Oracle Linux has received several security updates, including important kernel security updates for versions 7, 8, and 9. The Unbreakable Enterprise kernel has been updated to address security vulnerabilities on these versions, with multiple bug fix and enhancement updates also provided for various components such as linux-firmware. In addition, a moderate security update was applied to libxml2 on Oracle Linux 7.

ELSA-2025-20551 Important: Unbreakable Enterprise kernel security update
ELBA-2025-9413 Oracle Linux 10 linux-firmware bug fix update
ELBA-2025-20546 Oracle Linux 10 linux-firmware bug fix update
ELSA-2025-20551 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update
ELSA-2025-20552 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update
ELBA-2025-12877 Oracle Linux 9 linux-firmware bug fix and enhancement update
ELBA-2025-20549 Oracle Linux 7 linux-firmware bug fix update
ELSA-2025-20552 Important: Oracle Linux 8 Unbreakable Enterprise kernel security update
ELSA-2025-13789 Moderate: Oracle Linux 7 libxml2 security update
ELSA-2025-20552 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update
ELBA-2025-20547 Oracle Linux 9 linux-firmware bug fix update
ELBA-2025-10697 Oracle Linux 9 linux-firmware bug fix update
ELBA-2025-20548 Oracle Linux 8 linux-firmware bug fix update
ELBA-2025-8412 Oracle Linux 8 linux-firmware bug fix update
ELBA-2025-20550 Oracle Linux 7 linux-firmware bug fix update

ELSA-2025-20551 Important: Unbreakable Enterprise kernel security update

Oracle Linux Security Advisory ELSA-2025-20551

http://linux.oracle.com/errata/ELSA-2025-20551.html

The following updated rpms for have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-uek-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-core-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-devel-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-doc-6.12.0-103.40.4.1.el10uek.noarch.rpm
kernel-uek-modules-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-core-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-deprecated-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-desktop-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-extra-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-usb-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-modules-wireless-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-tools-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-core-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-devel-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-core-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-desktop-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-extra-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-usb-6.12.0-103.40.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-wireless-6.12.0-103.40.4.1.el10uek.x86_64.rpm

aarch64:
kernel-uek-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-core-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-devel-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-core-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-deprecated-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-desktop-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-extra-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-usb-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-modules-wireless-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-tools-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-core-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-devel-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-core-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-desktop-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-extra-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-usb-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-wireless-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-core-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-devel-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-core-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-deprecated-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-desktop-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-extra-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-extra-netfilter-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-usb-6.12.0-103.40.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-wireless-6.12.0-103.40.4.1.el10uek.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/kernel-uek-6.12.0-103.40.4.1.el10uek.src.rpm

Related CVEs:

CVE-2024-36350
CVE-2024-36357
CVE-2024-49929
CVE-2024-57976
CVE-2024-58091
CVE-2025-21879
CVE-2025-21942
CVE-2025-22101
CVE-2025-22112
CVE-2025-22115
CVE-2025-22119
CVE-2025-22128
CVE-2025-23137
CVE-2025-23155
CVE-2025-37842
CVE-2025-37984
CVE-2025-38067
CVE-2025-38083
CVE-2025-38084
CVE-2025-38085
CVE-2025-38086
CVE-2025-38087
CVE-2025-38088
CVE-2025-38090
CVE-2025-38091
CVE-2025-38092
CVE-2025-38093
CVE-2025-38094
CVE-2025-38095
CVE-2025-38096
CVE-2025-38097
CVE-2025-38098
CVE-2025-38099
CVE-2025-38100
CVE-2025-38101
CVE-2025-38102
CVE-2025-38103
CVE-2025-38104
CVE-2025-38106
CVE-2025-38107
CVE-2025-38108
CVE-2025-38109
CVE-2025-38110
CVE-2025-38111
CVE-2025-38112
CVE-2025-38113
CVE-2025-38115
CVE-2025-38117
CVE-2025-38118
CVE-2025-38119
CVE-2025-38120
CVE-2025-38122
CVE-2025-38123
CVE-2025-38124
CVE-2025-38125
CVE-2025-38126
CVE-2025-38127
CVE-2025-38129
CVE-2025-38131
CVE-2025-38134
CVE-2025-38135
CVE-2025-38136
CVE-2025-38138
CVE-2025-38139
CVE-2025-38141
CVE-2025-38142
CVE-2025-38143
CVE-2025-38145
CVE-2025-38146
CVE-2025-38147
CVE-2025-38148
CVE-2025-38149
CVE-2025-38151
CVE-2025-38153
CVE-2025-38154
CVE-2025-38155
CVE-2025-38156
CVE-2025-38157
CVE-2025-38158
CVE-2025-38159
CVE-2025-38160
CVE-2025-38161
CVE-2025-38162
CVE-2025-38163
CVE-2025-38164
CVE-2025-38165
CVE-2025-38166
CVE-2025-38167
CVE-2025-38168
CVE-2025-38169
CVE-2025-38170
CVE-2025-38172
CVE-2025-38173
CVE-2025-38174
CVE-2025-38177
CVE-2025-38179
CVE-2025-38180
CVE-2025-38181
CVE-2025-38182
CVE-2025-38183
CVE-2025-38184
CVE-2025-38185
CVE-2025-38186
CVE-2025-38188
CVE-2025-38189
CVE-2025-38190
CVE-2025-38191
CVE-2025-38192
CVE-2025-38193
CVE-2025-38194
CVE-2025-38195
CVE-2025-38197
CVE-2025-38198
CVE-2025-38200
CVE-2025-38201
CVE-2025-38202
CVE-2025-38208
CVE-2025-38210
CVE-2025-38211
CVE-2025-38212
CVE-2025-38214
CVE-2025-38215
CVE-2025-38216
CVE-2025-38217
CVE-2025-38218
CVE-2025-38219
CVE-2025-38220
CVE-2025-38222
CVE-2025-38223
CVE-2025-38224
CVE-2025-38225
CVE-2025-38226
CVE-2025-38227
CVE-2025-38228
CVE-2025-38229
CVE-2025-38230
CVE-2025-38231
CVE-2025-38232
CVE-2025-38236
CVE-2025-38238
CVE-2025-38239
CVE-2025-38242
CVE-2025-38243
CVE-2025-38244
CVE-2025-38245
CVE-2025-38246
CVE-2025-38249
CVE-2025-38250
CVE-2025-38251
CVE-2025-38253
CVE-2025-38255
CVE-2025-38256
CVE-2025-38257
CVE-2025-38258
CVE-2025-38259
CVE-2025-38260
CVE-2025-38262
CVE-2025-38263
CVE-2025-38264
CVE-2025-38265
CVE-2025-38267
CVE-2025-38268
CVE-2025-38269
CVE-2025-38270
CVE-2025-38273
CVE-2025-38274
CVE-2025-38275
CVE-2025-38277
CVE-2025-38278
CVE-2025-38279
CVE-2025-38280
CVE-2025-38282
CVE-2025-38283
CVE-2025-38285
CVE-2025-38286
CVE-2025-38288
CVE-2025-38289
CVE-2025-38290
CVE-2025-38292
CVE-2025-38293
CVE-2025-38295
CVE-2025-38297
CVE-2025-38298
CVE-2025-38299
CVE-2025-38300
CVE-2025-38301
CVE-2025-38302
CVE-2025-38303
CVE-2025-38304
CVE-2025-38305
CVE-2025-38307
CVE-2025-38310
CVE-2025-38312
CVE-2025-38313
CVE-2025-38315
CVE-2025-38317
CVE-2025-38318
CVE-2025-38319
CVE-2025-38320
CVE-2025-38321
CVE-2025-38323
CVE-2025-38324
CVE-2025-38325
CVE-2025-38326
CVE-2025-38328
CVE-2025-38331
CVE-2025-38332
CVE-2025-38333
CVE-2025-38334
CVE-2025-38336
CVE-2025-38337
CVE-2025-38338
CVE-2025-38341
CVE-2025-38342
CVE-2025-38343
CVE-2025-38344
CVE-2025-38345
CVE-2025-38346
CVE-2025-38347
CVE-2025-38348
CVE-2025-38349
CVE-2025-38350
CVE-2025-38352
CVE-2025-38353
CVE-2025-38354
CVE-2025-38355
CVE-2025-38356
CVE-2025-38360
CVE-2025-38361
CVE-2025-38362
CVE-2025-38363
CVE-2025-38364
CVE-2025-38365
CVE-2025-38368
CVE-2025-38369
CVE-2025-38371
CVE-2025-38372
CVE-2025-38373
CVE-2025-38374
CVE-2025-38375
CVE-2025-38376
CVE-2025-38377
CVE-2025-38379
CVE-2025-38380
CVE-2025-38381
CVE-2025-38382
CVE-2025-38383
CVE-2025-38384
CVE-2025-38385
CVE-2025-38386
CVE-2025-38387
CVE-2025-38388
CVE-2025-38389
CVE-2025-38390
CVE-2025-38391
CVE-2025-38392
CVE-2025-38393
CVE-2025-38395
CVE-2025-38396
CVE-2025-38399
CVE-2025-38400
CVE-2025-38401
CVE-2025-38402
CVE-2025-38403
CVE-2025-38404
CVE-2025-38405
CVE-2025-38406
CVE-2025-38407
CVE-2025-38408
CVE-2025-38409
CVE-2025-38410
CVE-2025-38412
CVE-2025-38413
CVE-2025-38414
CVE-2025-38415
CVE-2025-38416
CVE-2025-38417
CVE-2025-38418
CVE-2025-38419
CVE-2025-38420
CVE-2025-38422
CVE-2025-38423
CVE-2025-38424
CVE-2025-38425
CVE-2025-38427
CVE-2025-38428
CVE-2025-38429
CVE-2025-38430
CVE-2025-38436
CVE-2025-38437
CVE-2025-38438
CVE-2025-38439
CVE-2025-38440
CVE-2025-38441
CVE-2025-38443
CVE-2025-38444
CVE-2025-38445
CVE-2025-38446
CVE-2025-38448
CVE-2025-38449
CVE-2025-38450
CVE-2025-38451
CVE-2025-38452
CVE-2025-38454
CVE-2025-38455
CVE-2025-38456
CVE-2025-38457
CVE-2025-38458
CVE-2025-38459
CVE-2025-38460
CVE-2025-38461
CVE-2025-38462
CVE-2025-38463
CVE-2025-38464
CVE-2025-38465
CVE-2025-38466
CVE-2025-38467
CVE-2025-38468
CVE-2025-38469
CVE-2025-38470
CVE-2025-38471
CVE-2025-38472
CVE-2025-38473
CVE-2025-38474
CVE-2025-38475
CVE-2025-38476
CVE-2025-38477
CVE-2025-38478
CVE-2025-38480
CVE-2025-38481
CVE-2025-38482
CVE-2025-38483
CVE-2025-38484
CVE-2025-38485
CVE-2025-38488
CVE-2025-38489
CVE-2025-38490
CVE-2025-38491
CVE-2025-38493
CVE-2025-38494
CVE-2025-38495
CVE-2025-38496
CVE-2025-38497
CVE-2025-38498
CVE-2025-38499
CVE-2025-38503
CVE-2025-38505
CVE-2025-38506
CVE-2025-38507
CVE-2025-38510
CVE-2025-38511
CVE-2025-38512
CVE-2025-38513
CVE-2025-38514
CVE-2025-38515
CVE-2025-38516
CVE-2025-38517
CVE-2025-38520
CVE-2025-38521
CVE-2025-38523
CVE-2025-38524
CVE-2025-38526
CVE-2025-38527
CVE-2025-38528
CVE-2025-38529
CVE-2025-38530
CVE-2025-38531
CVE-2025-38532
CVE-2025-38533
CVE-2025-38535
CVE-2025-38537
CVE-2025-38538
CVE-2025-38539
CVE-2025-38540
CVE-2025-38541
CVE-2025-38542
CVE-2025-38543
CVE-2025-38544
CVE-2025-38545
CVE-2025-38546
CVE-2025-38547
CVE-2025-38548
CVE-2025-38549
CVE-2025-38550
CVE-2025-38551
CVE-2025-38552

Description of changes:

[6.12.0-103.40.4.1.el10uek]
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38361037]

[6.12.0-103.40.4.el10uek]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]

[6.12.0-103.40.3.el10uek]
- enic: get max rq & wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]

[6.12.0-103.40.2.el10uek]
- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use #[used(compiler)] to fix build and modpost with Rust >= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more noreturn Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing dma_map_error() (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of z_erofs_next_pcluster_t (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow dead_code warnings for Rust >= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also transport_local (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix vsock_proto declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg->scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req->base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)

[6.12.0-103.36.1.el10uek]
- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]

ELBA-2025-9413 Oracle Linux 10 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-9413

http://linux.oracle.com/errata/ELBA-2025-9413.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.43.el10.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el10.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el10.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el10.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el10.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el10.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el10.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el10.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el10.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el10.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el10.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el10.noarch.rpm
linux-firmware-whence-20250828-999.43.git260ff424.el10.noarch.rpm
liquidio-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
netronome-firmware-20250828-999.43.git260ff424.el10.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.43.el10.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el10.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el10.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el10.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el10.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el10.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el10.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el10.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el10.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el10.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el10.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el10.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el10.noarch.rpm
linux-firmware-whence-20250828-999.43.git260ff424.el10.noarch.rpm
liquidio-firmware-20250828-999.43.git260ff424.el10.noarch.rpm
netronome-firmware-20250828-999.43.git260ff424.el10.noarch.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/linux-firmware-20250828-999.43.git260ff424.el10.src.rpm

Description of changes:

[20250828-999.43.git260ff424.el10]
- Rebase to latest upstream [Orabug: 38200684]
- Solve conflicts caused by symbolic link changes [Orabug: 38206139]

[20250826-999.42.git356f06bf.el10]
- Handling downgrade issue for Nvidia firmware changes [Orabug: 38303112]

[20250611-999.41.git356f06bf.el10]
- Rebase to latest upstream and update the core list for UEK8 [Orabug: 38028345]

[20250423-999.40.git32f3227b.el10]
- Rebase to latest upstream [Orabug: 37868435]

[20250319-999.39.git430633ec.el10]
- Rebase to latest upstream [Orabug: 37729115]

[20250203-999.38.git0fd450ee.el10]
- Rebase to latest upstream [Orabug: 37535629]
- Avoid showing microcode reload error if it's up to date [Orabug: 37387663]

[20241213-999.36.git2cdfe09e.el10]
- Rebase to latest upstream [Orabug: 37405529]

[20241003-999.35.git95bfe086.el10]
- Create rpms for OL10. [Orabug: 37331081]

ELBA-2025-20546 Oracle Linux 10 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-20546

http://linux.oracle.com/errata/ELBA-2025-20546.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.42.el10.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el10.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl3160-firmware-25.30.13.0-999.42.el10.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el10.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el10.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el10.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el10.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el10.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el10.noarch.rpm
iwl7260-firmware-25.30.13.0-999.42.el10.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el10.noarch.rpm
libertas-sd8686-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
libertas-sd8787-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
libertas-usb8388-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
libertas-usb8388-olpc-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
linux-firmware-core-20250826-999.42.git356f06bf.el10.noarch.rpm
linux-firmware-whence-20250826-999.42.git356f06bf.el10.noarch.rpm
liquidio-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
netronome-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.42.el10.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el10.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl3160-firmware-25.30.13.0-999.42.el10.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el10.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el10.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el10.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el10.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el10.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.42.el10.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el10.noarch.rpm
iwl7260-firmware-25.30.13.0-999.42.el10.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el10.noarch.rpm
libertas-sd8686-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
libertas-sd8787-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
libertas-usb8388-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
libertas-usb8388-olpc-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
linux-firmware-core-20250826-999.42.git356f06bf.el10.noarch.rpm
linux-firmware-whence-20250826-999.42.git356f06bf.el10.noarch.rpm
liquidio-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm
netronome-firmware-20250826-999.42.git356f06bf.el10.noarch.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/linux-firmware-20250826-999.42.git356f06bf.el10.src.rpm

