Kernel, Tomcat, Firefox, and more updates for Oracle Linux

Oracle Linux 6419 Published 2025-12-11 08:57 by Philipp Esselbach

News

ELSA-2025-28040 Important: Unbreakable Enterprise kernel security update

Oracle Linux Security Advisory ELSA-2025-28040

http://linux.oracle.com/errata/ELSA-2025-28040.html

The following updated rpms for have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-uek-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-core-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-devel-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-doc-6.12.0-106.55.4.1.el10uek.noarch.rpm
kernel-uek-modules-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-core-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-deprecated-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-desktop-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-extra-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-usb-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-modules-wireless-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-tools-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-core-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-devel-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-core-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-desktop-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-extra-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-usb-6.12.0-106.55.4.1.el10uek.x86_64.rpm
kernel-uek-debug-modules-wireless-6.12.0-106.55.4.1.el10uek.x86_64.rpm

aarch64:
kernel-uek-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-core-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-devel-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-core-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-deprecated-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-desktop-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-extra-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-extra-netfilter-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-usb-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-modules-wireless-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-tools-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-core-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-devel-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-core-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-deprecated-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-desktop-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-extra-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-extra-netfilter-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-usb-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek-debug-modules-wireless-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-core-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-devel-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-core-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-deprecated-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-desktop-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-extra-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-extra-netfilter-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-usb-6.12.0-106.55.4.1.el10uek.aarch64.rpm
kernel-uek64k-modules-wireless-6.12.0-106.55.4.1.el10uek.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/kernel-uek-6.12.0-106.55.4.1.el10uek.src.rpm

Related CVEs:

CVE-2025-22117
CVE-2025-38105
CVE-2025-38678
CVE-2025-40001
CVE-2025-40018
CVE-2025-40019
CVE-2025-40026
CVE-2025-40027
CVE-2025-40030
CVE-2025-40031
CVE-2025-40035
CVE-2025-40037
CVE-2025-40038
CVE-2025-40040
CVE-2025-40042
CVE-2025-40044
CVE-2025-40047
CVE-2025-40048
CVE-2025-40049
CVE-2025-40051
CVE-2025-40052
CVE-2025-40053
CVE-2025-40055
CVE-2025-40056
CVE-2025-40057
CVE-2025-40058
CVE-2025-40061
CVE-2025-40070
CVE-2025-40071
CVE-2025-40078
CVE-2025-40080
CVE-2025-40081
CVE-2025-40085
CVE-2025-40087
CVE-2025-40096
CVE-2025-40099
CVE-2025-40100
CVE-2025-40101
CVE-2025-40103
CVE-2025-40104
CVE-2025-40105

Description of changes:

[6.12.0-106.55.4.1]
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38712798] {CVE-2025-38678}

[6.12.0-106.55.4]
- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek) [Orabug: 37844696] {CVE-2025-22117}

[6.12.0-106.55.3]
- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38594966]
- Revert "mptcp: disable by default" (Harshvardhan Jha) [Orabug: 38277777]

[6.12.0-106.55.2]
- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst->dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head & tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device->dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab->obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 & v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix srctree/ links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)

[6.12.0-106.51.1]
- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]

ELSA-2025-23052 Important: Oracle Linux 10 tomcat9 security update

Oracle Linux Security Advisory ELSA-2025-23052

http://linux.oracle.com/errata/ELSA-2025-23052.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
tomcat9-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm

aarch64:
tomcat9-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm
tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/tomcat9-9.0.87-8.el10_1.1.src.rpm

Related CVEs:

CVE-2025-31651
CVE-2025-55752

Description of changes:

[1:9.0.87-8.1]
- Resolves: RHEL-124497
tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
- Resolves: RHEL-91732
tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

ELSA-2025-23035 Important: Oracle Linux 10 firefox security update

Oracle Linux Security Advisory ELSA-2025-23035

http://linux.oracle.com/errata/ELSA-2025-23035.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
firefox-140.6.0-1.0.1.el10_1.x86_64.rpm

aarch64:
firefox-140.6.0-1.0.1.el10_1.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/firefox-140.6.0-1.0.1.el10_1.src.rpm

Related CVEs:

CVE-2025-14321
CVE-2025-14322
CVE-2025-14323
CVE-2025-14324
CVE-2025-14325
CVE-2025-14328
CVE-2025-14329
CVE-2025-14330
CVE-2025-14331
CVE-2025-14333

Description of changes:

[140.6.0-1.0.1]
- Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

[140.6.0-1]
- Update to 140.6.0 ESR

ELSA-2025-23008 Moderate: Oracle Linux 10 mysql8.4 security update

Oracle Linux Security Advisory ELSA-2025-23008

http://linux.oracle.com/errata/ELSA-2025-23008.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
mysql8.4-8.4.7-1.el10_1.x86_64.rpm
mysql8.4-common-8.4.7-1.el10_1.noarch.rpm
mysql8.4-devel-8.4.7-1.el10_1.x86_64.rpm
mysql8.4-errmsg-8.4.7-1.el10_1.noarch.rpm
mysql8.4-libs-8.4.7-1.el10_1.x86_64.rpm
mysql8.4-server-8.4.7-1.el10_1.x86_64.rpm
mysql8.4-test-8.4.7-1.el10_1.x86_64.rpm
mysql8.4-test-data-8.4.7-1.el10_1.noarch.rpm

aarch64:
mysql8.4-8.4.7-1.el10_1.aarch64.rpm
mysql8.4-common-8.4.7-1.el10_1.noarch.rpm
mysql8.4-devel-8.4.7-1.el10_1.aarch64.rpm
mysql8.4-errmsg-8.4.7-1.el10_1.noarch.rpm
mysql8.4-libs-8.4.7-1.el10_1.aarch64.rpm
mysql8.4-server-8.4.7-1.el10_1.aarch64.rpm
mysql8.4-test-8.4.7-1.el10_1.aarch64.rpm
mysql8.4-test-data-8.4.7-1.el10_1.noarch.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/mysql8.4-8.4.7-1.el10_1.src.rpm

Related CVEs:

CVE-2025-53040
CVE-2025-53042
CVE-2025-53044
CVE-2025-53045
CVE-2025-53053
CVE-2025-53054
CVE-2025-53062
CVE-2025-53069

Description of changes:

[8.4.7-1]
- Rebase to 8.4.7

ELSA-2025-22854 Moderate: Oracle Linux 10 kernel security update

Oracle Linux Security Advisory ELSA-2025-22854

http://linux.oracle.com/errata/ELSA-2025-22854.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-abi-stablelists-6.12.0-124.20.1.el10_1.noarch.rpm
kernel-core-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-cross-headers-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-core-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-devel-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-devel-matched-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-modules-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-modules-core-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-modules-extra-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-debug-uki-virt-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-devel-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-devel-matched-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-doc-6.12.0-124.20.1.el10_1.noarch.rpm
kernel-headers-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-modules-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-modules-core-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-modules-extra-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-modules-extra-matched-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-tools-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-tools-libs-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-tools-libs-devel-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-uki-virt-6.12.0-124.20.1.el10_1.x86_64.rpm
kernel-uki-virt-addons-6.12.0-124.20.1.el10_1.x86_64.rpm
libperf-6.12.0-124.20.1.el10_1.x86_64.rpm
perf-6.12.0-124.20.1.el10_1.x86_64.rpm
python3-perf-6.12.0-124.20.1.el10_1.x86_64.rpm
rtla-6.12.0-124.20.1.el10_1.x86_64.rpm
rv-6.12.0-124.20.1.el10_1.x86_64.rpm

aarch64:
kernel-cross-headers-6.12.0-124.20.1.el10_1.aarch64.rpm
kernel-headers-6.12.0-124.20.1.el10_1.aarch64.rpm
kernel-tools-6.12.0-124.20.1.el10_1.aarch64.rpm
kernel-tools-libs-6.12.0-124.20.1.el10_1.aarch64.rpm
kernel-tools-libs-devel-6.12.0-124.20.1.el10_1.aarch64.rpm
libperf-6.12.0-124.20.1.el10_1.aarch64.rpm
perf-6.12.0-124.20.1.el10_1.aarch64.rpm
python3-perf-6.12.0-124.20.1.el10_1.aarch64.rpm
rtla-6.12.0-124.20.1.el10_1.aarch64.rpm
rv-6.12.0-124.20.1.el10_1.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/kernel-6.12.0-124.20.1.el10_1.src.rpm

Related CVEs:

CVE-2025-38737
CVE-2025-39925
CVE-2025-39979
CVE-2025-39981
CVE-2025-39982
CVE-2025-39983
CVE-2025-40047
CVE-2025-40058
CVE-2025-40185

Description of changes:

[6.12.0-124.20.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst->dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csókás Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head & tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristóf)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca)
- tls: trim encrypted message to match the plaintext on short splice (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- ksmbd: fix recursive locking in RPC handle list access (Marios Makassikis)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov)
- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Linmao Li)
- doc: fix seg6_flowlabel path (Nicolas Dichtel)
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- can: m_can: fix CAN state in system PM (Marc Kleine-Budde)
- can: m_can: call deinit/init callback when going into suspend/resume (Sean Nyekjaer)
- can: m_can: add deinit callback (Sean Nyekjaer)
- can: m_can: m_can_chip_config(): bring up interface in correct state (Marc Kleine-Budde)
- can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active (Marc Kleine-Budde)
- can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() (Marc Kleine-Budde)
- dax: skip read lock assertion for read-only filesystems (Yuezhang Mo)
- HID: multitouch: fix sticky fingers (Benjamin Tissoires)
- Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Jens Axboe)
- cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay (Rafael J. Wysocki)
- usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: f_ncm: Refactor bind path to use __free() (Kuen-Han Tsai)
- usb: gadget: Introduce free_usb_request helper (Kuen-Han Tsai)
- usb: gadget: Store endpoint pointer in usb_request (Kuen-Han Tsai)
- drm/exynos: exynos7_drm_decon: remove ctx->suspended (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: properly clear channels during bind (Kaustabh Chakraborty)
- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (Kaustabh Chakraborty)
- media: nxp: imx8-isi: m2m: Fix streaming cleanup on release (Guoniu Zhou)
- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (Laurent Pinchart)
- drm/msm/a6xx: Fix PDC sleep sequence (Akhil P Oommen)
- cdx: Fix device node reference leak in cdx_msi_domain_init (Miaoqian Lin)
- irqdomain: cdx: Switch to of_fwnode_handle() (Jiri Slaby)
- drm/amd: Check whether secure display TA loaded successfully (Mario Limonciello)
- perf/core: Fix MMAP2 event device with backing files (Adrian Hunter)
- perf/core: Fix MMAP event path names with backing files (Adrian Hunter)
- perf/core: Fix address filter match with backing files (Adrian Hunter)
- drm/amdgpu: fix gfx12 mes packet status return check (Jonathan Kim)
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Tvrtko Ursulin) [Orabug: 38601869] {CVE-2025-40096}
- cifs: parse_dfs_referrals: prevent oob on malformed input (Eugene Korenevsky) [Orabug: 38601876] {CVE-2025-40099}
- can: gs_usb: increase max interface to U8_MAX (Celeste Liu)
- can: gs_usb: gs_make_candev(): populate net_device->dev_port (Celeste Liu)
- btrfs: do not assert we found block group item when creating free space tree (Filipe Manana) [Orabug: 38601884] {CVE-2025-40100}
- btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (Miquel Sabaté Solà) [Orabug: 38601892] {CVE-2025-40101}
- btrfs: fix incorrect readahead expansion length (Boris Burkov)
- btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl (Miquel Sabaté Solà)
- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (Filipe Manana)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey)
- ext4: wait for ongoing I/O to complete before freeing blocks (Zhang Yi)
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- f2fs: fix wrong block mapping for multi-devices (Jaegeuk Kim)
- r8152: add error handling in rtl8152_driver_init (Yi Cong)
- slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL (Hao Ge)
- smb: client: Fix refcount leak for cifs_sb_tlink (Shuhao Fu) [Orabug: 38601903] {CVE-2025-40103}
- rust: cfi: only 64-bit arm and x86 support CFI_CLANG (Conor Dooley)
- drm/xe/guc: Check GuC running state before deregistering exec queue (Shuicheng Lin)
- LTS version: v6.12.54 (Jack Vogel)
- nfsd: decouple the xprtsec policy check from check_nfsd_access() (Scott Mayhew)
- mount: handle NULL values in mnt_ns_release() (Christian Brauner)
- ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA (Kai Vehmanen)
- nfsd: fix access checking for NLM under XPRTSEC policies (Olga Kornievskaia)
- nfsd: fix __fh_verify for localio (Olga Kornievskaia)
- perf test stat: Avoid hybrid assumption when virtualized (Ian Rogers)
- sched/fair: Block delayed tasks on throttled hierarchy during dequeue (K Prateek Nayak)
- writeback: Avoid excessively long inode switching times (Jan Kara)
- writeback: Avoid softlockup when switching many inodes (Jan Kara)
- cramfs: Verify inode mode when loading from disk (Tetsuo Handa)
- fs: Add 'initramfs_options' to set initramfs mount options (Lichen Liu)
- pid: Add a judgment for ns null in pid_nr_ns (Gaoxiang17)
- minixfs: Verify inode mode when loading from disk (Tetsuo Handa)
- copy_file_range: limit size if in compat mode (Miklos Szeredi)
- irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume (Lucas Zampieri)
- irqchip/sifive-plic: Make use of __assign_bit() (Hongbo Li)
- s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG (Ilya Leoshkevich)
- s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL (Ilya Leoshkevich)
- s390/bpf: Describe the frame using a struct instead of constants (Ilya Leoshkevich)
- s390/bpf: Centralize frame offset calculations (Ilya Leoshkevich)
- mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage (Lance Yang)
- ipmi: Fix handling of messages with provided receive message pointer (Guenter Roeck)
- ipmi: Rework user message limit handling (Corey Minyard)
- mptcp: pm: in-kernel: usable client side with C-flag (Matthieu Baerts)
- ACPI: property: Do not pass NULL handles to acpi_attach_data() (Rafael J. Wysocki)
- ACPI: property: Add code comments explaining what is going on (Rafael J. Wysocki)
- ACPI: property: Disregard references in data-only subnode lists (Rafael J. Wysocki)
- ACPI: battery: Add synchronization between interface updates (Rafael J. Wysocki)
- ACPI: battery: Check for error code from devm_mutex_init() call (Andy Shevchenko)
- ACPI: battery: initialize mutexes through devm_ APIs (Thomas Weißschuh)
- ACPI: battery: allocate driver data through devm_ APIs (Thomas Weißschuh)
- nfsd: unregister with rpcbind when deleting a transport (Olga Kornievskaia)
- nfsd: don't use sv_nrthreads in connection limiting calculations. (Neil Brown)
- nfsd: refine and rename NFSD_MAY_LOCK (Neil Brown)
- NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() (Chuck Lever)
- nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT (Pali Rohár)
- x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (Sean Christopherson)
- x86/mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() (Kirill A. Shutemov)
- arm64: mte: Do not flag the zero page as PG_mte_tagged (Catalin Marinas)
- statmount: don't call path_put() under namespace semaphore (Christian Brauner)
- cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency (Rafael J. Wysocki)
- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (Qu Wenruo)
- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (Hans de Goede)
- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (Andy Shevchenko)
- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (Hans de Goede)
- ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples (Kai Vehmanen)
- ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams (Peter Ujfalusi)
- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (Shin'Ichiro Kawasaki)
- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (Wang Jiang)
- mm/ksm: fix incorrect KSM counter handling in mm_struct during fork (Donet Tom)
- tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [Orabug: 38592031] {CVE-2025-40042}
- Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher)
- Squashfs: add additional inode sanity checking (Phillip Lougher)
- media: mc: Clear minor number before put device (Edward Adam Davis)
- selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled (Lance Yang)
- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (Nathan Chancellor)
- ext4: free orphan info with kvfree (Jan Kara)
- ACPICA: Allow to skip Global Lock initialization (Huacai Chen)
- ext4: validate ea_ino and size in check_xattrs (Deepanshu Kartikey)
- ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag)
- ext4: fix an off-by-one issue during moving extents (Zhang Yi)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O)
- ext4: correctly handle queries for metadata mappings (Ojaswin Mujoo)
- ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() (Yongjian Sun)
- ext4: verify orphan file size is not too big (Jan Kara)
- ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() (Baokun Li)
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia)
- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (Thorsten Blum)
- mm/damon/lru_sort: use param_ctx for damon_attrs staging (Seongjae Park)
- mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (Seongjae Park)
- mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 (Li Rongqing)
- mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations (Thadeu Lima de Souza Cascardo)
- mm/thp: fix MTE tag mismatch when replacing zero-filled subpages (Lance Yang)
- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (Nick Morrow)
- wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 (Nick Morrow)
- wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again (Muhammad Usama Anjum)
- slab: mark slab->obj_exts allocation failures unconditionally (Suren Baghdasaryan)
- slab: prevent warnings when slab obj_exts vector allocation fails (Suren Baghdasaryan)
- s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR (Heiko Carstens)
- s390/dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request (Jaehoon Kim)
- s390/dasd: enforce dma_alignment to ensure proper buffer validation (Jaehoon Kim)
- selftests: mptcp: join: validate C-flag + def limit (Matthieu Baerts)
- x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) (Sean Christopherson)
- x86/umip: Check that the instruction opcode is at least two bytes (Sean Christopherson)
- x86/fred: Remove ENDBR64 from FRED entry points (Xin Li)
- spi: cadence-quadspi: Fix cqspi_setup_flash() (Santhosh Kumar K)
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- PCI: tegra194: Reset BARs when running in PCIe endpoint mode (Niklas Cassel)
- PCI: tegra194: Handle errors in BPMP response (Vidya Sagar)
- PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() (Niklas Cassel)
- PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: rcar-host: Drop PMSR spinlock (Marek Vasut)
- PCI: rcar-gen4: Fix PHY initialization (Marek Vasut)
- PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit (Siddharth Vadapalli)
- PCI: j721e: Fix programming sequence of "strap" settings (Siddharth Vadapalli)
- PCI/AER: Support errors introduced by PCIe r6.0 (Lukas Wunner)
- PCI/AER: Fix missing uevent on recovery when a reset is requested (Niklas Schnelle)
