ELSA-2026-500381

ELSA-2026-500381 - Unbreakable Enterprise kernel security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-09

Description

[5.15.0-325.221.6.1]
- x86/kexec: Add EFI config table identity mapping for kexec kernel (Tao Liu) [Orabug: 40127851]
- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson) [Orabug: 40127747] {CVE-2026-80726}

[5.15.0-325.221.6]
- scsi: qla2xxx: Preserve PURLS head on reject (Vijayendra Suman) [Orabug: 40088703]
- net: Account VLAN RPS drops (Vijayendra Suman) [Orabug: 40088694]
- net: tun: set drop reason for truncated raw TUN packets (Vijayendra Suman) [Orabug: 40088685]
- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 40002252]
- scsi: target: iblock: Allow iblock devices to be shared (Mike Christie) [Orabug: 39226785]
- scsi: target: core: Fix complete_type use (Mike Christie) [Orabug: 39226785]
- scsi: vhost-scsi: Report direction completion support (Mike Christie) [Orabug: 39226785]
- scsi: target: Allow userspace to set the completion type (Mike Christie) [Orabug: 39226785]
- scsi: target: Use driver completion preference by default (Mike Christie) [Orabug: 39226785]
- scsi: target: Add support for completing commands from backend context (Mike Christie) [Orabug: 39226785]
- scsi: target: Move LUN stats to per-CPU (Mike Christie) [Orabug: 39226785]
- scsi: target: Create and use macro helpers for per-CPU stats (Mike Christie) [Orabug: 39226785]
- scsi: target: Fix LUN/device R/W and total command stats (Mike Christie) [Orabug: 39226785]
- scsi: target: Move delayed/ordered tracking to per CPU (Mike Christie) [Orabug: 39226785]
- scsi: target: Fix ordered CMD_T_SENT handling (Mike Christie) [Orabug: 39226785]
- scsi: target: Move I/O path stats to per CPU (Mike Christie) [Orabug: 39226785]
- KVM: x86: Reset last_steal on vCPU pid change (Dongli Zhang) [Orabug: 39592756]
- bpftool: remove duplicate free_btf_vmlinux() definition (Suraj Jitindar Singh) [Orabug: 40083890]
- Revert 'bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls' (Vijayendra Suman) [Orabug: 40084576]
- LTS version: v5.15.221 (Vijayendra Suman)
- clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled (Bjorn Andersson)
- nvmet-rdma: fix queue leak when connect backlog is exceeded (Xixin Liu)
- kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c (Catalin Marinas)
- kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings (Catalin Marinas)
- Bluetooth: L2CAP: Fix send LE flow credits in ACL link (Zhang Chen)
- ALSA: control: Fix unannotated kfree() cleanup (Takashi Iwai)
- HID: fix an error code in hid_check_device_match() (Dan Carpenter)
- clk: qcom: Drop mmcx gdsc supply for dispcc and videocc (Abel Vesa)
- nvme: target: rdma: fix ndev refcount leak on queue connect (Wentao Liang)
- net/sched: sch_htb: limit htb_classify inner-class filter hops (Jamal Hadi Salim)
- tcp: fix corruption of urgent data on multi-segment retransmit (Jiayuan Chen)
- usb: atm: usbatm: fix invalid ci_range initialization (Deepanshu Kartikey)
- net: fec: only stop PTP if it was initialized (bui duc phuc)
- net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (Jamal Hadi Salim)
- net: stmmac: selftests: Account for the UC filter list for filtering tests (Maxime Chevallier)
- net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering (Maxime Chevallier)
- net: stmmac: dwmac4: Account for the primary MAC address for UC filtering (Maxime Chevallier)
- net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering (Maxime Chevallier)
- net: stmmac: selftests: Check multiple MMC counters (Maxime Chevallier)
- selftests/arm64: Treat KSM merge_across_nodes as optional (Muhammad Usama Anjum)
- selftests/arm64: Print missing MTE TAP headers (Muhammad Usama Anjum)
- selftests: arm64: add hugetlb mte tests (Yang Shi)
- netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() (Pablo Neira Ayuso)
- netfilter: xt_HL: add pr_fmt and checkentry validation (Marino Dzalto)
- netfilter: xt_cgroup: Make it independent from net_cls (Michal Koutny)
- netfilter: nf_tables: move hardware offload step after building the chain blob (Pablo Neira Ayuso)
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier)
- net: ethernet: sun4i-emac: Fix IRQ error handling (bui duc phuc)
- libceph: validate banner payload length (Aleksandr Nogikh)
- ASoC: dapm: Fix off-by-one check on the second enum channel (HyeongJun An)
- apparmor: policy_int make sure list heads are initialized before fail path (John Johansen)
- apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init (Thorsten Blum)
- tpm: st33zp24: Validate locality read result (Ruoyu Wang)
