix dma_free_coherent() size
     - bpf: Preserve id of register in sync_linked_regs()
     - hrtimer: Fix trace oddity
     - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls
     - [amd64] crypto: ccp - narrow scope of snp_range_list
     - bpf, sockmap: Fix incorrect copied_seq calculation
     - bpf, sockmap: Fix FIONREAD for sockmap
     - tracing: Add a comment about ftrace_regs definition
     - ftrace: Make ftrace_regs abstract from direct use
     - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs
     - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros
     - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value
     - fgraph: Replace fgraph_ret_regs with ftrace_regs
     - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs
     - tracing: Add ftrace_fill_perf_regs() for perf event
     - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return
       probe
     - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to
       hw_regs path
     - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe
     - bpf: Fix bpf_xdp_store_bytes proto for read-only arg
     - genirq: Set IRQF_COND_ONESHOT in devm_request_irq().
     - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()
     - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler
     - scsi: efct: Use IRQF_ONESHOT and default primary handler
     - EDAC/altera: Remove IRQF_ONESHOT
     - mfd: wm8350-core: Use IRQF_ONESHOT
     - media: pci: mg4b: Use IRQF_NO_THREAD
     - sched/deadline: Clear the defer params
     - sched/rt: Skip currently executing CPU in rto_next_cpu()
     - hwrng: core - Allow runtime disabling of the HW RNG
     - hwrng: core - use RCU and work_struct to fix race condition
     - pstore/ram: fix buffer overflow in persistent_ram_save_old()
     - soc: qcom: smem: handle ENOMEM error during probe
     - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()
     - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()
     - firmware: arm_ffa: Correct 32-bit response handling in
       NOTIFICATION_INFO_GET
     - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings
     - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings
     - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index()
     - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size
     - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on
     - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on
     - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks
     - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of
       AD7147
     - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property
     - [powerpc*] uaccess: Move barrier_nospec() out of
       allow_read_{from/write}_user()
     - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in
       cmd_db_dev_probe
     - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
     - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event
       handling
     - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node
     - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz
     - [arm64] dts: amlogic: s4: fix mmc clock assignment
     - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order
     - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog
       instances for j784s4
     - hwspinlock: omap: Handle devm_pm_runtime_enable() errors
     - [arm64] dts: amlogic: c3: assign the MMC signal clocks
     - [arm64] dts: amlogic: axg: assign the MMC signal clocks
     - [arm64] dts: amlogic: gx: assign the MMC signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks
     - [arm64] dts: amlogic: g12: assign the MMC A signal clock
     - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm
     - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0
     - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1
     - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models)
     - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions
     - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions
     - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures
     - [arm64] drm/panthor: Fix the full_tick check
     - [arm64] drm/panthor: Fix the group priority rotation logic
     - [arm64] drm/panthor: Fix immediate ticking on a disabled tick
     - [arm64] drm/panthor: Fix the logic that decides when to stop ticking
     - [arm64] drm/panthor: Make sure we resume the tick when new jobs are
       submitted
     - workqueue: Factor out assign_rescuer_work()
     - workqueue: Only assign rescuer work when really needed
     - workqueue: Process rescuer work items one-by-one using a cursor
     - drm/panel: sw43408: Remove manual invocation of unprepare at remove
     - ALSA: pcm: use new array-copying-wrapper
     - ALSA: pcm: Relax __free() variable declarations
     - ALSA: vmaster: Relax __free() variable declarations
     - [arm64] drm/panthor: Evict groups before VM termination
     - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking
     - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler
     - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect()
     - media: chips-media: wave5: Fix memory leak on codec_info allocation
       failure
     - drm/amd: Drop "amdgpu kernel modesetting enabled" message
     - drm/amdkfd: Fix signal_eviction_fence() bool return value
     - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init
     - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280
     - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support
     - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x
     - regulator: core: move supply check earlier in set_machine_constraints()
     - HID: playstation: Add missing check for input_ff_create_memless
     - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats
     - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x
     - media: ccs: Accommodate C-PHY into the calculation
     - [arm64] drm/msm/a2xx: fix pixel shader start on A225
     - drm/buddy: release free_trees array on buddy mm teardown
     - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev
     - media: uvcvideo: Fix allocation for small frame sizes
     - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()
     - drm/xe: Unregister drm device on probe error
     - platform/chrome: cros_ec_lightbar: Fix response size initialization
     - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
     - spi: tools: Add include folder to .gitignore
     - Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
     - hwmon: pmbus: mpq8785: Prepare driver for multiple device support
     - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio
       configuration
     - hwmon: pmbus: mpq8785: Add support for MPM82504
     - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification
     - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails
     - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors
     - PCI/PM: Avoid redundant delays on D3hot->D3cold
     - wifi: cfg80211: Fix use_for flag update on BSS refresh
     - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
     - docs: fix WARNING document not included in any toctree
     - Documentation: trace: Refactor toctree
     - Documentation: tracing: Add PCI tracepoint documentation
     - PCI: Do not attempt to set ExtTag for VFs
     - PCI/portdrv: Fix potential resource leak
     - dm: fix unlocked test for dm_suspended_md
     - dm: use READ_ONCE in dm_blk_report_zones
     - quota: fix livelock between quotactl and freeze_super
     - net: mctp-i2c: fix duplicate reception of old data
     - mctp i2c: initialise event handler read bytes
     - wifi: cfg80211: stop NAN and P2P in cfg80211_leave
     - netfilter: nf_tables: reset table validation state on abort
     - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH
     - netfilter: nf_conncount: increase the connection clean up limit to 64
     - netfilter: nft_compat: add more restrictions on netlink attributes
     - netfilter: nf_conncount: fix tracking of connections from localhost
     - module: add helper function for reading module_buildid()
     - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()
     - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken
     - [amd64] iommu/vt-d: Flush cache for PASID table before using it
     - [amd64] iommu/vt-d: Separate page request queue from SVM
     - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID
     - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path
     - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry
     - dm: use bio_clone_blkg_association
     - xdrgen: Fix struct prefix for typedef types in program wrappers
     - NFS: NFSERR_INVAL is not defined by NFSv2
     - xdrgen: Initialize data pointer for zero-length items
     - nfsd: never defer requests during idmap lookup
     - fat: avoid parent link count underflow in rmdir
     - tcp: tcp_tx_timestamp() must look at the rtx queue
     - PCI: Check parent for NULL in of_pci_bus_release_domain_nr()
     - wifi: ath10k: sdio: add missing lock protection in
       ath10k_sdio_fw_crashed_dump()
     - PCI: Initialize RCB from pci_configure_device()
     - PCI: Add defines for bridge window indexing
     - PCI/ACPI: Restrict program_hpx_type2() to AER bits
     - ipc: don't audit capability check in ipc_permissions()
     - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()
     - mptcp: fix receive space timestamp initialization
     - octeontx2-af: Fix PF driver crash with kexec kernel booting
     - bonding: only set speed/duplex to unknown, if getting speed failed
     - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
     - nfc: hci: shdlc: Stop timers and work before freeing context
     - netfilter: nfnetlink_queue: optimize verdict lookup with hash table
     - netfilter: nfnetlink_queue: do shared-unconfirmed check before
       segmentation
     - netfilter: nft_set_hash: fix get operation on big endian
     - netfilter: nft_counter: fix reset of counters on 32bit archs
     - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null
       interval
     - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
     - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
     - [arm64] net: hns3: fix double free issue for tx spare buffer
     - procfs: fix missing RCU protection when reading real_parent in
       do_task_stat()
     - smb: client: correct value for smbd_max_fragmented_recv_size
     - net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
     - net: sunhme: Fix sbus regression
     - net: Add skb_dstref_steal and skb_dstref_restore
     - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input
       callers
     - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path
     - serial: caif: fix use-after-free in caif_serial ldisc_close()
     - octeon_ep: disable per ring interrupts
     - octeon_ep: ensure dbell BADDR updation
     - octeon_ep_vf: ensure dbell BADDR updation
     - ionic: Rate limit unknown xcvr type messages
     - octeontx2-pf: Unregister devlink on probe failure
     - RDMA/rtrs: server: remove dead code
     - IB/cache: update gid cache on client reregister event
     - RDMA/hns: Fix WQ_MEM_RECLAIM warning
     - RDMA/hns: Fix RoCEv1 failure due to DSCP
     - RDMA/hns: Notify ULP of remaining soft-WCs during reset
     - power: supply: ab8500: Fix use-after-free in power_supply_changed()
     - power: supply: act8945a: Fix use-after-free in power_supply_changed()
     - power: supply: bq256xx: Fix use-after-free in power_supply_changed()
     - power: supply: bq25980: Fix use-after-free in power_supply_changed()
     - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
     - power: supply: goldfish: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()
     - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()
     - power: supply: rt9455: Fix use-after-free in power_supply_changed()
     - power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
     - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write
     - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported
     - power: supply: wm97xx: Fix NULL pointer dereference in
       power_supply_changed()
     - RDMA/rtrs-srv: fix SG mapping
     - RDMA/rxe: Fix double free in rxe_srq_from_init
     - RDMA/iwcm: Fix workqueue list corruption by removing work_list
     - tools/power/x86/intel-speed-select: Fix file descriptor leak in
       isolate_cpus()
     - RDMA/mlx5: Fix UMR hang in LAG error state unload
     - IB/mlx5: Fix port speed query for representors
     - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper
     - vfio/pci: Lock upstream bridge for vfio_pci_core_disable()
     - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate
     - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails
     - [amd64] crypto: ccp - Add an S4 restore flow
     - [amd64] crypto: ccp - Factor out ring destroy handling to a helper
     - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when
       PSP_CMD_TEE_RING_INIT fails
     - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
     - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx
     - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit
     - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
     - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
     - RDMA/rxe: Fix race condition in QP timer handlers
     - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing
     - cxl: Fix premature commit_end increment on decoder commit failure
     - mtd: parsers: ofpart: fix OF node refcount leak in
       parse_fixed_partitions()
     - mtd: spinand: Fix kernel doc
     - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
     - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer
     - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc
     - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN
     - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
     - scsi: ufs: host: mediatek: Require CONFIG_PM
     - scsi: csiostor: Fix dereference of null pointer rn
     - nvdimm: virtio_pmem: serialize flush requests
     - fs/nfs: Fix readdir slow-start regression
     - tracing: Properly process error handling in event_hist_trigger_parse()
     - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros
     - fbdev: of_display_timing: Fix device node reference leak in
       of_get_display_timings()
     - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
     - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
     - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs
     - clk: qcom: rcg2: compute 2d using duty fraction directly
     - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs
     - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops
     - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc
     - clk: qcom: gcc-ipq5018: flag sleep clock as critical
     - clk: Move clk_{save,restore}_context() to COMMON_CLK section
     - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks
     - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src
     - clk: qcom: gfx3d: add parent to parent request map
     - clk: mediatek: Fix error handling in runtime PM setup
     - interconnect: mediatek: Don't hijack parent device
     - interconnect: mediatek: Aggregate bandwidth with saturating add
     - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX
     - dma: dma-axi-dmac: fix SW cyclic transfers
     - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue
     - soundwire: intel_ace2x: add SND_HDA_CORE dependency
     - iio: test: drop dangling symbol in gain-time-scale helpers
     - staging: greybus: lights: avoid NULL deref
     - serial: imx: change SERIAL_IMX_CONSOLE to bool
     - serial: SH_SCI: improve "DMA support" prompt
     - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms
     - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation
     - iio: pressure: mprls0025pa: fix SPI CS delay violation
     - iio: pressure: mprls0025pa: fix interrupt flag
     - iio: pressure: mprls0025pa: fix scan_type struct
     - iio: pressure: mprls0025pa: fix pressure calculation
     - watchdog: starfive-wdt: Fix PM reference leak in probe error path
     - coresight: etm3x: Fix cpulocked warning on cpuhp
     - phy: freescale: imx8qm-hsio: fix NULL pointer dereference
     - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"
     - mfd: arizona: Fix regulator resource leak on
       wm5102_clear_write_sequencer() failure
     - mfd: simple-mfd-i2c: Add MAX77705 support
     - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA
     - mfd: simple-mfd-i2c: Add SpacemiT P1 support
     - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
     - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
     - drivers: iio: mpu3050: use dev_err_probe for regulator request
     - usb: bdc: fix sleep during atomic
     - pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
     - ovl: Fix uninit-value in ovl_fill_real
     - iio: sca3000: Fix a resource leak in sca3000_probe()
     - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
     - pinctrl: single: fix refcount leak in pcs_add_gpio_func()
     - leds: qcom-lpg: Check the return value of regmap_bulk_write()
     - backlight: qcom-wled: Support ovp values for PMI8994
     - backlight: qcom-wled: Change PM8950 WLED configurations
     - dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
     - drbd: always set BLK_FEAT_STABLE_WRITES
     - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
     - fs/ntfs3: Initialize new folios before use
     - fs/ntfs3: prevent infinite loops caused by the next valid being the same
     - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
     - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs
     - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check
     - kbuild: Add objtool to top-level clean target
     - objpool: fix the overestimation of object pooling metadata size
     - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
     - cpuidle: Skip governor when only one idle state is available
     - net: sparx5/lan969x: fix DWRR cost max to match hardware register width
     - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper
     - net: mscc: ocelot: split xmit into FDMA and register injection paths
     - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()
     - ipv6: Fix out-of-bound access in fib6_add_rt2node().