- PCI/ERR: Fix uevent on failure to recover (Lukas Wunner)
- PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (Niklas Schnelle)
- PCI/sysfs: Ensure devices are powered for config reads (Brian Norris)
- PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock (Marek Vasut)
- PCI: xilinx-nwl: Fix ECAM programming (Jani Nurminen)
- rseq/selftests: Use weak symbol reference, not definition, to link with glibc (Sean Christopherson)
- rtc: interface: Fix long-standing race when setting alarm (Esben Haabendal)
- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (Esben Haabendal)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- mmc: mmc_spi: multiple block read remove read crc ack (Rex Chen)
- mmc: core: SPI mode remove cmd7 (Rex Chen)
- mtd: rawnand: fsmc: Default to autodetect buswidth (Linus Walleij)
- xsk: Harden userspace-supplied xdp_desc validation (Alexander Lobakin)
- xtensa: simdisk: add input size check in proc_write_simdisk (Miaoqian Lin)
- sparc: fix error handling in scan_one_device() (Ma Ke)
- sparc64: fix hugetlb for sun4u (Anthony Yznaga)
- sctp: Fix MAC comparison to be constant-time (Eric Biggers)
- scsi: sd: Fix build warning in sd_revalidate_disk() (Abinash Lalotra)
- scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() (Thorsten Blum)
- sched/deadline: Fix race in push_dl_task() (Harshit Agarwal)
- Revert "ipmi: fix msg stack when IPMI is disconnected" (Corey Minyard)
- pwm: berlin: Fix wrong register in suspend/resume (Jisheng Zhang)
- powerpc/pseries/msi: Fix potential underflow and leak issue (Nam Cao)
- powerpc/powernv/pci: Fix underflow and leak issue (Nam Cao)
- power: supply: max77976_charger: fix constant current reporting (Dzmitry Sankouski)
- pinctrl: samsung: Drop unused S3C24xx driver data (Krzysztof Kozlowski)
- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (Georg Gottleuber)
- parisc: Remove spurious if statement from raw_copy_from_user() (John David Anglin)
- parisc: don't reference obsolete termio struct for TC* constants (Sam James)
- openat2: don't trigger automounts with RESOLVE_NO_XDEV (Askar Safin)
- of: unittest: Fix device reference count leak in of_unittest_pci_node_verify (Ma Ke)
- loop: fix backing file reference leak on validation error (Li Chen)
- lib/genalloc: fix device leak in of_gen_pool_get() (Johan Hovold)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (Oleg Nesterov)
- iommu/vt-d: PRS isn't usable if PDS isn't supported (Lu Baolu)
- iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume (Sean Nyekjaer)
- init: handle bootloader identifier in kernel parameters (Huacai Chen)
- iio: xilinx-ams: Unmask interrupts after updating alarms (Sean Anderson)
- iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK (Sean Anderson)
- iio: frequency: adf4350: Fix prescaler usage. (Michael Hennerich)
- iio: dac: ad5421: use int type to store negative error codes (Rong Qianfeng)
- iio: dac: ad5360: use int type to store negative error codes (Rong Qianfeng)
- iio/adc/pac1934: fix channel disable configuration (Aleksandar Gerasimovski)
- fuse: fix livelock in synchronous file put from fuseblk workers (Darrick J. Wong)
- fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() (Miklos Szeredi)
- fs: quota: create dedicated workqueue for quota_release_work (Shashank A P)
- fs/ntfs3: Fix a resource leak bug in wnd_extend() (Haoxiang Li)
- fbdev: Fix logic error in "offb" name match (Finn Thain)
- eventpoll: Replace rwlock with spinlock (Nam Cao)
- crypto: rockchip - Fix dma_unmap_sg() nents value (Thomas Fourier)
- crypto: atmel - Fix dma_unmap_sg() direction (Thomas Fourier)
- crypto: aspeed - Fix dma_unmap_sg() direction (Thomas Fourier)
- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (Rafael J. Wysocki)
- copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) (Simon Schuster)
- clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk (Abel Vesa)
- bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() (Adam Xue)
- bus: mhi: ep: Fix chained transfer handling in read path (Sumit Kumar)
- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (Anderson Nascimento)
- blk-crypto: fix missing blktrace bio split events (Yu Kuai)
- drm/amd/display: Enable Dynamic DTBCLK Switch (Fangzhi Zuo)
- drm/xe/uapi: loosen used tracking restriction (Matthew Auld)
- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (Shuhao Fu)
- drm/rcar-du: dsi: Fix 1/2/3 lane support (Marek Vasut)
- drm/panthor: Fix memory leak in panthor_ioctl_group_create() (Jann Horn)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: ti: j721e-csi2rx: Fix source subdev link creation (Jai Luthra)
- media: ti: j721e-csi2rx: Use devm_of_platform_populate (Jai Luthra)
messages (Hans Verkuil)
- media: venus: firmware: Use correct reset sequence for IRIS2 (Stephan Gerhold)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- media: pci: mg4b: fix uninitialized iio scan data (David Lechner)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: mc: Fix MUST_CONNECT handling for pads with no links (Laurent Pinchart)
- media: i2c: mt9v111: fix incorrect type for ret (Rong Qianfeng)
- media: cx18: Add missing check after DMA map (Thomas Fourier)
- media: cec: extron-da-hd-4k-plus: drop external-module make commands (Randy Dunlap)
- firmware: meson_sm: fix device leak at probe (Johan Hovold)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk)
- xen/manage: Fix suspend error path (Lukas Wunner)
- xen/events: Cleanup find_virq() return codes (Jason Andryuk)
- dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required (Michael Riesch)
- perf/arm-cmn: Fix CMN S3 DTM offset (Robin Murphy)
- ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init (Miaoqian Lin)
- ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) (Alexander Sverdlin)
- arm64: kprobes: call set_memory_rox() for kprobe page (Yang Shi)
- arm64: dts: ti: k3-am62a-main: Fix main padcfg length (Vibhore Vardhan)
- arm64: dts: qcom: x1e80100-pmics: Disable pm8010 by default (Aleksandrs Vinarskis)
- arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees (Stephan Gerhold)
- arm64: dts: qcom: msm8939: Add missing MDSS reset (Stephan Gerhold)
- arm64: dts: qcom: msm8916: Add missing MDSS reset (Stephan Gerhold)
- ACPI: debug: fix signedness issues in read/write helpers (Amir Mohammad Jahangirzad)
- ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT (Daniel Tang)
- ACPI: property: Fix buffer properties extraction for subnodes (Rafael J. Wysocki)
- s390/vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections (Nathan Chancellor)
- s390: vmlinux.lds.S: Reorder sections (Alexey Gladkov)
- bpf: Avoid RCU context warning when unpinning htab with internal structs (Kafai Wan)
- gpio: wcd934x: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (Gunnar Kudrjavets)
- cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points (Pali Rohár)
- smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara)
- cifs: Fix copy_to_iter return value check (Wangfushuai)
- crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38581453] {CVE-2025-40019}
- selftests: netfilter: query conntrack state to check for port clash resolution (Florian Westphal)
- bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() (Eric Woudstra)
- netfilter: nft_objref: validate objref and objrefmap expressions (Fernando Fernandez Mancera)
- drm/amd/display: Properly disable scaling on DCE6 (Timur Kristóf)
- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (Timur Kristóf)
- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (Timur Kristóf)
- drm/amdgpu: Add additional DCE6 SCL registers (Alex Deucher)
- mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() (Jason-JH Lin)
- mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() (Sakari Ailus)
- mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() (Sakari Ailus)
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann)
- mailbox: zynqmp-ipi: Fix SGI cleanup on unbind (Harini T)
- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T)
- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (Harini T)
- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (Harini T)
- tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() (Eric Dumazet)
- perf python: split Clang options when invoking Popen (Leo Yan)
- tools build: Align warning options with perf (Leo Yan)
- net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe (Erick Karanja)
- ice: ice_adapter: release xa entry on adapter allocation failure (Xu Wang)
- net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (Duoming Zhou)
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Kuniyuki Iwashima)
- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov)
- drm/vmwgfx: Fix copy-paste typo in validation (Ian Forbes)
- drm/vmwgfx: Fix Use-after-free in validation (Ian Forbes)
- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin)
- s390/cio: Update purge function to unregister the unused subchannels (Vineeth Vijayan)
- drm/xe/hw_engine_group: Fix double write lock release in error path (Shuicheng Lin)
- net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() (Dan Carpenter)
- ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Peter Ujfalusi)
- LoongArch: Init acpi_gbl_use_global_lock to false (Huacai Chen)
- LoongArch: Add cflag -fno-isolate-erroneous-paths-dereference (Tiezhu Yang)
- ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Peter Ujfalusi)
- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Peter Ujfalusi)
- scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (Duoming Zhou) [Orabug: 38557652] {CVE-2025-40001}
- cpufreq: tegra186: Set target frequency for all cpus in policy (Aaron Kling)
- clk: tegra: do not overallocate memory for bpmp clocks (Fedor Pchelkin)
- clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver (Alok Tiwari)
- clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() (Brian Masney)
- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (Chen-Yu Tsai)
- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (AngeloGioacchino Del Regno)
- perf evsel: Ensure the fallback message is always written to (Ian Rogers)
- perf tools: Add fallback for exclude_guest (Namhyung Kim)
- perf test: Add a test for default perf stat command (James Clark)
- perf test: Don't leak workload gopipe in PERF_RECORD_* (Ian Rogers)
- perf session: Fix handling when buffer exceeds 2 GiB (Leo Yan)
- perf test shell lbr: Avoid failures with perf event paranoia (Ian Rogers)
- perf test: Update sysfs path for core PMU caps (Namhyung Kim)
- perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches (Ilkka Koskinen)
- perf arm_spe: Correct memory level for remote access (Leo Yan)
- perf arm_spe: Correct setting remote access (Leo Yan)
- rtc: optee: fix memory leak on driver removal (Clément Le Goffic)
- rtc: x1205: Fix Xicor X1205 vendor prefix (Rob Herring)
- perf util: Fix compression checks returning -1 as bool (Yunseong Kim)
- clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() (Yuan Chen)
- clk: at91: peripheral: fix return value (Brian Masney)
- clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() (Dan Carpenter)
- libperf event: Ensure tracing data is multiple of 8 sized (Ian Rogers)
- perf evsel: Avoid container_of on a NULL leader (Ian Rogers)