- tpm: st33zp24: Return zero on status read failure (Ruoyu Wang)
- net/sched: sch_teql: restore skb->dev on the slave failure path (Victor Nogueira)
- net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (Jamal Hadi Salim)
- net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (Jamal Hadi Salim)
- net/sched: fq_pie: clamp default quantum to avoid signed overflow (Jamal Hadi Salim)
- net/sched: sch_codel: clamp default mtu to avoid disabling CoDel (Jamal Hadi Salim)
- net/sched: fq_codel: clamp default quantum and mtu (Jamal Hadi Salim)
- net_sched: export pfifo_fast prio2band[] (Eric Dumazet)
- net_sched: sch_fq: change how @inactive is tracked (Eric Dumazet)
- net_sched: sch_fq: struct sched_data reorg (Eric Dumazet)
- net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() (Jiapeng Chong)
- net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (Eric Dumazet)
- cifs: fix clearing stats for fastest execution of each smb2 command (Frank Sorenson)
- octeontx2-af: Fix TL3/TL2 link config ENA clearing (Naveen Mamindlapalli)
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames (Xiang Mei)
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (Cen Zhang (Microsoft))
- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (Hyunwoo Kim)
- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (Chris Lu)
- scsi: qla2xxx: Fix an loop timeout test (Dan Carpenter)
- NFSv4/pnfs: key the data server cache on the NFS version (Junrui Luo)
- nfs: move the nfs4_data_server_cache into struct nfs_net (Jeff Layton)
- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (Junrui Luo)
- net/smc: free pending qentry in smc_llc_flow_stop() before memset (Mahanta Jambigi)
- net: ipa: balance runtime PM reference on remove error (Ruoyu Wang)
- net: ipa: Convert to platform remove callback returning void (Uwe Kleine-Konig)
- net: ipa: report when the driver has been removed (Alex Elder)
- forcedeth: stop the tx_timeout register dump past the requested window (Marek Czernohous)
- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (Fan Ye)
- net: bridge: Reject descending VLAN tunnel ranges (Ruoyu Wang)
- RDMA/ucma: Allow path records to exactly fit the output buffer (Serhat Kumral)
- ALSA: control: Use automatic cleanup of kfree() (Takashi Iwai)
- prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator (Bradley Morgan)
- rtc: pcf8563: fix clock provider leak on unbind (Yi Ding)
- vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (Li RongQing)
- virtio_balloon: disable indirect descriptors (Michael S. Tsirkin)
- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (Jian-Ming Liao)
- i3c: mipi-i3c-hci: Refactor PIO register initialization (Adrian Hunter)
- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (Adrian Hunter)
- i3c: mipi-i3c-hci: Quieten initialization messages (Adrian Hunter)
- i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 (Jarkko Nikula)
- i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes (Jarkko Nikula)
- bonding: initialize err for empty target lists (Ruoyu Wang)
- vsock: use sock_error() to consume sk_err after a failed connect (Nguyen Dinh Phi)
- platform/x86: dell-wmi-sysman: Fix instance ID bounds (HyeongJun An)
- 8139cp: fix Rx and Tx not being disabled in cp_suspend (Karl Mehltretter)
- ALSA: hda: Fix connection list comparison in proc output (Xu Rao)
- fs/ntfs3: validate ef->size covers the record's name and value (Weiming Shi)
- fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (Konstantin Komarov)
- cuse: wait for pending RCU callbacks on module exit (Baokun Li)
- net: bridge: vlan: fix inverted default vlan notification (Nikolay Aleksandrov)
- ipvs: fix integer overflow in ftp helper port/address parsing (Joas Antonio dos Santos)
- net: hsr: Use full string description when opening HSR network device (Lukasz Majewski)
- hsr: Use a single struct for self_node. (Sebastian Andrzej Siewior)
- pppox: drain queued packets on channel handoff (Qingfang Deng)
- net: kcm: Hold RCU read lock while running BPF parser (Junseo Lim)
- NFSv4: remove callback IDR entry on client allocation failure (Ruoyu Wang)
- nfs: refactor pNFS functions using clear_and_wake_up_bit (Arnaud Bonnet)
- nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper (Arnaud Bonnet)
- bpf: Reject negative optlen in cgroup getsockopt hook (Junseo Lim)
- lwt_bpf: Restore reserved headroom after xmit program (Junseo Lim)
- smb/server: preserve error status in smb2_handle_negotiate() (ZhangGuoDong)
- hwmon: (emc1403) Add support for EMC1442 (Delphine CC Chiu)
- mailbox: rockchip: disable pclk on probe failure and unbind (Linmao Li)
- perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() (Arnaldo Carvalho de Melo)
- perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() (Arnaldo Carvalho de Melo)
- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (Zhushuai Yin)
- bpf: Fix pending_pos walk on 32-bit ring position wrap (Israel Tellez Garcia)
- tracing: Have trace_event_update_all() only handle module that is loading (Steven Rostedt)
- tracing: Remove '__attribute__()' from the type field of event format (Masami Hiramatsu (Google))
- ALSA: core: Fix use-after-free in snd_card_do_free() (Aleksandr Nogikh)
- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Chandrakanth Patil)
- Squashfs: check block offset is not negative (Phillip Lougher)
- ocfs2: fix circular locking dependency in ocfs2_init_acl() (Krystian Kaniewski)
- bpftool: Fix double close in map dump (Yuan Chen)
- x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported (Bijan Tabatabai)
- clocksource/drivers/armada: Unwind timer clock on init failure (Yuho Choi)
- clocksource/drivers/clps711x: Do not unmap clocksource MMIO (Guangshuo Li)
- s390/debug: Fix deadlock during unregister (Peter Oberparleiter)
- xenbus: Unregister reboot notifier on init failure (Yuho Choi)
- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (Henrik Grimler)
- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (Henrik Grimler)
- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (Henrik Grimler)
- power: supply: bd99954: Drop bad register fields (Matti Vaittinen)
- spi: img-spfi: don't disable runtime PM on DMA deferred probe (Felix Gu)
- selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM (Vineet Gupta)
- selftests/bpf: Add description for running vmtest on RV64 (Pu Lehui)
- selftests/bpf: Support local rootfs image for vmtest (Pu Lehui)
- selftests/bpf: Limit URLS parsing logic to actual scope in vmtest (Pu Lehui)
- selftests/bpf: Fix vmtest.sh getopts optstring (Daniel Xu)
- bpf/docs: Update list of architectures supported. (KP Singh)
- selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes (Ilya Leoshkevich)
- selfetests/bpf: Update vmtest.sh defaults (Yucong Sun)
- UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC (Ran Hongyun)
- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (Rosen Penev)
- ubi: Fix rollback for explicit UBI device numbers (Yuho Choi)
- ubi: fastmap: Add module parameter to control reserving filling pool PEBs (Zhihao Cheng)
- ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs (Zhihao Cheng)
- ubi: fastmap: Wait until there are enough free PEBs before filling pools (Zhihao Cheng)
- ubi: Simplify bool conversion (Yang Li)
- ubi: fastmap: Add fastmap control support for module parameter (ZhaoLong Wang)
- ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl (Zhihao Cheng)
- UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs (Zhihao Cheng)
- UBI: Preserve torture flag when rescheduling failed erasures (Zhihao Cheng)
- ubi: Replace erase_block() with sync_erase() (Zhihao Cheng)
- ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap (Zhihao Cheng)
- ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash (Zhihao Cheng)
- ubi: fastmap: Fix missed ec updating after erasing old fastmap data block (Zhihao Cheng)
- ubi: fastmap: Use the bitmap API to allocate bitmaps (Christophe JAILLET)
- ubi: Fix repeated words in comments (Jilin Yuan)
- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (LiangCheng Wang)
- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (bui duc phuc)
- RDMA/cma: Fix WARNING in res_to_rt (Zhu Yanjun)
- RDMA/cxgb4: Free debugfs on registration failure (Fan Wu)
- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (Guangshuo Li)
- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (Yun Zhou)
- nfc: digital: Do not dump a NULL response in command completion (Linmao Li)
- nfc: pn533: hold a reference to the request skb during send_frame (Yinhao Hu)
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (Doruk Tan Ozturk)
- nfc: nci: fix double completion race in nci_data_exchange_complete (Zhenghang Xiao)
- nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (Breno Leitao)
- nfc: llcp: avoid userspace overflow on invalid optlen (Breno Leitao)
- nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (Guixin Liu)
- spi: sprd-adi: Fix probe succeeding without registering the controller (Babanpreet Singh)
- powerpc/configs: enable CONFIG_RAS to fix EDAC support (Michael Walle)
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (Weiming Shi)
- m68k: Fix backtraces for non-running tasks (Karl Mehltretter)
- iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes)
- fbdev: kyro: Validate overlay viewport coordinates (Danila Chernetsov)
- perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads (Ian Rogers)
- perf synthetic-events: Fix uninitialized pthread_join (Ian Rogers)
- perf stat: Fix evsel_list leak in cmd_stat (Ian Rogers)
- perf stat: Clear screen only if output file is a tty (Namhyung Kim)
- ARM: dts: helios4: add SATA regulator supplies (Rosen Penev)
- ARM: dts: helios4: add vcc-supply to GPIO expander (Rosen Penev)
- ARM: dts: helios4: add vcc-supply to EEPROM (Rosen Penev)
- arm64: dts: turris-mox: fix usb3 phys (Tomas Macholda)
- net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (Victor Nogueira)
- iio: light: gp2ap002: re-enable irq if runtime suspend fails (Nikhil Gautam)
- iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (Nikhil Gautam)
- Bluetooth: MSFT: validate evt_prefix_len against the response length (Ali Ahmet Memis)
- Bluetooth: virtio_bt: avoid OOB read of build info string (HyeongJun An)
- scsi: sd: Fix sd_done() sense handling condition (Yang Xiuwei)
- perf trace-event: Fix integer truncation in do_read() and skip() (Tanushree Shah)
- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (Zijun Hu)
- sched/fair: Check CPU capacity before comparing group types during load balance (Ricardo Neri)
- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (Kamal Wadhwa)
- coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (Yeoreum Yun)
- coresight: Change syncfreq to be a u8 (James Clark)
- coresight: etm4x: Cleanup TRCIDR5 register accesses (James Clark)
- coresight: etm4x: Cleanup TRCIDR4 register accesses (James Clark)
- coresight: etm4x: Cleanup TRCIDR3 register accesses (James Clark)
- coresight: etm4x: Cleanup TRCIDR2 register accesses (James Clark)
- coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() (Yeoreum Yun)
- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (Loic Poulain)
- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (Linkai Gong)
- hugetlbfs: release subpool on fill_super failure (Yichong Chen)
- pinctrl: rockchip: Reset the pin count when recalculating SoC data (Simon Glass)
- firmware_loader: do not queue completed sysfs fallback requests (Mukesh Ojha)
- firmware_loader: Check fw_state_is_done in loading_store (Russ Weight)
- scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (Manish Rangankar)
- drm/amdgpu/gfx6: Use PFP on the compute queues too (Timur Kristof)
- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (Timur Kristof)
- perf trace-event: Fix buffer overflow in read_string() (Tanushree Shah)
- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (Gerald Loacker)
- ext4: fix spurious message about orphan cleanup on RO fs (Jan Kara)
- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (Timur Kristof)
- mfd: iqs62x: Reject zero-length firmware records (Pengpeng Hou)
- mfd: rave-sp: validate received frame payload lengths (Pengpeng Hou)
- arm64: hibernate: Restore DAIF state on error (Vladimir Murzin)
- arm64: hibernate: mask DAIF before restoring hibernated kernel (Ada Couprie Diaz)
- RDMA/siw: Fix use-after-free in siw_accept() (Shuangpeng Bai)
- RDMA/siw: Introduce siw_free_cm_id (Guoqing Jiang)
- IB/isert: post the full-feature receive buffers after session registration (Yehyeong Lee)
- IB/isert: delay the final Login Response until the session is registered (Yehyeong Lee)
- cpufreq: imx6q: fix out-of-bounds write when probed more than once (Karl Mehltretter)
- cpufreq: imx6q: fix devres accumulation across driver rebind (Karl Mehltretter)
- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (Jernej Skrabec)
- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (Jernej Skrabec)
- drm/sun4i: tcon: Drop remote endpoint reference (Jernej Skrabec)
- drm/sun4i: crtc: Propagate layer initialization error (Jernej Skrabec)
- drm/sun4i: tcon: Drop TCON TOP device reference (Jernej Skrabec)
- bitfield: Add non-constant field_{prep,get}() helpers (Geert Uytterhoeven)
- bitfield: Add less-checking __FIELD_{GET,PREP}() (Geert Uytterhoeven)
- of: property: use unsigned int return on of_graph_get_endpoint_count() (Kuninori Morimoto)
- of: property: add missing kerneldoc for of_graph_get_endpoint_count() (Kuninori Morimoto)
- drm/sun4i: vi scaler: Fix coefficient selection (Jernej Skrabec)
- ocfs2: synchronize heartbeat callbacks with o2net teardown (Cen Zhang)
- ocfs2: use bitmap API in fill_node_map (Joseph Qi)
- ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults (Xie Yuanbin)
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (Yehyeong Lee)
- scripts/tags.sh: Prevent binary files appearing in cscope.files (Sergei Litvin)
- scripts/tags.sh: improve compiled sources generation (Jialu Xu)
- remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (Mukesh Ojha)
- remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() (Mukesh Ojha)
- remoteproc: Move resource table data structure to its own header (Mukesh Ojha)
- PCI/sysfs: Add static PCI resource attribute macros (Krzysztof Wilczynski)
- drm/omap: dsi: Do not copy isr table (Andreas Kemnade)
- fat: release buffer head after rebuilding parent (Yichong Chen)
- rapidio: clear mport->net when rio_add_net() fails (Guangshuo Li)
- pps-gpio: remove dead capture_clear code (Calvin Owens)
- pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler (Michael Byczkowski)
- pps: clients: gpio: Bypass edge's direction check when not needed (Bastien Curutchet)
- pps: don't try to wait for negative timeouts in PPS_FETCH (Calvin Owens)
- lib/string: fix memchr_inv() for large ranges (Bradley Morgan)
- block/kyber-iosched: flush per-cpu latency buckets over possible CPUs (Tao Cui)
- block/blk-iocost: collect per-cpu latency stats over possible CPUs (Tao Cui)
- block/blk-stat: drain per-cpu callback stats over possible CPUs (Tao Cui)
- phonet: pep: do not write beyond optlen in getsockopt (Breno Leitao)
- iio: light: tsl2583: return zero in write_raw() on success (Sang-Heon Jeon)
- iio: light: isl29028: return zero in write_raw() on success (Sang-Heon Jeon)
- iio: light: tsl2772: fix ALS calibscale readback (Yuanshen Cao)
- perf intel-bts: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
- perf intel-pt: Fix off-by-one in auxtrace_info minimum size check (Arnaldo Carvalho de Melo)
- perf auxtrace: Fix queue grow overflow and old array leak (Arnaldo Carvalho de Melo)
- perf thread-stack: Fix heap buffer overflow on branch stack wrap copy (Arnaldo Carvalho de Melo)
- HID: lg4ff: validate report length before fixed offsets (Jiancheng Huang)
- HID: i2c-hid: Fix '(null)' output when reading report descriptor fails (Ai Chao)
- HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling (Hans de Goede)
- HID: synchronize input before cleaning up a failed probe (Yousef Alhouseen)
- HID: ensure timely release of driver-allocated resources (Dmitry Torokhov)
- HID: split apart hid_device_probe to make logic more apparent (Dmitry Torokhov)
- tty: clear cdev pointer after cdev_add() failure (Karl Mehltretter)
- serial: amba-pl011: unprepare console clock on unregister (Karl Mehltretter)
- MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL (Thomas Bogendoerfer)
- powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass (Gou Hao)
- firmware: coreboot: Validate table bounds (Laxman Acharya Padhya)
- firmware: google: Add bounds checks in coreboot_table_populate() (Titouan Ameline de Cadeville)
- wifi: mac80211: skip unused probe response countdown offsets (Zhao Li)
- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (Slawomir Stepien)
- wifi: mac80211: send TWT teardown to peer after setup TX failure (Zhao Li)
- iommu/arm-smmu-v3: Convert to use atomic poll timeout (Pranjal Shrivastava)
- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (Linghui Wu)
- perf machine: Check snprintf truncation for guest kallsyms path (Arnaldo Carvalho de Melo)
- perf machine: Free scandir entries in guest kernel map creation (Arnaldo Carvalho de Melo)
- perf machine: Reset errno before strtol in guest kernel map creation (Arnaldo Carvalho de Melo)
- perf machine: Don't abort guest map creation on first inaccessible dir (Arnaldo Carvalho de Melo)
- perf machine: Check snprintf truncation in machines__findnew() (Arnaldo Carvalho de Melo)
- perf machine: Use snprintf() for guestmount path construction (Arnaldo Carvalho de Melo)
- perf machine: Guard against NULL strlist in machines__findnew() (Arnaldo Carvalho de Melo)
- regulator: core: use system_freezable_wq for init complete work (Joy Zou)
- wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (Jeff Johnson)
- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (Konrad Dybcio)
- perf: arm_spe: Make wakeup range check overflow safe (Leo Yan)
- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (Felix Fietkau)
- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (Felix Fietkau)
- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (Eason Lai)
- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (Devin Wittmayer)
- fanotify: report full event length for FIONREAD (Yichong Chen)
- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (Abdun Nihaal)
- locking/lockdep: Fix NULL pointer dereference in __lock_set_class() (Naveen Kumar Chaudhary)
- i3c: master: Fix device_register() error path (Adrian Hunter)
- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (Jakub Kicinski)