     - net: sparx5/lan969x: fix PTP clock max_adj value
     - net: usb: catc: enable basic endpoint checking
     - xen-netback: reject zero-queue configuration from guest
     - net/rds: rds_sendmsg should not discard payload_len
     - net: bridge: mcast: always update mdb_n_entries for vlan contexts
     - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
     - ipvs: do not keep dest_dst if dev is going down
     - net: remove WARN_ON_ONCE when accessing forward path array
     - netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
       (CVE-2026-23231)
     - ipv6: fix a race in ip6_sock_set_v6only()
     - bpftool: Fix truncated netlink dumps
     - ping: annotate data-races in ping_lookup()
     - macvlan: observe an RCU grace period in macvlan_common_newlink() error
       path
     - icmp: prevent possible overflow in icmp_global_allow()
     - inet: move icmp_global_{credit,stamp} to a separate cache line
     - octeontx2-af: Fix default entries mcam entry action
     - bonding: alb: fix UAF in rlb_arp_recv during bond up/down
     - net/mlx5: Fix multiport device check over light SFs
     - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels
     - apparmor: fix NULL sock in aa_sock_file_perm
     - AppArmor: Allow apparmor to handle unaligned dfa tables
     - apparmor: Fix & Optimize table creation from possibly unaligned memory
     - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure
     - apparmor: fix rlimit for posix cpu timers
     - apparmor: remove apply_modes_to_perms from label_match
     - apparmor: make label_match return a consistent value
     - apparmor: avoid per-cpu hold underflow in aa_get_buffer
     - apparmor: fix invalid deref of rawdata when export_binary is unset
     - apparmor: fix aa_label to return state from compount and component match
     - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
     - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
     - drm/amdgpu: Fix memory leak in amdgpu_ras_init()
     - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()
     - [amd64] drm/i915/acpi: free _DSM package when no connectors
     - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init
     - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
     - drm/amd/display: Reject cursor plane on DCE when scaled differently than
       primary
     - drm/amd/display: Fix out-of-bounds stream encoder index v3
     - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
     - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
     - drm/xe: Move forcewake to 'gt.pm' substructure
     - drm/xe: Create dedicated xe_mmio structure
     - drm/xe: Clarify size of MMIO region
     - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio'
     - drm/xe: Populate GT's mmio iomap from tile during init
     - drm/xe: Switch mmio_ext to use 'struct xe_mmio'
     - drm/xe: Add xe_tile backpointer to xe_mmio
     - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code
     - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt
     - drm/xe/mmio: Avoid double-adjust in 64-bit reads
     - drm/xe/ptl: Apply Wa_13011645652
     - drm/xe/xe2_hpg: Add set of workarounds
     - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138
     - efi: Fix reservation of unaccepted memory table
     - btrfs: use the correct type to initialize block reserve for delayed refs
     - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not
       found
     - [amd64] x86/hyperv: Fix error pointer dereference
     - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by
       set_sysclk
     - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats
     - ext4: subdivide EXT4_EXT_DATA_VALID1
     - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
     - ext4: don't cache extent during splitting extent
     - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
     - ext4: drop extent cache when splitting extent fails
     - ext4: fix memory leak in ext4_ext_shift_extents()
     - ext4: fix e4b bitmap inconsistency reports
     - ext4: fix dirtyclusters double decrement on fs shutdown
     - ext4: use optimized mballoc scanning regardless of inode format
     - ata: pata_ftide010: Fix some DMA timings
     - ata: libata-scsi: refactor ata_scsi_translate()
     - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT
     - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
     - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
     - dt-bindings: phy: qcom-edp: Add missing clock for X Elite
     - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false
     - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names
     - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names
     - perf test stat: Update test expectations and events
     - perf test stat tests: Fix for virtualized machines
     - perf unwind-libdw: Fix invalid reference counts
     - perf callchain: Fix srcline printing with inlines
     - libsubcmd: Fix null intersection case in exclude_cmds()
     - perf maps: Fix reference count leak in maps__find_ams()
     - perf annotate: Fix memcpy size in arch__grow_instructions()
     - perf vendor events amd: Fix Zen 5 MAB allocation events
     - libperf: Don't remove -g when EXTRA_CFLAGS are used
     - libperf build: Always place libperf includes first
     - rtc: interface: Alarm race handling should not discard preceding error
     - statmount: permission check should return EPERM
     - audit: add fchmodat2() to change attributes class
     - hfsplus: fix volume corruption issue for generic/498
     - fs/buffer: add alert in try_to_free_buffers() for folios without buffers
     - audit: add missing syscalls to read class
     - hfsplus: pretend special inodes as regular files
     - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr()
     - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init
     - minix: Add required sanity checking to minix_check_superblock()
     - dlm: validate length in dlm_search_rsb_tree
     - btrfs: fallback to buffered IO if the data profile has duplication
     - btrfs: handle user interrupt properly in btrfs_trim_fs()
     - smb: client: add proper locking around ses->iface_last_update
     - gfs2: fiemap page fault fix
     - smb: client: prevent races in ->query_interfaces()
     - tools/power cpupower: Reset errno before strtoull()
     - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS
     - [arm64] Add support for TSV110 Spectre-BHB mitigation
     - rnbd-srv: Zero the rsp buffer before using it
     - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when
       CONFIG_X86_PAE is set
     - EFI/CPER: don't dump the entire memory region
     - APEI/GHES: ensure that won't go past CPER allocated record
     - APEI/GHES: ARM processor Error: don't go past allocated memory
     - EFI/CPER: don't go past the ARM processor CPER record buffer
     - ACPI: processor: Fix NULL-pointer dereference in
       acpi_processor_errata_piix4()
     - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
     - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP
     - powercap: intel_rapl: Add PL4 support for Ice Lake
     - alpha: fix user-space corruption during memory compaction
     - md-cluster: fix NULL pointer dereference in process_metadata_update
     - cpufreq: dt-platdev: Block the driver from probing on more QC platforms
     - [s390x] perf: Disable register readout on sampling events
     - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD
     - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display)
     - ACPI: battery: fix incorrect charging status when current is zero
     - xenbus: Use .freeze/.thaw to handle xenbus devices
     - blk-mq-debugfs: add missing debugfs_mutex in
       blk_mq_debugfs_register_hctxs()
     - block: decouple secure erase size limit from discard size limit
     - bpf: verifier improvement in 32bit shift sign extension pattern
     - [amd64] perf/x86/msr: Add Airmont NP
     - [amd64] perf/x86/cstate: Add Airmont NP
     - bpf: crypto: Use the correct destructor kfunc type
     - bpf: Recognize special arithmetic shift in the verifier
     - clocksource/drivers/sh_tmu: Always leave device running after probe
     - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on
       OF
     - PCI/MSI: Unmap MSI-X region on error
     - crypto: hisilicon/qm - move the barrier before writing to the mailbox
       register
     - mailbox: bcm-ferxrm-mailbox: Use default primary handler
     - char: tpm: cr50: Remove IRQF_ONESHOT
     - sched/debug: Fix updating of ppos on server write ops
     - pstore: ram_core: fix incorrect success return when vmap() fails
     - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure
     - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
     - [arm64] tegra: smaug: Add usb-role-switch support
     - drm/display/dp_mst: Add protection against 0 vcpi
     - gpu/panel-edp: add AUO panel entry for B140HAN06.4
     - drm/amdgpu: fix NULL pointer issue buffer funcs
     - drm/amdkfd: Handle GPU reset and drain retry fault race
     - spi-geni-qcom: initialize mode related registers to 0
     - spi-geni-qcom: use xfer->bits_per_word for can_dma()
     - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32
     - [amd64] ASoC: SOF: ipc4: Support for sending payload along with
       LARGE_CONFIG_GET
     - media: dvb-core: dmxdevfilter must always flush bufs
     - spi: stm32: fix Overrun issue at < 8bpw
     - drm/v3d: Set DMA segment size to avoid debug warnings
     - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes
     - media: omap3isp: isppreview: always clamp in preview_try_format()
     - media: omap3isp: set initial format
     - media: chips-media: wave5: Fix conditional in start_streaming
     - media: chips-media: wave5: Process ready frames when CMD_STOP sent to
       Encoder
     - media: mediatek: vcodec: Don't try to decode 422/444 VP9
     - drm/amdgpu: add support for HDP IP version 6.1.1
     - drm/amd/display: Fix dsc eDP issue
     - drm/amdgpu: avoid a warning in timedout job handler
     - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
     - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards
     - drm/amdgpu: Skip loading SDMA_RS64 in VF
     - drm/amd/display: only power down dig on phy endpoints
     - drm/xe: Only toggle scheduling in TDR if GuC is running
     - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask
     - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug
     - spi: spi-mem: Limit octal DTR constraints to octal DTR situations
     - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START
     - drm/panel: Fix a possible null-pointer dereference in
       jdi_panel_dsi_remove()
     - media: adv7180: fix frame interval in progressive mode
     - media: pvrusb2: fix URB leak in pvr2_send_request_ex
     - media: solo6x10: Check for out of bounds chip_id
     - media: cx25821: Fix a resource leak in cx25821_dev_setup()
     - media: v4l2-async: Fix error handling on steps after finding a match
     - media: mt9m114: Avoid a reset low spike during probe()
     - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found
     - media: ipu6: Ensure stream_mutex is acquired when dealing with node list
     - media: ipu6: Close firmware streams on streaming enable failure
     - media: ipu6: Always close firmware stream
     - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk
     - drm/amdkfd: Relax size checking during queue buffer get
     - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map()
     - drm: Account property blob allocations to memcg
     - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed
     - virt: vbox: uapi: Mark inner unions in packed structs as packed
     - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to
       aggregated
     - PCI: Add Intel Nova Lake audio Device ID
     - drm/amd/display: Disable FEC when powering down encoders
     - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
     - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional
       parts
     - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
     - media: rkisp1: Fix filter mode register configuration
     - HID: multitouch: add eGalaxTouch EXC3188 support
     - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK
     - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro
     - ALSA: hda/realtek: fix LG Gram Style 14 speakers
     - gpio: aspeed-sgpio: Change the macro to support deferred probe
     - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for
       devm_regmap_init_mmio
     - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end
     - drm/amd/display: Fix GFX12 family constant checks
     - drm/amd/display: avoid dig reg access timeout on usb4 link training fail
     - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in
       max98390_i2c_probe()
     - hwmon: (dell-smm) Add support for Dell OptiPlex 7080
     - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE
     - hwmon: (f71882fg) Add F81968 support
     - HID: logitech-hidpp: Add support for Logitech K980
     - ASoC: es8328: Add error unwind in resume
     - modpost: Amend ppc64 save/restfpr symnames for -Os build
     - power: sequencing: fix missing state_lock in pwrseq_power_on() error path
     - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference
     - spi: geni-qcom: Fix abort sequence execution for serial engine errors
     - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe
     - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx
     - ALSA: mixer: oss: Add card disconnect checkpoints
     - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
     - jfs: Add missing set_freezable() for freezable kthread
     - jfs: nlink overflow in jfs_rename
     - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero
     - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
     - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H
     - wifi: rtw89: 8922a: set random mac if efuse contains zeroes
     - wifi: rtw89: ser: enable error IMR after recovering from L1
     - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
     - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band
       data
     - dm: replace -EEXIST with -EBUSY
     - dm: remove fake timeout to avoid leak request
     - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency
     - net: wwan: mhi: Add network support for Foxconn T99W760
     - wifi: libertas: fix WARNING in usb_tx_block
     - [amd64] iommu/amd: move wait_on_sem() out of spinlock
     - wifi: rtw89: mac: correct page number for CSI response
     - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode
     - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1
     - wifi: ath11k: Fix failure to connect to a 6 GHz AP
     - wifi: ath12k: fix preferred hardware mode calculation
     - wifi: cfg80211: allow only one NAN interface, also in multi radio
     - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}()
     - ipv6: annotate data-races over sysctl.flowlabel_reflect
     - ipv6: exthdrs: annotate data-race over multiple sysctl
     - ext4: mark group add fast-commit ineligible
     - ext4: move ext4_percpu_param_init() before ext4_mb_init()
     - ext4: mark group extend fast-commit ineligible
     - ext4: use reserved metadata blocks when splitting extent on endio
     - netfilter: nf_conntrack: Add allow_clash to generic protocol handler
     - netfilter: xt_tcpmss: check remaining length before reading optlen
     - net: usb: r8152: fix transmit queue timeout
     - wifi: iwlwifi: mvm: check the validity of noa_len
     - wifi: rtw89: fix unable to receive probe responses under MLO connection
     - wifi: rtw89: 8922a: add digital compensation for 2GHz
     - net/rds: No shortcut out of RDS_CONN_ERROR
     - ext4: propagate flags to convert_initialized_extent()
     - gro: change the BUG_ON() in gro_pull_from_frag0()
     - ipv4: igmp: annotate data-races around idev->mr_maxdelay
     - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits
     - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power()
     - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()
     - ipv4: fib: Annotate access to struct fib_alias.fa_state.
     - Bluetooth: btusb: Add support for MediaTek7920 0489:e158
     - Bluetooth: hci_conn: Set link_policy on incoming ACL connections
     - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
     - Bluetooth: btusb: Add new VID/PID for RTL8852CE
     - Bluetooth: btusb: Add device ID for Realtek RTL8761BU
     - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
     - net: sfp: add quirk for Lantech 8330-265D
     - wifi: rtw89: pci: restore LDO setting after device resume
     - wifi: ath10k: fix lock protection in
       ath10k_wmi_event_peer_sta_ps_state_chg()
     - bnxt_en: Allow ntuple filters for drops
     - net: usb: sr9700: remove code to drive nonexistent multicast filter
     - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16
     - net/rds: Clear reconnect pending bit
     - PCI: Mark ASM1164 SATA controller to avoid bus reset
     - PCI/AER: Clear stale errors on reporting agents upon probe
     - PCI: Fix pci_slot_lock () device locking
     - PCI: Enable ACS after configuring IOMMU for OF platforms
     - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
     - PCI: Mark Nvidia GB10 to avoid bus reset
     - myri10ge: avoid uninitialized variable use
     - nfc: nxp-nci: remove interrupt trigger type
     - RDMA/rtrs-clt: For conn rejection use actual err number
     - ata: libata: avoid long timeouts on hot-unplugged SATA DAS
     - hisi_acc_vfio_pci: update status after RAS error
     - scsi: buslogic: Reduce stack usage
     - vhost: fix caching attributes of MMIO regions by setting them explicitly
     - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event
     - [riscv64] vector: init vector context with proper vlenb
     - tracing: Fix false sharing in hwlat get_sample()
     - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX
       channel is uninitialized
     - mailbox: pcc: Remove spurious IRQF_ONESHOT usage
     - mailbox: imx: Skip the suspend flag for i.MX7ULP
     - mailbox: sprd: mask interrupts that are not handled
     - remoteproc: mediatek: Break lock dependency to `prepare_lock`
     - mailbox: sprd: clear delivery flag before handling TX done
     - clk: microchip: core: correct return value on *_get_parent()
     - HID: i2c-hid: Add FocalTech FT8112
     - 9p/xen: protect xen_9pfs_front_free against concurrent calls
     - dmaengine: stm32-dma3: use module_platform_driver
     - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
     - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
     - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure
     - serial: 8250_dw: handle clock enable errors in runtime_resume
     - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs
     - fpga: of-fpga-region: Fail if any bridge is missing
     - most: core: fix resource leak in most_register_interface error paths
     - dmaengine: sun6i: Choose appropriate burst length under maxburst
     - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings
     - phy: ti: phy-j721e-wiz: restore mux selection during resume
     - phy: cadence-torrent: restore parent clock for refclk during resume
     - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
     - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66
     - usb: gadget: f_fs: fix DMA-BUF OUT queues
     - usb: gadget: f_fs: Fix ioctl error handling
     - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
     - staging: rtl8723bs: fix memory leak on failure path