Description of changes:

[20250826-999.42.git356f06bf.el10]
- Handling downgrade issue for Nvidia firmware changes [Orabug: 38303112]

[20250611-999.41.git356f06bf.el10]
- Rebase to latest upstream and update the core list for UEK8 [Orabug: 38028345]

[20250423-999.40.git32f3227b.el10]
- Rebase to latest upstream [Orabug: 37868435]

[20250319-999.39.git430633ec.el10]
- Rebase to latest upstream [Orabug: 37729115]

[20250203-999.38.git0fd450ee.el10]
- Rebase to latest upstream [Orabug: 37535629]
- Avoid showing microcode reload error if it's up to date [Orabug: 37387663]

[20241213-999.36.git2cdfe09e.el10]
- Rebase to latest upstream [Orabug: 37405529]

[20241003-999.35.git95bfe086.el10]
- Create rpms for OL10. [Orabug: 37331081]

ELSA-2025-20551 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update

Oracle Linux Security Advisory ELSA-2025-20551

http://linux.oracle.com/errata/ELSA-2025-20551.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-uek-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-core-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-core-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-devel-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-core-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-desktop-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-usb-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-debug-modules-wireless-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-devel-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-doc-6.12.0-103.40.4.1.el9uek.noarch.rpm
kernel-uek-modules-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-core-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-deprecated-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-desktop-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-extra-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-usb-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-modules-wireless-6.12.0-103.40.4.1.el9uek.x86_64.rpm
kernel-uek-tools-6.12.0-103.40.4.1.el9uek.x86_64.rpm

aarch64:
kernel-uek-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-core-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-core-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-devel-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-core-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-desktop-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-extra-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-usb-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-debug-modules-wireless-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-devel-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-extra-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-core-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-deprecated-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-desktop-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-usb-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-modules-wireless-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek-tools-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-core-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-devel-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-core-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-deprecated-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-desktop-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-extra-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-extra-netfilter-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-usb-6.12.0-103.40.4.1.el9uek.aarch64.rpm
kernel-uek64k-modules-wireless-6.12.0-103.40.4.1.el9uek.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-6.12.0-103.40.4.1.el9uek.src.rpm

Related CVEs:

CVE-2024-36350
CVE-2024-36357
CVE-2024-49929
CVE-2024-57976
CVE-2024-58091
CVE-2025-21879
CVE-2025-21942
CVE-2025-22101
CVE-2025-22112
CVE-2025-22115
CVE-2025-22119
CVE-2025-22128
CVE-2025-23137
CVE-2025-23155
CVE-2025-37842
CVE-2025-37984
CVE-2025-38067
CVE-2025-38083
CVE-2025-38084
CVE-2025-38085
CVE-2025-38086
CVE-2025-38087
CVE-2025-38088
CVE-2025-38090
CVE-2025-38091
CVE-2025-38092
CVE-2025-38093
CVE-2025-38094
CVE-2025-38095
CVE-2025-38096
CVE-2025-38097
CVE-2025-38098
CVE-2025-38099
CVE-2025-38100
CVE-2025-38101
CVE-2025-38102
CVE-2025-38103
CVE-2025-38104
CVE-2025-38106
CVE-2025-38107
CVE-2025-38108
CVE-2025-38109
CVE-2025-38110
CVE-2025-38111
CVE-2025-38112
CVE-2025-38113
CVE-2025-38115
CVE-2025-38117
CVE-2025-38118
CVE-2025-38119
CVE-2025-38120
CVE-2025-38122
CVE-2025-38123
CVE-2025-38124
CVE-2025-38125
CVE-2025-38126
CVE-2025-38127
CVE-2025-38129
CVE-2025-38131
CVE-2025-38134
CVE-2025-38135
CVE-2025-38136
CVE-2025-38138
CVE-2025-38139
CVE-2025-38141
CVE-2025-38142
CVE-2025-38143
CVE-2025-38145
CVE-2025-38146
CVE-2025-38147
CVE-2025-38148
CVE-2025-38149
CVE-2025-38151
CVE-2025-38153
CVE-2025-38154
CVE-2025-38155
CVE-2025-38156
CVE-2025-38157
CVE-2025-38158
CVE-2025-38159
CVE-2025-38160
CVE-2025-38161
CVE-2025-38162
CVE-2025-38163
CVE-2025-38164
CVE-2025-38165
CVE-2025-38166
CVE-2025-38167
CVE-2025-38168
CVE-2025-38169
CVE-2025-38170
CVE-2025-38172
CVE-2025-38173
CVE-2025-38174
CVE-2025-38177
CVE-2025-38179
CVE-2025-38180
CVE-2025-38181
CVE-2025-38182
CVE-2025-38183
CVE-2025-38184
CVE-2025-38185
CVE-2025-38186
CVE-2025-38188
CVE-2025-38189
CVE-2025-38190
CVE-2025-38191
CVE-2025-38192
CVE-2025-38193
CVE-2025-38194
CVE-2025-38195
CVE-2025-38197
CVE-2025-38198
CVE-2025-38200
CVE-2025-38201
CVE-2025-38202
CVE-2025-38208
CVE-2025-38210
CVE-2025-38211
CVE-2025-38212
CVE-2025-38214
CVE-2025-38215
CVE-2025-38216
CVE-2025-38217
CVE-2025-38218
CVE-2025-38219
CVE-2025-38220
CVE-2025-38222
CVE-2025-38223
CVE-2025-38224
CVE-2025-38225
CVE-2025-38226
CVE-2025-38227
CVE-2025-38228
CVE-2025-38229
CVE-2025-38230
CVE-2025-38231
CVE-2025-38232
CVE-2025-38236
CVE-2025-38238
CVE-2025-38239
CVE-2025-38242
CVE-2025-38243
CVE-2025-38244
CVE-2025-38245
CVE-2025-38246
CVE-2025-38249
CVE-2025-38250
CVE-2025-38251
CVE-2025-38253
CVE-2025-38255
CVE-2025-38256
CVE-2025-38257
CVE-2025-38258
CVE-2025-38259
CVE-2025-38260
CVE-2025-38262
CVE-2025-38263
CVE-2025-38264
CVE-2025-38265
CVE-2025-38267
CVE-2025-38268
CVE-2025-38269
CVE-2025-38270
CVE-2025-38273
CVE-2025-38274
CVE-2025-38275
CVE-2025-38277
CVE-2025-38278
CVE-2025-38279
CVE-2025-38280
CVE-2025-38282
CVE-2025-38283
CVE-2025-38285
CVE-2025-38286
CVE-2025-38288
CVE-2025-38289
CVE-2025-38290
CVE-2025-38292
CVE-2025-38293
CVE-2025-38295
CVE-2025-38297
CVE-2025-38298
CVE-2025-38299
CVE-2025-38300
CVE-2025-38301
CVE-2025-38302
CVE-2025-38303
CVE-2025-38304
CVE-2025-38305
CVE-2025-38307
CVE-2025-38310
CVE-2025-38312
CVE-2025-38313
CVE-2025-38315
CVE-2025-38317
CVE-2025-38318
CVE-2025-38319
CVE-2025-38320
CVE-2025-38321
CVE-2025-38323
CVE-2025-38324
CVE-2025-38325
CVE-2025-38326
CVE-2025-38328
CVE-2025-38331
CVE-2025-38332
CVE-2025-38333
CVE-2025-38334
CVE-2025-38336
CVE-2025-38337
CVE-2025-38338
CVE-2025-38341
CVE-2025-38342
CVE-2025-38343
CVE-2025-38344
CVE-2025-38345
CVE-2025-38346
CVE-2025-38347
CVE-2025-38348
CVE-2025-38349
CVE-2025-38350
CVE-2025-38352
CVE-2025-38353
CVE-2025-38354
CVE-2025-38355
CVE-2025-38356
CVE-2025-38360
CVE-2025-38361
CVE-2025-38362
CVE-2025-38363
CVE-2025-38364
CVE-2025-38365
CVE-2025-38368
CVE-2025-38369
CVE-2025-38371
CVE-2025-38372
CVE-2025-38373
CVE-2025-38374
CVE-2025-38375
CVE-2025-38376
CVE-2025-38377
CVE-2025-38379
CVE-2025-38380
CVE-2025-38381
CVE-2025-38382
CVE-2025-38383
CVE-2025-38384
CVE-2025-38385
CVE-2025-38386
CVE-2025-38387
CVE-2025-38388
CVE-2025-38389
CVE-2025-38390
CVE-2025-38391
CVE-2025-38392
CVE-2025-38393
CVE-2025-38395
CVE-2025-38396
CVE-2025-38399
CVE-2025-38400
CVE-2025-38401
CVE-2025-38402
CVE-2025-38403
CVE-2025-38404
CVE-2025-38405
CVE-2025-38406
CVE-2025-38407
CVE-2025-38408
CVE-2025-38409
CVE-2025-38410
CVE-2025-38412
CVE-2025-38413
CVE-2025-38414
CVE-2025-38415
CVE-2025-38416
CVE-2025-38417
CVE-2025-38418
CVE-2025-38419
CVE-2025-38420
CVE-2025-38422
CVE-2025-38423
CVE-2025-38424
CVE-2025-38425
CVE-2025-38427
CVE-2025-38428
CVE-2025-38429
CVE-2025-38430
CVE-2025-38436
CVE-2025-38437
CVE-2025-38438
CVE-2025-38439
CVE-2025-38440
CVE-2025-38441
CVE-2025-38443
CVE-2025-38444
CVE-2025-38445
CVE-2025-38446
CVE-2025-38448
CVE-2025-38449
CVE-2025-38450
CVE-2025-38451
CVE-2025-38452
CVE-2025-38454
CVE-2025-38455
CVE-2025-38456
CVE-2025-38457
CVE-2025-38458
CVE-2025-38459
CVE-2025-38460
CVE-2025-38461
CVE-2025-38462
CVE-2025-38463
CVE-2025-38464
CVE-2025-38465
CVE-2025-38466
CVE-2025-38467
CVE-2025-38468
CVE-2025-38469
CVE-2025-38470
CVE-2025-38471
CVE-2025-38472
CVE-2025-38473
CVE-2025-38474
CVE-2025-38475
CVE-2025-38476
CVE-2025-38477
CVE-2025-38478
CVE-2025-38480
CVE-2025-38481
CVE-2025-38482
CVE-2025-38483
CVE-2025-38484
CVE-2025-38485
CVE-2025-38488
CVE-2025-38489
CVE-2025-38490
CVE-2025-38491
CVE-2025-38493
CVE-2025-38494
CVE-2025-38495
CVE-2025-38496
CVE-2025-38497
CVE-2025-38498
CVE-2025-38499
CVE-2025-38503
CVE-2025-38505
CVE-2025-38506
CVE-2025-38507
CVE-2025-38510
CVE-2025-38511
CVE-2025-38512
CVE-2025-38513
CVE-2025-38514
CVE-2025-38515
CVE-2025-38516
CVE-2025-38517
CVE-2025-38520
CVE-2025-38521
CVE-2025-38523
CVE-2025-38524
CVE-2025-38526
CVE-2025-38527
CVE-2025-38528
CVE-2025-38529
CVE-2025-38530
CVE-2025-38531
CVE-2025-38532
CVE-2025-38533
CVE-2025-38535
CVE-2025-38537
CVE-2025-38538
CVE-2025-38539
CVE-2025-38540
CVE-2025-38541
CVE-2025-38542
CVE-2025-38543
CVE-2025-38544
CVE-2025-38545
CVE-2025-38546
CVE-2025-38547
CVE-2025-38548
CVE-2025-38549
CVE-2025-38550
CVE-2025-38551
CVE-2025-38552

Description of changes:

[6.12.0-103.40.4.1.el9uek]
- netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38361037]

[6.12.0-103.40.4.el9uek]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169301]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38325898]

[6.12.0-103.40.3.el9uek]
- enic: get max rq & wq entries supported by hw, 16K queues (Satish Kharat) [Orabug: 38058289]
- enic: cleanup of enic wq request completion path (Satish Kharat) [Orabug: 38058289]
- enic: added enic_wq.c and enic_wq.h (Satish Kharat) [Orabug: 38058289]
- enic: remove unused function cq_enet_wq_desc_dec (Satish Kharat) [Orabug: 38058289]
- enic: enable rq extended cq support (Satish Kharat) [Orabug: 38058289]
- enic: enic rq extended cq defines (Satish Kharat) [Orabug: 38058289]
- enic: enic rq code reorg (Satish Kharat) [Orabug: 38058289]
- enic: Move function from header file to c file (Satish Kharat) [Orabug: 38058289]
- enic: add dependency on Page Pool (John Daley) [Orabug: 38058289]
- enic: remove copybreak tunable (John Daley) [Orabug: 38058289]
- enic: Use the Page Pool API for RX (John Daley) [Orabug: 38058289]
- enic: Simplify RX handler function (John Daley) [Orabug: 38058289]
- enic: Move RX functions to their own file (John Daley) [Orabug: 38058289]
- enic: Fix typo in comment in table indexed by link speed (John Daley) [Orabug: 38058289]
- enic: Obtain the Link speed only after the link comes up (John Daley) [Orabug: 38058289]
- enic: Move RX coalescing set function (John Daley) [Orabug: 38058289]
- enic: Move kdump check into enic_adjust_resources() (Nelson Escobar) [Orabug: 38058289]
- enic: Move enic resource adjustments to separate function (Nelson Escobar) [Orabug: 38058289]
- enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (Nelson Escobar) [Orabug: 38058289]
- enic: Allocate arrays in enic struct based on VIC config (Nelson Escobar) [Orabug: 38058289]
- enic: Save resource counts we read from HW (Nelson Escobar) [Orabug: 38058289]
- enic: Make MSI-X I/O interrupts come after the other required ones (Nelson Escobar) [Orabug: 38058289]
- enic: Create enic_wq/rq structures to bundle per wq/rq data (Nelson Escobar) [Orabug: 38058289]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161799]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161799]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161799]
- block: use chunk_sectors when evaluating stacked atomic write limits (John Garry) [Orabug: 38279050]
- dm-stripe: limit chunk_sectors to the stripe size (John Garry) [Orabug: 38279050]
- md/raid10: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- md/raid0: set chunk_sectors limit (John Garry) [Orabug: 38279050]
- block: sanitize chunk_sectors for atomic write limits (John Garry) [Orabug: 38279050]
- ilog2: add max_pow_of_two_factor() (John Garry) [Orabug: 38279050]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38281424]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38281424]