- iommu/dma: Check atomic pool allocation result directly (Aneesh Kumar K.V (Arm))
- clk: qcom: Return expected ENOMEM error on dynamic allocation failure (Vladimir Zapolskiy)
- lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone (Stanislav Kinsburskii)
- bpf: Fix potential UAF in bpf_netns_link_update_prog (Pu Lehui)
- power: supply: sc2731_charger: cancel work on remove (Hongyan Xu)
- power: supply: sc2731_charger: Convert to platform remove callback returning void (Uwe Kleine-Konig)
- power: supply: isp1704_charger: cancel work on remove (Hongyan Xu)
- selftests/zram: fix kernel_gte() for POSIX sh (Cheng-Han Wu)
- md/raid5-ppl: fix use-after-free in ppl_do_flush() (Sajal Gupta)
- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (Manivannan Sadhasivam)
- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (Abdun Nihaal)
- nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (Guixin Liu)
- IB/isert: reject login PDUs declaring more data than was received (Yehyeong Lee)
- IB/isert: reject PDUs declaring more data than was received (Yehyeong Lee)
- RDMA/cxgb4: free STAG index when TPT entry write fails (Leon Romanovsky)
- RDMA/mlx5: Send cong param changes to the resolved port mdev (Leon Romanovsky)
- RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (Leon Romanovsky)
- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (David Strahan)
- nilfs2: prevent out-of-bounds read in super root block parsing (David Lee)
- nilfs2: fix infinite loop in nilfs_clean_segments() (Joshua Crofts)
- clk/x86: pmc_atom: add kasprintf return value check (longlong yan)
- clk: palmas: Manage external-control prepare with devm (Myeonghun Pak)
- clk: tegra: tegra124-emc: put EMC node on register failure (Guangshuo Li)
- arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix (Ondrej Jirman)
- RDMA/efa: Fix PBL chunk length computation (Yonatan Nachum)
- fs/ntfs3: reject restart table growth beyond U16_MAX entries (Weiming Shi)
- staging: rtl8723bs: use kfree_sensitive() for key material (Ivy Lopez)
- remoteproc: Prevent crash handling to race with rproc_del() (Bjorn Andersson)
- remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() (Jingyi Wang)
- remoteproc: Use unbounded workqueue for recovery work (Mukesh Ojha)
- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (Babanpreet Singh)
- isofs: release zisofs block pointer buffer head (Yichong Chen)
- RDMA/mlx5: Fix integer overflow of user QP buffer size (Maher Sanalla)
- crypto: keembay - publish OF module alias for OCS AES/SM4 (Can Peng)
- crypto: keembay - Initialize completion before requesting IRQ (Linmao Li)
- power: supply: sbs-battery: Use a per-device serial number buffer (Babanpreet Singh)
- ARM: lpc32xx: only run SoC init on LPC32xx hardware (Karl Mehltretter)
- arm64: dts: rockchip: Fix Gru WLAN sideband interrupt (Fabio Estevam)
- arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru (Rob Herring)
- arm64: dts: rockchip: Add gru-scarlet-dumo board (Chen-Yu Tsai)
- fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (Weiming Wu)
- netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (Florian Westphal)
- drm/tve200: add OF module alias for autoloading (Can Peng)
- leds: pca9532: Fix phantom device registration on missing hardware (Cosmo Chou)
- perf cs-etm: Avoid truncating AUX buffer sizes to int (Leo Yan)
- perf cs-etm: Flush thread stacks after decoder reset (Leo Yan)
- ARM: dts: allwinner: a10: Fix PMU interrupt (Andre Przywara)
- ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (Xiang Mei)
- ext4: fix buffer_head leak in ext4_init_orphan_info (Guanghui Yang)
- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (Jeff Johnson)
- ath11k: add trace log support (Venkateswara Naralasetty)
- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (Jeff Johnson)
- wifi: ath6kl: avoid buffer overreads in WMI event handlers (Jeff Johnson)
- ext4: drain in-flight DIO before buffered write fallback (Baokun Li)
- thermal: intel: int3400: clean up ODVP on probe failures (Pengpeng Hou)
- thermal: int340x_thermal: Consolidate priv->data_vault checks (Rafael J. Wysocki)
- iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() (Mukesh Ojha)
- iommu/qcom: Remove sysfs device on probe failure path (Haoxiang Li)
- iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe (Miaoqian Lin)
- RDMA/core: Fix potential use after free in ib_free_cq() (Patrisious Haddad)
- RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() (Mark Zhang)
- RDMA/restrack: Fix typos in the comments (Kalesh AP)
- RDMA/srpt: Pass the mapped task attribute to target_init_cmd() (Leon Romanovsky)
- ext4: skip extra isize expansion during mount to prevent deadlock (Yun Zhou)