     - serial: 8250: 8250_omap.c: Add support for handling UART error conditions
     - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA
       termination is done
     - fix it87_wdt early reboot by reporting running timer
     - [arm*] binder: don't use %pK through printk
     - watchdog: imx7ulp_wdt: handle the nowayout option
     - phy: mvebu-cp110-utmi: fix dr_mode property read from dts
     - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature
     - Revert "mfd: da9052-spi: Change read-mask to write-mask"
     - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
     - iio: Use IRQF_NO_THREAD
     - iio: magnetometer: Remove IRQF_ONESHOT
     - fs: ntfs3: check return value of indx_find to avoid infinite loop
     - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent
       metadata
     - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
     - fs/ntfs3: drop preallocated clusters for sparse and compressed files
     - fs/ntfs3: avoid calling run_get_entry() when run == NULL in
       ntfs_read_run_nb_ra()
     - ceph: supply snapshot context in ceph_uninline_data()
     - libceph: define and enforce CEPH_MAX_KEY_LEN
     - thermal: int340x: Fix sysfs group leak on DLVR registration failure
     - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90
     - include: uapi: netfilter_bridge.h: Cover for musl libc
     - drm/amd/display: Fix writeback on DCN 3.2+
     - drm/amd/display: Fix system resume lag issue
     - drm/amd/display: Avoid updating surface with the same surface under MPO
     - drm/amdgpu: Adjust usleep_range in fence wait
     - ALSA: usb-audio: Update the number of packets properly at receiving
     - drm/amdgpu: Add HAINAN clock adjustment
     - drm/amd/display: bypass post csc for additional color spaces in dal
     - spi: spidev: fix lock inversion between spi_lock and buf_lock
     - drm/radeon: Add HAINAN clock adjustment
     - ALSA: usb-audio: Add sanity check for OOB writes at silencing
     - btrfs: replace BUG() with error handling in __btrfs_balance()
     - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16)
     - drm/amd/display: Remove conditional for shaper 3DLUT power-on
     - rtc: zynqmp: correct frequency value
     - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
     - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
     - xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
     - xfrm: skip templates check for packet offload tunnel mode
     - ipmi: ipmb: initialise event handler read bytes
     - xfrm: always flush state and policy upon NETDEV_UNREGISTER event
     - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)
     - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
     - net: usb: lan78xx: scan all MDIO addresses on LAN7801
     - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()
     - net: ethernet: xscale: Check for PTP support properly
     - bnxt_en: Fix RSS context delete logic
     - bnxt_en: Fix deleting of Ntuple filters
     - wifi: cfg80211: wext: fix IGTK key ID off-by-one
     - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
     - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ
     - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short
     - Bluetooth: hci_qca: Cleanup on all setup failures
     - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on
       L2CAP_ECRED_CONN_REQ
     - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
     - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)
     - kcm: fix zero-frag skb in frag_list on partial sendmsg error
     - tipc: fix duplicate publication key in tipc_service_insert_publ()
     - RDMA/core: Fix stale RoCE GIDs during netdev events at registration
     - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
     - RDMA/efa: Fix typo in efa_alloc_mr()
     - net: usb: pegasus: enable basic endpoint checking
     - RDMA/umem: Fix double dma_buf_unpin in failure path
     - net/mlx5: DR, Fix circular locking dependency in dump
     - net/mlx5: E-switch, Clear legacy flag when moving to switchdev
     - net/mlx5: Fix missing devlink lock in SRIOV enable error path
     - net/mlx5e: Separate address related variables to be in struct
     - net/mlx5e: Support routed networks during IPsec MACs initialization
     - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
     - net: consume xmit errors of GSO frames
     - dpaa2-switch: validate num_ifs to prevent out-of-bounds write
     - netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
     - rpmsg: core: fix race in driver_override_show() and use core helper
     - [arm64] clk: renesas: rzg2l: Fix intin variable size
     - [arm64] clk: renesas: rzg2l: Select correct div round macro
     - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes
       update
     - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes
       controls
     - [amd64] ASoC: SOF: ipc4-control: Use the correct size for
       scontrol->ipc_control_data
     - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date
     - fpga: dfl: use subsys_initcall to allow built-in drivers to be added
     - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global
       IRQ' is supported"
     - phy: qcom: edp: Make the number of clocks flexible
     - dm-verity: correctly handle dm_bufio_client_create() failure
     - media: mediatek: encoder: Fix uninitialized scalar variable issue
     - media: mtk-mdp: Fix error handling in probe function
     - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
     - media: chips-media: wave5: Fix kthread worker destruction in polling mode
     - media: chips-media: wave5: Fix device cleanup order to prevent kernel
       panic
     - media: verisilicon: AV1: Fix enable cdef computation
     - media: verisilicon: AV1: Fix tx mode bit setting
     - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs
     - [armhf] omap2: Fix reference count leaks in omap_control_init()
     - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to
       unsupported PV MSR
     - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3()
       succeeding
     - [arm64] Disable branch profiling for all arm64 code
     - HID: hid-pl: handle probe errors
     - HID: magicmouse: Do not crash on missing msc->input
     - HID: prodikeys: Check presence of pm->input_ep82
     - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
     - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on
     - media: amphion: Drop min_queued_buffers assignment
     - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()
     - media: verisilicon: AV1: Set IDR flag for intra_only frame type
     - media: radio-keene: fix memory leak in error path
     - media: cx88: Add missing unmap in snd_cx88_hw_params()
     - media: cx23885: Add missing unmap in snd_cx23885_hw_params()
     - media: cx25821: Add missing unmap in snd_cx25821_hw_params()
     - media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
     - media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
     - media: i2c: ov01a10: Fix the horizontal flip control
     - media: i2c: ov01a10: Fix reported pixel-rate value
     - media: i2c: ov01a10: Fix analogue gain range
     - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls
     - media: i2c: ov01a10: Fix passing stream instead of pad to
       v4l2_subdev_state_get_format()
     - media: i2c: ov01a10: Fix test-pattern disabling
     - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
     - media: ccs: Avoid possible division by zero
     - media: i2c: ov5647: Initialize subdev before controls
     - media: i2c: ov5647: Correct pixel array offset
     - media: i2c: ov5647: Correct minimum VBLANK value
     - media: i2c: ov5647: Sensor should report RAW color space
     - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode
     - media: ccs: Fix setting initial sub-device state
     - media: i2c: ov5647: use our own mutex for the ctrl lock
     - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c
     - media: ipu6: Fix RPM reference leak in probe error paths
     - [amd64] platform/x86: ISST: Add missing write block check
     - dm-integrity: fix a typo in the code for write/discard race
     - dm: clear cloned request bio pointer when last clone bio completes
     - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure
     - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
     - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
     - bus: omap-ocp2scp: fix OF populate on driver rebind
     - clk: clk-apple-nco: Add "apple,t8103-nco" compatible
     - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON
       definition
     - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled
     - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop
     - media: i2c: ov01a10: Fix digital gain range
     - clk: tegra: tegra124-emc: Fix potential memory leak in
       tegra124_clk_register_emc()
     - [s390x] pci: Handle futile config accesses of disabled devices directly
     - reset: gpio: suppress bind attributes in sysfs
     - dm-integrity: fix recalculation in bitmap mode
     - dm-unstripe: fix mapping bug when there are multiple targets in a table
     - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro
     - media: venus: vdec: fix error state assignment for zero bytesused
     - media: venus: vdec: restrict EOS addr quirk to IRIS2 only
     - drm: of: drm_of_panel_bridge_remove(): fix device_node leak
     - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations
     - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs
     - drm/buddy: Prevent BUG_ON by validating rounded allocation
     - drm/bridge: anx7625: Fix invalid EDID size
     - xfs: mark data structures corrupt on EIO and ENODATA
     - xfs: remove xfs_attr_leaf_hasname
     - media: verisilicon: AV1: Fix tile info buffer size
     - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in
       scalable mode
     - mfd: core: Add locking around 'mfd_of_node_list'
     - mfd: qcom-pm8xxx: Fix OF populate on driver rebind
     - mfd: omap-usb-host: Fix OF populate on driver rebind
     - iio: accel: adxl380: Avoid reading more entries than present in FIFO
     - xfs: delete attr leaf freemap entries when empty
     - xfs: fix freemap adjustments when adding xattrs to leaf blocks
     - xfs: fix the xattr scrub to detect freemap/entries array collisions
     - xfs: fix remote xattr valuelblk check
     - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
     - PCI: endpoint: Fix swapped parameters in
       pci_{primary/secondary}_epc_epf_unlink() functions
     - pinctrl: intel: Add code name documentation
     - xfs: only call xf{array,blob}_destroy if we have a valid pointer
     - xfs: check return value of xchk_scrub_create_subord
     - xfs: check for deleted cursors when revalidating two btrees
     - md/bitmap: fix GPF in write_page caused by resize race
     - nfsd: fix return error code for nfsd_map_name_to_[ug]id
     - nvmem: Drop OF node reference on nvmem_add_one_cell() failure
     - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer
     - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
     - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
     - io_uring/net: don't continue send bundle if poll was required for retry
     - bus: fsl-mc: fix an error handling in fsl_mc_device_add()
     - dm mpath: make pg_init_delay_msecs settable
     - [arm64] poe: fix stale POR_EL0 values for ptrace
     - tools: Fix bitfield dependency failure
     - vhost: move vdpa group bound check to vhost_vdpa
     - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups()
     - iio: gyro: itg3200: Fix unchecked return value in read_raw
     - mtd: spinand: Disable continuous read during probe
     - mm/highmem: fix __kmap_to_page() build error
     - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
     - ocfs2: fix reflink preserve cleanup issue
     - kexec: derive purgatory entry from symbol
     - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling
       SR-IOV"
     - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
     - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
     - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
     - btrfs: continue trimming remaining devices on failure
     - remoteproc: imx_rproc: Fix invalid loaded resource table detection
     - perf/arm-cmn: Reject unsupported hardware configurations
     - scsi: ufs: core: Flush exception handling work when RPM level is zero
     - mm/slab: use unsigned long for orig_size to ensure proper metadata align
     - PCI: dwc: Fix msg_atu_index assignment
     - usb: dwc3: gadget: Move vbus draw to workqueue context
     - usb: dwc2: fix resume failure if dr_mode is host
     - mtd: rawnand: pl353: Fix software ECC support
     - tipc: fix RCU dereference race in tipc_aead_users_dec()
     - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
     - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error
       path
     - PCI: Fix pci_slot_trylock() error handling
     - staging: rtl8723bs: fix null dereference in find_network
     - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format
     - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()
     - cifs: Fix locking usage for tcon fields
     - ceph: supply snapshot context in ceph_zero_partial_object()
     - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0
     - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID
     - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
     - octeontx2-af: CGX: fix bitmap leaks
     - net: ti: icssg-prueth: Add optional dependency on HSR
     - net: macb: Fix tx/rx malfunction after phy link down and up
     - tracing: Fix to set write permission to per-cpu buffer_size_kb
     - io_uring/filetable: clamp alloc_hint to the configured alloc range
     - drm/amd/display: Increase DCN35 SR enter/exit latency
     - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
     - procfs: fix possible double mmput() in do_procmap_query()
     - net: intel: fix PCI device ID conflict between i40e and ipw2200
     - atm: fore200e: fix use-after-free in tasklets during device removal
     - function_graph: Restore direct mode when callbacks drop to one
     - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
     - mm: numa_memblks: Identify the accurate NUMA ID of CFMW
     - fbcon: check return value of con2fb_acquire_newinfo()
     - fbdev: vt8500lcdfb: fix missing dma_free_coherent()
     - fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
     - fbdev: ffb: fix corrupted video output on Sun FFB1
     - fbcon: Remove struct fbcon_display.inverse
     - cifs: some missing initializations on replay
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
     - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
     - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
     - [amd64] x86/kexec: Copy ACPI root pointer address from config table
     - [arm64] Force the use of CNTVCT_EL0 in __delay()
     - drm/amdgpu: keep vga memory on MacBooks with switchable graphics
     - net: nfc: nci: Fix parameter validation for packet data
     - tracing: ring-buffer: Fix to check event length before using
     - fgraph: Do not call handlers direct when not using ftrace_ops
     - tracing: Fix checking of freed trace_event_file for hist files
     - tracing: Wake up poll waiters for hist files when removing an event
     - NTB: ntb_transport: Fix too small buffer for debugfs_name
     - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl()
     - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros
     - xfs: fix copy-paste error in previous fix
     - [arm64] Fix sampling the "stable" virtual counter in preemptible section
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76
     - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec
       buffer"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77
     - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release
     - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
     - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
     - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host
     - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity
       setting
     - scsi: lpfc: Properly set WC for DPP mapping
     - scsi: pm8001: Fix use-after-free in pm8001_queue_command()
     - ALSA: scarlett2: Fix redeclaration of loop variable
     - ALSA: scarlett2: Fix DSP filter control array handling
     - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices
     - [amd64] x86/fred: Correct speculative safety in fred_extint()
     - rseq: Clarify rseq registration rseq_size bound check comment
     - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in
       update_cpumasks_hier()
     - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume
     - ALSA: usb-audio: Cap the packet size pre-calculations
     - ALSA: usb-audio: Use inclusive terms
     - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
     - [s390x] idle: Fix cpu idle exit cpu time accounting
     - [s390x] vtime: Fix virtual timer forwarding
     - PCI: endpoint: Introduce pci_epc_function_is_valid()
     - PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
     - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr()
       operation
     - [arm64] PCI: dwc: ep: Use align addr function for
       dw_pcie_ep_raise_{msi,msix}_irq()
     - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
     - drm/amdgpu: Unlock a mutex before destroying it
     - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
     - drm/amdgpu: Fix locking bugs in error paths
     - ALSA: pci: hda: use snd_kcontrol_chip()
     - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()
     - btrfs: fix incorrect key offset in error message in
       check_dev_extent_item()
     - btrfs: fix objectid value in error message in check_extent_data_ref()
     - btrfs: fix warning in scrub_verify_one_metadata()
     - btrfs: print correct subvol num if active swapfile prevents deletion
     - btrfs: fix compat mask in error messages in btrfs_check_features()
     - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent
       atomic tearing
     - bpf: Fix stack-out-of-bounds write in devmap
     - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value
     - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again
     - [arm64] memory: mtk-smi: fix device leaks on common probe
     - [arm64] memory: mtk-smi: fix device leak on larb probe
     - resource: Add resource set range and size helpers
     - PCI: Use resource_set_range() that correctly sets ->end
     - media: tegra-video: Fix memory leak in __tegra_channel_try_format()
     - media: dw9714: move power sequences to dedicated functions
     - media: dw9714: add support for powerdown pin
     - media: dw9714: Fix powerup sequence
     - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from
       vcpu_block()
     - ata: libata-scsi: Refactor ata_scsi_simulate()
     - ata: libata-scsi: Refactor ata_scsiop_read_cap()
     - ata: libata-scsi: Refactor ata_scsiop_maint_in()
     - ata: libata-scsi: Document all VPD page inquiry actors
     - ata: libata-scsi: Remove struct ata_scsi_args
     - ata: libata: Remove ATA_DFLAG_ZAC device flag
     - ata: libata: Introduce ata_port_eh_scheduled()
     - ata: libata-scsi: avoid Non-NCQ command starvation
     - [arm64,armhf] drm/tegra: dsi: fix device leak on probe
     - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT
     - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting
       I/O
     - mailbox: don't protect of_parse_phandle_with_args with con_mutex
     - mailbox: sort headers alphabetically