[6.12.0-103.40.2.el9uek]
- arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue (Marc Zyngier) [Orabug: 38194015]
- arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 (D Scott Phillips) [Orabug: 38194015]
- scsi: fnic: Set appropriate logging level for log message (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Turn off FDMI ACTIVE flags on link down (Karan Tilak Kumar) [Orabug: 38226429]
- scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (Karan Tilak Kumar) [Orabug: 38175020,38226429] {CVE-2025-38238}
- fnic: treewide: Switch/rename to timer_delete[_sync]() (Thomas Gleixner) [Orabug: 38226429]
- LTS version: v6.12.40 (Jack Vogel)
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (Manuel Andreas) [Orabug: 38254220] {CVE-2025-38469}
- iommu/vt-d: Fix misplaced domain_attached assignment (Bbaa)
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Stefan Metzmacher)
- drm/xe: Move page fault init after topology init (Matthew Brost)
- drm/xe/mocs: Initialize MOCS index early (Balasubramani Vivekanandan)
- sched,freezer: Remove unnecessary warning in __thaw_task (Chen Ridong)
- i2c: omap: fix deprecated of_property_read_bool() use (Johan Hovold)
- i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Fix an error handling path in omap_i2c_probe() (Christophe Jaillet)
- i2c: omap: Add support for setting mux (Jayesh Choudhary)
- selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar (Ihor Solodrai)
- rust: use #[used(compiler)] to fix build and modpost with Rust >= 1.89.0 (Miguel Ojeda)
- net: libwx: fix multicast packets received count (Jiawen Wu)
- usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
- usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
- usb: hub: Fix flushing of delayed work used for post resume purposes (Mathias Nyman)
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
- btrfs: fix block group refcount race in btrfs_create_pending_block_groups() (Boris Burkov) [Orabug: 37844509] {CVE-2025-22115}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310005] {CVE-2025-38499}
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (Breno Leitao) [Orabug: 38324320] {CVE-2025-38549}
- libbpf: Fix handling of BPF arena relocations (Andrii Nakryiko)
- drm/mediatek: only announce AFBC if really supported (Icenowy Zheng)
- drm/mediatek: Add wait_event_timeout when disabling plane (Jason-JH Lin)
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" (Chen Ridong)
- rxrpc: Fix transmission of an abort in response to an abort (David Howells)
- rxrpc: Fix recv-recv race of completed call (David Howells) [Orabug: 38324205] {CVE-2025-38524}
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254212] {CVE-2025-38468}
- net: bridge: Do not offload IGMP/MLD messages (Joseph Huang)
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254223] {CVE-2025-38470}
- tls: always refresh the queue when reading sock (Jakub Kicinski) [Orabug: 38254232] {CVE-2025-38471}
- virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324329] {CVE-2025-38551}
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Li Tian)
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset (Michal Wajdeczko)
- drm/xe/pf: Move VFs reprovisioning to worker (Michal Wajdeczko)
- drm/xe/pf: Sanitize VF scratch registers on FLR (Michal Wajdeczko)
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (Florian Westphal) [Orabug: 38254235] {CVE-2025-38472}
- net: fix segmentation after TCP/UDP fraglist GRO (Felix Fietkau)
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (Yue Haibing) [Orabug: 38324325] {CVE-2025-38550}
- net/mlx5: Correctly set gso_size when LRO is used (Christoph Paasch)
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID (Zijun Hu)
- Bluetooth: hci_core: add missing braces when using macro parameters (Christian Eggers)
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
- Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: fix connectable extended advertising when using static random address (Alessandro Gasbarroni)
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254239] {CVE-2025-38473}
- riscv: traps_misaligned: properly sign extend value in misaligned load handler (Andreas Schwab)
- riscv: Enable interrupt during exception handling (Nam Cao)
- loop: use kiocb helpers to fix lockdep warning (Ming Lei)
- usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254247] {CVE-2025-38474}
- ice: check correct pointer in fwlog debugfs (Michal Swiatkowski)
- ice: add NULL check in eswitch lag check (Dave Ertman) [Orabug: 38324213] {CVE-2025-38526}
- hwmon: (corsair-cpro) Validate the size of the received input buffer (Marius Zachmann) [Orabug: 38324317] {CVE-2025-38548}
- selftests: net: increase inter-packet timeout in udpgro.sh (Paolo Abeni)
- can: tcan4x5x: fix reset gpio usage during probe (Brett Werling)
- can: tcan4x5x: add option for selecting nWKRQ voltage (Sean Nyekjaer)
- wifi: cfg80211: remove scan request n_channels counted_by (Johannes Berg)
- nvmet-tcp: fix callback lock for TLS handshake (Maurizio Lombardi)
- nvme: fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
- net: phy: Don't register LEDs for genphy (Sean Anderson) [Orabug: 38324260] {CVE-2025-38537}
- smc: Fix various oops due to inet_sock type confusion. (Kuniyuki Iwashima) [Orabug: 38254256] {CVE-2025-38475}
- nvme: fix endianness of command word prints in nvme_log_err_passthru() (John Garry)
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() (Zheng Qixing)
- fix a leak in fcntl_dirnotify() (Al Viro)
- smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [Orabug: 38324216] {CVE-2025-38527}
- rpl: Fix use-after-free in rpl_do_srh_inline(). (Kuniyuki Iwashima) [Orabug: 38254259] {CVE-2025-38476}
- net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254264] {CVE-2025-38477}
- block: fix kobject leak in blk_unregister_queue (Ming Lei)
- net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
- cachefiles: Fix the incorrect return value in __cachefiles_write() (Zizhi Wo)
- selftests/sched_ext: Fix exit selftest hang on UP (Andrea Righi)
- bpf: Reject %p% format string in bprintf-like helpers (Paul Chaignon) [Orabug: 38324225] {CVE-2025-38528}
- arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep (Richard Zhu)
- soundwire: amd: fix for clearing command status register (Vijendar Mukunda)
- soundwire: amd: fix for handling slave alerts after link is down (Vijendar Mukunda)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B (Andy Yan)
- arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5 (Andy Yan)
- comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254270] {CVE-2025-38478}
- comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254276] {CVE-2025-38480}
- comedi: Fix some signed shift left operations (Ian Abbott)
- comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254283] {CVE-2025-38481}
- comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254291] {CVE-2025-38482}
- comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254299] {CVE-2025-38483}
- comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324229] {CVE-2025-38529}
- comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324236] {CVE-2025-38530}
- iio: common: st_sensors: Fix use of uninitialize device structs (Maud Spierings) [Orabug: 38324242] {CVE-2025-38531}
- iio: backend: fix out-of-bound write (Markus Burri) [Orabug: 38254383] {CVE-2025-38484}
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
- iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps (Chen-Yu Tsai) [Orabug: 38324314] {CVE-2025-38547}
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush (Sean Nyekjaer) [Orabug: 38254306] {CVE-2025-38485}
- soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
- soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
- smb: client: fix use-after-free in crypt_message when using async crypto (Wang Zhaolong) [Orabug: 38254322] {CVE-2025-38488}
- s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again (Ilya Leoshkevich) [Orabug: 38254325] {CVE-2025-38489}
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
- net: libwx: properly reset Rx ring descriptor (Jiawen Wu) [Orabug: 38324251] {CVE-2025-38532}
- net: libwx: fix the using of Rx buffer DMA (Jiawen Wu) [Orabug: 38324253] {CVE-2025-38533}
- net: libwx: remove duplicate page_pool_put_full_page() (Jiawen Wu) [Orabug: 38254327] {CVE-2025-38490}
- net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback (Markus Blöchl)
- mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
- mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
- isofs: Verify inode mode when loading from disk (Jan Kara)
- dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324262] {CVE-2025-38538}
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y (Daniel Lezcano)
- Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type (Luiz Augusto von Dentz)
- af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
- arm64: dts: rockchip: use cs-gpios for spi1 on ringneck (Jakob Unterwurzacher)
- arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency (Tim Harvey)
- arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on (Francesco Dolcini)
- arm64: dts: add big-endian property back into watchdog node (Meng Li)
- arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency (Tim Harvey)
- net/mlx5: Update the list of the PCI supported devices (Maor Gottlieb)
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
- mptcp: reset fallback status gracefully at disconnect() time (Paolo Abeni)
- mptcp: plug races between subflow fail and subflow creation (Paolo Abeni) [Orabug: 38324332] {CVE-2025-38552}
- mptcp: make fallback action and fallback decision atomic (Paolo Abeni) [Orabug: 38254329] {CVE-2025-38491}
- io_uring/poll: fix POLLERR handling (Pavel Begunkov)
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS (Takashi Iwai)
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx (Edip Hazuri)
- drm/amd/display: Free memory allocation (Clayton King)
- drm/amd/display: Disable CRTC degamma LUT for DCN401 (Melissa Wen)
- drm/amdgpu: Increase reset counter only on success (Lijo Lazar)
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume (Eeli Haapalainen)
- objtool/rust: add one more noreturn Rust function for Rust 1.89.0 (Miguel Ojeda)
- tracing/osnoise: Fix crash in timerlat_dump_stack() (Tomas Glozar) [Orabug: 38254335] {CVE-2025-38493}
- tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324268] {CVE-2025-38539}
- tracing/probes: Avoid using params uninitialized in parse_btf_arg() (Nathan Chancellor)
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254338] {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254346] {CVE-2025-38495}
- dm-bufio: fix sched in atomic context (Sheng Yong) [Orabug: 38254353] {CVE-2025-38496}
- spi: Add check for 8-bit transfer with 8 IO mode support (Cheng Ming Lin)
- pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
- Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion (Michael C. Pratt)
- nvmem: imx-ocotp: fix MAC address byte length (Steffen Bätz)
- Revert "staging: vchiq_arm: Create keep-alive thread during probe" (Stefan Wahren)
- thunderbolt: Fix bit masking in tb_dp_port_set_hops() (Alok Tiwari)
- thunderbolt: Fix wake on connect at runtime (Mario Limonciello)
- i2c: stm32f7: unmap DMA mapped buffer (Clément Le Goffic)
- i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
- usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254356] {CVE-2025-38497}
- usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY (Minas Harutyunyan)
- usb: musb: fix gadget state on disconnect (Drew Hamilton)
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
- USB: serial: option: add Foxconn T99W640 (Slark Xiao)
- USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
- phy: tegra: xusb: Disable periodic tracking on Tegra234 (Haotien Hsu)
- phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode (Wayne Chang)
- phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode (Wayne Chang) [Orabug: 38324256] {CVE-2025-38535}
- LTS version: v6.12.39 (Jack Vogel)
- KVM: SVM: Set synthesized TSA CPUID flags (Borislav Petkov)
- rseq: Fix segfault on registration when rseq_cs is non-zero (Michael Jeanson) [Orabug: 38095070] {CVE-2025-38067}
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (Lukas Wunner) [Orabug: 37977089] {CVE-2025-37984}
- arm64: Filter out SME hwcaps when FEAT_SME isn't implemented (Mark Brown)
- ksmbd: fix potential use-after-free in oplock/lease break ack (Namjae Jeon) [Orabug: 38254080] {CVE-2025-38437}
- kasan: remove kasan_find_vm_area() to prevent possible deadlock (Levi Yun) [Orabug: 38324146] {CVE-2025-38510}
- net: wangxun: revert the adjustment of the IRQ vector sequence (Jiawen Wu)
- erofs: fix rare pcluster memory leak after unmounting (Gao Xiang)
- selftests/bpf: adapt one more case in test_lru_map to the new target_free (Willem de Bruijn)
- HID: nintendo: avoid bluetooth suspend/resume stalls (Daniel J. Ogorchock) [Orabug: 38324137] {CVE-2025-38507}
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324277] {CVE-2025-38540}
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
- riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment (Fangrui Song)
- bpf: Adjust free target to avoid global starvation of LRU map (Willem de Bruijn)
- vt: add missing notification when switching back to text mode (Nicolas Pitre)
- btrfs: fix assertion when building free space tree (Filipe Manana) [Orabug: 38324119] {CVE-2025-38503}
- net: mana: Record doorbell physical address in PF mode (Long Li)
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 (Akira Inoue)
- driver: bluetooth: hci_qca:fix unable to load the BT driver (Shuai Zhang)
- net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
- ALSA: hda/realtek: Add quirks for some Clevo laptops (Tim Crawford)
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100 (Yasmin Fitzgerald)
- ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic (Yuzuru)
- io_uring: make fallocate be hashed work (Fengnan Chang)
- ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606 (Takashi Iwai)
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. (Tamura Dai) [Orabug: 38254084] {CVE-2025-38438}
- um: vector: Reduce stack usage in vector_eth_configure() (Tiwei Bie)
- atm: idt77252: Add missing dma_map_error() (Thomas Fourier)
- ublk: sanity check add_dev input for underflow (Ronnie Sahlberg)
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254088] {CVE-2025-38439}
- bnxt_en: Fix DCB ETS validation (Shravya Kn)
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam() (Alok Tiwari)
- net/mlx5e: Add new prio for promiscuous mode (Jianbo Liu)
- net/mlx5e: Fix race between DIM disable and net_dim() (Carolina Jubran) [Orabug: 38254092] {CVE-2025-38440}
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() (Shuicheng Lin)
- selftests: net: lib: fix shift count out of range (Hangbin Liu)
- selftests: net: lib: Move logging from forwarding/lib.sh here (Petr Machata)
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits (Oleksij Rempel)
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mingming Cao)
- net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324288] {CVE-2025-38542}
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (Eric Dumazet) [Orabug: 38254094] {CVE-2025-38441}
- erofs: fix to add missing tracepoint in erofs_readahead() (Chao Yu)
- erofs: refine readahead tracepoint (Gao Xiang)
- erofs: tidy up zdata.c (Gao Xiang)
- erofs: get rid of z_erofs_next_pcluster_t (Gao Xiang)
- erofs: free pclusters if no cached folio is attached (Chunhai Guo)
- drm/xe/pf: Clear all LMTT pages on alloc (Michal Wajdeczko) [Orabug: 38324148] {CVE-2025-38511}
- nbd: fix uaf in nbd_genl_connect() error path (Zheng Qixing) [Orabug: 38254100] {CVE-2025-38443}
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() (Henry Martin) [Orabug: 38324286] {CVE-2025-38541}
- drm/nouveau/gsp: fix potential leak of memory used during acpi init (Ben Skeggs)
- wifi: rt2x00: fix remove callback type mismatch (Felix Fietkau)
- wifi: mac80211: fix non-transmitted BSSID profile search (Johannes Berg)
- wifi: mac80211: correctly identify S1G short beacon (Lachlan Hodges)
- raid10: cleanup memleak at raid10_make_request (Nigel Croxon) [Orabug: 38254103] {CVE-2025-38444}
- md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254107] {CVE-2025-38445}
- drm/tegra: nvdec: Fix dma_alloc_coherent error check (Mikko Perttunen) [Orabug: 38324294] {CVE-2025-38543}
- wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324159] {CVE-2025-38513}
- wifi: cfg80211: fix S1G beacon head validation in nl80211 (Lachlan Hodges)
- netfs: Fix ref leak on inserted extra subreq in write retry (David Howells)
- netlink: make sure we allow at least one dump skb (Jakub Kicinski)
- netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
- ASoC: Intel: sof-function-topology-lib: Print out the unsupported dmic count (Peter Ujfalusi)
- erofs: address D-cache aliasing (Gao Xiang)
- erofs: fix to add missing tracepoint in erofs_read_folio() (Chao Yu)
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked() (Al Viro)
- smb: server: make use of rdma_destroy_qp() (Stefan Metzmacher)
- clk: scmi: Handle case where child clocks are initialized before their parents (Sascha Hauer)
- x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
- x86/rdrand: Disable RDSEED on AMD Cyan Skillfish (Mikhail Paulyshka)
- clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data (Xiaolei Wang) [Orabug: 38254112] {CVE-2025-38446}
- rust: init: allow dead_code warnings for Rust >= 1.89.0 (Miguel Ojeda)
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() (Harry Yoo) [Orabug: 38324192] {CVE-2025-38517}
- mm/vmalloc: leave lazy MMU mode on PTE mapping error (Alexander Gordeev)
- scripts/gdb: fix interrupts.py after maple tree conversion (Florian Fainelli)
- scripts/gdb: de-reference per-CPU MCE interrupts (Florian Fainelli)
- scripts/gdb: fix interrupts display after MCP on x86 (Florian Fainelli)
- mm: fix the inaccurate memory statistics issue for users (Baolin Wang)
- maple_tree: fix mt_destroy_walk() on root leaf node (Wei Yang)
- kallsyms: fix build without execinfo (Achill Gilgenast)
- Revert "PCI/ACPI: Fix allocated memory release on error in pci_acpi_scan_root()" (Zhe Qiao)
- Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
- drm/xe: Allocate PF queue size on pow2 boundary (Matthew Brost)
- drm/framebuffer: Acquire internal references on GEM handles (Thomas Zimmermann)
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io" (Kuen-Han Tsai)
- usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254116] {CVE-2025-38448}
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" (Matthew Brost)
- drm/xe/bmg: fix compressed VRAM handling (Matthew Auld)
- drm/gem: Fix race in drm_gem_handle_create_tail() (Simona Vetter)
- drm/ttm: fix error handling in ttm_buffer_object_transfer (Christian König)
- drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324178] {CVE-2025-38515}
- drm/gem: Acquire references on GEM handles for framebuffers (Thomas Zimmermann) [Orabug: 38254122] {CVE-2025-38449}
- drm/amdkfd: Don't call mmput from MMU notifier callback (Philip Yang) [Orabug: 38324196] {CVE-2025-38520}
- drm/imagination: Fix kernel crash when hard resetting the GPU (Alessio Belle) [Orabug: 38324199] {CVE-2025-38521}
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan (Michael Lo)
- wifi: mt76: mt7925: fix the wrong config for tx interrupt (Ming Yen Hsieh)
- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() (Deren Wu) [Orabug: 38254130] {CVE-2025-38450}
- wifi: mt76: mt7921: prevent decap offload config before STA initialization (Deren Wu)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface (Vitor Soares) [Orabug: 38324132] {CVE-2025-38505}
- wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [Orabug: 38324151] {CVE-2025-38512}
- pwm: mediatek: Ensure to disable clocks in error path (Uwe Kleine-König)
- pwm: Fix invalid state detection (Uwe Kleine-König)
- pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324184] {CVE-2025-38516}
- net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() (Haoxiang Li) [Orabug: 38254133] {CVE-2025-38452}
- gre: Fix IPv6 multicast route creation. (Guillaume Nault)
- ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
- ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() (Thorsten Blum) [Orabug: 38254137] {CVE-2025-38454}
- KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick) [Orabug: 38324134] {CVE-2025-38506}
- KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson) [Orabug: 38254139] {CVE-2025-38455}
- KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
- KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table. (David Woodhouse)
- x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
- x86/mce: Ensure user polling settings are honored when restarting timer (Yazen Ghannam)
- x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
- x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
- x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Dan Carpenter) [Orabug: 38254142] {CVE-2025-38456}
- rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324168] {CVE-2025-38514}
- rxrpc: Fix bug due to prealloc collision (David Howells) [Orabug: 38324296] {CVE-2025-38544}
- net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254145] {CVE-2025-38457}
- net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info (Chintan Vankar) [Orabug: 38324304] {CVE-2025-38545}
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254151] {CVE-2025-38458}
- atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254159] {CVE-2025-38459}
- atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324307] {CVE-2025-38546}
- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254165] {CVE-2025-38460}
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Oleksij Rempel)
- net: phy: smsc: Force predictable MDI-X state on LAN87xx (Oleksij Rempel)
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Oleksij Rempel)
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2 (Ericchan)
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also transport_local (Michal Luczaj)
- vsock: Fix transport_* TOCTOU (Michal Luczaj) [Orabug: 38254171] {CVE-2025-38461}
- vsock: Fix transport_{g2h,h2g} TOCTOU (Michal Luczaj) [Orabug: 38254174] {CVE-2025-38462}
- tcp: Correct signedness in skb remaining space calculation (Jiayuan Chen) [Orabug: 38254177] {CVE-2025-38463}
- tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254179] {CVE-2025-38464}
- vsock: fix vsock_proto declaration (Stefano Garzarella)
- netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254186] {CVE-2025-38465}
- net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Luo Jie)
- net: phy: qcom: move the WoL function to shared library (Luo Jie)
- arm64: poe: Handle spurious Overlay faults (Kevin Brodsky)
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to CONFIG_RFS_ACCEL (Jason Xing)
- sched/deadline: Fix dl_server runtime calculation formula (Kuyo Chang)
- fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
- pinctrl: amd: Clear GPIO debounce for suspend (Mario Limonciello)
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected (Luiz Augusto von Dentz)
- Bluetooth: hci_sync: Fix not disabling advertising instance (Luiz Augusto von Dentz)
- ASoC: cs35l56: probe() should fail if the device ID is not recognized (Richard Fitzgerald)
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes (Peter Zijlstra) [Orabug: 38254195] {CVE-2025-38466}
- sched/core: Fix migrate_swap() vs. hotplug (Peter Zijlstra)
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ (Nam Cao)
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (Luo Gengkun)
- ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches (Charles Keepax)
- ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: add sof_sdw_get_tplg_files ops (Bard Liao)
- ASoC: soc-acpi: add get_function_tplg_files ops (Bard Liao)
- ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43 laptops (Simon Trimmer)
- ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address struct (Simon Trimmer)
- ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select SND_SOC_ACPI_INTEL_MATCH (Bard Liao)
- ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode (Shengjiu Wang)
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV (Srinivasan Shanmugam) [Orabug: 37855415] {CVE-2025-38104}
- crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2 (Eric Biggers)
- drm/amdgpu/ip_discovery: add missing ip_discovery fw (Flora Cui)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics (Flora Cui)
- drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254201] {CVE-2025-38467}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (Linus Torvalds) [Orabug: 38209551] {CVE-2025-38349}
- LTS version: v6.12.38 (Jack Vogel)
- x86/CPU/AMD: Properly check the TSA microcode (Borislav Petkov)
- LTS version: v6.12.37 (Jack Vogel)
- x86/process: Move the buffer clearing before MONITOR (Borislav Petkov)
- x86/microcode/AMD: Add TSA microcode SHAs (Borislav Petkov)
- KVM: SVM: Advertise TSA CPUID bits to guests (Borislav Petkov)
- x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov) [Orabug: 38023239,38129827] {CVE-2024-36350,CVE-2024-36357}
- x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt() (Andrew Cooper) [Orabug: 38264060]
- Revert "x86/bugs: Rename MDS machinery to something more generic" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/bugs: Add a Transient Scheduler Attacks mitigation" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "KVM: SVM: Advertize TSA CPUID bits to guests" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/process: Move the buffer clearing before MONITOR" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "Add Zen34 clients" (Boris Ostrovsky) [Orabug: 38264060]
- Revert "x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()" (Boris Ostrovsky) [Orabug: 38264060]
- mm: userfaultfd: fix race of userfaultfd_move and swap cache (Kairui Song) [Orabug: 38175034] {CVE-2025-38242}
- mm/vmalloc: fix data race in show_numa_info() (Jeongjun Park) [Orabug: 38253860] {CVE-2025-38383}
- powerpc/kernel: Fix ppc_save_regs inclusion in build (Madhavan Srinivasan)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38254393] {CVE-2025-38404}
- platform/x86: think-lmi: Fix sysfs group cleanup (Kurt Borja)
- platform/x86: think-lmi: Fix kobject cleanup (Kurt Borja)
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- riscv: cpu_ops_sbi: Use static array for boot_data (Vivian Wang) [Orabug: 38253953] {CVE-2025-38407}
- powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed (Zhang Rui)
- iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU (Simon Xue)
- optee: ffa: fix sleep in atomic context (Jens Wiklander) [Orabug: 38253830] {CVE-2025-38374}
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253849] {CVE-2025-38380}
- dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
- cifs: all initializations for tcon should happen in tcon_info_alloc (Shyam Prasad N)
- smb: client: fix readdir returning wrong type with POSIX extensions (Philipp Kerling)
- usb: acpi: fix device link removal (Krogerus Heikki)
- usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume (Xu Yang) [Orabug: 38253838] {CVE-2025-38376}
- usb: dwc3: Abort suspend on soft disconnect failure (Kuen-Han Tsai)
- usb: cdnsp: Fix issue with CV Bad Descriptor test (Pawel Laszczak)
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- Input: iqs7222 - explicitly define number of external channels (Jeff Labundy)
- Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
- xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- usb: xhci: quirk for data loss in ISOC transfers (Raju Rangoju)
- Revert "usb: xhci: Implement xhci_handshake_check_state() helper" (Roy Luo)
- usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed (Roy Luo)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/xe: Allow dropping kunit dependency as built-in (Harry Austen)
- drm/xe/bmg: Update Wa_22019338487 (Vinay Belgaumkar)
- IB/mlx5: Fix potential deadlock in MR deregistration (Or Har-Toov) [Orabug: 38253826] {CVE-2025-38373}
- RDMA/mlx5: Fix cache entry update on dereg error (Michael Guralnik)
- fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Shivank Garg) [Orabug: 38253909] {CVE-2025-38396}
- module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper (Peter Zijlstra)
- add a string-to-qstr constructor (Al Viro)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253862] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253873] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253944] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- aoe: defer rexmit timer downdev work to workqueue (Justin Sanders)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253913] {CVE-2025-38399}
- regulator: fan53555: add enable_time support and soft-start times (Heiko Stuebner)
- ASoC: amd: yc: update quirk data for HP Victus (Raven Black)
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek) [Orabug: 38253955] {CVE-2025-38408}
- platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list (Mario Limonciello)
- ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic (Gabriel Santese)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled (Tasos Sahanidis)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix another leak in the submit error path (Rob Clark) [Orabug: 38253959] {CVE-2025-38409}
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253966] {CVE-2025-38410}
- scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag (Ewan D. Milne)
- sched_ext: Make scx_group_set_weight() always update tg->scx.weight (Tejun Heo)
- drm/amdgpu/mes: add missing locking in helper functions (Alex Deucher)
- arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on (Johan Hovold)
- drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (Nicholas Kazlauskas) [Orabug: 38253787] {CVE-2025-38360}
- drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 (Frank Min)
- drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read (Imre Deak)
- drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause (Sonny Jiang)
- drm/simpledrm: Do not upcast in release helpers (Thomas Zimmermann)
- selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
- drm/xe/guc: Explicitly exit CT safe mode on unwind (Michal Wajdeczko) [Orabug: 38253775] {CVE-2025-38356}
- drm/xe/guc: Dead CT helper (John Harrison)
- drm/xe: Replace double space with single space after comma (Gote, Nitin R)
- drm/xe: move DPT l2 flush to a more sensible place (Matthew Auld)
- drm/xe: Allow bo mapping on multiple ggtts (Niranjana Vishwanathapura)
- drm/xe: add interface to request physical alignment for buffer objects (Juha-Pekka Heikkila)
- drm/xe: Move DSB l2 flush to a more sensible place (Maarten Lankhorst)
- drm/xe: Fix DSB buffer coherency (Maarten Lankhorst)
- mfd: exynos-lpass: Fix another error handling path in exynos_lpass_probe() (Christophe Jaillet)
- netfs: Fix oops in write-retry from mis-resetting the subreq iterator (David Howells) [Orabug: 38153033] {CVE-2025-38139}
- remoteproc: k3-r5: Refactor sequential core power up/down operations (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_rproc_add() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_ioremap_wc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Use devm_kcalloc() helper (Beleswar Padhi)
- remoteproc: k3-r5: Add devm action to release reserved memory (Beleswar Padhi)
- remoteproc: k3: Call of_node_put(rmem_np) only once in three functions (Markus Elfring)
- ubsan: integer-overflow: depend on BROKEN to keep this out of CI (Kees Cook)
- arm64: dts: qcom: sm8650: add the missing l2 cache node (Pengyu Luo)
- arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description (Geert Uytterhoeven)
- arm64: dts: renesas: Factor out White Hawk Single board support (Geert Uytterhoeven)
- arm64: dts: renesas: Use interrupts-extended for Ethernet PHYs (Geert Uytterhoeven)
- arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2 (Luca Weiss)
- arm64: dts: qcom: sm8650: change labels to lower-case (Krzysztof Kozlowski)
- bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) [Orabug: 38180467] {CVE-2025-38279}
- bpf: use common instruction history across all states (Andrii Nakryiko)
- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (Longfang Liu)
- hisi_acc_vfio_pci: bugfix cache write-back issue (Longfang Liu)
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Justin Tee) [Orabug: 38180503] {CVE-2025-38289}
- f2fs: zone: fix to calculate first_zoned_segno correctly (Chao Yu)
- f2fs: zone: introduce first_zoned_segno in f2fs_sb_info (Chao Yu)
- f2fs: decrease spare area for pinned files for zoned devices (Daeho Jeong)
- iommu: ipmmu-vmsa: avoid Wformat-security warning (Arnd Bergmann)
- RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug (Zhu Yanjun)
- wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers (Rameshkumar Sundaram)
- wifi: ath12k: Handle error cases during extended skb allocation (P Praneesh)
- wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path (Nicolas Escande)
- bonding: Mark active offloaded xfrm_states (Cosmin Ratiu)
- ACPI: thermal: Execute _SCP before reading trip points (Armin Wolf)
- ACPI: thermal: Fix stale comment regarding trip points (Xueqin Luo)
- ASoC: tas2764: Reinit cache on part reset (Martin Povišer)
- ASoC: tas2764: Extend driver to SN012776 (Martin Povišer)
- gfs2: Don't start unnecessary transactions during log flush (Andreas Gruenbacher)
- gfs2: Move gfs2_trans_add_databufs (Andreas Gruenbacher)
- sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE (Xuewen Yan)
- sched/fair: Add new cfs_rq.h_nr_runnable (Vincent Guittot)
- sched/fair: Rename h_nr_running into h_nr_queued (Vincent Guittot)
- btrfs: fix wrong start offset for delalloc space release during mmap write (Filipe Manana)
- btrfs: prepare btrfs_page_mkwrite() for large folios (Qu Wenruo)
- gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher)
- gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher)
- gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher)
- gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher)
- gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher)
- gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher)
- gfs2: Prevent inode creation race (Andreas Gruenbacher)
- gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher)
- gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher)
- gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher)
- kunit: qemu_configs: Disable faulting tests on 32-bit SPARC (David Gow)
- kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y (Thomas Weißschuh)
- kunit: qemu_configs: sparc: use Zilog console (Thomas Weißschuh)
- crypto: zynqmp-sha - Add locking (Herbert Xu)
- spinlock: extend guard with spinlock_bh variants (Christian Marangi)
- crypto: iaa - Do not clobber req->base.data (Herbert Xu)
- crypto: iaa - Remove dst_null support (Herbert Xu)
- arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma (Lukasz Czechowski)
- smb: client: fix race condition in negotiate timeout by using more precise timing (Wang Zhaolong)
- amd-xgbe: do not double read link status (Raju Rangoju)
- net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] {CVE-2025-38350}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253840] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- netfs: Fix i_size updating (David Howells)
- smb: client: set missing retry flag in cifs_writev_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in cifs_readv_callback() (Paulo Alcantara)
- smb: client: set missing retry flag in smb2_writev_callback() (Paulo Alcantara)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- idpf: convert control queue mutex to a spinlock (Ahmed Zaki) [Orabug: 38253897] {CVE-2025-38392}
- idpf: return 0 size for RSS key if not supported (Michal Swiatkowski) [Orabug: 38253932] {CVE-2025-38402}
- drm/i915/gsc: mei interrupt top half should be in irq disabled context (Junxiao Chang)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253885] {CVE-2025-38389}
- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253870] {CVE-2025-38385}
- smb: client: fix warning when reconnecting channel (Paulo Alcantara) [Orabug: 38254386] {CVE-2025-38379}
- drm/bridge: aux-hpd-bridge: fix assignment of the of_node (Dmitry Baryshkov)
- platform/mellanox: mlxreg-lc: Fix logic error in power state check (Alok Tiwari)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: dell-sysman: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Simplify API (Thomas Weißschuh)
- platform/x86: firmware_attributes_class: Move include linux/device/class.h (Thomas Weißschuh)
- platform/x86: hp-bioscfg: Fix class device unregistration (Kurt Borja)
- platform/x86: hp-bioscfg: Directly use firmware_attributes_class (Thomas Weißschuh)
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253975] {CVE-2025-38412}
- nvmet: fix memory leak of bio integrity (Dmitry Bogdanov) [Orabug: 38253942] {CVE-2025-38405}
- nvme: Fix incorrect cdw15 value in passthru error logging (Alok Tiwari)
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
- btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
- btrfs: record new subvolume in parent dir earlier to avoid dir logging races (Filipe Manana)
- btrfs: fix inode lookup error handling during log replay (Filipe Manana)
- btrfs: fix invalid inode pointer dereferences during log replay (Filipe Manana) [Orabug: 38288149] {CVE-2025-38243}
- btrfs: return a btrfs_inode from read_one_inode() (Filipe Manana)
- btrfs: return a btrfs_inode from btrfs_iget_logging() (Filipe Manana)
- btrfs: fix iteration of extrefs during log replay (Filipe Manana) [Orabug: 38253858] {CVE-2025-38382}
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- Bluetooth: Prevent unintended pause by checking if advertising is active (Yang Li)
- platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message (Alok Tiwari)
- platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (Alok Tiwari)
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: sd: Fix VPD page 0xb7 length check (Jackysliu)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253899] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253921] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253879] {CVE-2025-38387}
- RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling (Or Har-Toov) [Orabug: 38253824] {CVE-2025-38372}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename (Janne Grunau)
- firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic context (Sudeep Holla) [Orabug: 38253883] {CVE-2025-38388}
- firmware: arm_ffa: Move memory allocation outside the mutex locking (Sudeep Holla)
- firmware: arm_ffa: Fix memory leak by freeing notifier callback node (Sudeep Holla) [Orabug: 38253890] {CVE-2025-38390}
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253819] {CVE-2025-38371}
- mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253926] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253892] {CVE-2025-38391}
- Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() (Yunshui) [Orabug: 38253852] {CVE-2025-38381}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253905] {CVE-2025-38395}
- iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes (Nicolin Chen)
- Bluetooth: MGMT: mesh_send: check instances prior disabling advertising (Christian Eggers)
- Bluetooth: MGMT: set_mesh: update LE scan interval and window (Christian Eggers)
- Bluetooth: hci_sync: revert some mesh modifications (Christian Eggers)
- Bluetooth: HCI: Set extended advertising data synchronously (Christian Eggers)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- Revert "mmc: sdhci: Disable SD card clock before changing parameters" (Ulf Hansson)
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- net: libwx: fix the incorrect display of the queue number (Jiawen Wu)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253935] {CVE-2025-38403}
- net: txgbe: request MISC IRQ in ndo_open (Jiawen Wu)
- s390/pci: Do not try re-enabling load/store if device is disabled (Niklas Schnelle)
- s390/pci: Fix stale function handles in error handling (Niklas Schnelle)
- virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253832] {CVE-2025-38375}
- virtio-net: xsk: rx: fix the frame's length check (Bui Quang Minh) [Orabug: 38253978] {CVE-2025-38413}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- rtc: pcf2127: fix SPI command byte for PCF2131 (Elena Popa)
- rtc: pcf2127: add missing semicolon after statement (Hugo Villeneuve)