- perf test trace_btf_enum: Skip if permissions are insufficient (Ian Rogers)
- perf disasm: Avoid undefined behavior in incrementing NULL (Ian Rogers)
- asm-generic/io.h: Skip trace helpers if rwmmio events are disabled (Varad Gautam)
- media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() (Tomi Valkeinen)
- iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE (Michael Hennerich)
- KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 (Sean Christopherson)
- dma-mapping: fix direction in dma_alloc direction traces (Petr Tesarik)
- page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches (Toke Høiland-Jørgensen)
- clocksource/drivers/clps711x: Fix resource leaks in error paths (Zhen Ni)
- listmount: don't call path_put() under namespace semaphore (Christian Brauner)
- rseq: Protect event mask against membarrier IPI (Thomas Gleixner)
- arm64: map [_text, _stext) virtual address range non-executable+read-only (Omar Sandoval)
- fscontext: do not consume log entries when returning -EMSGSIZE (Aleksa Sarai)
- fs: always return zero on success from replace_fd() (Thomas Weißschuh)
- LTS version: v6.12.53 (Jack Vogel)
- usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call (Miaoqian Lin)
- arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode (Konrad Dybcio)
- usb: typec: tipd: Clear interrupts first (Sven Peter)
- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (Oleksij Rempel)
- net/9p: Fix buffer overflow in USB transport layer (Dominique Martinet)
- bus: fsl-mc: Check return value of platform_get_resource() (Salah Triki)
- pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [Orabug: 38591979] {CVE-2025-40030}
- tee: fix register_shm_helper() (Jens Wiklander) [Orabug: 38591986] {CVE-2025-40031}
- remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (Zhen Ni)
- sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu)
- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [Orabug: 38591999] {CVE-2025-40035}
- Input: atmel_mxt_ts - allow reset GPIO to sleep (Marek Vasut)
- misc: fastrpc: Skip reference for DMA handles (Ling Xu)
- misc: fastrpc: fix possible map leak in fastrpc_put_args (Ling Xu)
- misc: fastrpc: Fix fastrpc_map_lookup operation (Ling Xu)
- misc: fastrpc: Save actual DMA size in fastrpc_map structure (Ling Xu)
- nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() (Guangshuo Li)
- mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi)
- fbdev: simplefb: Fix use after free in simplefb_detach_genpds() (Janne Grunau) [Orabug: 38592013] {CVE-2025-40037}
- KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson) [Orabug: 38592015] {CVE-2025-40038}
- ext4: fix checks for orphan inodes (Jan Kara)
- ksmbd: add max ip connections parameter (Namjae Jeon)
- ksmbd: fix error code overwriting in smb2_get_info_filesystem() (Matvey Kovalev)
- ksmbd: Fix race condition in RPC handle list access (Yunseong Kim)
- LoongArch: Automatically disable kaslr if boot from kexec_file (Youling Tang)
- dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing)
- dm: fix queue start/stop imbalance under suspend/load/resume races (Zheng Qixing)
- mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() (Bartosz Golaszewski)
- mfd: rz-mtu3: Fix MTU5 NFCR register offset (Cosmin Tanislav)
- net: nfc: nci: Add parameter validation for packet data (Deepak Sharma)
- fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [Orabug: 38592045] {CVE-2025-40044}
- ASoC: codecs: wcd937x: make stub functions inline (Srinivas Kandagatla)
- ASoC: codecs: wcd937x: set the comp soundwire port correctly (Srinivas Kandagatla)
- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Ranjani Sridharan)
- ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Ma Ke)
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (Jens Axboe) [Orabug: 38592063] {CVE-2025-40047}
- uio_hv_generic: Let userspace take care of interrupt mask (Naman Jain) [Orabug: 38592065] {CVE-2025-40048}
- Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [Orabug: 38592075] {CVE-2025-40049}
- bpf: Reject negative offsets for ALU ops (Yazhou Tang)
- vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592084] {CVE-2025-40051}
- Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" (Jakub Kicinski) [Orabug: 38545203]
- smb: client: fix crypto buffers in non-linear memory (Enzo Matsumiya) [Orabug: 38592090] {CVE-2025-40052}
- net/mlx5: fw reset, add reset timeout work (Moshe Shemesh)
- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Shay Drory)
- net/mlx5: Stop polling for command response if interface goes down (Moshe Shemesh)
- net: dlink: handle copy_thresh allocation failure (Moon Yeounsu) [Orabug: 38592094] {CVE-2025-40053}
- net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable (Kohei Enju)
- nfp: fix RSS hash key size when RSS is not supported (Kohei Enju)
- idpf: fix mismatched free function for dma_alloc_coherent (Alok Tiwari)
- PCI: j721e: Fix incorrect error message in probe() (Alok Tiwari)
- mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands (Erick Karanja)
- drivers/base/node: fix double free in register_one_node() (Donet Tom)
- ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [Orabug: 38592108] {CVE-2025-40055}
- hwrng: ks-sa - fix division by zero in ks_sa_rng_init (Nishanth Menon)
- KEYS: X.509: Fix Basic Constraints CA flag parsing (Fan Wu)
- Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements (Luiz Augusto von Dentz)
- Bluetooth: ISO: don't leak skb in ISO_CONT RX (Pauli Virtanen)
- Bluetooth: ISO: free rx_skb if not consumed (Pauli Virtanen)
- Bluetooth: ISO: Fix possible UAF on iso_conn_free (Luiz Augusto von Dentz)
- Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO (Luiz Augusto von Dentz)
- vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592116] {CVE-2025-40056}
- ptp: Add a upper bound on max_vclocks (I Viswanath) [Orabug: 38592122] {CVE-2025-40057}
- net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath)
- RDMA/siw: Always report immediate post SQ errors (Bernard Metzler)
- iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 38592128] {CVE-2025-40058}
- PCI: rcar-gen4: Fix inverted break condition in PHY initialization (Marek Vasut)
- PCI: rcar-gen4: Assure reset occurs before DBI access (Marek Vasut)
- PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion (Marek Vasut)
- usb: vhci-hcd: Prevent suspending virtually attached devices (Cristian Ciocaltea)
- scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar)
- netfilter: nfnetlink: reset nlh pointer during batch replay (Fernando Fernandez Mancera)
- ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [Orabug: 38581443] {CVE-2025-40018}
- NFSv4.1: fix backchannel max_resp_sz verification check (Anthony Iliopoulos)
- coresight: Fix incorrect handling for return value of devm_kzalloc (Lin Yujun)
- coresight: tpda: fix the logic to setup the element size (Jie Gan)
- coresight: trbe: Return NULL pointer for allocation failures (Leo Yan)
- coresight: etm4x: Support atclk (Leo Yan)
- coresight: catu: Support atclk (Leo Yan)
- coresight: tmc: Support atclk (Leo Yan)
- coresight-etm4x: Conditionally access register TRCEXTINSELR (Yuanfang Zhang)
- dm vdo: return error on corrupted metadata in start_restoring_volume functions (Ivan Abramov)
- remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice (Stephan Gerhold)
- PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() (Nagarjuna Kristam)
- wifi: rtw89: avoid circular locking dependency in ser_state_run() (Fedor Pchelkin)
- RDMA/rxe: Fix race in do_task() when draining (Gui-Dong Han) [Orabug: 38592139] {CVE-2025-40061}
- crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs (Chenghai Huang)
- vfio/pds: replace bitmap_free with vfree (Zilin Guan)
- sparc: fix accurate exception reporting in copy_{from,to}_user for M7 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_to_user for Niagara 4 (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III (Michael Karcher)
- sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC (Michael Karcher)
- ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Richard Fitzgerald)
- wifi: mac80211: fix Rx packet handling when pubsta information is not available (Aditya Kumar Singh)
- iommu/vt-d: debugfs: Fix legacy mode page table dump logic (Vineeth Pillai)
- wifi: ath10k: avoid unnecessary wait for service ready message (Baochen Qiang)
- wifi: ath12k: fix wrong logging ID used for CE (Baochen Qiang)
- Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram (Bagas Sanjaya)
- IB/sa: Fix sa_local_svc_timeout_ms read race (Vlad Dumitrescu)
- RDMA/core: Resolve MAC of next-hop device without ARP support (Parav Pandit)
- Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" (Michał Pecio)
- f2fs: fix zero-sized extent for precache extents (Zijie Wang)
- HID: hidraw: tighten ioctl command parsing (Benjamin Tissoires)
- scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() (Rong Qianfeng)
- scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() (Rong Qianfeng)
- scsi: qla2xxx: edif: Fix incorrect sign of error code (Rong Qianfeng)
- ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message (Colin Ian King)
- ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Sebastian Andrzej Siewior)
- f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() (Chao Yu)
- f2fs: fix to truncate first page in error path of f2fs_truncate() (Chao Yu)
- f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() (Chao Yu)
- wifi: mt76: mt7915: fix mt7981 pre-calibration (Zhi-Jun You)
- wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE (Lorenzo Bianconi)
- wifi: mt76: mt7996: Fix RX packets configuration for primary WED device (Lorenzo Bianconi)
- wifi: mt76: fix potential memory leak in mt76_wmac_probe() (Abdun Nihaal)
- RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge)
- drivers/base/node: handle error properly in register_one_node() (Donet Tom)
- watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog (Christophe Leroy)
- ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable (Zhang Tengfei)
- netfilter: ipset: Remove unused htable_bits in macro ahash_region (Zhen Ni)
- iio: consumers: Fix offset handling in iio_convert_raw_to_processed() (Hans de Goede)
- iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() (Hans de Goede)
- fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist (Moon Hee Lee)
- fs: ntfs3: Fix integer overflow in run_unpack() (Vitaly Grigoryev)
- drm/msm/dpu: fix incorrect type for ret (Rong Qianfeng)
- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai)
- ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Takashi Iwai)
- idpf: fix Rx descriptor ready check barrier in splitq (Alexander Lobakin)
- wifi: iwlwifi: Remove redundant header files (Liao Yuanhong)
- pps: fix warning in pps_register_cdev when register device fail (Wang Liang) [Orabug: 38592168] {CVE-2025-40070}
- misc: genwqe: Fix incorrect cmd field being reported in error (Colin Ian King)
- tty: n_gsm: Don't block input queue by waiting MSC (Seppo Takalo) [Orabug: 38592173] {CVE-2025-40071}
- usb: gadget: configfs: Correctly set use_os_string at bind (William Wu)
- usb: phy: twl6030: Fix incorrect type for ret (Xichao Zhao)
- drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() (Rong Qianfeng)
- tcp: fix __tcp_close() to only send RST when required (Eric Dumazet)
- PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation (Alok Tiwari)
- wifi: mwifiex: send world regulatory domain to driver (Stefan Kerkmann)
- drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) (Timur Kristóf)
- drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) (Timur Kristóf)
- drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) (Timur Kristóf)
- drm/amd/pm: Adjust si_upload_smc_data register programming (v3) (Timur Kristóf)
- drm/amd/pm: Fix si_upload_smc_data (v3) (Timur Kristóf)
- drm/amd/pm: Disable ULV even if unsupported (v3) (Timur Kristóf)
- drm/amdgpu: Power up UVD 3 for FW validation (v2) (Timur Kristóf)
- coresight: Only register perf symlink for sinks with alloc_buffer (Yuanfang Zhang)
- inet: ping: check sock_net() in ping_get_port() and ping_lookup() (Eric Dumazet)
- crypto: hisilicon/qm - check whether the input function and PF are on the same device (Zhushuai Yin)
- crypto: hisilicon - re-enable address prefetch after device resuming (Chenghai Huang)
- crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations (Chenghai Huang)
- media: st-delta: avoid excessive stack usage (Arnd Bergmann)
- ALSA: lx_core: use int type to store negative error codes (Rong Qianfeng)
- PCI/ACPI: Fix pci_acpi_preserve_config() memory leak (Nirmoy Das)
- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Or Har-Toov)
- media: rj54n1cb0c: Fix memleak in rj54n1_probe() (Zhang Shurong)
- crypto: octeontx2 - Call strscpy() with correct size argument (Thorsten Blum)
- scsi: myrs: Fix dma_alloc_coherent() error check (Thomas Fourier)
- scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod (Niklas Cassel)
- hwrng: nomadik - add ARM_AMBA dependency (Arnd Bergmann)
- crypto: keembay - Add missing check after sg_nents_for_len() (Thomas Fourier)
- drm/amd/display: Remove redundant semicolons (Liao Yuanhong)
- serial: max310x: Add error checking in probe() (Dan Carpenter)
- usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls (Komal Bajaj)
- usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup (Dan Carpenter)
- phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 (Jonas Karlman)
- media: zoran: Remove zoran_fh structure (Jacopo Mondi)
- drm/bridge: it6505: select REGMAP_I2C (Chia-I Wu)
- f2fs: fix condition in __allow_reserved_blocks() (Chao Yu)
- drm/radeon/r600_cs: clean up of dead code in r600_cs (Brahmajit Das)
- drm/panel: novatek-nt35560: Fix invalid return value (Brigham Campbell)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- libbpf: Fix error when st-prefix_ops and ops from differ btf (D. Wythe)
- i2c: designware: Add disabling clocks when probe fails (Kunihiko Hayashi)
- i2c: designware: Fix clock issue when PM is disabled (Kunihiko Hayashi)
- i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD (Leilk Liu)
- thermal/drivers/qcom/lmh: Add missing IRQ includes (Dmitry Baryshkov)
- thermal/drivers/qcom: Make LMH select QCOM_SCM (Dmitry Baryshkov)
- hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems (Vadim Pasternak)
- once: fix race by moving DO_ONCE to separate section (Qi Xi)
- bpf: Mark kfuncs as __noclone (Andrea Righi)
- spi: fix return code when spi device has too many chipselects (Jonas Gorski)
- tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers (Zhouyi Zhou)
- smp: Fix up and expand the smp_call_function_many() kerneldoc (Rafael J. Wysocki)
- bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() (Hengqi Chen)
- bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [Orabug: 38592203] {CVE-2025-40078}
- selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported (Akhilesh Patil)
- i3c: master: svc: Recycle unused IBI slot (Stanley Chu)
- i3c: master: svc: Use manual response for IBI events (Stanley Chu)
- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (Daniel Wagner)
- riscv, bpf: Sign extend struct ops return values properly (Hengqi Chen)
- ACPICA: Fix largest possible resource descriptor index (Dmitry Antipov)
- pwm: tiehrpwm: Fix corner case in clock divisor calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation (Uwe Kleine-König)
- pwm: tiehrpwm: Make code comment in .free() more useful (Uwe Kleine-König)
- pwm: tiehrpwm: Don't drop runtime PM reference in .free() (Uwe Kleine-König)
- arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value (AngeloGioacchino Del Regno)
- mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() (Bean Huo)
- arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names (AngeloGioacchino Del Regno)
- arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model (Chen-Yu Tsai)
- cpuidle: qcom-spm: fix device and OF node leaks at probe (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure (Johan Hovold)
- soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure (Johan Hovold)
- firmware: firmware: meson-sm: fix compile-test default (Johan Hovold)
- PM / devfreq: rockchip-dfi: double count on RK3588 (Nicolas Frattaroli)
- nbd: restrict sockets to TCP and UDP (Eric Dumazet) [Orabug: 38592211] {CVE-2025-40080}
- arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 (Guoqing Jiang)
- selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO (Thomas Weißschuh)
- selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper (Thomas Weißschuh)
- null_blk: Fix the description of the cache_size module argument (Genjian Zhang)
- pinctrl: renesas: Use int type to store negative error codes (Rong Qianfeng)
- power: supply: cw2015: Fix a alignment coding style issue (Andy Yan)
- PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() (Dan Carpenter)
- ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property (Jihed Chaibi)
- ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS (Jihed Chaibi)
- ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax (Jihed Chaibi)
- vdso: Add struct __kernel_old_timeval forward declaration to gettime.h (Thomas Weißschuh)
- PM: sleep: core: Clear power.must_resume in noirq suspend error path (Rafael J. Wysocki)
- block: use int to store blk_stack_limits() return value (Rong Qianfeng)
- leds: leds-lp55xx: Use correct address for memory programming (Andrei Lalaev)
- selftests/nolibc: fix EXPECT_NZ macro (Benjamin Berg)
- regulator: scmi: Use int type to store negative error codes (Rong Qianfeng)
- arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map (Janne Grunau)
- ARM: at91: pm: fix MCKx restore routine (Nicolas Ferre)
- blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan)
- pinctrl: meson-gxl: add missing i2c_d pinmux (Da Xue)
- soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS (Sneh Mankad)
- ACPI: processor: idle: Fix memory leak when register cpuidle device failed (Huisong Li)
- arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid (Joy Zou)
- arm64: dts: imx93-kontron: Fix USB port assignment (Frieder Schrempf)
- arm64: dts: imx93-kontron: Fix GPIO for panel regulator (Annette Kobou)
- firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver (Junnan Wu)
- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (Florian Fainelli)
- leds: flash: leds-qcom-flash: Update torch current clamp setting (Fenglin Wu)
- ARM: dts: renesas: porter: Fix CAN pin group (Geert Uytterhoeven)
- libbpf: Fix reuse of DEVMAP (Yureka Lilian)
- bpf: Remove migrate_disable in kprobe_multi_link_prog_run (Tao Chen)
- bpf/selftests: Fix test_tcpnotify_user (Matt Bobrowski)
- regmap: Remove superfluous check for !config in __regmap_init() (Geert Uytterhoeven)
- arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 (Biju Das)
- pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() (Lad Prabhakar)
- btrfs: return any hit error from extent_writepage_io() (Qu Wenruo)
- lsm: CONFIG_LSM can depend on CONFIG_SECURITY (Randy Dunlap)
- x86/vdso: Fix output operand size of RDPID (Uros Bizjak)
- EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo)
- smb: server: fix IRD/ORD negotiation with the client (Stefan Metzmacher)
- perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [Orabug: 38592219] {CVE-2025-40081}
- coresight: trbe: Prevent overflow in PERF_IDX2OFF() (Leo Yan)
- uprobes: uprobe_warn should use passed task (Jeremy Linton)
- powerpc/603: Really copy kernel PGD entries into all PGDIRs (Christophe Leroy)
- powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler (Christophe Leroy)
- gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote (Andreas Gruenbacher)
- selftests: arm64: Check fread return value in exec_target (Bala-Vignesh-Reddy)
- seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast (Johannes Nixdorf)
- init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD (Geert Uytterhoeven)
- filelock: add FL_RECLAIM to show_fl_flags() macro (Jeff Layton)
- LTS version: v6.12.52 (Jack Vogel)
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [Orabug: 38591957] {CVE-2025-40026}
- net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [Orabug: 38591963] {CVE-2025-40027}
- crypto: rng - Ensure set_ent is always present (Herbert Xu)
- driver core/PM: Set power.no_callbacks along with power.no_pm (Rafael J. Wysocki)
- staging: axis-fifo: flush RX FIFO on read errors (Ovidiu Panait)
- staging: axis-fifo: fix TX handling on copy_from_user() failure (Ovidiu Panait)
- staging: axis-fifo: fix maximum TX packet length check (Ovidiu Panait)
- serial: stm32: allow selecting console when the driver is module (Raphaël Gallais-Pou)
- binder: fix double-free in dbitmap (Carlos Llamas)
- nvmem: layouts: fix automatic module loading (Michael Walle)
- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (Arnaud Lecomte)
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park)
- ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [Orabug: 38152882] {CVE-2025-38105}
- drm/amdgpu: Enable MES lr_compute_wa by default (Mario Limonciello)
- drm/amd/include : Update MES v12 API for fence update (Shaoyun Liu)
- drm/amd/include : MES v11 and v12 API header update (Shaoyun Liu)
- drm/amd : Update MES API header file for v11 & v12 (Shaoyun Liu)
- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (Christoffer Sandberg)
- can: rcar_canfd: Fix controller mode setting (Duy Nguyen)
- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (Chen Yufeng)
- netfs: Prevent duplicate unlocking (Lizhi Xu)
- btrfs: ref-verify: handle damaged extent root tree (David Sterba)
- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (Jack Yu)
- platform/x86/amd/pmf: Support new ACPI ID AMDI0108 (Shyam Sundar S K)
- perf subcmd: avoid crash in exclude_cmds when excludes is empty (Hupu)
- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (April Grimoire)
- dm-integrity: limit MAX_TAG_SIZE to 255 (Mikulas Patocka)
- ASoC: amd: acp: Adjust pdm gain value (Venkata Prasad Potturu)
- rust: block: fix srctree/ links (Miguel Ojeda)
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 (Bitterblue Smith)
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (Zenm Chen)
- USB: serial: option: add SIMCom 8230C compositions (Xiaowei Li)
- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (Duoming Zhou)
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (Fedor Pchelkin)