     - mailbox: remove unused header files
     - mailbox: Use dev_err when there is error
     - mailbox: Use guard/scoped_guard for con_mutex
     - mailbox: Allow controller specific mapping using fwnode
     - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
     - ext4: add ext4_try_lock_group() to skip busy groups
     - ext4: factor out __ext4_mb_scan_group()
     - ext4: factor out ext4_mb_might_prefetch()
     - ext4: factor out ext4_mb_scan_group()
     - ext4: convert free groups order lists to xarrays
     - ext4: refactor choose group to scan group
     - ext4: implement linear-like traversal across order xarrays
     - ext4: always allocate blocks only from groups inode can use
     - workqueue: Add system_percpu_wq and system_dfl_wq
     - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq
     - Input: synaptics_i2c - guard polling restart in resume
     - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device
       without scalable mode
     - [arm64] dts: rockchip: Fix rk356x PCIe range mappings
     - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings
     - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate()
     - ima: kexec: silence RCU list traversal warning
     - ima: rename variable the seq_file "file" to "ima_kexec_file"
     - ima: define and call ima_alloc_kexec_file_buf()
     - kexec: define functions to map and unmap segments
     - ima: kexec: define functions to copy IMA log at soft boot
     - ima: verify the previous kernel's IMA buffer lies in addressable RAM
     - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()
     - drm/exynos: vidi: fix to avoid directly dereferencing user pointer
     - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()
     - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member
       variables related to memory alloc/free (CVE-2026-23227)
     - uprobes: switch to RCU Tasks Trace flavor for better performance
     - uprobes: Fix incorrect lockdep condition in filter_chain()
     - btrfs: drop unused parameter fs_info from do_reclaim_sweep()
     - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
     - btrfs: fix reclaimed bytes accounting after automatic block group reclaim
     - btrfs: fix periodic reclaim condition
     - btrfs: zoned: fix alloc_offset calculation for partly conventional block
       groups
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
     - btrfs: zoned: fixup last alloc pointer after extent removal for DUP
     - btrfs: zoned: fix stripe width calculation
     - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros
     - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10
     - [riscv64] usb: cdns3: remove redundant if branch
     - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()
     - [riscv64] usb: cdns3: fix role switching during resume
     - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()
       (Closes: #1130930)
     - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
     - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization
       induced race
     - ksmbd: check return value of xa_store() in krb5_authenticate
     - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226)
     - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)
     - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)
     - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
     - net: arcnet: com20020-pci: fix support for 2.5Mbit cards
     - eventpoll: Fix integer overflow in ep_loop_check_proc()
     - namespace: fix proc mount iteration
     - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
     - nfc: pn533: properly drop the usb interface reference on disconnect
     - net: usb: kaweth: validate USB endpoints
     - net: usb: kalmia: validate USB endpoints
     - net: usb: pegasus: validate USB endpoints
     - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a
       message
     - can: usb: f81604: correctly anchor the urb in the read bulk callback
     - can: ucan: Fix infinite loop from zero-length messages
     - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
     - can: usb: f81604: handle short interrupt urb messages properly
     - can: usb: f81604: handle bulk write errors properly
     - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
     - [amd64] x86/efi: defer freeing of boot services memory
     - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password
       data
     - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes
     - ALSA: usb-audio: Use correct version for UAC3 header validation
     - wifi: radiotap: reject radiotap with unknown bits
     - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
     - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
     - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
     - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
     - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
     - net/sched: ets: fix divide by zero in the offload path
     - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
     - tracing: Fix WARN_ON in tracing_buffers_mmap_close
     - scsi: target: Fix recursive locking in __configfs_open_file()
     - Squashfs: check metadata block offset is within range
     - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
     - drbd: fix null-pointer dereference on local read error
     - smb: client: fix cifs_pick_channel when channels are equally loaded
     - smb: client: fix broken multichannel with krb5+signing
     - smb: client: Don't log plaintext credentials in cifs_set_cifscreds
     - scsi: core: Fix refcount leak for tagset_refcnt
     - xattr: switch to CLASS(fd) (CVE-2024-14027)
     - btrfs: always fallback to buffered write if the inode requires checksum
     - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with
       clang < 18
     - nvme: fix admin queue leak on controller reset
     - hwmon: (aht10) Add support for dht20
     - hwmon: (aht10) Fix initialization commands for AHT20
     - pinctrl: equilibrium: rename irq_chip function callbacks
     - pinctrl: equilibrium: fix warning trace on load
     - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
     - HID: multitouch: add quirks for Lenovo Yoga Book 9i
     - HID: multitouch: new class MT_CLS_EGALAX_P80H84
     - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
     - hwmon: (it87) Check the it87_lock() return value
     - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue
       numbering
     - i40e: Fix preempt count leak in napi poll tracepoint
     - e1000e: clear DPG_EN after reset to avoid autonomous power-gating
     - drm/solomon: Fix page start when updating rectangle in page addressing
       mode
     - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling
       in ALE table
     - xsk: Get rid of xdp_buff_xsk::xskb_list_node
     - xsk: s/free_list_node/list_node/
     - xsk: Fix fragment node deletion to prevent buffer leak
     - xsk: Fix zero-copy AF_XDP fragment drop
     - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
     - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup
       when link speed is not 1G
     - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
     - can: bcm: fix locking for bcm_op runtime updates
     - can: mcp251x: fix deadlock in error path of mcp251x_open
     - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
     - drm/xe: Do not preempt fence signaling CS instructions
     - kunit: tool: copy caller args in run_kernel to prevent mutation
     - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
     - octeon_ep: Relocate counter updates before NAPI
     - octeon_ep: avoid compiler and IQ/OQ reordering
     - octeon_ep_vf: Relocate counter updates before NAPI
     - octeon_ep_vf: avoid compiler and IQ/OQ reordering
     - wifi: cw1200: Fix locking in error paths
     - wifi: wlcore: Fix a locking bug
     - wifi: mt76: mt7996: Fix possible oob access in
       mt7996_mac_write_txwi_80211()
     - wifi: mt76: mt7925: Fix possible oob access in
       mt7925_mac_write_txwi_80211()
     - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
     - indirect_call_wrapper: do not reevaluate function pointer
     - net/rds: Fix circular locking dependency in rds_tcp_tune
     - xen/acpi-processor: fix _CST detection using undersized evaluation buffer
     - iavf: fix netdev->max_mtu to respect actual hardware limit
     - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
     - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
     - smb/client: fix buffer size for smb311_posix_qinfo in
       SMB311_posix_query_info()
     - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
     - net: ipv4: fix ARM64 alignment fault in multipath hash seed
     - amd-xgbe: fix sleep while atomic on suspend/resume
     - drm/sched: Fix kernel-doc warning for drm_sched_job_done()
     - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
     - drm/xe/reg_sr: Fix leak on xa_store failure
     - nvme: reject invalid pr_read_keys() num_keys values
     - nvme: fix memory allocation in nvme_pr_read_keys()
     - hwmon: (max6639) : Configure based on DT property
     - hwmon: (max6639) fix inverted polarity
     - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless
       qdiscs
     - net: nfc: nci: Fix zero-length proprietary notifications
     - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()
     - nfc: nci: free skb on nci_transceive early error paths
     - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
     - nfc: rawsock: cancel tx_work before socket teardown
     - net: stmmac: Fix error handling in VLAN add and delete paths
     - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
     - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in
       mtk_xdp_setup()
     - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
     - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
     - net/sched: act_ife: Fix metalist update behavior
     - xdp: use modulo operation to calculate XDP frag tailroom
     - xsk: introduce helper to determine rxq->frag_size
     - i40e: fix registering XDP RxQ info
     - i40e: use xdp.frame_sz as XDP RxQ info frag_size
     - xdp: produce a warning when calculated tailroom is negative
     - tracing: Add NULL pointer check to trigger_data_free()
     - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared
       blocks
     - ext4: fix potential null deref in ext4_mb_init()
     - ata: libata-core: fix cancellation of a port deferred qc work
     - ata: libata-eh: correctly handle deferred qc timeouts
     - ata: libata: cancel pending work after clearing deferred_qc
     - ata: libata-eh: Fix detection of deferred qc timeouts
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78
     - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
     - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35
     - scsi: mpi3mr: Add NULL checks when resetting request and reply queues
     - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter
     - unshare: fix unshare_fs() handling
     - wifi: mac80211: set default WMM parameters on all links
     - ACPI: OSI: Add DMI quirk for Acer Aspire One D255
     - scsi: ses: Fix devices attaching to different hosts
     - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table
     - [amd64] ASoC: cs42l43: Report insert for exotic peripherals
     - scsi: ufs: core: Fix possible NULL pointer dereference in
       ufshcd_add_command_trace()
     - scsi: ufs: core: Fix shift out of bounds when MAXQ=32
     - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0
     - drm/amdgpu/vcn5: Add SMU dpm interface type
     - ALSA: usb-audio: Check max frame size for implicit feedback mode, too
     - kexec: Consolidate machine_kexec_mask_interrupts() implementation
     - kexec: Include kernel-end even without crashkernel
     - [powerpc*] kexec/core: use big-endian types for crash variables
     - [powerpc*] crash: adjust the elfcorehdr size
     - remoteproc: sysmon: Correct subsys_name_len type in QMI request
     - remoteproc: mediatek: Unprepare SCP clock during system suspend
     - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix
     - smb/server: Fix another refcount leak in smb2_open()
     - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
     - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi
       registers
     - xprtrdma: Decrement re_receiving on the early exit paths
     - btrfs: hold space_info->lock when clearing periodic reclaim ready
     - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
     - perf disasm: Fix off-by-one bug in outside check
     - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi
     - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14
     - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states
     - net/mlx5: IFC updates for disabled host PF
     - net/mlx5: Query to see if host PF is disabled
     - net/mlx5: Fix deadlock between devlink lock and esw->wq
     - net/mlx5: Fix crash when moving to switchdev mode
     - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
     - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL
       slave xmit (CVE-2026-23277)
     - ASoC: soc-core: drop delayed_work_pending() check before flush
     - ASoC: soc-core: flush delayed work before removing DAIs and widgets
     - ASoC: simple-card-utils: use __free(device_node) for device node
     - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays
     - net: sfp: improve Huawei MA5671a fixup
     - serial: caif: hold tty->link reference in ldisc_open and ser_release
     - bnxt_en: Fix RSS table size check when changing ethtool channels
     - mctp: i2c: fix skb memory leak in receive path
     - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return
       value
     - bonding: add ESP offload features when slaves support
     - bonding: Correctly support GSO ESP offload
     - net: add a common function to compute features for upper devices
     - bonding: use common function to compute the features
     - bonding: fix type confusion in bond_setup_by_slave()
     - mctp: route: hold key->lock in mctp_flow_prepare_output()
     - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation
     - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN
       disabled
     - xdp: allow attaching already registered memory model to xdp_rxq_info
     - xdp: register system page pool as an XDP memory model
     - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)
     - netfilter: nf_tables: always walk all pending catchall elements
       (CVE-2026-23278)
     - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
     - netfilter: x_tables: guard option walkers against 1-byte tail reads
     - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
     - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
     - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
       (CVE-2026-23274)
     - perf annotate: Fix hashmap__new() error checking
     - regulator: pca9450: Correct interrupt type
     - perf ftrace: Fix hashmap__new() error checking
     - sched: idle: Make skipping governor callbacks more consistent
     - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
     - nvme-pci: Fix race bug in nvme_poll_irqdisable()
     - i40e: fix src IP mask checks and memcpy argument names in cloud filter
     - e1000/e1000e: Fix leak in DMA error cleanup
     - net: bcmgenet: fix broken EEE by converting to phylib-managed state
     - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()
     - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock
       acquisition
     - ASoC: detect empty DMI strings
     - drm/amdkfd: Unreserve bo if queue update failed
     - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition
     - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt
       status
     - net: prevent NULL deref in ip[6]tunnel_xmit()
     - iio: imu: inv-mpu9150: fix irq ack preventing irq storms
     - usb: gadget: f_mass_storage: Fix potential integer overflow in
       check_command_size_in_blocks()
     - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on"
     - cgroup: fix race between task migration and iteration
     - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
     - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer
       interfaces
     - net: usb: lan78xx: fix silent drop of packets with checksum errors
     - net: usb: lan78xx: fix TX byte statistics for small packets
     - net: usb: lan78xx: skip LTM configuration for LAN7850
     - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA
     - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
       in-kernel APIC
     - USB: add QUIRK_NO_BOS for video capture several devices
     - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
     - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
     - usb: xhci: Fix memory leak in xhci_disable_slot()
     - usb: xhci: Prevent interrupt storm on host controller error (HCE)
     - usb: yurex: fix race in probe
     - usb: dwc3: pci: add support for the Intel Nova Lake -H
     - usb: misc: uss720: properly clean up reference in uss720_probe()
     - usb: core: don't power off roothub PHYs if phy_set_mode() fails
     - usb: cdc-acm: Restore CAP_BRK functionnality to CH343
     - usb: roles: get usb role switch from parent only for usb-b-connector
     - usb: typec: altmode/displayport: set displayport signaling rate in
       configure message
     - USB: usbcore: Introduce usb_bulk_msg_killable()
     - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
     - USB: core: Limit the length of unkillable synchronous timeouts
     - usb: class: cdc-wdm: fix reordering issue in read code path
     - usb: mdc800: handle signal and read racing
     - usb: image: mdc800: kill download URB on timeout
     - mm/tracing: rss_stat: ensure curr is false from kthread context
     - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
     - mm/kfence: disable KFENCE upon KASAN HW tags enablement
     - mmc: core: Avoid bitfield RMW for claim/retune flags
     - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and
       start
     - tipc: fix divide-by-zero in tipc_sk_filter_connect()
     - kprobes: avoid crash when rmmod/insmod after ftrace killed
     - ceph: add a bunch of missing ceph_path_info initializers
     - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
     - libceph: reject preamble if control segment is empty
     - libceph: prevent potential out-of-bounds reads in process_message_header()
     - libceph: Use u32 for non-negative values in ceph_monmap_decode()
     - libceph: admit message frames only in CEPH_CON_S_OPEN state
     - ceph: fix i_nlink underrun during async unlink
     - ceph: fix memory leaks in ceph_mdsc_build_path()
     - time/jiffies: Mark jiffies_64_to_clock_t() notrace
     - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
     - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
     - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset
       spec
     - scsi: hisi_sas: Use macro instead of magic number
     - scsi: hisi_sas: Fix NULL pointer exception during user_scan()
     - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17
     - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
     - Revert "tcpm: allow looking for role_sw device in the main node"
     - drm/amd: Disable MES LR compute W/A
     - drm/bridge: samsung-dsim: Fix memory leak in error path
     - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used
     - [s390x] pfault: Fix virtual vs physical address confusion
     - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().