[6.12.0-103.36.1.el9uek]
- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38233600]
- mm: memcontrol: fix MM statistics during lruvec reparenting on MGLRU (Harry Yoo) [Orabug: 38002245]
- memcg: add folio_memcg_charged() stub for !memcg (Kamalesh Babulal) [Orabug: 38002245]
- mm: memcontrol: fix a build error on CONFIG_MEMCG=n (Harry Yoo) [Orabug: 38002245]
- net/mlx5: Add poll-eq API to be used by ULP's (Praveen Kumar Kannoju) [Orabug: 38182399]
- net/rds: poll eq during user-reset (Praveen Kumar Kannoju) [Orabug: 38189326]

ELSA-2025-20552 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update

Oracle Linux Security Advisory ELSA-2025-20552

http://linux.oracle.com/errata/ELSA-2025-20552.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-core-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-debug-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-debug-core-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-debug-devel-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-devel-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-doc-5.15.0-312.187.5.el9uek.noarch.rpm
kernel-uek-modules-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-modules-extra-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-container-5.15.0-312.187.5.el9uek.x86_64.rpm
kernel-uek-container-debug-5.15.0-312.187.5.el9uek.x86_64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-5.15.0-312.187.5.el9uek.src.rpm

Related CVEs:

CVE-2024-26726
CVE-2024-57883
CVE-2025-37948
CVE-2025-37958
CVE-2025-37963
CVE-2025-38000
CVE-2025-38001
CVE-2025-38003
CVE-2025-38004
CVE-2025-38034
CVE-2025-38035
CVE-2025-38037
CVE-2025-38043
CVE-2025-38044
CVE-2025-38048
CVE-2025-38051
CVE-2025-38052
CVE-2025-38058
CVE-2025-38061
CVE-2025-38065
CVE-2025-38066
CVE-2025-38068
CVE-2025-38072
CVE-2025-38075
CVE-2025-38077
CVE-2025-38078
CVE-2025-38079
CVE-2025-38083
CVE-2025-38084
CVE-2025-38085
CVE-2025-38086
CVE-2025-38088
CVE-2025-38090
CVE-2025-38094
CVE-2025-38100
CVE-2025-38102
CVE-2025-38103
CVE-2025-38107
CVE-2025-38108
CVE-2025-38111
CVE-2025-38112
CVE-2025-38115
CVE-2025-38119
CVE-2025-38120
CVE-2025-38122
CVE-2025-38135
CVE-2025-38136
CVE-2025-38138
CVE-2025-38143
CVE-2025-38145
CVE-2025-38146
CVE-2025-38147
CVE-2025-38153
CVE-2025-38154
CVE-2025-38157
CVE-2025-38159
CVE-2025-38160
CVE-2025-38161
CVE-2025-38163
CVE-2025-38167
CVE-2025-38173
CVE-2025-38174
CVE-2025-38180
CVE-2025-38181
CVE-2025-38184
CVE-2025-38185
CVE-2025-38190
CVE-2025-38193
CVE-2025-38194
CVE-2025-38197
CVE-2025-38200
CVE-2025-38203
CVE-2025-38204
CVE-2025-38206
CVE-2025-38211
CVE-2025-38212
CVE-2025-38214
CVE-2025-38218
CVE-2025-38219
CVE-2025-38222
CVE-2025-38226
CVE-2025-38227
CVE-2025-38229
CVE-2025-38230
CVE-2025-38231
CVE-2025-38237
CVE-2025-38245
CVE-2025-38249
CVE-2025-38251
CVE-2025-38257
CVE-2025-38262
CVE-2025-38263
CVE-2025-38273
CVE-2025-38280
CVE-2025-38285
CVE-2025-38286
CVE-2025-38293
CVE-2025-38298
CVE-2025-38305
CVE-2025-38310
CVE-2025-38312
CVE-2025-38313
CVE-2025-38319
CVE-2025-38320
CVE-2025-38323
CVE-2025-38324
CVE-2025-38326
CVE-2025-38328
CVE-2025-38332
CVE-2025-38336
CVE-2025-38337
CVE-2025-38342
CVE-2025-38344
CVE-2025-38345
CVE-2025-38346
CVE-2025-38348
CVE-2025-38350
CVE-2025-38352
CVE-2025-38362
CVE-2025-38363
CVE-2025-38371
CVE-2025-38377
CVE-2025-38380
CVE-2025-38384
CVE-2025-38386
CVE-2025-38387
CVE-2025-38389
CVE-2025-38391
CVE-2025-38393
CVE-2025-38395
CVE-2025-38399
CVE-2025-38400
CVE-2025-38401
CVE-2025-38403
CVE-2025-38404
CVE-2025-38406
CVE-2025-38410
CVE-2025-38412
CVE-2025-38415
CVE-2025-38416
CVE-2025-38418
CVE-2025-38419
CVE-2025-38420
CVE-2025-38424
CVE-2025-38428
CVE-2025-38430
CVE-2025-38498

Description of changes:

[5.15.0-312.187.5.el9uek]
- Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli) [Orabug: 38327655]

[5.15.0-312.187.4.el9uek]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38166374]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319943]
- hugetlb: arm64: add mte support (Dave Kleikamp) [Orabug: 38177800]

[5.15.0-312.187.3.el9uek]
- TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig (Günther Noack) [Orabug: 38255504]
- TIOCSTI: always enable for CAP_SYS_ADMIN (Samuel Thibault) [Orabug: 38255504]
- tty: Fix typo in LEGACY_TIOCSTI Kconfig description (Hanno Böck) [Orabug: 38255504]
- tty: Move TIOCSTI toggle variable before kerndoc (Kees Cook) [Orabug: 38255504]
- tty: Allow TIOCSTI to be disabled (Kees Cook) [Orabug: 38255504]
- tty: Move sysctl setup into "core" tty logic (Kees Cook) [Orabug: 38255504]
- tty: reformat kernel-doc in tty_io.c (Jiri Slaby) [Orabug: 38255504]
- tty: reformat kernel-doc in tty_ldisc.c (Jiri Slaby) [Orabug: 38255504]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38236297]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38236297]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38236297]
- IB/mlx5: Support querying eswitch functions from DEVX (Bodong Wang) [Orabug: 38236297]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161800]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161800]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161800]
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]

[5.15.0-312.187.2.el9uek]
- EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
- LTS version: v5.15.187 (Vijayendra Suman)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253850] {CVE-2025-38380}
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
- dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
- dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
- regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
- btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
- tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
- tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
- vgacon: remove unneeded forward declarations (Jiri Slaby)
- vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
- tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
- fbcon: delete a few unneeded forward decl (Daniel Vetter)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
- Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
- Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- LTS version: v5.15.186 (Vijayendra Suman)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- ext4: avoid remount errors with 'abort' mount option (Jan Kara)
- ext4: make 'abort' mount option handling standard (Jan Kara)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
- arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- arm64: insn: add encoders for atomic operations (Hou Tao)
- arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
- ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
- mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
- thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
- pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
- nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
- media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
- media: tc358743: ignore video while HPD is low (Hans Verkuil)
- drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
- drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
- jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
- drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
- drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
- ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
- sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
- media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
- media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
- jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
- ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
- drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
- media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
- media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
- drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
- media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
- drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
- drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
- media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
- drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
- media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
- drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
- exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
- drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
- sunrpc: update nextcheck time when adding new cache entries (Long Li)
- drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
- ACPI: battery: negate current when discharging (Peter Marheine)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
- kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
- kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
- drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
- drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
- kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
- kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
- kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
- mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
- drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
- kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
- MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
- MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
- x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
- net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
- arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
- perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)

[5.15.0-312.185.1.el9uek]
- uek-rpm: mips: Disable CONFIG_TRANSPARENT_HUGEPAGE (Dave Kleikamp) [Orabug: 38280961]
- KVM: x86/MMU: Allow faulting at hugepages during dirty tracking (Joao Martins) [Orabug: 36409415]
- KVM: x86/MMU: Dirty tracking without write-protection for shadow paging (Joao Martins) [Orabug: 36409415]
- KVM: x86/MMU: Track rmap present pages (Joao Martins) [Orabug: 36409415]
- nvme: check for valid nvme_identify_ns() before using it (Ewan D. Milne) [Orabug: 38207640]
- nvme: bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) [Orabug: 38207640]
- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236843]

ELBA-2025-12877 Oracle Linux 9 linux-firmware bug fix and enhancement update

Oracle Linux Bug Fix Advisory ELBA-2025-12877

http://linux.oracle.com/errata/ELBA-2025-12877.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el9.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el9.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el9.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el9.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el9.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el9.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el9.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-whence-20250828-999.43.git260ff424.el9.noarch.rpm
liquidio-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
netronome-firmware-20250828-999.43.git260ff424.el9.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el9.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el9.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el9.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el9.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el9.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el9.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el9.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-whence-20250828-999.43.git260ff424.el9.noarch.rpm
liquidio-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
netronome-firmware-20250828-999.43.git260ff424.el9.noarch.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/linux-firmware-20250828-999.43.git260ff424.el9.src.rpm

Description of changes:

[20250828-999.43.git260ff424.el9]
- Rebase to latest upstream [Orabug: 38200684]
- Solve conflicts caused by symbolic link changes [Orabug: 38206139]

ELBA-2025-20549 Oracle Linux 7 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-20549

http://linux.oracle.com/errata/ELBA-2025-20549.html

The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.42.el7.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el7.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el7.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el7.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el7.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el7.noarch.rpm
iwl3160-firmware-22.0.7.0-999.42.el7.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el7.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el7.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el7.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el7.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el7.noarch.rpm
iwl6000g2a-firmware-17.168.5.3-999.42.el7.noarch.rpm
iwl6000g2b-firmware-17.168.5.2-999.42.el7.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el7.noarch.rpm
iwl7260-firmware-22.0.7.0-999.42.el7.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el7.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el7.noarch.rpm

SRPMS:
http://oss.oracle.com/ol7/SRPMS-updates/linux-firmware-20250826-999.42.git356f06bf.el7.src.rpm

Description of changes:

[20250826-999.42.git356f06bf.el7]
- Handling downgrade issue for Nvidia firmware changes [Orabug: 38303112]

[20250611-999.41.git356f06bf.el7]
- Rebase to latest upstream [Orabug: 38028345]

[20250423-999.40.git32f3227b.el7]
- Rebase to latest upstream [Orabug: 37868435]

[20250319-999.39.git430633ec.el7]
- Rebase to latest upstream [Orabug: 37729115]

[20250203-999.38.git0fd450ee.el7]
- Rebase to latest upstream [Orabug: 37535629]

[20241213-999.36.git2cdfe09e.el7]
- Rebase to latest upstream [Orabug: 37405529]

ELSA-2025-20552 Important: Oracle Linux 8 Unbreakable Enterprise kernel security update

Oracle Linux Security Advisory ELSA-2025-20552

http://linux.oracle.com/errata/ELSA-2025-20552.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-core-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-debug-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-debug-core-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-debug-devel-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-debug-modules-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-debug-modules-extra-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-devel-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-doc-5.15.0-312.187.5.el8uek.noarch.rpm
kernel-uek-modules-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-modules-extra-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-container-5.15.0-312.187.5.el8uek.x86_64.rpm
kernel-uek-container-debug-5.15.0-312.187.5.el8uek.x86_64.rpm

aarch64:
bpftool-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-core-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-debug-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-debug-core-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-debug-devel-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-debug-modules-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-debug-modules-extra-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-devel-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-doc-5.15.0-312.187.5.el8uek.noarch.rpm
kernel-uek-modules-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-modules-extra-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-container-5.15.0-312.187.5.el8uek.aarch64.rpm
kernel-uek-container-debug-5.15.0-312.187.5.el8uek.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-uek-5.15.0-312.187.5.el8uek.src.rpm

Related CVEs:

CVE-2024-26726
CVE-2024-57883
CVE-2025-37948
CVE-2025-37958
CVE-2025-37963
CVE-2025-38000
CVE-2025-38001
CVE-2025-38003
CVE-2025-38004
CVE-2025-38034
CVE-2025-38035
CVE-2025-38037
CVE-2025-38043
CVE-2025-38044
CVE-2025-38048
CVE-2025-38051
CVE-2025-38052
CVE-2025-38058
CVE-2025-38061
CVE-2025-38065
CVE-2025-38066
CVE-2025-38068
CVE-2025-38072
CVE-2025-38075
CVE-2025-38077
CVE-2025-38078
CVE-2025-38079
CVE-2025-38083
CVE-2025-38084
CVE-2025-38085
CVE-2025-38086
CVE-2025-38088
CVE-2025-38090
CVE-2025-38094
CVE-2025-38100
CVE-2025-38102
CVE-2025-38103
CVE-2025-38107
CVE-2025-38108
CVE-2025-38111
CVE-2025-38112
CVE-2025-38115
CVE-2025-38119
CVE-2025-38120
CVE-2025-38122
CVE-2025-38135
CVE-2025-38136
CVE-2025-38138
CVE-2025-38143
CVE-2025-38145
CVE-2025-38146
CVE-2025-38147
CVE-2025-38153
CVE-2025-38154
CVE-2025-38157
CVE-2025-38159
CVE-2025-38160
CVE-2025-38161
CVE-2025-38163
CVE-2025-38167
CVE-2025-38173
CVE-2025-38174
CVE-2025-38180
CVE-2025-38181
CVE-2025-38184
CVE-2025-38185
CVE-2025-38190
CVE-2025-38193
CVE-2025-38194
CVE-2025-38197
CVE-2025-38200
CVE-2025-38203
CVE-2025-38204
CVE-2025-38206
CVE-2025-38211
CVE-2025-38212
CVE-2025-38214
CVE-2025-38218
CVE-2025-38219
CVE-2025-38222
CVE-2025-38226
CVE-2025-38227
CVE-2025-38229
CVE-2025-38230
CVE-2025-38231
CVE-2025-38237
CVE-2025-38245
CVE-2025-38249
CVE-2025-38251
CVE-2025-38257
CVE-2025-38262
CVE-2025-38263
CVE-2025-38273
CVE-2025-38280
CVE-2025-38285
CVE-2025-38286
CVE-2025-38293
CVE-2025-38298
CVE-2025-38305
CVE-2025-38310
CVE-2025-38312
CVE-2025-38313
CVE-2025-38319
CVE-2025-38320
CVE-2025-38323
CVE-2025-38324
CVE-2025-38326
CVE-2025-38328
CVE-2025-38332
CVE-2025-38336
CVE-2025-38337
CVE-2025-38342
CVE-2025-38344
CVE-2025-38345
CVE-2025-38346
CVE-2025-38348
CVE-2025-38350
CVE-2025-38352
CVE-2025-38362
CVE-2025-38363
CVE-2025-38371
CVE-2025-38377
CVE-2025-38380
CVE-2025-38384
CVE-2025-38386
CVE-2025-38387
CVE-2025-38389
CVE-2025-38391
CVE-2025-38393
CVE-2025-38395
CVE-2025-38399
CVE-2025-38400
CVE-2025-38401
CVE-2025-38403
CVE-2025-38404
CVE-2025-38406
CVE-2025-38410
CVE-2025-38412
CVE-2025-38415
CVE-2025-38416
CVE-2025-38418
CVE-2025-38419
CVE-2025-38420
CVE-2025-38424
CVE-2025-38428
CVE-2025-38430
CVE-2025-38498