[6.12.0-106.51.1]
- KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Harshit Mogalapalli) [Orabug: 38478491]
1 VM count transitions (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Harshit Mogalapalli) [Orabug: 38478491]
- x86/bugs: Add SRSO_USER_KERNEL_NO support (Harshit Mogalapalli) [Orabug: 38478491]
- x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Harshit Mogalapalli) [Orabug: 38478491]
- Revert "x86/bugs: Adjust SRSO mitigation to new features" (Harshit Mogalapalli) [Orabug: 38478491]
- uek-rpm: add "bpf" to CONFIG_LSM as overheads are reduced (Alan Maguire) [Orabug: 38519747]
- uek-rpm: Enable CONFIG_COMPAT_32BIT_TIME for x86 container kernel (Boris Ostrovsky) [Orabug: 38540664]

ELBA-2025-22801-1 Oracle Linux 8 kernel bug fix update

Oracle Linux Bug Fix Advisory ELBA-2025-22801-1

http://linux.oracle.com/errata/ELBA-2025-22801-1.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-abi-stablelists-4.18.0-553.89.1.0.1.el8_10.noarch.rpm
kernel-core-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-cross-headers-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-debug-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-debug-core-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-debug-devel-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-debug-modules-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-debug-modules-extra-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-devel-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-doc-4.18.0-553.89.1.0.1.el8_10.noarch.rpm
kernel-headers-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-modules-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-modules-extra-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-tools-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-tools-libs-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
kernel-tools-libs-devel-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
perf-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm
python3-perf-4.18.0-553.89.1.0.1.el8_10.x86_64.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-553.89.1.0.1.el8_10.src.rpm