     - device property: Allow secondary lookup in fwnode_get_next_child_node()
     - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the
       range the ITS supports
     - btrfs: fix chunk map leak in btrfs_map_block() after
       btrfs_chunk_map_num_copies()
     - ice: reintroduce retry mechanism for indirect AQ
     - ixgbevf: fix link setup issue
     - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
     - staging: rtl8723bs: fix potential out-of-bounds read in
       rtw_restruct_wmm_ie
     - media: dvb-net: fix OOB access in ULE extension header tables
     - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds
     - ice: fix retry for AQ command 0x06EE
     - tracing: Fix syscall events activation by ensuring refcount hits zero
     - net/tcp-ao: Fix MAC comparison to be constant-time
     - batman-adv: Avoid double-rtnl_lock ELP metric worker
     - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
     - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
     - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
     - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults
     - pmdomain: bcm: bcm2835-power: Fix broken reset status read
     - ata: libata-core: Disable LPM on ST1000DM010-2EP102
     - drm/amd/display: Fallback to boot snapshot for dispclk
     - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
     - smb: server: fix use-after-free in smb2_open()
     - ksmbd: fix use-after-free by using call_rcu() for oplock_info
     - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
     - net: ncsi: fix skb leak in error paths
     - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
     - net: dsa: microchip: Fix error path in PTP IRQ setup
     - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x
     - drm/amdgpu: Fix use-after-free race in VM acquire
     - drm/amd: Set num IP blocks to 0 if discovery fails
     - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
     - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length
     - [arm64] drm/msm: Fix dma_free_attrs() buffer size
     - tracing: Fix enabling multiple events on the kernel command line and
       bootconfig
     - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
     - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size
     - cifs: make default value of retrans as zero
     - xfs: fix returned valued from xfs_defer_can_append
     - xfs: fix undersized l_iclog_roundoff values
     - xfs: ensure dquot item is deleted from AIL only after log shutdown
     - [s390x] dasd: Move quiesce state with pprc swap
     - [s390x] dasd: Copy detected format information to secondary device
     - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
     - scsi: core: Fix error handling for scsi_alloc_sdev()
     - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so
     - lib/bootconfig: fix snprintf truncation check in
       xbc_node_compose_key_after()
     - lib/bootconfig: check bounds before writing in __xbc_open_brace()
     - smb: client: fix atomic open with O_DIRECT & O_SYNC
     - smb: client: fix in-place encryption corruption in SMB2_write()
     - smb: client: fix iface port assignment in parse_server_interfaces
     - btrfs: fix transaction abort on file creation due to name hash collision
     - btrfs: fix transaction abort on set received ioctl due to item overflow
     - btrfs: abort transaction on failure to update root in the received subvol
       ioctl
     - iio: dac: ds4424: reject -128 RAW value
     - iio: frequency: adf4377: Fix duplicated soft reset mask
     - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
     - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
     - iio: potentiometer: mcp4131: fix double application of wiper shift
     - iio: chemical: bme680: Fix measurement wait duration calculation
     - iio: buffer: Fix wait_queue not being removed
     - iio: gyro: mpu3050-core: fix pm_runtime error handling
     - iio: gyro: mpu3050-i2c: fix pm_runtime error handling
     - iio: imu: inv_icm42600: fix odr switch to the same value
     - iio: imu: inv_icm42600: fix odr switch when turning buffer off
     - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
     - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
     - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
     - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
     - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD
     - net/tcp-md5: Fix MAC comparison to be constant-time
     - ksmbd: Compare MACs in constant time (CVE-2026-23364)
     - smb: client: Compare MACs in constant time
     - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
     - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths
     - spi: cadence-quadspi: Implement refcount to handle unbind during busy
       (CVE-2025-40005)
     - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
       (CVE-2026-23386)
     - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
       (CVE-2026-23368)
     - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests
     - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data
       (Closes: #1127612)
     - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281)
     - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids
     - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events
     - mptcp: pm: in-kernel: always mark signal+subflow endp as used
     - mptcp: pm: avoid sending RM_ADDR over same subflow
     - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
     - kbuild: Leave objtool binary around with 'make clean'
     - net/sched: act_gate: snapshot parameters with RCU on replace
       (CVE-2026-23245)
     - xfs: Fix error pointer dereference
     - can: gs_usb: gs_can_open(): always configure bitrates before starting
       device
     - cleanup: Provide retain_and_null_ptr()
     - usb: gadget: f_ncm: Fix net_device lifecycle with device_move
     - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
     - [amd64] KVM: SVM: Limit AVIC physical max index based on configured
       max_vcpu_ids
     - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC
     - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is
       (de)activated
     - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros
     - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support
     - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal
       phase support
     - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook()
     - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess
     - mm/page_alloc: forward the gfp flags from alloc_contig_range() to
       post_alloc_hook()
     - mm/kfence: fix KASAN hardware tag faults during late enablement
     - nsfs: tighten permission checks for ns iteration ioctls
     - sched_ext: Disable preemption between scx_claim_exit() and kicking helper
       work
     - sched_ext: Fix starvation of scx_enable() under fair-class saturation
     - iomap: reject delalloc mappings during writeback
     - fgraph: Fix thresh_return clear per-task notrace
     - [amd64] KVM: x86: Co-locate initialization of feature MSRs in
       kvm_arch_vcpu_create()
     - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max
       configuration
     - [amd64] KVM: x86: do not allow re-enabling quirks
     - [amd64] KVM: x86: Allow vendor code to disable quirks
     - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks
     - [amd64] KVM: x86: Introduce Intel specific quirk
       KVM_X86_QUIRK_IGNORE_GUEST_PAT
     - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET
     - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
     - ksmbd: Don't log keys in SMB3 signing and encryption key generation
     - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
     - net: macb: Shuffle the tx ring before enabling tx
     - cifs: open files should not hold ref on superblock
     - xfs: fix integer overflow in bmap intent sort comparator
     - drm/xe/sync: Cleanup partially initialized sync on parse failure
     - ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
     - dm-verity: disable recursive forward error correction (CVE-2025-71161)
     - rxrpc: Fix recvmsg() unconditional requeue
     - btrfs: do not strictly require dirty metadata threshold for metadata
       writepages (CVE-2026-23157)
     - ice: fix devlink reload call trace (CVE-2026-23104)
     - tracing: Add recursion protection in kernel stack trace recording
       (CVE-2026-23138)
     - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070)
     - io_uring/uring_cmd: fix too strict requirement on ioctl
     - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
     - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC
       (CVE-2025-68334)
     - mptcp: pm: in-kernel: always set ID as avail when rm endp
     - net: stmmac: remove support for lpi_intr_o
     - f2fs: compress: change the first parameter of page_array_{alloc,free} to
       sbi
     - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
       (CVE-2025-38627)
     - f2fs: fix to avoid migrating empty section (CVE-2025-40150)
     - blk-throttle: fix access race during throttle policy activation
       (CVE-2025-40147)
     - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
       (CVE-2025-71221)
     - net: dsa: properly keep track of conduit reference (CVE-2025-71152)
     - binfmt_misc: restore write access before closing files opened by
       open_exec() (CVE-2025-68239)
     - xfs: get rid of the xchk_xfile_*_descr calls
     - erofs: fix inline data read failure for ztailpacking pclusters
     - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
     - sched_ext: Remove redundant css_put() in scx_cgroup_init()
     - io_uring/kbuf: check if target buffer list is still legacy on recycle
     - sched/fair: Fix zero_vruntime tracking
     - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint
     - [s390x] xor: Fix xor_xc_2() inline assembly constraints
     - [amd64] drm/i915/alpm: ALPM disable fixes
     - [amd64] drm/i915/psr: Repeat Selective Update area alignment
     - drm/amd/display: Add pixel_clock to amd_pp_display_configuration
     - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)
     - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426)
     - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
     - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
     - HID: bpf: prevent buffer overflow in hid_hw_request
     - sunrpc: fix cache_request leak in cache_release
     - nvdimm/bus: Fix potential use after free in asynchronous initialization
     - NFC: nxp-nci: allow GPIOs to sleep
     - net: macb: fix use-after-free access to PTP clock
     - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
     - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
     - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
     - smb: client: fix krb5 mount with username option
     - ksmbd: unset conn->binding on failed binding request
     - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
     - [amd64] drm/i915/dsc: Add Selective Update register definitions
     - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET
       parameters
     - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode
     - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute
     - kprobes: Remove unneeded goto
     - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
     - btrfs: fix transaction abort when snapshotting received subvolumes
     - batman-adv: avoid OGM aggregation when skb tailroom is insufficient
     - net: macb: Introduce gem_init_rx_ring()
     - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during
       resume
     - ata: libata-core: disable LPM on ADATA SU680 SSD
     - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
     - mmc: sdhci: fix timing selection for 1-bit bus width
     - pmdomain: bcm: bcm2835-power: Increase ASB control timeout
     - spi: fix use-after-free on controller registration failure
     - spi: fix statistics allocation
     - mtd: rawnand: pl353: make sure optimal timings are applied
     - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in
       cadence_nand_init()
     - mtd: Avoid boot crash in RedBoot partition table parser
     - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
     - serial: 8250_pci: add support for the AX99100
     - serial: 8250: Fix TX deadlock when using DMA
     - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART
       BUSY
     - serial: uartlite: fix PM runtime usage count underflow on probe
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - drm: Fix use-after-free on framebuffers and property blobs when calling
       drm_dev_unplug
     - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START,
       END}
     - drm/amdgpu/gmc9.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.0: add bounds checking for cid
     - drm/amdgpu/mmhub2.3: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.1: add bounds checking for cid
     - drm/amdgpu/mmhub3.0.2: add bounds checking for cid
     - drm/amdgpu/mmhub3.0: add bounds checking for cid
     - drm/amdgpu/mmhub4.1.0: add bounds checking for cid
     - drm/imagination: Fix deadlock in soft reset sequence
     - drm/radeon: apply state adjust rules to some additional HAINAN vairants
     - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
     - drm/xe/oa: Allow reading after disabling OA stream
     - drm/xe: Open-code GGTT MMIO access protection
     - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
       (CVE-2026-23395)
     - ata: libata-scsi: Return residual for emulated SCSI commands
     - ata: libata-scsi: report correct sense field pointer in
       ata_scsiop_maint_in()
     - btrfs: log new dentries when logging parent dir of a conflicting inode
     - btrfs: tree-checker: fix misleading root drop_level error message
     - [riscv64] soc: microchip: mpfs: Fix memory leak in
       mpfs_sys_controller_probe()
     - [riscv64] cache: starfive: fix device node leak in starlink_cache_init()
     - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning
     - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
     - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
     - [arm64] dts: renesas: r9a09g057: Add RTC node
     - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
     - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path
     - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
     - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
     - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
     - Bluetooth: ISO: Fix defer tests being unstable
     - Bluetooth: hci_sync: Fix hci_le_create_conn_sync
     - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
     - Bluetooth: HIDP: Fix possible UAF
     - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
     - Bluetooth: qca: fix ROM version reading on WCN3998 chips
     - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393)
     - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
     - mpls: add missing unregister_netdevice_notifier to mpls_init
     - netfilter: ctnetlink: remove refcounting in expectation dumpers
       (CVE-2025-39764)
     - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
     - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in
       sip_help_tcp()
     - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
     - nf_tables: nft_dynset: fix possible stateful expression memleak in error
       path (CVE-2026-23399)
     - netfilter: nft_ct: drop pending enqueued packets on removal
     - netfilter: xt_CT: drop pending enqueued packets on template removal
       (CVE-2026-23391)
     - netfilter: xt_time: use unsigned int for monthday bit shift
     - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
     - net: bcmgenet: increase WoL poll timeout
     - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel()
       by reordering teardown
     - sched: idle: Consolidate the handling of two special cases
     - PM: runtime: Fix a race condition related to device removal
     - bonding: prevent potential infinite loop in bond_header_parse()
     - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
     - net/sched: teql: Fix double-free in teql_master_xmit
     - net: airoha: read default PSE reserved pages value before updating
     - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init()
     - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll()
     - net: airoha: Remove airoha_dev_stop() in airoha_remove()
     - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
     - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
     - clsact: Fix use-after-free in init/destroy rollback asymmetry
     - net: usb: aqc111: Do not perform PM inside suspend callback
     - igc: fix missing update of skb->tail in igc_xmit_frame()
     - igc: fix page fault in XDP TX timestamps handling
     - iavf: fix VLAN filter lost on add/delete race
     - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396)
     - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough
       headroom
     - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
     - net: macb: fix uninitialized rx_fs_lock
     - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
     - net/mlx5e: Prevent concurrent access to IPSec ASO context
     - net/mlx5e: Fix race condition during IPSec ESN update
     - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
     - net: bonding: fix NULL deref in bond_debug_rlb_hash_show
     - netfilter: bpf: defer hook memory release until rcu readers are done
     - netfilter: nf_tables: release flowtable after rcu grace period on error
       (CVE-2026-23392)
     - nfnetlink_osf: validate individual option lengths in fingerprints
       (CVE-2026-23397)
     - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in
       buffer switching
     - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error
       paths
     - icmp: fix NULL pointer dereference in icmp_tag_validation()
       (CVE-2026-23398)
     - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return
       value
     - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
     - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
     - USB: serial: f81232: fix incomplete serial port generation
     - i2c: cp2615: fix serial string NULL-deref at probe
     - i2c: fsi: Fix a potential leak in fsi_i2c_probe()
     - i2c: pxa: defer reset on Armada 3700 when recovery is used
     - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
     - [amd64] x86/platform/uv: Handle deconfigured sockets
     - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode
     - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode
     - mm: shmem: fix potential data corruption during shmem swapin
     - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio()
     - mm/shmem, swap: improve cached mTHP handling and fix potential hang
     - mm/shmem, swap: avoid redundant Xarray lookup during swapin
     - mtd: rawnand: serialize lock/unlock against other NAND operations
     - mtd: rawnand: brcmnand: skip DMA during panic write
     - drm/amd/display: Fix DisplayID not-found handling in
       parse_edid_displayid_vrr()
     - drm/amd: fix dcn 2.01 check
     - ksmbd: fix use-after-free of share_conf in compound request
     - ksmbd: fix use-after-free in durable v2 replay of active file handles
     - [amd64] drm/i915/gt: Check set_default_submission() before deferencing
     - lib/bootconfig: check xbc_init_node() return in override path
     - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
     - hwmon: (max6639) Fix pulses-per-revolution implementation
     - [amd64] perf/x86/intel: Add missing branch counters constraint apply
     - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)
     - xen/privcmd: add boot control for restricted usage in domU
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80
     - cxl/port: Fix use after free of parent_port in cxl_detach_ep()
     - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)
       (Closes: #1132622)
     - perf: Make sure to use pmu_ctx->pmu for groups
     - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled
     - hwmon: axi-fan: don't use driver_override as IRQ name
     - driver core: generalize driver_override in struct device
     - driver core: platform: use generic driver_override infrastructure
     - bpf: Release module BTF IDR before module unload
     - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
     - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
     - HID: asus: avoid memory leak in asus_report_fixup()
     - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to
       dmi_vgbs_allow_list
     - nvme-pci: cap queue creation to used queues
     - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
     - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold
       16 Gen 1
     - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix
       touchscreen on SUPI S10
     - nvme-pci: ensure we're polling a polled queue
     - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2
     - HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
     - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list
     - net: usb: r8152: add TRENDnet TUC-ET2G
     - kbuild: install-extmod-build: Package resolve_btfids if necessary
     - HID: mcp2221: cancel last I2C command on read error
     - HID: asus: add xg mobile 2023 external hardware support
     - module: Fix kernel panic when a symbol st_shndx is out of bounds
     - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout
     - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP
     - dma-buf: Include ioctl.h in UAPI header
     - ALSA: hda/senary: Ensure EAPD is enabled during init
     - HID: apple: avoid memory leak in apple_report_fixup()
     - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
     - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
     - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk
     - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390
     - objtool: Handle Clang RSP musical chairs
     - nvmet: move async event work off nvmet-wq
     - drm/amdgpu: fix gpu idle power consumption issue for gfx v12
     - usb: core: new quirk to handle devices with zero configurations
     - spi: intel-pci: Add support for Nova Lake mobile SPI flash
     - ALSA: hda/realtek: add quirk for ASUS UM6702RC
     - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
     - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
     - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
     - xfrm: call xdo_dev_state_delete during state update
     - xfrm: Fix the usage of skb->sk
     - esp: fix skb leak with espintcp and async crypto
     - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
     - xfrm: prevent policy_hthresh.work from racing with netns teardown
     - af_key: validate families in pfkey_send_migrate()
     - dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
     - erofs: set fileio bio failed in short read case
     - can: statistics: add missing atomic access in hot path
     - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
     - Bluetooth: L2CAP: Validate PDU length before reading SDU length in
       l2cap_ecred_data_rcv()
     - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing
       sock_hold
     - Bluetooth: MGMT: Fix dangling pointer on
       mgmt_add_adv_patterns_monitor_complete
     - Bluetooth: hci_ll: Fix firmware leak on error path
     - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
     - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without
       EINT
     - ionic: fix persistent MAC address override on PF
     - nfc: nci: fix circular locking dependency in nci_close_device
     - net: openvswitch: Avoid releasing netdev before teardown completes
     - openvswitch: defer tunnel netdev_put to RCU release
     - openvswitch: validate MPLS set/set_masked payload length
     - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe
       buffer
     - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
     - net: bcm: asp2: fix LPI timer handling
     - net: bcm: asp2: remove tx_lpi_enabled
     - net: bcm: asp2: convert to phylib managed EEE
     - net: bcmasp: Remove support for asp-v2.0
     - net: bcmasp: streamline early exit in probe
     - net: bcmasp: fix double free of WoL irq
     - net: bcmasp: Add support for asp-v3.0
     - net: bcmasp: fix double disable of clk
     - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print
       inlen
     - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation
     - ice: fix inverted ready check for VF representors
     - ice: use ice_update_eth_stats() for representor stats
     - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
     - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions
       expire.
     - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist.