Description of changes:

[5.15.0-312.187.5.el8uek]
- Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli) [Orabug: 38327655]

[5.15.0-312.187.4.el8uek]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38166374]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319943]
- hugetlb: arm64: add mte support (Dave Kleikamp) [Orabug: 38177800]

[5.15.0-312.187.3.el8uek]
- TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig (Günther Noack) [Orabug: 38255504]
- TIOCSTI: always enable for CAP_SYS_ADMIN (Samuel Thibault) [Orabug: 38255504]
- tty: Fix typo in LEGACY_TIOCSTI Kconfig description (Hanno Böck) [Orabug: 38255504]
- tty: Move TIOCSTI toggle variable before kerndoc (Kees Cook) [Orabug: 38255504]
- tty: Allow TIOCSTI to be disabled (Kees Cook) [Orabug: 38255504]
- tty: Move sysctl setup into "core" tty logic (Kees Cook) [Orabug: 38255504]
- tty: reformat kernel-doc in tty_io.c (Jiri Slaby) [Orabug: 38255504]
- tty: reformat kernel-doc in tty_ldisc.c (Jiri Slaby) [Orabug: 38255504]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38236297]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38236297]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38236297]
- IB/mlx5: Support querying eswitch functions from DEVX (Bodong Wang) [Orabug: 38236297]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161800]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161800]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161800]
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]

[5.15.0-312.187.2.el8uek]
- EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
- LTS version: v5.15.187 (Vijayendra Suman)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253850] {CVE-2025-38380}
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
- dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
- dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
- regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
- btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
- tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
- tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
- vgacon: remove unneeded forward declarations (Jiri Slaby)
- vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
- tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
- fbcon: delete a few unneeded forward decl (Daniel Vetter)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
- Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
- Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- LTS version: v5.15.186 (Vijayendra Suman)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- ext4: avoid remount errors with 'abort' mount option (Jan Kara)
- ext4: make 'abort' mount option handling standard (Jan Kara)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
- arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- arm64: insn: add encoders for atomic operations (Hou Tao)
- arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
- ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
- mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
- thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
- pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
- nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
- media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
- media: tc358743: ignore video while HPD is low (Hans Verkuil)
- drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
- drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
- jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
- drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
- drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
- ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
- sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
- media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
- media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
- jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
- ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
- drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
- media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
- media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
- drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
- media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
- drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
- drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
- media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
- drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
- media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
- drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
- exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
- drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
- sunrpc: update nextcheck time when adding new cache entries (Long Li)
- drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
- ACPI: battery: negate current when discharging (Peter Marheine)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
- kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
- kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
- drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
- drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
- kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
- kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
- kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
- mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
- drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
- kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
- MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
- MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
- x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
- net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
- arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
- perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)

[5.15.0-312.185.1.el8uek]
- uek-rpm: mips: Disable CONFIG_TRANSPARENT_HUGEPAGE (Dave Kleikamp) [Orabug: 38280961]
- KVM: x86/MMU: Allow faulting at hugepages during dirty tracking (Joao Martins) [Orabug: 36409415]
- KVM: x86/MMU: Dirty tracking without write-protection for shadow paging (Joao Martins) [Orabug: 36409415]
- KVM: x86/MMU: Track rmap present pages (Joao Martins) [Orabug: 36409415]
- nvme: check for valid nvme_identify_ns() before using it (Ewan D. Milne) [Orabug: 38207640]
- nvme: bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) [Orabug: 38207640]
- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236843]

ELSA-2025-13789 Moderate: Oracle Linux 7 libxml2 security update

Oracle Linux Security Advisory ELSA-2025-13789

http://linux.oracle.com/errata/ELSA-2025-13789.html

The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:

x86_64:
libxml2-2.9.1-6.0.11.el7_9.6.i686.rpm
libxml2-2.9.1-6.0.11.el7_9.6.x86_64.rpm
libxml2-devel-2.9.1-6.0.11.el7_9.6.i686.rpm
libxml2-devel-2.9.1-6.0.11.el7_9.6.x86_64.rpm
libxml2-python-2.9.1-6.0.11.el7_9.6.x86_64.rpm
libxml2-static-2.9.1-6.0.11.el7_9.6.i686.rpm
libxml2-static-2.9.1-6.0.11.el7_9.6.x86_64.rpm

SRPMS:
http://oss.oracle.com/ol7/SRPMS-updates/libxml2-2.9.1-6.0.11.el7_9.6.src.rpm

Related CVEs:

CVE-2025-32415

Description of changes:

[2.9.1-6.0.11.6]
- Fix CVE-2025-32415: Fix heap buffer overflow [Orabug: 38310750]

ELSA-2025-20552 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update

Oracle Linux Security Advisory ELSA-2025-20552

http://linux.oracle.com/errata/ELSA-2025-20552.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

aarch64:
kernel-uek-5.15.0-312.187.5.el9uek.aarch64.rpm
bpftool-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-container-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-container-debug-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-core-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-debug-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-debug-core-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-debug-devel-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-debug-modules-extra-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-devel-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-doc-5.15.0-312.187.5.el9uek.noarch.rpm
kernel-uek-modules-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek-modules-extra-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek64k-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek64k-core-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek64k-devel-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek64k-modules-5.15.0-312.187.5.el9uek.aarch64.rpm
kernel-uek64k-modules-extra-5.15.0-312.187.5.el9uek.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-5.15.0-312.187.5.el9uek.src.rpm

Related CVEs:

CVE-2024-26726
CVE-2024-57883
CVE-2025-37948
CVE-2025-37958
CVE-2025-37963
CVE-2025-38000
CVE-2025-38001
CVE-2025-38003
CVE-2025-38004
CVE-2025-38034
CVE-2025-38035
CVE-2025-38037
CVE-2025-38043
CVE-2025-38044
CVE-2025-38048
CVE-2025-38051
CVE-2025-38052
CVE-2025-38058
CVE-2025-38061
CVE-2025-38065
CVE-2025-38066
CVE-2025-38068
CVE-2025-38072
CVE-2025-38075
CVE-2025-38077
CVE-2025-38078
CVE-2025-38079
CVE-2025-38083
CVE-2025-38084
CVE-2025-38085
CVE-2025-38086
CVE-2025-38088
CVE-2025-38090
CVE-2025-38094
CVE-2025-38100
CVE-2025-38102
CVE-2025-38103
CVE-2025-38107
CVE-2025-38108
CVE-2025-38111
CVE-2025-38112
CVE-2025-38115
CVE-2025-38119
CVE-2025-38120
CVE-2025-38122
CVE-2025-38135
CVE-2025-38136
CVE-2025-38138
CVE-2025-38143
CVE-2025-38145
CVE-2025-38146
CVE-2025-38147
CVE-2025-38153
CVE-2025-38154
CVE-2025-38157
CVE-2025-38159
CVE-2025-38160
CVE-2025-38161
CVE-2025-38163
CVE-2025-38167
CVE-2025-38173
CVE-2025-38174
CVE-2025-38180
CVE-2025-38181
CVE-2025-38184
CVE-2025-38185
CVE-2025-38190
CVE-2025-38193
CVE-2025-38194
CVE-2025-38197
CVE-2025-38200
CVE-2025-38203
CVE-2025-38204
CVE-2025-38206
CVE-2025-38211
CVE-2025-38212
CVE-2025-38214
CVE-2025-38218
CVE-2025-38219
CVE-2025-38222
CVE-2025-38226
CVE-2025-38227
CVE-2025-38229
CVE-2025-38230
CVE-2025-38231
CVE-2025-38237
CVE-2025-38245
CVE-2025-38249
CVE-2025-38251
CVE-2025-38257
CVE-2025-38262
CVE-2025-38263
CVE-2025-38273
CVE-2025-38280
CVE-2025-38285
CVE-2025-38286
CVE-2025-38293
CVE-2025-38298
CVE-2025-38305
CVE-2025-38310
CVE-2025-38312
CVE-2025-38313
CVE-2025-38319
CVE-2025-38320
CVE-2025-38323
CVE-2025-38324
CVE-2025-38326
CVE-2025-38328
CVE-2025-38332
CVE-2025-38336
CVE-2025-38337
CVE-2025-38342
CVE-2025-38344
CVE-2025-38345
CVE-2025-38346
CVE-2025-38348
CVE-2025-38350
CVE-2025-38352
CVE-2025-38362
CVE-2025-38363
CVE-2025-38371
CVE-2025-38377
CVE-2025-38380
CVE-2025-38384
CVE-2025-38386
CVE-2025-38387
CVE-2025-38389
CVE-2025-38391
CVE-2025-38393
CVE-2025-38395
CVE-2025-38399
CVE-2025-38400
CVE-2025-38401
CVE-2025-38403
CVE-2025-38404
CVE-2025-38406
CVE-2025-38410
CVE-2025-38412
CVE-2025-38415
CVE-2025-38416
CVE-2025-38418
CVE-2025-38419
CVE-2025-38420
CVE-2025-38424
CVE-2025-38428
CVE-2025-38430
CVE-2025-38498

Description of changes:

[5.15.0-312.187.5.el9uek]
- Revert "mm: hugetlb: independent PMD page table shared count" (Harshit Mogalapalli) [Orabug: 38327655]

[5.15.0-312.187.4.el9uek]
- rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38166374]
- KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319943]
- hugetlb: arm64: add mte support (Dave Kleikamp) [Orabug: 38177800]

[5.15.0-312.187.3.el9uek]
- TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig (Günther Noack) [Orabug: 38255504]
- TIOCSTI: always enable for CAP_SYS_ADMIN (Samuel Thibault) [Orabug: 38255504]
- tty: Fix typo in LEGACY_TIOCSTI Kconfig description (Hanno Böck) [Orabug: 38255504]
- tty: Move TIOCSTI toggle variable before kerndoc (Kees Cook) [Orabug: 38255504]
- tty: Allow TIOCSTI to be disabled (Kees Cook) [Orabug: 38255504]
- tty: Move sysctl setup into "core" tty logic (Kees Cook) [Orabug: 38255504]
- tty: reformat kernel-doc in tty_io.c (Jiri Slaby) [Orabug: 38255504]
- tty: reformat kernel-doc in tty_ldisc.c (Jiri Slaby) [Orabug: 38255504]
- net/mlx5: E-Switch, Fix switching to switchdev mode in MPV (Patrisious Haddad) [Orabug: 38236297]
- net/mlx5: E-Switch, Fix switching to switchdev mode with IB device disabled (Patrisious Haddad) [Orabug: 38236297]
- net/mlx5: E-switch, refactor eswitch mode change (Patrisious Haddad) [Orabug: 38236297]
- IB/mlx5: Support querying eswitch functions from DEVX (Bodong Wang) [Orabug: 38236297]
- RDMA/mlx5: Fix HW counters query for non-representor devices (Patrisious Haddad) [Orabug: 38161800]
- RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 38161800]
- Revert "RDMA/mlx5: Fix CC counters query for MPV" (Qing Huang) [Orabug: 38161800]
- RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad) [Orabug: 38118599]