Description of changes:

[4.18.0-553.89.1.0.1]
- scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]

[4.18.0-553.89.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 cached (Radostin Stoyanov) [RHEL-122774]
- mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
- mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
- gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660]
- gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660]

[4.18.0-553.88.1]
- scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199]
- RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539}
- RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543}

ELSA-2025-23049 Important: Oracle Linux 9 tomcat security update

Oracle Linux Security Advisory ELSA-2025-23049

http://linux.oracle.com/errata/ELSA-2025-23049.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
tomcat-9.0.87-6.el9_7.1.noarch.rpm
tomcat-admin-webapps-9.0.87-6.el9_7.1.noarch.rpm
tomcat-docs-webapp-9.0.87-6.el9_7.1.noarch.rpm
tomcat-el-3.0-api-9.0.87-6.el9_7.1.noarch.rpm
tomcat-jsp-2.3-api-9.0.87-6.el9_7.1.noarch.rpm
tomcat-lib-9.0.87-6.el9_7.1.noarch.rpm
tomcat-servlet-4.0-api-9.0.87-6.el9_7.1.noarch.rpm
tomcat-webapps-9.0.87-6.el9_7.1.noarch.rpm

aarch64:
tomcat-9.0.87-6.el9_7.1.noarch.rpm
tomcat-admin-webapps-9.0.87-6.el9_7.1.noarch.rpm
tomcat-docs-webapp-9.0.87-6.el9_7.1.noarch.rpm
tomcat-el-3.0-api-9.0.87-6.el9_7.1.noarch.rpm
tomcat-jsp-2.3-api-9.0.87-6.el9_7.1.noarch.rpm
tomcat-lib-9.0.87-6.el9_7.1.noarch.rpm
tomcat-servlet-4.0-api-9.0.87-6.el9_7.1.noarch.rpm
tomcat-webapps-9.0.87-6.el9_7.1.noarch.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/tomcat-9.0.87-6.el9_7.1.src.rpm

Related CVEs:

CVE-2025-31651
CVE-2025-55752

Description of changes:

[1:9.0.87-6.1]
- Resolves: RHEL-124518
tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
- Resolves: RHEL-91753
tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

ELSA-2025-23034 Important: Oracle Linux 9 firefox security update

Oracle Linux Security Advisory ELSA-2025-23034

http://linux.oracle.com/errata/ELSA-2025-23034.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
firefox-140.6.0-1.0.1.el9_7.x86_64.rpm
firefox-x11-140.6.0-1.0.1.el9_7.x86_64.rpm

aarch64:
firefox-140.6.0-1.0.1.el9_7.aarch64.rpm
firefox-x11-140.6.0-1.0.1.el9_7.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/firefox-140.6.0-1.0.1.el9_7.src.rpm

Related CVEs:

CVE-2025-14321
CVE-2025-14322
CVE-2025-14323
CVE-2025-14324
CVE-2025-14325
CVE-2025-14328
CVE-2025-14329
CVE-2025-14330
CVE-2025-14331
CVE-2025-14333

Description of changes:

[140.6.0-1.0.1]
- Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

[140.6.0]
- Add debranding patches (Mustafa Gezen)
- Add OpenELA default preferences (Louis Abel)

[140.6.0-1]
- Update to 140.6.0 ESR

ELSA-2025-22865 Moderate: Oracle Linux 9 kernel security update

Oracle Linux Security Advisory ELSA-2025-22865

http://linux.oracle.com/errata/ELSA-2025-22865.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-abi-stablelists-5.14.0-611.13.1.el9_7.noarch.rpm
kernel-core-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-cross-headers-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-core-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-devel-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-devel-matched-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-modules-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-modules-core-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-modules-extra-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-debug-uki-virt-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-devel-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-devel-matched-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-doc-5.14.0-611.13.1.el9_7.noarch.rpm
kernel-headers-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-modules-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-modules-core-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-modules-extra-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-tools-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-tools-libs-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-tools-libs-devel-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-uki-virt-5.14.0-611.13.1.el9_7.x86_64.rpm
kernel-uki-virt-addons-5.14.0-611.13.1.el9_7.x86_64.rpm
libperf-5.14.0-611.13.1.el9_7.x86_64.rpm
perf-5.14.0-611.13.1.el9_7.x86_64.rpm
python3-perf-5.14.0-611.13.1.el9_7.x86_64.rpm
rtla-5.14.0-611.13.1.el9_7.x86_64.rpm
rv-5.14.0-611.13.1.el9_7.x86_64.rpm

aarch64:
kernel-cross-headers-5.14.0-611.13.1.el9_7.aarch64.rpm
kernel-headers-5.14.0-611.13.1.el9_7.aarch64.rpm
kernel-tools-5.14.0-611.13.1.el9_7.aarch64.rpm
kernel-tools-libs-5.14.0-611.13.1.el9_7.aarch64.rpm
kernel-tools-libs-devel-5.14.0-611.13.1.el9_7.aarch64.rpm
libperf-5.14.0-611.13.1.el9_7.aarch64.rpm
perf-5.14.0-611.13.1.el9_7.aarch64.rpm
python3-perf-5.14.0-611.13.1.el9_7.aarch64.rpm
rtla-5.14.0-611.13.1.el9_7.aarch64.rpm
rv-5.14.0-611.13.1.el9_7.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-5.14.0-611.13.1.el9_7.src.rpm

Related CVEs:

CVE-2025-39925
CVE-2025-39979

Description of changes:

[5.14.0-611.13.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64

Tomcat, Firefox, LibSSH, and more updates for RHEL

Kernel and Abrt updates for AlmaLinux

Kernel, Tomcat, Firefox, and more updates for Oracle Linux

ELSA-2025-28040 Important: Unbreakable Enterprise kernel security update

ELSA-2025-23052 Important: Oracle Linux 10 tomcat9 security update

ELSA-2025-23035 Important: Oracle Linux 10 firefox security update

ELSA-2025-23008 Moderate: Oracle Linux 10 mysql8.4 security update

ELSA-2025-22854 Moderate: Oracle Linux 10 kernel security update

ELBA-2025-22801-1 Oracle Linux 8 kernel bug fix update

ELSA-2025-23049 Important: Oracle Linux 9 tomcat security update

ELSA-2025-23034 Important: Oracle Linux 9 firefox security update

ELSA-2025-22865 Moderate: Oracle Linux 9 kernel security update

Windows

Linux

macOS

Community