     - net: fix fanout UAF in packet_release() via NETDEV_UP race
     - tcp: optimize inet_use_bhash2_on_bind()
     - udp: Fix wildcard bind conflict check when using hash2
     - net: enetc: fix the output issue of 'ethtool --show-ring'
     - team: fix header_ops type confusion with non-Ethernet ports
     - net: lan743x: fix duplex configuration in mac_link_up
     - dma-mapping: add missing `inline` for `dma_free_attrs`
     - Bluetooth: L2CAP: Fix send LE flow credits in ACL link
     - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
     - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
     - Bluetooth: btusb: clamp SCO altsetting table indices
     - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)
     - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
     - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
     - netfilter: nf_conntrack_expect: skip expectations in other netns via proc
     - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in
       process_sdp
     - netfilter: ctnetlink: use netlink policy range checks
     - net: macb: use the current queue number for stats
     - regmap: Synchronize cache for the page selector
     - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter
     - RDMA/rw: Fall back to direct SGE on MR pool exhaustion
     - RDMA/irdma: Initialize free_qp completion before using it
     - RDMA/irdma: Update ibqp state to error if QP is already in error state
     - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()
     - RDMA/irdma: Clean up unnecessary dereference of event->cm_node
     - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()
     - RDMA/irdma: Fix deadlock during netdev reset with active connections
     - RDMA/irdma: Return EINVAL for invalid arp index error
     - scsi: scsi_transport_sas: Fix the maximum channel scanning issue
     - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of
       ranges_to_free size
     - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
     - PM: hibernate: Drain trailing zero pages on userspace restore
     - spi: sn-f-ospi: Fix resource leak in f_ospi_probe()
     - [amd64] ASoC: Intel: catpt: Fix the device initialization
     - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path
     - drm/amd/display: Do not skip unrelated mode changes in DSC validation
     - spi: Group CS related fields in struct spi_device
     - spi: use generic driver_override infrastructure
     - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
     - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
     - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion
     - hwmon: (pmbus/core) Fix various coding style issues
     - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only
     - hwmon: (pmbus) Introduce the concept of "write-only" attributes
     - sysctl: fix uninitialized variable in proc_do_large_bitmap
     - [s390x] syscalls: Add spectre boundary for syscall dispatch table
     - [s390x] barrier: Make array_index_mask_nospec() __always_inline
     - [s390x] entry: Scrub r12 register on kernel entry
     - ksmbd: replace hardcoded hdr2_len with offsetof() in
       smb2_calc_max_out_buf_len()
     - ksmbd: fix potencial OOB in get_file_all_info() for compound requests
     - ksmbd: fix memory leaks and NULL deref in smb2_lock()
     - ksmbd: do not expire session on binding failure
     - ALSA: firewire-lib: fix uninitialized local variable
     - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial
       payload
     - can: gw: fix OOB heap access in cgw_csum_crc8_rel()
     - can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
     - cpufreq: conservative: Reset requested_freq on limits change
     - [amd64] platform/x86: ISST: Correct locked bit width
     - [arm64] KVM: arm64: Discard PC update state on vcpu reset
     - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs
       attributes
     - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute
       temperature
     - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()
     - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
     - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and
       napi_tx is false
     - erofs: add GFP_NOIO in the bio completion if needed
     - alarmtimer: Fix argument order in alarm_timer_forward()
     - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()
     - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
     - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4
     - ovl: fix wrong detection of 32bit inode numbers
     - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
     - scsi: ses: Handle positive SCSI error from ses_recv_diag()
     - net: macb: Move devm_{free,request}_irq() out of spin lock area
     - net: macb: Protect access to net_device::ip_ptr with RCU lock
     - net: macb: Use dev_consume_skb_any() to free TX SKBs
     - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an
       MMIO SPTE (CVE-2026-23401)
     - jbd2: gracefully abort on checkpointing state corruptions
     - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment
     - futex: Clear stale exiting pointer in futex_lock_pi() retry path
     - dmaengine: fsl-edma: fix channel parameter config for fixed channel
       requests
     - dmaengine: sh: rz-dmac: Protect the driver specific lists
     - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock
     - drm/amdgpu: prevent immediate PASID reuse case
     - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in
       atomic state
     - xfs: stop reclaim before pushing AIL during unmount
     - xfs: save ailp before dropping the AIL lock in push callbacks
     - xfs: scrub: unlock dquot before early return in quota scrub
     - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2
     - xfs: don't irele after failing to iget in xfs_attri_recover_work
     - xfs: remove file_path tracepoint data
     - ext4: fix journal credit check when setting fscrypt context
     - ext4: convert inline data to extents when truncate exceeds inline size
     - ext4: fix stale xarray tags after writeback
     - ext4: fix fsync(2) for nojournal mode
     - ext4: make recently_deleted() properly work with lazy itable
       initialization
     - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
     - ext4: validate p_idx bounds in ext4_ext_correct_indexes
     - ext4: avoid infinite loops caused by residual data
     - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
     - ext4: reject mount if bigalloc with s_first_data_block != 0
     - ext4: fix use-after-free in update_super_work when racing with umount
     - ext4: fix the might_sleep() warnings in kvfree()
     - ext4: handle wraparound when searching for blocks for indirect mapped
       blocks
     - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
     - ext4: always drain queued discard work in ext4_mb_release()
     - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off
     - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is
       NULL
     - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
     - tracing: Switch trace_osnoise.c code over to use guard() and __free()
     - tracing: Fix potential deadlock in cpu hotplug with osnoise
     - drm/xe: always keep track of remap prev/next
     - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
     - ovl: Use str_on_off() helper in ovl_show_options()
     - ovl: make fsync after metadata copy-up opt-in mount option
     - xfs: avoid dereferencing log items after push callbacks
     - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
     - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)
     - landlock: Optimize file path walks and prepare for audit support
     - landlock: Fix handling of disconnected directories (CVE-2025-68736)
     - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
       (CVE-2025-22117)
     - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210)
     - [amd64,arm64] idpf: check error for register_netdev() on init
     - [amd64,arm64] idpf: detach and close netdevs while handling a reset
       (CVE-2026-22981)
     - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool
       operations (CVE-2026-22985)
     - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset
       (CVE-2026-22993)
     - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release()
     - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset
     - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late
     - phy: ti: j721e-wiz: Fix device node reference leak in
       wiz_get_lane_phy_types()
     - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and
       CYCLE_BIT bits for HDMA.
     - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
     - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in
       llist_abort_desc()
     - btrfs: fix super block offset in error message in btrfs_validate_super()
     - btrfs: fix leak of kobject name for sub-group space_info
     - btrfs: fix lost error when running device stats on multiple devices fs
     - xen/privcmd: unregister xenstore notifier on module exit
     - futex: Require sys_futex_requeue() to have identical flags
     - [amd64] dmaengine: idxd: Fix leaking event log memory
     - net: bcmasp: Restore programming of TX map vector register
     - net: bcmasp: Fix network filter wake for asp-3.0
     - [amd64,arm64] idpf: nullify pointers after they are freed
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81
     - io_uring/kbuf: remove legacy kbuf bulk allocation
     - io_uring/kbuf: remove legacy kbuf kmem cache
     - io_uring/kbuf: simplify __io_put_kbuf
     - io_uring/kbuf: remove legacy kbuf caching
     - io_uring/kbuf: open code __io_put_kbuf()
     - io_uring/kbuf: introduce io_kbuf_drop_legacy()
     - io_uring/kbuf: uninline __io_put_kbufs
     - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments
     - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases
     - io_uring/net: clarify io_recv_buf_select() return value
     - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers
     - io_uring/kbuf: introduce struct io_br_sel
     - io_uring/kbuf: use struct io_br_sel for multiple buffers picking
     - io_uring/net: use struct io_br_sel->val as the recv finish value
     - io_uring/net: use struct io_br_sel->val as the send finish value
     - io_uring/kbuf: switch to storing struct io_buffer_list locally
     - io_uring: remove async/poll related provided buffer recycles
     - io_uring/net: correct type for min_not_zero() cast
     - io_uring/rw: check for NULL io_br_sel when putting a buffer
     - io_uring/kbuf: enable bundles for incrementally consumed buffers
     - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
     - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory
     - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields
     - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
     - io_uring/kbuf: propagate BUF_MORE through early buffer commit path
     - HID: logitech-hidpp: Enable MX Master 4 over bluetooth
     - wifi: mac80211: check tdls flag in ieee80211_tdls_oper
     - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
     - atm: lec: fix use-after-free in sock_def_readable()
     - btrfs: don't take device_list_mutex when querying zone info
     - tg3: replace placeholder MAC address with device property
     - HID: logitech-hidpp: Prevent use-after-free on force feedback
       initialisation failure
     - HID: multitouch: Check to ensure report responses match the request
     - btrfs: reserve enough transaction items for qgroup ioctls
     - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe
     - btrfs: reject root items with drop_progress and zero drop_level
     - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR
     - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common
       property warning
     - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU
       session
     - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys
     - [arm64,armhf] crypto: caam - fix overflow on long hmac keys
     - crypto: af-alg - fix NULL pointer dereference in scatterwalk
     - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface
     - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
     - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields
       to zero to prevent an info-leak
     - net/ipv6: ioam6: prevent schema length wraparound in trace fill
     - tg3: Fix race for querying speed/duplex
     - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
     - ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
     - bridge: br_nd_send: linearize skb before parsing ND options
     - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
     - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
     - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz
     - ipv6: prevent possible UaF in addrconf_permanent_addr()
     - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
     - net: introduce mangleid_features
     - net: use skb_header_pointer() for TCPv4 GSO frag_off check
     - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero
       to prevent an info-leak
     - NFC: pn533: bound the UART receive buffer
     - ASoC: Intel: boards: fix unmet dependency on PINCTRL
     - bpf: Fix regsafe() for pointers to packet
     - net: ipv6: flowlabel: defer exclusive option free until RCU teardown
     - netfilter: flowtable: strictly check for maximum number of actions
     - netfilter: nfnetlink_log: account for netlink header size
     - netfilter: x_tables: ensure names are nul-terminated
     - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
     - netfilter: nf_conntrack_helper: pass helper to expect cleanup
     - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
     - netfilter: nf_conntrack_expect: honor expectation helper field
     - netfilter: nf_conntrack_expect: use expect->helper
     - netfilter: nf_conntrack_expect: store netns and zone in expectation
     - netfilter: ctnetlink: ignore explicit helper on new expectations
     - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions
       for NFPROTO_ARP
     - netfilter: nf_tables: reject immediate NF_QUEUE verdict
     - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
     - Bluetooth: SCO: fix race conditions in sco_sock_connect()
     - Bluetooth: MGMT: validate LTK enc_size on load
     - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
     - Bluetooth: hci_event: fix potential UAF in
       hci_le_remote_conn_param_req_evt
     - Bluetooth: MGMT: validate mesh send advertising payload length
     - rds: ib: reject FRMR registration before IB connection is established
     - bpf: sockmap: Fix use-after-free of sk->sk_socket in
       sk_psock_verdict_data_ready().
     - net/sched: sch_netem: fix out-of-bounds access in packet corruption
     - net: macb: fix clk handling on PCI glue driver removal
     - net: macb: properly unregister fixed rate clocks
     - net/mlx5: lag: Check for LAG device before creating debugfs
     - net/mlx5: Avoid "No data available" when FW version queries fail
     - net/mlx5: Fix switchdev mode rollback in case of failure
     - bnxt_en: Restore default stat ctxs for ULP when resource is available
     - net/x25: Fix potential double free of skb
     - net/x25: Fix overflow when accumulating packets
     - net/sched: cls_fw: fix NULL pointer dereference on shared blocks
     - net/sched: cls_flow: fix NULL pointer dereference on shared blocks
     - net: hsr: fix VLAN add unwind on slave errors
     - ipv6: avoid overflows in ip6_datagram_send_ctl()
     - bpf: reject direct access to nullable PTR_TO_BUF pointers
     - Revert "drm: Fix use-after-free on framebuffers and property blobs when
       calling drm_dev_unplug"
     - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
     - hwmon: (pxe1610) Check return value of page-select write in probe
     - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
     - dt-bindings: gpio: fix microchip #interrupt-cells
     - hwmon: (tps53679) Fix device ID comparison and printing in
       tps53676_identify()
     - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended()
     - sched/fair: Use protect_slice() instead of direct comparison
     - sched/fair: Fix zero_vruntime tracking fix
     - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path
     - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
     - wifi: iwlwifi: mvm: fix potential out-of-bounds read in
       iwl_mvm_nd_match_info_handler()
     - USB: serial: option: add MeiG Smart SRM825WN
     - ALSA: caiaq: fix stack out-of-bounds read in init_card
     - ALSA: ctxfi: Fix missing SPDIFI1 index handling
     - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
     - Bluetooth: SMP: derive legacy responder STK authentication from MITM state
     - Bluetooth: SMP: force responder MITM requirements before building the
       pairing response
     - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
     - ksmbd: fix OOB write in QUERY_INFO for compound requests
     - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1()
     - drm/amdgpu: fix the idr allocation flags
     - iio: adc: ti-adc161s626: fix buffer read on big-endian
     - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