[5.15.0-312.187.2.el9uek]
- EDAC: Octeon: Fix compile error by replacing sdei_init() with acpi_sdei_init() (Vijayendra Suman) [Orabug: 38294908]
- LTS version: v5.15.187 (Vijayendra Suman)
- usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38309912] {CVE-2025-38404}
- platform/x86: think-lmi: Create ksets consecutively (Kurt Borja)
- Logitech C-270 even more broken (Oliver Neukum)
- i2c/designware: Fix an initialization issue (Michael J. Ruhl) [Orabug: 38253850] {CVE-2025-38380}
- usb: cdnsp: do not disable slot for disabled slot (Peter Chen)
- xhci: dbc: Flush queued requests before stopping dbc (Mathias Nyman)
- xhci: dbctty: disable ECHO flag by default (Łukasz Bartosik)
- platform/x86: dell-wmi-sysman: Fix class device unregistration (Kurt Borja)
- platform/x86: think-lmi: Fix class device unregistration (Kurt Borja)
- dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
- net: dpaa2-eth: rearrange variable in dpaa2_eth_get_ethtool_stats (Ioana Ciornei)
- dpaa2-eth: Update SINGLE_STEP register access (Radu Bulie)
- dpaa2-eth: Update dpni_get_single_step_cfg command (Radu Bulie)
- ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
- NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
- drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253820] {CVE-2025-38371}
- regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253906] {CVE-2025-38395}
- regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
- mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier (Avri Altman)
- rcu: Return early if callback is not specified (Uladzislau Rezki)
- mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [Orabug: 38253863] {CVE-2025-38384}
- ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253874] {CVE-2025-38386}
- wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253945] {CVE-2025-38406}
- wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (Maurizio Lombardi) [Orabug: 38253914] {CVE-2025-38399}
- powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
- ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
- ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
- ALSA: sb: Don't allow changing the DMA mode during operations (Takashi Iwai)
- drm/msm: Fix a fence leak in submit error path (Rob Clark) [Orabug: 38253967] {CVE-2025-38410}
- nui: Fix dma_mapping_error() check (Thomas Fourier)
- rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253841] {CVE-2025-38377}
- enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
- amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
- lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
- igc: disable L1.2 PCI-E link substate to avoid performance issue (Vitaly Lifshits)
- drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253886] {CVE-2025-38389}
- platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (Kurt Borja) [Orabug: 38253976] {CVE-2025-38412}
- drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
- spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
- drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
- btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
- scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
- scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
- scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database() (Thomas Fourier)
- NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [Orabug: 38253900] {CVE-2025-38393}
- nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253922] {CVE-2025-38400}
- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253880] {CVE-2025-38387}
- platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
- mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
- mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253927] {CVE-2025-38401}
- mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
- usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253893] {CVE-2025-38391}
- mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
- vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253936] {CVE-2025-38403}
- rtc: cmos: use spin_lock_irqsave in cmos_interrupt (Mateusz Jończyk)
- ARM: 9354/1: ptrace: Use bitfield helpers (Geert Uytterhoeven)
- btrfs: don't drop extent_map for free space inode on write error (Josef Bacik) [Orabug: 36530624] {CVE-2024-26726}
- arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
- s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
- s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens)
- media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
- PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Dexuan Cui)
- drm/amd/display: Add null pointer check for get_first_active_display() (Xu Wang) [Orabug: 38253794] {CVE-2025-38362}
- drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
- drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
- drm/amdkfd: Fix race in GWS queue scheduling (Jay Cornwall)
- drm/udl: Unregister device before cleaning up on disconnect (Thomas Zimmermann)
- drm/tegra: Fix a possible null pointer dereference (Qiu-Ji Chen) [Orabug: 38253800] {CVE-2025-38363}
- drm/tegra: Assign plane type before registration (Thierry Reding)
- HID: wacom: fix kobject reference count leak (Qasim Ijaz)
- HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
- HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
- btrfs: update superblock's device bytes_used when dropping chunk (Mark Harmstone)
- dm-raid: fix variable in journal device check (Heinz Mauelshagen)
- Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
- dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive (Yao Zi)
- staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
- net: selftests: fix TCP packet checksum (Jakub Kicinski)
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175043] {CVE-2025-38245}
- net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
- um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
- vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
- af_unix: Don't set -ECONNRESET for consumed OOB skb. (Kuniyuki Iwashima)
- wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
- libbpf: Fix null pointer dereference in btf_dump__free on allocation failure (Yuan Chen)
- attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
- ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175063] {CVE-2025-38249}
- atm: clip: prevent NULL deref in clip_push() (Eric Dumazet) [Orabug: 38175077] {CVE-2025-38251}
- s390/pkey: Prevent overflow in size calculation for memdup_user() (Fedor Pchelkin) [Orabug: 38175091] {CVE-2025-38257}
- i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
- i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
- platform/x86: ideapad-laptop: use usleep_range() for EC polling (Rongrong)
- dummycon: Trigger redraw when switching consoles with deferred takeover (Thomas Zimmermann)
- tty: vt: make consw::con_switch() return a bool (Jiri Slaby)
- tty: vt: sanitize arguments of consw::con_clear() (Jiri Slaby)
- tty: vt: make init parameter of consw::con_init() a bool (Jiri Slaby)
- vgacon: remove unneeded forward declarations (Jiri Slaby)
- vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() (Jiri Slaby)
- tty/vt: consolemap: rename and document struct uni_pagedir (Jiri Slaby)
- fbcon: delete a few unneeded forward decl (Daniel Vetter)
- uio_hv_generic: Align ring size to system page (Long Li)
- uio_hv_generic: Query the ringbuffer size for device (Saurabh Singh Sengar)
- Drivers: hv: vmbus: Add utility function for querying ring size (Saurabh Singh Sengar)
- Drivers: hv: Rename 'alloced' to 'allocated' (Vitaly Kuznetsov)
- f2fs: don't over-report free space or inodes in statvfs (Chao Yu)
- media: imx-jpeg: Drop the first error frames (Ming Qian)
- clk: ti: am43xx: Add clkctrl data for am43xx ADC1 (Miquel Raynal)
- media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: davinci: vpif: Fix memory leak in probe error path (Dmitry Nikiforov)
- jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158700] {CVE-2025-38230}
- fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
- ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
- ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
- ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock (Mario Limonciello)
- ALSA: hda: Add new pci id for AMD GPU display HD audio controller (Vijendar Mukunda)
- ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
- usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
- usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
- usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
- usb: common: usb-conn-gpio: use a unique name for usb connector device (Chance Yang)
- tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175113] {CVE-2025-38262}
- usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
- usb: dwc2: also exit clock_gating when stopping udc while suspended (Michael Grzeschik)
- coresight: Only check bottom two claim bits (James Clark)
- um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h (Sami Tolvanen)
- iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
- bcache: fix NULL pointer in cache_set_flush() (Linggang Zeng) [Orabug: 38175119] {CVE-2025-38263}
- md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
- dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
- ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension (Namjae Jeon)
- hwmon: (pmbus/max34440) Fix support for max34451 (Alexis Czezar Torreno)
- leds: multicolor: Fix intensity setting while SW blinking (Sven Schwermer)
- mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
- mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
- NFSv4.2: fix listxattr to return selinux security label (Olga Kornievskaia)
- NFSv4: Always set NLINK even if the server doesn't support it (Han Young)
- cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)
- LTS version: v5.15.186 (Vijayendra Suman)
- scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
- scsi: elx: efct: Fix memory leak in efct_hw_parse_filter() (Vitaliy Shevtsov)
- arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180595] {CVE-2025-38320}
- perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254029] {CVE-2025-38424}
- s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
- bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE (Paul Chaignon)
- net: Fix checksum update for ILA adj-transport (Paul Chaignon)
- ext4: avoid remount errors with 'abort' mount option (Jan Kara)
- ext4: make 'abort' mount option handling standard (Jan Kara)
- mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976983] {CVE-2025-37958}
- net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158476] {CVE-2025-38193}
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse)
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977005] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976929] {CVE-2025-37948}
- arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
- arm64: proton-pack: Expose whether the branchy loop k value (James Morse)
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse)
- arm64: insn: Add support for encoding DSB (James Morse)
- arm64: insn: add encoders for atomic operations (Hou Tao)
- arm64: move AARCH64_BREAK_FAULT into insn-def.h (Hou Tao)
- serial: sh-sci: Increment the runtime usage counter for the earlycon device (Claudiu Beznea)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
- ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
- ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
- net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158405] {CVE-2025-38180}
- net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180611] {CVE-2025-38323}
- calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158412] {CVE-2025-38181}
- tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158424] {CVE-2025-38184}
- tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
- atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158433] {CVE-2025-38185}
- mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180617] {CVE-2025-38324}
- wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254010] {CVE-2025-38420}
- ptp: fix breakage after ptp_vclock_in_use() rework (Vladimir Oltean)
- net: ice: Perform accurate aRFS flow match (Krishna Kumar)
- aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180627] {CVE-2025-38326}
- pldmfw: Select CRC32 when PLDMFW is selected (Simon Horman)
- hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
- hwmon: (occ) Rework attribute registration for stack usage (Arnd Bergmann)
- hwmon: (occ) Add soft minimum power cap attribute (Eddie James)
- drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
- drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate (Krzysztof Kozlowski)
- erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [Orabug: 38132180] {CVE-2025-38085}
- mm: hugetlb: independent PMD page table shared count (Liu Shixin) [Orabug: 37484959] {CVE-2024-57883}
- mm/hugetlb: unshare page tables during VMA split, not before (Jann Horn) [Orabug: 38132171] {CVE-2025-38084}
- iio: accel: fxls8962af: Fix temperature calculation (Sean Nyekjaer)
- ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
- ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
- ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card (Wangdicheng)
- Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
- block: default BLOCK_LEGACY_AUTOLOAD to y (Christoph Hellwig)
- HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152876] {CVE-2025-38103}
- atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158457] {CVE-2025-38190}
- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
- selftests/x86: Add a test to detect infinite SIGTRAP handler loop (Xin Li)
- udmabuf: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
- scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
- jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180635] {CVE-2025-38328}
- jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158483] {CVE-2025-38194}
- drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137453] {CVE-2025-38090}
- powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
- platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
- platform/x86: dell_rbu: Fix list usage (Stuart Hayes) [Orabug: 38158494] {CVE-2025-38197}
- Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
- tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
- ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
- bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
- watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
- octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer() (Xu Wang)
- bpf, sockmap: Fix data lost during EAGAIN retries (Jiayuan Chen)
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158517] {CVE-2025-38200}
- sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
- scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180667] {CVE-2025-38332}
- pinctrl: mcp23s08: Reset all pins to input at probe (Mike Looijmans)
- software node: Correct a OOB check in software_node_get_reference_args() (Zijun Hu) [Orabug: 38180730] {CVE-2025-38342}
- vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
- net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions (Yong Wang)
- iommu/amd: Ensure GA log notifier callbacks finish running before module unload (Sean Christopherson)
- scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands (Justin Tee)
- libbpf: Add identical pointer detection to btf_dedup_is_equiv() (Alan Maguire)
- clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
- wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
- net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
- pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
- net: atlantic: generate software timestamp just before the doorbell (Jason Xing)
- ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
- tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
- tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
- net: dlink: add synchronization for stats update (Moon Yeounsu)
- i2c: npcm: Add clock toggle recovery (Tali Perry)
- cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs (Mike Tipton)
- sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
- wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R (Henk Vergonet)
- emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
- i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
- tipc: use kfree_sensitive() for aead cleanup (Zilin Guan)
- net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
- cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
- thermal/drivers/qcom/tsens: Update conditions to strictly evaluate for IP v2+ (George Moussalem)
- pmdomain: ti: Fix STANDBY handling of PER power domain (Sukrut Bellary)
- nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
- media: i2c: imx334: update mode_3840x2160_regs array (Shravan Chippa)
- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175013] {CVE-2025-38237}
- media: tc358743: ignore video while HPD is low (Hans Verkuil)
- drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
- drm/msm/dpu: don't select single flush for active CTL blocks (Dmitry Baryshkov)
- jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158545] {CVE-2025-38203}
- drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
- drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
- ext4: prevent stale extent cache entries caused by concurrent get es_cache (Zhang Yi)
- sunrpc: fix race in cache cleanup causing stale nextcheck time (Long Li)
- media: rkvdec: Initialize the m2m context before the controls (Nicolas Dufresne)
- media: ti: cal: Fix wrong goto on error path (Tomi Valkeinen)
- jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158552] {CVE-2025-38204}
- ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Zhang Yi)
- drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
- media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition (Nas Chung)
- media: ccs-pll: Better validate VT PLL branch (Sakari Ailus)
- drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
- media: i2c: imx334: Fix runtime PM handling in remove function (Tarang Raval)
- drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
- drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
- media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
- drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
- media: i2c: imx334: Enable runtime PM before sub-device registration (Tarang Raval)
- drm/bridge: anx7625: change the gpiod_set_value API (Ayushi Makhija)
- exfat: fix double free in delayed_free (Namjae Jeon) [Orabug: 38158566] {CVE-2025-38206}
- drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
- sunrpc: update nextcheck time when adding new cache entries (Long Li)
- drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
- ACPI: battery: negate current when discharging (Peter Marheine)
- PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
- ASoC: tegra210_ahub: Add check to of_device_get_match_data() (Yuanjun Gong)
- ACPICA: utilities: Fix overflow check in vsnprintf() (Philip Redkin)
- power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
- ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180747] {CVE-2025-38344}
- ACPI: bus: Bail out if acpi_kobj registration fails (Armin Wolf)
- ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change (Hector Martin)
- ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
- clocksource: Fix the CPUs' choice in the watchdog per CPU verification (Guilherme G. Piccoli)
- ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180755] {CVE-2025-38345}
- iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
- iio: imu: inv_icm42600: Fix temperature calculation (Sean Nyekjaer)
- iio: accel: fxls8962af: Fix temperature scan element sign (Sean Nyekjaer)
- PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit() (Diederik de Haas)
- PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
- PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
- PCI: cadence-ep: Correct PBA offset in .set_msix() callback (Niklas Cassel)
- uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
- remoteproc: core: Release rproc->clean_table after rproc_attach() fails (Xiaolei Wang) [Orabug: 38254002] {CVE-2025-38418}
- remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach() (Xiaolei Wang) [Orabug: 38254006] {CVE-2025-38419}
- regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
- mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
- staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
- net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132188] {CVE-2025-38086}
- ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180767] {CVE-2025-38346}
- dm-mirror: fix a tiny race condition (Mikulas Patocka)
- mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
- mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
- mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
- RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158591] {CVE-2025-38211}
- ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158597] {CVE-2025-38212}
- clk: meson-g12a: add missing fclk_div2 to spicc (Da Xue)
- parisc: fix building with gcc-15 (Arnd Bergmann)
- vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
- fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158614] {CVE-2025-38214}
- EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
- NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253991] {CVE-2025-38416}
- f2fs: fix to do sanity check on sit_bitmap_size (Chao Yu) [Orabug: 38158639] {CVE-2025-38218}
- f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158647] {CVE-2025-38219}
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254053] {CVE-2025-38428}
- ext4: ensure i_size is smaller than maxbytes (Zhang Yi)
- ext4: factor out ext4_get_maxbytes() (Zhang Yi)
- ext4: fix calculation of credits for extent tree modification (Jan Kara)
- ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158661] {CVE-2025-38222}
- bus: fsl-mc: fix GET/SET_TAILDROP command ids (Wan Junjie)
- bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
- ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180696] {CVE-2025-38336}
- can: tcan4x5x: fix power regulator retrieval during probe (Brett Werling)
- bus: mhi: host: Fix conflict between power_up and SYSERR (Jeffrey Hugo)
- ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4 (Andreas Kemnade)
- ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
- media: uvcvideo: Fix deferred probing error (Ricardo Ribalda)
- media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
- media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
- media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158680] {CVE-2025-38226}
- media: vidtv: Terminating the subsequent process of initialization failure (Edward Adam Davis) [Orabug: 38158685] {CVE-2025-38227}
- media: videobuf2: use sgtable-based scatterlist wrappers (Marek Szyprowski)
- media: venus: Fix probe error handling (Loic Poulain)
- media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
- media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
- media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158691] {CVE-2025-38229}
- media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case (Sakari Ailus)
- media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div (Sakari Ailus)
- media: ccs-pll: Start OP pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ccs-pll: Start VT pre-PLL multiplier search from correct value (Sakari Ailus)
- media: ov8856: suppress probe deferral errors (Johan Hovold)
- wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
- jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180706] {CVE-2025-38337}
- nfsd: Initialize ssc before laundromat_work to prevent NULL dereference (Li Lingfeng) [Orabug: 38158706] {CVE-2025-38231}
- nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254061] {CVE-2025-38430}
- wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180782] {CVE-2025-38348}
- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Xu Wang)
- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Xu Wang)
- powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states (Gautam Menghani)
- ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
- ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params() (Xu Wang)
- gfs2: move msleep to sleepable context (Alexander Aring)
- crypto: marvell/cesa - Do not chain submitted requests (Herbert Xu)
- configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
- xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong)
- kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
- kbuild: userprogs: fix bitsize and target detection on clang (Thomas Weißschuh)
- drm/meson: Use 1000ULL when operating with mode->clock (I Hsin Cheng)
- net: usb: aqc111: debug info before sanitation (Oliver Neukum)
- calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
- x86/iopl: Cure TIF_IO_BITMAP inconsistencies (Thomas Gleixner) [Orabug: 38152863] {CVE-2025-38100}
- xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
- usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx() (Amit Sunil Dhamne)
- usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
- usb: cdnsp: Fix issue with detecting USB 3.2 speed (Pawel Laszczak)
- usb: cdnsp: Fix issue with detecting command completion event (Pawel Laszczak)
- VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152868] {CVE-2025-38102}
- drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
- kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
- kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
- kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
- mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
- drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
- kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
- MIPS: Prefer cc-option for additions to cflags (Nathan Chancellor)
- MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
- x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223086] {CVE-2025-38352}
- ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 (David Heimann)
- perf: Ensure bpf_perf_link path is properly serialized (Peter Zijlstra)
- nvmet-fcloop: access fcpreq only when holding reqlock (Daniel Wagner)
- fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
- net_sched: ets: fix a race in ets_qdisc_change() (Eric Dumazet) [Orabug: 38152893] {CVE-2025-38107}
- sch_ets: make est_qlen_notify() idempotent (Cong Wang)
- net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
- net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152898] {CVE-2025-38108}
- net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105333] {CVE-2025-38083}
- net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
- net/mlx5: Ensure fw pages are always allocated on same NUMA (Moshe Shemesh)
- net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski) [Orabug: 38152911] {CVE-2025-38111}
- net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
- macsec: MACsec SCI assignment for ES = 0 (Carlos Fernandez)
- net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [Orabug: 38152915] {CVE-2025-38112}
- i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
- i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
- drm/meson: fix more rounding issues with 59.94Hz modes (Martin Blumenstingl)
- drm/meson: use vclk_freq instead of pixel_freq in debug print (Martin Blumenstingl)
- drm/meson: fix debug log statement when setting the HDMI clocks (Martin Blumenstingl)
- drm/meson: use unsigned long long / Hz for frequency types (Martin Blumenstingl)
- powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() (Haren Myneni)
- powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (Ritesh Harjani) [Orabug: 38137444] {CVE-2025-38088}
- net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152922] {CVE-2025-38115}
- scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
- ath10k: snoc: fix unbalanced IRQ enable in crash recovery (Caleb Connolly)
- ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() (Jeongjun Park) [Orabug: 38180545] {CVE-2025-38305}
- scsi: core: ufs: Fix a hang in the error handler (Sanjeev Yadav) [Orabug: 38152945] {CVE-2025-38119}
- serial: sh-sci: Clean sci_ports[0] after at earlycon exit (Claudiu Beznea)
- serial: sh-sci: Move runtime PM enable to sci_probe_single() (Claudiu Beznea)
- serial: sh-sci: Check if TX data was written to device in .tx_empty() (Claudiu Beznea)
- arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez)
- arm64: dts: ti: k3-am65-main: Fix sdhci node properties (Judith Mendez)
- arm64: dts: ti: k3-am65-main: Drop deprecated ti,otap-del-sel property (Nishanth Menon)
- Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
- Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
- pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
- do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256449] {CVE-2025-38498}
- fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2) (Al Viro)
- seg6: Fix validation of nexthop addresses (Ido Schimmel) [Orabug: 38180555] {CVE-2025-38310}
- wireguard: device: enable threaded NAPI (Mirco Barone)
- netfilter: nf_set_pipapo_avx2: fix initial map fill (Florian Westphal) [Orabug: 38152957] {CVE-2025-38120}
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Alok Tiwari) [Orabug: 38152965] {CVE-2025-38122}
- vmxnet3: correctly report gso type for UDP tunnels (Ronak Doshi)
- net: dsa: tag_brcm: legacy: fix pskb_may_pull length (Álvaro Fernández Rojas)
- ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
- Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
- spi: bcm63xx-hsspi: fix shared reset (Álvaro Fernández Rojas)
- spi: bcm63xx-spi: fix shared reset (Álvaro Fernández Rojas)
- net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
- driver: net: ethernet: mtk_star_emac: fix suspend/resume issue (Yanqing Wang)
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Alok Tiwari)
- net: stmmac: platform: guarantee uniqueness of bus_id (Quentin Schulz)
- vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
- MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a (Yuli Wang)
- iio: adc: ad7124: Fix 3dB filter frequency reading (Uwe Kleine-König)
- serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153011] {CVE-2025-38135}
- usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153016] {CVE-2025-38136}
- PCI/DPC: Initialize aer_err_info before using it (Bjorn Helgaas)
- dmaengine: ti: Add NULL check in udma_probe() (Henry Martin) [Orabug: 38153029] {CVE-2025-38138}
- PCI: cadence: Fix runtime atomic count underflow (Hans Zhang)
- rtc: sh: assign correct interrupts with DT (Wolfram Sang)
- perf record: Fix incorrect --user-regs comments (Dapeng Mi)
- perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
- mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
- mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
- rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
- remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe (Dan Carpenter)
- perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
- backlight: pm8941: Add NULL check in wled_configure() (Henry Martin) [Orabug: 38153050] {CVE-2025-38143}
- perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
- perf build: Warn when libdebuginfod devel files are not available (Arnaldo Carvalho de Melo)
- fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180565] {CVE-2025-38312}
- soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153059] {CVE-2025-38145}
- soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
- arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
- ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
- bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180572] {CVE-2025-38313}
- nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
- nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
- ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery (Murad Masimov)
- Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253984] {CVE-2025-38415}
- arm64: dts: imx8mn-beacon: Fix RTC capacitive load (Adam Ford)
- arm64: dts: imx8mm-beacon: Fix RTC capacitive load (Adam Ford)
- ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
- ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
- f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
- f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
- net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Horatiu Vultur)
- net: openvswitch: Fix the dead loop of MPLS parse (Faicker Mo) [Orabug: 38153064] {CVE-2025-38146}
- calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153069] {CVE-2025-38147}
- net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
- bpf: Avoid __bpf_prog_ret0_warn when jit fails (Kafai Wan) [Orabug: 38180470] {CVE-2025-38280}
- net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153088] {CVE-2025-38153}
- netfilter: nft_tunnel: fix geneve_opt dump (Fernando Fernandez Mancera)
- bpf, sockmap: Avoid using sk_socket after free when sending (Jiayuan Chen) [Orabug: 38153094] {CVE-2025-38154}
- vfio/type1: Fix error unwind in migration dirty bitmap allocation (Li Rongqing)
- netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
- wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153109] {CVE-2025-38157}
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (Alexey Kodanev) [Orabug: 38153121] {CVE-2025-38159}
- s390/bpf: Store backchain even for leaf progs (Ilya Leoshkevich)
- clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz (Vincent Knecht)
- bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180488] {CVE-2025-38285}
- pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180494] {CVE-2025-38286}
- libbpf: Use proper errno value in nlattr (Anton Protopopov)
- ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
- clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (Henry Martin) [Orabug: 38153131] {CVE-2025-38160}
- clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs (Luca Weiss)
- bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ (Anton Protopopov)
- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Patrisious Haddad) [Orabug: 38153138] {CVE-2025-38161}
- netfilter: nft_quota: match correctly when the quota just depleted (Zhongqiu Duan)
- netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
- libbpf: Use proper errno value in linker (Anton Protopopov)
- f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed() (Chao Yu)
- f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
- iommu: Protect against overflow in iommu_pgsize() (Jason Gunthorpe)
- RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
- wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
- libbpf: Fix buffer overflow in bpf_object__init_prog (Viktor Malik)
- net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
- f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153149] {CVE-2025-38163}
- bpf, sockmap: fix duplicated data transmission (Jiayuan Chen)
- IB/cm: use rwlock for MAD agent lock (Jacob Moroni)
- wifi: ath11k: fix node corruption in ar->arvifs list (Stone Zhang) [Orabug: 38180515] {CVE-2025-38293}
- firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES (Huang Yiwei)
- drm/tegra: rgb: Fix the unbound reference count (Biju Das)
- drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
- drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
- selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
- firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
- m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
- fs/ntfs3: handle hdr_first_de() return value (Andrey Vatoropin) [Orabug: 38153172] {CVE-2025-38167}
- media: rkvdec: Fix frame size enumeration (Jonas Karlman)
- drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [Orabug: 38180589] {CVE-2025-38319}
- spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
- ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
- PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
- power: reset: at91-reset: Optimize at91_reset() (Alexander Shiyan)
- EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180524] {CVE-2025-38298}
- crypto: sun8i-ce - move fallback ahash_request to the end of the struct (Ovidiu Panait)
- crypto: xts - Only add ecb if it is not already there (Herbert Xu)
- crypto: lrw - Only add ecb if it is not already there (Herbert Xu)
- crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
- crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153188] {CVE-2025-38173}
- x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
- crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions (Corentin Labbe)
- perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
- gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
- thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158383] {CVE-2025-38174}
- usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
- USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh)
- usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
- usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
- rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
- rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
- pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
- pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)