     - drm/ast: dp501: Fix initialization of SCU2C
     - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in
       command mode
     - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw
       CPU eDP
     - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
     - drm/amdgpu/pm: drop SMU driver if version not matched messages
     - USB: serial: io_edgeport: add support for Blackbox IC135A
     - USB: serial: option: add support for Rolling Wireless RW135R-GL
     - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
     - Input: synaptics-rmi4 - fix a locking bug in an error path
     - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk
       table
     - Input: bcm5974 - recover from failed mode switch
     - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
     - Input: xpad - add support for Razer Wolverine V3 Pro
     - iio: adc: aspeed: clear reference voltage bits before configuring vref
     - iio: accel: fix ADXL355 temperature signature value
     - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
     - iio: dac: ad5770r: fix error return in ad5770r_read_raw()
     - iio: light: vcnl4035: fix scan buffer on big-endian
     - iio: imu: bmi160: Remove potential undefined behavior in
       bmi160_config_pin()
     - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
     - iio: gyro: mpu3050: Fix incorrect free_irq() variable
     - iio: gyro: mpu3050: Fix irq resource leak
     - iio: gyro: mpu3050: Move iio_device_register() to correct location
     - iio: gyro: mpu3050: Fix out-of-sequence free_irq()
     - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
     - usb: ulpi: fix double free in ulpi_register_interface() error path
     - usb: usbtmc: Flush anchored URBs in usbtmc_release
     - usb: ehci-brcm: fix sleep during atomic
     - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
     - usb: core: phy: avoid double use of 'usb3-phy'
     - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
     - usb: cdns3: gadget: fix state inconsistency on gadget init failure
     - bridge: br_nd_send: validate ND option lengths
     - cdc-acm: new quirk for EPSON HMD
     - [amd64] comedi: Reinit dev->spinlock between attachments to low-level
       drivers
     - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer
     - [amd64] comedi: me4000: Fix potential overrun of firmware buffer
     - [riscv64] firmware: microchip: fail auto-update probe if no flash found
     - dt-bindings: connector: add pd-disable dependency
     - nvmem: imx: assign nvmem_cell_info::raw_len
     - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
     - netfilter: ipset: drop logically empty buckets in mtype_del
     - vxlan: validate ND option lengths in vxlan_na_create
     - net: ftgmac100: fix ring allocation unwind on open failure
     - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
     - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error
       path
     - gpio: mxc: map Both Edge pad wakeup to Rising Edge
     - thermal: core: Fix thermal zone device registration error path
     - misc: fastrpc: possible double-free of cctx->remote_heap
     - [amd64] thunderbolt: Fix property read in nhi_wake_supported()
     - USB: dummy-hcd: Fix locking/synchronization error
     - USB: dummy-hcd: Fix interrupt synchronization error
     - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows
       partial transfer
     - usb: typec: ucsi: validate connector number in ucsi_notify_common()
     - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)
     - btrfs: fix the qgroup data free range for inline data extents
     - btrfs: do not free data reservation in fallback from inline due to -ENOSPC
       (CVE-2025-71269)
     - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
     - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
     - usb: gadget: uvc: fix NULL pointer dereference during unbind race
     - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
     - usb: gadget: f_rndis: Protect RNDIS options with mutex
     - usb: gadget: f_ecm: Fix net_device lifecycle with device_move
     - usb: gadget: f_eem: Fix net_device lifecycle with device_move
     - usb: gadget: f_subset: Fix net_device lifecycle with device_move
     - usb: gadget: f_rndis: Fix net_device lifecycle with device_move
     - usb: gadget: f_hid: move list and spinlock inits from bind to alloc
     - usb: gadget: f_uac1_legacy: validate control request size
     - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
     - spi: cadence-qspi: Fix exec_mem_op error handling
     - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
     - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path
     - scsi: target: tcm_loop: Drain commands in target_reset handler
     - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests
     - mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
     - mm: replace READ_ONCE() with standard page table accessors
     - mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
     - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
     - ext4: publish jinode after initialization
     - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128()
     - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception
     - MPTCP: fix lock class name family in pm_nl_create_listen_socket
     - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
     - drm/amd/amdgpu: decouple ASPM with pcie dpm
     - drm/amd/amdgpu: disable ASPM in some situations
     - drm/amd/display: Disable fastboot on DCE 6 too
     - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
     - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
     - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
     - drm/amd/display: Disable scaling on DCE6 for now
     - drm/amd: Disable ASPM on SI
     - drm/amd/display: Correct logic check error for fastboot
     - bpf: Improve bounds when s64 crosses sign boundary
     - bpf: Add third round of bounds deduction
     - bpf: Fix u32/s32 bounds when ranges cross min/max boundary
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82
     - lib/crypto: chacha: Zeroize permuted_state before it leaves scope
     - usb: typec: ucsi: skip connector validation before init
     - wifi: rt2x00usb: fix devres lifetime
     - xfrm_user: fix info leak in build_report()
     - net: rfkill: prevent unlimited numbers of rfkill events from being created
     - mptcp: fix slab-use-after-free in __inet_lookup_established
     - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
     - Input: uinput - fix circular locking dependency with ff-core
     - Input: uinput - take event lock when submitting FF request "event"
     - ASoC: simple-card-utils: Don't use __free(device_node) at
       graph_util_parse_dai()
     - btrfs: make wait_on_extent_buffer_writeback() static inline
     - btrfs: remove unused define WAIT_PAGE_LOCK for extent io
     - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait
     - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD
     - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT
     - btrfs: remove pointless out labels from extent-tree.c
     - btrfs: fix incorrect return value after changing leaf in
       lookup_extent_data_ref()
     - blktrace: fix __this_cpu_read/write in preemptible context
     - nfc: nci: complete pending data exchange on device close
     - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
     - Revert "mptcp: add needs_id for netlink appending addr"
     - net: annotate data-races around sk->sk_{data_ready,write_space}
     - netfilter: nft_ct: fix use-after-free in timeout object destroy
     - workqueue: Add pool_workqueue to pending_pwqs list when unplugging
       multiple inactive works
     - xfrm: clear trailing padding in build_polexpire()
     - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
     - wifi: brcmsmac: Fix dma_free_coherent() size
     - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit
     - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"
     - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V
     - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
     - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges
     - nfc: pn533: allocate rx skb before consuming bytes
     - batman-adv: reject oversized global TT response buffers
     - X.509: Fix out-of-bounds access when parsing extensions
     - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc()
     - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
     - batman-adv: hold claim backbone gateways by reference
     - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
     - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area
     - net/mlx5: Update the list of the PCI supported devices
     - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
     - mmc: vub300: fix NULL-deref on disconnect
     - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation
       failure
     - net: stmmac: fix integer underflow in chain mode
     - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
     - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free()
     - [amd64,arm64] idpf: set the payload size before calling the async handler
     - rxrpc: Fix anonymous key handling
     - rxrpc: Fix call removal to use RCU safe deletion
     - rxrpc: Fix key reference count leak from call->key
     - rxrpc: Only put the call ref if one was acquired
     - rxrpc: reject undecryptable rxkad response tickets
     - rxrpc: fix reference count leak in rxrpc_server_keyring()
     - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
     - rxrpc: Fix missing error checks for rxkad encryption/decryption failure
     - net: skb: fix cross-cache free of KFENCE-allocated skb head
     - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6
     - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83
     - RDMA/irdma: Fix double free related to rereg_user_mr
     - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA
     - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk
     - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC
     - [arm64,armhf] media: rkvdec: reduce stack usage in
       rkvdec_init_v4l2_vp9_count_tbl()
     - ALSA: asihpi: avoid write overflow check warning
     - Bluetooth: hci_sync: annotate data-races around hdev->req_status
     - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF
     - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in
       token parser
     - can: mcp251x: add error handling for power enable in open and resume
     - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP
       GZ302EAC
     - btrfs: tracepoints: get correct superblock from dentry in event
       btrfs_sync_file()
     - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx
     - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems
     - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
     - ALSA: hda/realtek: add quirk for Framework F111:000F
     - wifi: wl1251: validate packet IDs before indexing tx_frames
     - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list
     - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)
     - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex
     - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
     - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9
     - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW
       debouncer)
     - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug
     - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
     - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10
     - HID: roccat: fix use-after-free in roccat_report_event
     - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
     - wifi: brcmfmac: validate bsscfg indices in IF events
     - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
     - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
     - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID
       matching
     - [arm64] dts: qcom: hamoa/x1: fix idle exit latency
     - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency
     - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD
     - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration
     - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei
     - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon
     - PCI: hv: Set default NUMA node to 0 for devices without affinity info
     - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP
     - xfrm: account XFRMA_IF_ID in aevent size calculation
     - [arm*] drm/vc4: Release runtime PM reference after binding V3D
     - [arm*] drm/vc4: Fix memory leak of BO array in hang state
     - [arm*] drm/vc4: Fix a memory leak in hang state error path
     - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
     - eventpoll: defer struct eventpoll free to RCU grace period
     - net: sched: act_csum: validate nested VLAN headers
     - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
     - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
     - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
       (CVE-2026-31531)
     - ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
     - net: increase IP_TUNNEL_RECURSION_LIMIT to 5
     - nfc: s3fwrn5: allocate rx skb before consuming bytes
     - net: stmmac: Fix PTP ref clock for Tegra234
     - dt-bindings: net: Fix Tegra234 MGBE PTP clock
     - tracing/probe: reject non-closed empty immediate strings
     - ixgbevf: add missing negotiate_features op to Hyper-V ops table
     - e1000: check return value of e1000_read_eeprom
     - xsk: tighten UMEM headroom validation to account for tailroom and min
       frame
     - xsk: respect tailroom for ZC setups
     - xsk: fix XDP_UMEM_SG_FLAG issues
     - xsk: validate MTU against usable frame size on bind
     - xfrm: Wait for RCU readers during policy netns exit
     - xfrm: fix refcount leak in xfrm_migrate_policy_find
     - xfrm_user: fix info leak in build_mapping()
     - ipvs: fix NULL deref in ip_vs_add_service error path
     - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
     - netfilter: xt_multiport: validate range encoding in checkentry
     - netfilter: ip6t_eui64: reject invalid MAC header for all packets
     - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC ->
       GFP_KERNEL_ACCOUNT allocation
     - netfilter: nfnetlink_queue: make hash table per queue
     - net: txgbe: leave space for null terminators on property_entry
     - af_unix: read UNIX_DIAG_VFS data under unix_state_lock
     - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
     - net: ipa: fix event ring index not programmed for IPA v5.0+
     - l2tp: Drop large packets with UDP encap
     - gpio: tegra: fix irq_release_resources calling enable instead of disable
     - crypto: af_alg - limit RX SG extraction by receive buffer budget
     - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies
     - sched/deadline: Use revised wakeup rule for dl_server
     - crypto: algif_aead - Fix minimum RX size check for decryption
     - netfilter: conntrack: add missing netlink policy validations
       (CVE-2026-31407)
     - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads"
     - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt"
     - thermal: core: Mark thermal zones as exiting before unregistration
     - thermal: core: Address thermal zone removal races with resume
     - ALSA: usb-audio: Improve Focusrite sample rate filtering
     - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC
       handling
     - nfc: llcp: add missing return after LLCP_CLOSED checks
     - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
     - i2c: s3c24xx: check the size of the SMBUS message before using it
     - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
     - HID: alps: fix NULL pointer dereference in alps_raw_event()
     - HID: core: clamp report_size in s32ton() to avoid undefined shift
     - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
     - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
     - [arm*] drm/vc4: platform_get_irq_byname() returns an int
     - ALSA: fireworks: bound device-supplied status before string array lookup
     - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
     - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
     - usb: gadget: renesas_usb3: validate endpoint index in standard request
       handlers
     - smb: client: fix off-by-8 bounds check in check_wsl_eas()
     - ksmbd: validate EaNameLength in smb2_get_ea()
     - ksmbd: require 3 sub-authorities before reading sub_auth[2]
     - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc
     - usbip: validate number_of_packets in usbip_pack_ret_submit()
     - usb: storage: Expand range of matched versions for VL817 quirks entry
     - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen
     - usb: gadget: f_hid: don't call cdev_init while cdev in use
     - usb: port: add delay after usb_hub_set_port_power()
     - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
     - scripts: generate_rust_analyzer.py: avoid FD leak
     - wifi: rtw88: fix device leak on probe failure
     - staging: sm750fb: fix division by zero in ps_to_hz()
     - USB: serial: option: add Telit Cinterion FN990A MBIM composition
     - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates
       race
     - ALSA: ctxfi: Limit PTP to a single page
     - dcache: Limit the minimal number of bucket to two
     - media: vidtv: fix NULL pointer dereference in
       vidtv_channel_pmt_match_sections
     - ocfs2: fix possible deadlock between unlink and dio_end_io_write
     - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
     - ocfs2: handle invalid dinode in ocfs2_group_extend
     - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
     - [amd64] KVM: SEV: Reject attempts to sync VMSA of an
       already-launched/encrypted vCPU
     - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being
       created
     - [amd64] KVM: SEV: Drop WARN on large size for
       KVM_MEMORY_ENCRYPT_REG_REGION
     - gpiolib: unify two loops initializing GPIO descriptors
     - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)
     - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
     - kernel: be more careful about dup_mmap() failures and uprobe registering
     - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay
     - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs
     - checkpatch: add support for Assisted-by tag
     - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function
     - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache()
     - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache
     - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write
       values
     - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged
       version
     - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
     - media: vidtv: fix nfeeds state corruption on start_streaming failure
     - media: mediatek: vcodec: fix use-after-free in encoder release path
     - media: em28xx: fix use-after-free in em28xx_v4l2_open()
     - hwmon: (powerz) Fix use-after-free on USB disconnect
     - ALSA: 6fire: fix use-after-free on disconnect
     - bcache: fix cached_dev.sb_bio use-after-free and crash
     - media: as102: fix to not free memory after the device is registered in
       as102_usb_probe()
     - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
     - media: vidtv: fix pass-by-value structs causing MSAN warnings
     - media: hackrf: fix to not free memory after the device is registered in
       hackrf_probe()
     - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
     - ocfs2: validate inline data i_size during inode read
     - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
     - rxrpc: Fix key quota calculation for multitoken keys
     - PCI: Fix placement of pci_save_state() in pci_bus_add_device()
     - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
     - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms"
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84
     - mm/userfaultfd: fix hugetlb fault mutex hash calculation
     - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
     - ima: verify if the segment size has changed
     - ima: do not copy measurement list to kdump kernel
     - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
     - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU
       registers
     - drm/amdgpu: replace PASID IDR with XArray
     - mm/pagewalk: fix race between concurrent split and refault
     - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger
     - scripts/dtc: Remove unused dts_version in dtc-lexer.l
     - rxrpc: only handle RESPONSE during service challenge
     - fs/ntfs3: validate rec->used in journal-replay file record check
     - f2fs: fix to avoid memory leak in f2fs_rename()
     - fuse: reject oversized dirents in page cache
     - fuse: Check for large folio with SPLICE_F_MOVE
     - fuse: quiet down complaints in fuse_conn_limit_write
     - ksmbd: require minimum ACE size in smb_check_perm_dacl()
     - smb: server: fix active_num_conn leak on transport allocation failure
     - smb: server: fix max_connections off-by-one in tcp accept path
     - smb: client: require a full NFS mode SID before reading mode bits
     - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
     - ksmbd: validate response sizes in ipc_validate_msg()
     - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
     - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
     - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
     - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()
     - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
     - ALSA: caiaq: take a reference on the USB device in create_card()
     - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
     - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command
       failed
     - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP
       command failed
     - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command
       failed
     - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85
     - crypto: scatterwalk - Backport memcpy_sglist()
     - crypto: algif_aead - use memcpy_sglist() instead of null skcipher
     - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
     - crypto: algif_aead - snapshot IV for async AEAD requests
     - crypto: authenc - use memcpy_sglist() instead of null skcipher
     - crypto: authencesn - Do not place hiseq at end of dst for out-of-place
       decryption
     - crypto: authencesn - Fix src offset when decrypting in-place
     - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
     - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
     - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
Checksums-Sha1:
 c62cf6df39bc2561cf034a80499bbe829a3a419b 965472 bpftool-dbgsym_7.5.0+6.12.85-1_amd64.deb
 ad443780b9811855a70623840c61ff8f4e34c9fd 1530076 bpftool_7.5.0+6.12.85-1_amd64.deb
 2cae6777065db073daefa285929e383fb618ca58 46356 hyperv-daemons-dbgsym_6.12.85-1_amd64.deb
 a39e32fd9a8983c8e18f21a4fac94cd296f75c0a 1263936 hyperv-daemons_6.12.85-1_amd64.deb
 59ad4b05fecae5eb28e3da7637ce046d1447260d 19668 intel-sdsi-dbgsym_6.12.85-1_amd64.deb
 7be26a097da01a9fe81c4239ddbaeeeb329d3ac7 1252284 intel-sdsi_6.12.85-1_amd64.deb
 d26f218488cfa4d53735815f9a3da7a3efe967b6 1248020 libcpupower-dev_6.12.85-1_amd64.deb
 b0dca863a14ae750f562918f21d7844d2f3467a8 32368 libcpupower1-dbgsym_6.12.85-1_amd64.deb
 b9d249324abbba5504c4b818fe0d706a58564383 1255812 libcpupower1_6.12.85-1_amd64.deb
 b447a65ac7fa243fd453f069cb9894909c52221f 1714964 linux-bpf-dev_6.12.85-1_amd64.deb
 1a49d26f05192b7b96be33c1f7e8737a1933ddc6 1389692 linux-config-6.12_6.12.85-1_amd64.deb
 9cc396268c378e2deb22da0ed63b9ea48d92671d 402196 linux-cpupower-dbgsym_6.12.85-1_amd64.deb
 0e41a4be641fc1821ae50b9cd3aa92f370243bea 1421452 linux-cpupower_6.12.85-1_amd64.deb
 05c4dd54c7a8a49e9231880375b1375bb11c941d 3004820 linux-headers-6.12.85+deb13-amd64_6.12.85-1_amd64.deb
 8319f1ee67f30b92cf1786de76295c4fe55ca4dd 2664564 linux-headers-6.12.85+deb13-cloud-amd64_6.12.85-1_amd64.deb
 e0f247cc4ecba1a510c7e9dca343c403b98a67f6 3003280 linux-headers-6.12.85+deb13-rt-amd64_6.12.85-1_amd64.deb
 dc9e028886584bd5640041af2b68b87663f5332a 1039878664 linux-image-6.12.85+deb13-amd64-dbg_6.12.85-1_amd64.deb
 11008d9bbdc8c581b876f6f48ac47eae37d76cbd 107662340 linux-image-6.12.85+deb13-amd64-unsigned_6.12.85-1_amd64.deb
 205b5c5cc21398f1bf7513117ad8009fa9ae85e1 318334776 linux-image-6.12.85+deb13-cloud-amd64-dbg_6.12.85-1_amd64.deb
 8d30bbc13760039b341485585f3da75ea8336dd8 34230092 linux-image-6.12.85+deb13-cloud-amd64-unsigned_6.12.85-1_amd64.deb
 5934c8bb9aa7e1f32542026a864ec2bef191fd85 1039582432 linux-image-6.12.85+deb13-rt-amd64-dbg_6.12.85-1_amd64.deb
 372ce3937c41fb863503490a5deacc398dbf49c3 107660732 linux-image-6.12.85+deb13-rt-amd64-unsigned_6.12.85-1_amd64.deb
 c8683513a9c4c5233de05e0c85afca2c8a47c778 1164 linux-image-amd64-dbg_6.12.85-1_amd64.deb
 59954474d1d76ab3c7fd4e0d4eacb737f04f4c47 2174668 linux-image-amd64-signed-template_6.12.85-1_amd64.deb
 f143a3c20024a0347275a1beecc1ebac7372e158 1180 linux-image-cloud-amd64-dbg_6.12.85-1_amd64.deb
 10e4a40aea4e946e6f514e2f2877e183c84c59e6 1172 linux-image-rt-amd64-dbg_6.12.85-1_amd64.deb
 556ecd9165724d08f5532d77873ee78906ac0e8f 1919596 linux-kbuild-6.12.85+deb13-dbgsym_6.12.85-1_amd64.deb
 e1cba1251d54fbebf7cf3f2b52c14c04ad362e56 1679664 linux-kbuild-6.12.85+deb13_6.12.85-1_amd64.deb
 9216f8fcef0d3de152ab208fdf1469e8b0492f5b 12298840 linux-perf-dbgsym_6.12.85-1_amd64.deb
 60df561ffa46492ee27567476e1488c1441f3b79 4800260 linux-perf_6.12.85-1_amd64.deb
 c894f96981ae9d864d372311d3ae819edc0c3976 22233 linux_6.12.85-1_amd64-buildd.buildinfo
 53b8909bbe973b8dc3466fe3169b7df3ef6da6df 112140 rtla-dbgsym_6.12.85-1_amd64.deb
 f02bff5aeb745841bdd39c8a58ead8359eb37ef2 1301428 rtla_6.12.85-1_amd64.deb
 24348459220ae8fa8e92de703178bb28ebc739fb 145900 usbip-dbgsym_2.0+6.12.85-1_amd64.deb
 99375fad3aa4dcdaa288751dba2e641857d7cf5a 1287792 usbip_2.0+6.12.85-1_amd64.deb
Checksums-Sha256:
 8cb2301f30dad572753532a60fff54e603a7eed88b38db221b5667cae279effc 965472 bpftool-dbgsym_7.5.0+6.12.85-1_amd64.deb
 34ea9044b15a9bf0f566b2d6f8c1621facb8a8dffb24eeb632f80eba1c3f23fd 1530076 bpftool_7.5.0+6.12.85-1_amd64.deb
 6ef8ca9571b9759c9c72de017b3e7a91eca8ef5265dec5ec40002581720d1fb7 46356 hyperv-daemons-dbgsym_6.12.85-1_amd64.deb
 cfa0aa667967a01b4d13a787f6862226e7bab63b8ff6a36424e96f21f601d217 1263936 hyperv-daemons_6.12.85-1_amd64.deb
 9629d546ba600ceaa8b60c6db1300a76d35849e1dde29cde971d290fdec46956 19668 intel-sdsi-dbgsym_6.12.85-1_amd64.deb
 2164c56aab9a6d54c159dcf74fb6b00712b71280b4433d1afe8e8288b5772f43 1252284 intel-sdsi_6.12.85-1_amd64.deb
 f37868b38f7f157de6c566981b7208a476dbcd87ca96629367db606a8f2f03d8 1248020 libcpupower-dev_6.12.85-1_amd64.deb
 3282802afbbb9c7c2e98723df8031a82d29c0051be182ab43d91f084e7f73e15 32368 libcpupower1-dbgsym_6.12.85-1_amd64.deb
 d183b8e0f5805d41416071bbaaf7f5ee77fba63e61ef1fe33f06b8b910bc1f88 1255812 libcpupower1_6.12.85-1_amd64.deb
 c8d60c1e1572bec1e7d17d977a4beaf5f3c9f313defa4798786eafb66d3b433f 1714964 linux-bpf-dev_6.12.85-1_amd64.deb
 2e6bc9223db2a041f575c19cfc09b82938cac9bcfc914f142cdb5689388ade02 1389692 linux-config-6.12_6.12.85-1_amd64.deb
 d7b9842b500492704059b9853643db41316619ac5e55c814404647dde2869f68 402196 linux-cpupower-dbgsym_6.12.85-1_amd64.deb
 28934812bae9a0d79a9387a8dfff3be2147332740e855af463b9687d0b8d501b 1421452 linux-cpupower_6.12.85-1_amd64.deb
 ecf05c7a6b3cb048ddcc23e6e5fdcd54359d78cdc4bc8e7307b74375a91640ae 3004820 linux-headers-6.12.85+deb13-amd64_6.12.85-1_amd64.deb
 413894ca66b4e3797fe53ecd6d918dba4e7f38d89a96b1f57fcbd04faa57c84d 2664564 linux-headers-6.12.85+deb13-cloud-amd64_6.12.85-1_amd64.deb
 df33a9f71d03fc30e802f0d321973561e016dac3d26bb8060bd9b1ad849d5062 3003280 linux-headers-6.12.85+deb13-rt-amd64_6.12.85-1_amd64.deb
 803b6edc8f6dd24cc2e1a1313dfb7b263a4487e8445be4a2c881fed3759855cb 1039878664 linux-image-6.12.85+deb13-amd64-dbg_6.12.85-1_amd64.deb
 a1b1c65e8c6f64facebf1a78a5cc62318e6183b378bf7ea2c490cd2eee7d0abb 107662340 linux-image-6.12.85+deb13-amd64-unsigned_6.12.85-1_amd64.deb
 2d97f4153b9ac8de22d9fc1b90011c77002b5ffe15b30387d24d820d832da9c7 318334776 linux-image-6.12.85+deb13-cloud-amd64-dbg_6.12.85-1_amd64.deb
 ab1e52b2f989c1a43f78ef7ba40f09412bd0bef5f00ac465da36a8d44824ef44 34230092 linux-image-6.12.85+deb13-cloud-amd64-unsigned_6.12.85-1_amd64.deb
 b84cadb883e4e0e5c5482abbe51506901b8a7ffa2ff0c1e5de9c9a5e49ff16e2 1039582432 linux-image-6.12.85+deb13-rt-amd64-dbg_6.12.85-1_amd64.deb
 640b0e9bbd1a23d402280f1241df009de1a006c74160555836fa9c5621fe49a6 107660732 linux-image-6.12.85+deb13-rt-amd64-unsigned_6.12.85-1_amd64.deb
 09d04960552ead24be6d61480001b4b6a94fb07d341270eed3d5432593915ae4 1164 linux-image-amd64-dbg_6.12.85-1_amd64.deb
 e83562932ca453c7949eab7f03f420228a9794328d511f6b8e0c0f4dd0036fe3 2174668 linux-image-amd64-signed-template_6.12.85-1_amd64.deb
 f32afc47bcbf2af559abcb5b7d7f8c27eff16b1b2399c6af1749b76f0442e15a 1180 linux-image-cloud-amd64-dbg_6.12.85-1_amd64.deb
 7616cb02ccf1385140079dc6bb504bf5f4b0aeaab822ed84e40e5bb8a6fa01d6 1172 linux-image-rt-amd64-dbg_6.12.85-1_amd64.deb
 92e8fdf46119a9b5155a979bf049db277df14f7657fdfd16fef5567068c42d5f 1919596 linux-kbuild-6.12.85+deb13-dbgsym_6.12.85-1_amd64.deb
 bf1c9b203c4010922884ab49abbc7fb016a2f220abc4e8e986677dc171d839a7 1679664 linux-kbuild-6.12.85+deb13_6.12.85-1_amd64.deb
 990da1a3df8bc44cbc98709d64418e990707e546035e2a979b6709b42222cb42 12298840 linux-perf-dbgsym_6.12.85-1_amd64.deb
 7593a7990aaca7da5a78ea8828b6b7f21410270f12723aea2918cbcee6c8ec20 4800260 linux-perf_6.12.85-1_amd64.deb
 fdf2657e1b6b3f18b5d920fe4f15371f94beb3fbb42e33dd4865e97b16d7217b 22233 linux_6.12.85-1_amd64-buildd.buildinfo
 43509d5159b0b596407d0904dfe76e779843de468ab29c23e7489c0e8e923d13 112140 rtla-dbgsym_6.12.85-1_amd64.deb
 293ddeabcfc4360c4b378916595d115629ee748c2f5949bd7daa304657649d5e 1301428 rtla_6.12.85-1_amd64.deb
 e9b3ce9551c22a31b7a2ea090cc865f8d04e4cdf3019bd4f7beb93c50612e132 145900 usbip-dbgsym_2.0+6.12.85-1_amd64.deb
 00d54d8e076fddf5eb339e62e602e1224fb6887d76f890f5155ceaf8b701e012 1287792 usbip_2.0+6.12.85-1_amd64.deb
Files:
 5a627eddff8ba1fec003204dccc1e3e5 965472 debug optional bpftool-dbgsym_7.5.0+6.12.85-1_amd64.deb
 d287f94e1fd46636225a234a52525293 1530076 devel optional bpftool_7.5.0+6.12.85-1_amd64.deb
 a589f13c999d5708e0d55a0ff145c3b4 46356 debug optional hyperv-daemons-dbgsym_6.12.85-1_amd64.deb
 46e036f3c04e874625acfa44c0604179 1263936 admin optional hyperv-daemons_6.12.85-1_amd64.deb
 235f5fe2372951528cf3a09fe051f1ec 19668 debug optional intel-sdsi-dbgsym_6.12.85-1_amd64.deb
 196a49a8175f4754c4be89a2b37e664f 1252284 admin optional intel-sdsi_6.12.85-1_amd64.deb
 5bf9a10d2849bcc8cfec6e42f45d9c03 1248020 libdevel optional libcpupower-dev_6.12.85-1_amd64.deb
 782ca1ab822dbc971bc85fa74d90e3d8 32368 debug optional libcpupower1-dbgsym_6.12.85-1_amd64.deb
 9c3dbfa51169ccb7c177396d2711299c 1255812 libs optional libcpupower1_6.12.85-1_amd64.deb
 b507fcf5d26da5f0966a56eeb46737a2 1714964 devel optional linux-bpf-dev_6.12.85-1_amd64.deb
 60b92c447141244ef6ef5a9b21451560 1389692 kernel optional linux-config-6.12_6.12.85-1_amd64.deb
 b6caf47b24cbd75ebb04afc267eff70c 402196 debug optional linux-cpupower-dbgsym_6.12.85-1_amd64.deb
 ebfe49e9f91be7d4a1bf4a7ac7fae239 1421452 admin optional linux-cpupower_6.12.85-1_amd64.deb
 bbf1bb262130b57121e98f28e27f1400 3004820 kernel optional linux-headers-6.12.85+deb13-amd64_6.12.85-1_amd64.deb
 ccf96632e45fe51dd1a9353238e47653 2664564 kernel optional linux-headers-6.12.85+deb13-cloud-amd64_6.12.85-1_amd64.deb
 43a9c2952fefcc105062089375b21818 3003280 kernel optional linux-headers-6.12.85+deb13-rt-amd64_6.12.85-1_amd64.deb
 8449cc6e673078ed9e50ad9246a97fba 1039878664 debug optional linux-image-6.12.85+deb13-amd64-dbg_6.12.85-1_amd64.deb
 956aa81ad408ee4a3d7d9e3fe9024df8 107662340 kernel optional linux-image-6.12.85+deb13-amd64-unsigned_6.12.85-1_amd64.deb
 e464c8452ac1ac58a7303fad28a16370 318334776 debug optional linux-image-6.12.85+deb13-cloud-amd64-dbg_6.12.85-1_amd64.deb
 ca488694f124a7228a82b5252ae5760c 34230092 kernel optional linux-image-6.12.85+deb13-cloud-amd64-unsigned_6.12.85-1_amd64.deb
 2f624aa5fb26730b4f669630e89f693e 1039582432 debug optional linux-image-6.12.85+deb13-rt-amd64-dbg_6.12.85-1_amd64.deb
 077ed3be348114561dbf3f7c8b666b29 107660732 kernel optional linux-image-6.12.85+deb13-rt-amd64-unsigned_6.12.85-1_amd64.deb
 e87f580c4570625e3355cfc7751d34bf 1164 kernel optional linux-image-amd64-dbg_6.12.85-1_amd64.deb
 96603dc825d2e6bc5affb84c0b5e0331 2174668 kernel optional linux-image-amd64-signed-template_6.12.85-1_amd64.deb
 374f5fa92d2da2f8da865ac81595e362 1180 kernel optional linux-image-cloud-amd64-dbg_6.12.85-1_amd64.deb
 2cd94aa1aa19700f0a0781ae5fc0eecc 1172 kernel optional linux-image-rt-amd64-dbg_6.12.85-1_amd64.deb
 8f5cc877dcc8987e2e02cd177faf7196 1919596 debug optional linux-kbuild-6.12.85+deb13-dbgsym_6.12.85-1_amd64.deb
 6d214992462f1a86503d6bfe8155c2e3 1679664 kernel optional linux-kbuild-6.12.85+deb13_6.12.85-1_amd64.deb
 4f097a1bf040543fbb39feab6495aaa3 12298840 debug optional linux-perf-dbgsym_6.12.85-1_amd64.deb
 a3fae9549110097a3fcde06b7e58e983 4800260 devel optional linux-perf_6.12.85-1_amd64.deb
 edfc161a09e4b27f4a27ce7f9b47a772 22233 kernel optional linux_6.12.85-1_amd64-buildd.buildinfo
 d3670dc40ade625c29543dbf18d1b1cb 112140 debug optional rtla-dbgsym_6.12.85-1_amd64.deb
 b04a727fd02ecfd10cf3680d8fb1bcf2 1301428 devel optional rtla_6.12.85-1_amd64.deb
 5256440af87df956ddcaad1330ecb0e2 145900 debug optional usbip-dbgsym_2.0+6.12.85-1_amd64.deb
 d9df2ebf0f7706547e92d69e94c9cd28 1287792 admin optional usbip_2.0+6.12.85-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEPAUaMA0H0rOy6qBWf2INRiCdaWIFAmnzamoACgkQf2INRiCd
aWJgChAAlUZn4/JnBcOyLuRwp8H1uXQ/Uq/rqOKIIuQxK8lEtOWRF4I39Km93sOr
3RNs5xQP3wQksFg5Xph+WopXvB/4wOMNr5+uvpL0xD4tCaba9qOHrgfOByNKvhkW
KTUnNDnJH9S6VDpe8soYDiHQ5hG/+BSSdpxp9FLzS5aUwuhhi+L6jeEOLn5d6koM
F1wXv1ggE+YZwTDQQoz7GCL3BDiLDT6fmdvGq0B9+0zT/jVWmBf0rqsWBOde4R3x
BWpW2LbNL36GkINOKL4x0uULWyy0VqySsu1c3cirldL9yf0L6Of+Kth5CPB5tgqo
ekP+FoFq/i9/COt/ZS1HwDbamTZhcfFHI4hP0GMIDwo1/X5gpE3irUOF1TDIuKQS
sPObWz272jPXvxFedmF8Dx+Qz4xJzLBgOWsSwF/CiAKsZs68MOOmGbSrPgCot2up
GyXywmI/xz9jIL5hSJARSYi84H+EIABU3TPsdF5mOgMkH/OKT/j5Y2CNHG2AVb0n
MxIcyXrsbtJS/DyT9pwEd3PAqO5oU/qDvV9X4uxftFBJnWwePETDervlYFEocuRZ
9lZ+Z1MqVLhbATGxpGU3NMn99qRVkrog8DQ8qRqTLh3wjIkDWJAcw2lihPGO+gKk
eJ++xdI4wuOriovfM37b6fCcT+e5C6Njy6ll7pK04X7MJiHCrDI=
=If8F
-----END PGP SIGNATURE-----