[5.15.0-312.185.1.el9uek]
- uek-rpm: mips: Disable CONFIG_TRANSPARENT_HUGEPAGE (Dave Kleikamp) [Orabug: 38280961]
- KVM: x86/MMU: Allow faulting at hugepages during dirty tracking (Joao Martins) [Orabug: 36409415]
- KVM: x86/MMU: Dirty tracking without write-protection for shadow paging (Joao Martins) [Orabug: 36409415]
- KVM: x86/MMU: Track rmap present pages (Joao Martins) [Orabug: 36409415]
- nvme: check for valid nvme_identify_ns() before using it (Ewan D. Milne) [Orabug: 38207640]
- nvme: bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) [Orabug: 38207640]
- rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236843]

ELBA-2025-20547 Oracle Linux 9 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-20547

http://linux.oracle.com/errata/ELBA-2025-20547.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.42.el9.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el9.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl3160-firmware-25.30.13.0-999.42.el9.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el9.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el9.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el9.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el9.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el9.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el9.noarch.rpm
iwl7260-firmware-25.30.13.0-999.42.el9.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el9.noarch.rpm
libertas-sd8686-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
libertas-sd8787-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
libertas-usb8388-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
libertas-usb8388-olpc-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
linux-firmware-core-20250826-999.42.git356f06bf.el9.noarch.rpm
linux-firmware-whence-20250826-999.42.git356f06bf.el9.noarch.rpm
liquidio-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
netronome-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.42.el9.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el9.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl3160-firmware-25.30.13.0-999.42.el9.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el9.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el9.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el9.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el9.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el9.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.42.el9.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el9.noarch.rpm
iwl7260-firmware-25.30.13.0-999.42.el9.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el9.noarch.rpm
libertas-sd8686-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
libertas-sd8787-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
libertas-usb8388-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
libertas-usb8388-olpc-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
linux-firmware-core-20250826-999.42.git356f06bf.el9.noarch.rpm
linux-firmware-whence-20250826-999.42.git356f06bf.el9.noarch.rpm
liquidio-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm
netronome-firmware-20250826-999.42.git356f06bf.el9.noarch.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/linux-firmware-20250826-999.42.git356f06bf.el9.src.rpm

Description of changes:

[20250826-999.42.git356f06bf.el9]
- Handling downgrade issue for Nvidia firmware changes [Orabug: 38303112]

ELBA-2025-10697 Oracle Linux 9 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-10697

http://linux.oracle.com/errata/ELBA-2025-10697.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el9.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el9.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el9.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el9.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el9.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el9.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el9.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-whence-20250828-999.43.git260ff424.el9.noarch.rpm
liquidio-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
netronome-firmware-20250828-999.43.git260ff424.el9.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el9.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el9.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el9.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el9.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el9.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el9.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el9.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el9.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el9.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el9.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el9.noarch.rpm
linux-firmware-whence-20250828-999.43.git260ff424.el9.noarch.rpm
liquidio-firmware-20250828-999.43.git260ff424.el9.noarch.rpm
netronome-firmware-20250828-999.43.git260ff424.el9.noarch.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/linux-firmware-20250828-999.43.git260ff424.el9.src.rpm

Description of changes:

[20250828-999.43.git260ff424.el9]
- Rebase to latest upstream [Orabug: 38200684]
- Solve conflicts caused by symbolic link changes [Orabug: 38206139]

ELBA-2025-20548 Oracle Linux 8 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-20548

http://linux.oracle.com/errata/ELBA-2025-20548.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.42.el8.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el8.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl3160-firmware-25.30.13.0-999.42.el8.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el8.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el8.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el8.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el8.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el8.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el8.noarch.rpm
iwl7260-firmware-25.30.13.0-999.42.el8.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el8.noarch.rpm
libertas-sd8686-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
libertas-sd8787-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
libertas-usb8388-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
libertas-usb8388-olpc-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
linux-firmware-core-20250826-999.42.git356f06bf.el8.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.42.el8.noarch.rpm
iwl100-firmware-39.31.5.1-999.42.el8.noarch.rpm
iwl105-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl135-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl2000-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl2030-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl3160-firmware-25.30.13.0-999.42.el8.noarch.rpm
iwl3945-firmware-15.32.2.9-999.42.el8.noarch.rpm
iwl4965-firmware-228.61.2.24-999.42.el8.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.42.el8.noarch.rpm
iwl5150-firmware-8.24.2.2-999.42.el8.noarch.rpm
iwl6000-firmware-9.221.4.1-999.42.el8.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.42.el8.noarch.rpm
iwl6050-firmware-41.28.5.1-999.42.el8.noarch.rpm
iwl7260-firmware-25.30.13.0-999.42.el8.noarch.rpm
iwlax2xx-firmware-20250826-999.42.el8.noarch.rpm
libertas-sd8686-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
libertas-sd8787-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
libertas-usb8388-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
libertas-usb8388-olpc-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
linux-firmware-20250826-999.42.git356f06bf.el8.noarch.rpm
linux-firmware-core-20250826-999.42.git356f06bf.el8.noarch.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/linux-firmware-20250826-999.42.git356f06bf.el8.src.rpm

Description of changes:

[20250826-999.42.git356f06bf.el8]
- Handling downgrade issue for Nvidia firmware changes [Orabug: 38303112]

ELBA-2025-8412 Oracle Linux 8 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-8412

http://linux.oracle.com/errata/ELBA-2025-8412.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.43.el8.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el8.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el8.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el8.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el8.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el8.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el8.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el8.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el8.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el8.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el8.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el8.noarch.rpm

aarch64:
iwl1000-firmware-39.31.5.1-999.43.el8.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el8.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl3160-firmware-25.30.13.0-999.43.el8.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el8.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el8.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el8.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el8.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el8.noarch.rpm
iwl6000g2a-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl6000g2b-firmware-18.168.6.1-999.43.el8.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el8.noarch.rpm
iwl7260-firmware-25.30.13.0-999.43.el8.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el8.noarch.rpm
libertas-sd8686-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
libertas-sd8787-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
libertas-usb8388-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
libertas-usb8388-olpc-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el8.noarch.rpm
linux-firmware-core-20250828-999.43.git260ff424.el8.noarch.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/linux-firmware-20250828-999.43.git260ff424.el8.src.rpm

Description of changes:

[20250828-999.43.git260ff424.el8]
- Rebase to latest upstream [Orabug: 38200684]
- Solve conflicts caused by symbolic link changes [Orabug: 38206139]

ELBA-2025-20550 Oracle Linux 7 linux-firmware bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-20550

http://linux.oracle.com/errata/ELBA-2025-20550.html

The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:

x86_64:
iwl1000-firmware-39.31.5.1-999.43.el7.noarch.rpm
iwl100-firmware-39.31.5.1-999.43.el7.noarch.rpm
iwl105-firmware-18.168.6.1-999.43.el7.noarch.rpm
iwl135-firmware-18.168.6.1-999.43.el7.noarch.rpm
iwl2000-firmware-18.168.6.1-999.43.el7.noarch.rpm
iwl2030-firmware-18.168.6.1-999.43.el7.noarch.rpm
iwl3160-firmware-22.0.7.0-999.43.el7.noarch.rpm
iwl3945-firmware-15.32.2.9-999.43.el7.noarch.rpm
iwl4965-firmware-228.61.2.24-999.43.el7.noarch.rpm
iwl5000-firmware-8.83.5.1_1-999.43.el7.noarch.rpm
iwl5150-firmware-8.24.2.2-999.43.el7.noarch.rpm
iwl6000-firmware-9.221.4.1-999.43.el7.noarch.rpm
iwl6000g2a-firmware-17.168.5.3-999.43.el7.noarch.rpm
iwl6000g2b-firmware-17.168.5.2-999.43.el7.noarch.rpm
iwl6050-firmware-41.28.5.1-999.43.el7.noarch.rpm
iwl7260-firmware-22.0.7.0-999.43.el7.noarch.rpm
iwlax2xx-firmware-20250828-999.43.el7.noarch.rpm
linux-firmware-20250828-999.43.git260ff424.el7.noarch.rpm

SRPMS:
http://oss.oracle.com/ol7/SRPMS-updates/linux-firmware-20250828-999.43.git260ff424.el7.src.rpm

Description of changes:

[20250828-999.43.git260ff424.el7]
- Rebase to latest upstream [Orabug: 38200684]
- Solve conflicts caused by symbolic link changes [Orabug: 38206139]

[20250826-999.42.git356f06bf.el7]
- Handling downgrade issue for Nvidia firmware changes [Orabug: 38303112]

[20250611-999.41.git356f06bf.el7]
- Rebase to latest upstream [Orabug: 38028345]

[20250423-999.40.git32f3227b.el7]
- Rebase to latest upstream [Orabug: 37868435]

[20250319-999.39.git430633ec.el7]
- Rebase to latest upstream [Orabug: 37729115]

[20250203-999.38.git0fd450ee.el7]
- Rebase to latest upstream [Orabug: 37535629]

[20241213-999.36.git2cdfe09e.el7]
- Rebase to latest upstream [Orabug: 37405529]