- ext4: fix out-of-bounds read in ext4_read_inline_dir() (Xiang Mei)
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (Chen Pei)
- ACPI: processor: validate MADT IOAPIC entry bounds (Pengpeng Hou)
- irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (Kemeng Shi)
- RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (TanZheng)
- RDMA/hfi1: Propagate sdma_txinit_ahg() errors (Danila Chernetsov)
- arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe (Jun Yan)
- ASoC: meson: Keep link pointers valid on realloc failure (Linmao Li)
- dmaengine: dw-edma: Clear stale requests on termination (Koichiro Den)
- dmaengine: dw-edma: Serialize channel state checks (Koichiro Den)
- dmaengine: dw-edma: Serialize abort state updates (Koichiro Den)
- driver core: soc: Unregister bus on early device registration failure (Yuho Choi)
- driver core: soc: remove layering violation for the soc_bus (Greg Kroah-Hartman)
- software node: Fix software_node_get_reference_args() with index -1 (Alban Bedel)
- perf ui hists: Fix uninitialized stack memory free on pstack allocation failure (Ian Rogers)
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (zhouminqiang)
- mtd: mtdswap: Avoid freeing registered blktrans device twice (Ruoyu Wang)
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Xiang Mei)
- char: xilinx_hwicap: unregister class on init errors (Myeonghun Pak)
- ppdev: prevent overflow when setting port timeout (Linmao Li)
- misc: ad525x_dpot: use driver core groups for sysfs files (Pengpeng Hou)
- misc: ad525x_dpot: Make ad_dpot_remove() return void (Uwe Kleine-Konig)
- misc: rtsx: add missing write register handling (Gleb Markov)
- misc: bcm-vk: Use acquire/release for msgq_inited (Gui-Dong Han)
- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (Pavel Zhigulin)
- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (Christophe JAILLET)
- uio: Fix stale info pointer in failed registration path (Yuho Choi)
- UDF symlink pathComponent header OOB read (David Lee)
- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (Karl Mehltretter)
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (Xu Yang)
- ACPI: processor: idle: Expand _LPI package sanity checks (Rafael J. Wysocki)
- ACPI: move from strlcpy() with unused retval to strscpy() (Wolfram Sang)
- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (Thorsten Blum)
- gpu: host1x: Avoid stack over-read in debug output helpers (Mikko Perttunen)
- gpu: host1x: Fix offset calculation in trace_write_gather (Mikko Perttunen)
- arm64: dts: qcom: sm8250: Add camcc DT node (Bryan O'Donoghue)
- arm64: dts: qcom: sm8250: remove mmcx regulator (Dmitry Baryshkov)
- arm64: dts: qcom: sm8250: Use QMP property to control load state (Sibi Sankar)
- drm/bridge: tc358767: clamp the reported AUX read size to the request (Maoyi Xie)
- remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev (Uday Khare)
- cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han)
- cpufreq: intel_pstate: Fix setting minimum P-state at init time (Rafael J. Wysocki)
- genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() (Herve Codina)
- irqdomain: Handle additional domain flags in irq_domain_instantiate() (Herve Codina)
- irqdomain: Introduce irq_domain_instantiate() (Herve Codina)
- irqdomain: Introduce irq_domain_free() (Herve Codina)
- cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() (Dan Carpenter)
- libnvdimm/labels: Bound the on-media label size before the shift (Bryam Vargas)
- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (Baochen Qiang)
- hfsplus: validate thread record before delete key rebuild (Kyle Zeng)
- rpmsg: glink: fix deadlock in endpoint destroy during driver detach (Vishnu Santhosh)
- rpmsg: glink: remove duplicate code for rpmsg device remove (Srinivas Kandagatla)
- rpmsg: glink: Remove the rpmsg dev in close_ack (Arun Kumar Neelakantam)
- isofs: fix out-of-bounds page array access on empty zisofs block (Xiang Mei)
- fs/isofs: replace kmap() with kmap_local_page() (Fabio M. De Francesco)
- RDMA/hfi1: Initialize debugfs after probe completes (Leon Romanovsky)
- RDMA/hfi1: Stop flushing the global IB workqueue (Leon Romanovsky)
- RDMA/hfi1: Create workqueues before device initialization (Leon Romanovsky)
- RDMA/hfi1: Remove redundant PCI device ID validation (Leon Romanovsky)
- RDMA/hfi1: Free RX data on late probe failure (Leon Romanovsky)
- RDMA/hfi1: Preserve unit 0 on allocation failure (Leon Romanovsky)
- misc: rtsx_usb: avoid USB I/O in runtime autosuspend (Sean Rhodes)
- pmdomain: bcm: bcm2835: handle genpd provider registration errors (Pengpeng Hou)
- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (Evgenii Burenchev)
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (Xiang Mei)
- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (Yuho Choi)
- hwrng: ks-sa - access private data via struct hwrng (Martin Kaiser)
- RDMA/ipoib: Drain RCU callbacks during module teardown (Leon Romanovsky)
- RDMA/mlx5: Drain RCU callbacks during module teardown (Leon Romanovsky)
- RDMA/core: Wait for RCU callbacks before unloading ib_core (Leon Romanovsky)
- RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage (Tetsuo Handa)
- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (Mert Seftali)
- drm/panel: samsung-s6d16d0: Power off on prepare failure (Laxman Acharya Padhya)
- usb: renesas_usbhs: Fix power-off ordering on unbind (Biju Das)
- usb: mtu3: allow system suspend during active gadget connection (Fei Shao)
- platform/surface: acpi-notify: Check ACPI companion before use (Linmao Li)
- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (Linmao Li)
- usb: gadget: configfs: fix out-of-bounds read of qw_sign (Michael Bommarito)
- hwspinlock: propagate errno when registering single lock (Wolfram Sang)
- platform/x86: dell-wmi-base: Fix resource leak on module load failure (Armin Wolf)
- platform/x86: dell-privacy: Fix race condition (Armin Wolf)
- leds: pca9532: Fix inverted GPIO output polarity (Cosmo Chou)
- iommu/amd: Fix false positive in SB IOAPIC IVRS validation (Wei Wang)
- iommu/amd: Add support for Hygon family 18h model 4h IOAPIC (Fu Hao)
- iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors (Wei Wang)
- iommu/msm: Return -ENOMEM on memory allocation failure in probe (Vladimir Zapolskiy)
- iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX (Akari Tsuyukusa)
- efi: fix stale reference to efi_recover_from_page_fault() (Breno Leitao)
- bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (Daniel Borkmann)
- udf: Mark LVID buffer as uptodate before marking it dirty (Aleksandr Nogikh)
- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (Hongyan Xu)
- clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (Herman van Hazendonk)
- clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code (Bryan O'Donoghue)
- clk: qcom: gdsc: Release pm subdomains in reverse add order (Bryan O'Donoghue)
- clk: qcom: gdsc: enable optional power domain support (Dmitry Baryshkov)
- clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains (Herman van Hazendonk)
- clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status (Herman van Hazendonk)
- timekeeping: Account for monotonicity adjustment in ntp_error (David Woodhouse)
- y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 (Thomas Weissschuh)
- clocksource: Unregister subsystem on device registration failure (Yuho Choi)
- selftests: timers: leap-a-day: Fix -w option and update usage comment (Jiangshan Yi)
- irqchip/gic-v3-its: Fix memleak in its_probe_one() (Kemeng Shi)
- selftests/bpf: Fix memory leak in msg_alloc_iov (Feng Yang)
- selftests/bpf: Fix memory leak in msg_alloc_iov error path (Malaya Kumar Rout)
- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (Evgenii Burenchev)
- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (Dawei Feng)
- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (Dan Carpenter)
- greybus: audio: bound the topology section sizes against the fetched size (Bryam Vargas)
- staging: sm750fb: gate dualview dataflow using g_dualview (Ahmet Sezgin Duran)
- staging: greybus: audio: correct sscanf() return value check (Alexander A. Klimov)
- PM: sleep: Fix off-by-one in wakelocks number limit check (Haowen Tu)
- bus: ti-sysc: Fix /chosen node reference leak (Yuho Choi)
- nvmet-rdma: fix response resource leak on queue teardown (Shin'ichiro Kawasaki)
- nvmet-rdma: factor out response resource cleanup (Shin'ichiro Kawasaki)
- nvmet-rdma: use sbitmap to replace rsp free list (Guixin Liu)
- nvmet-rdma: avoid circular locking dependency on install_queue() (Hannes Reinecke)
- crypto: sa2ul - stop probe if context pool creation fails (Pengpeng Hou)
- crypto: sa2ul - Use the defined variable to clean code (Tang Bin)
- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (Lothar Rubusch)
- crypto: atmel-ecc - reject hardware ECDH without a public key (Thorsten Blum)
- crypto: atmel-ecc - clean up and improve ECDH comments (Thorsten Blum)
- crypto: atmel-ecc - replace min_t with min (Thorsten Blum)
- crypto: qat - clear AES key schedule from stack (Giovanni Cabiddu)
- platform/chrome: sensorhub: Fix memory overread in ring handler (Tzung-Bi Shih)
- selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check (Hisam Mehboob)
- csky: Fix a4/a5 restoration in syscall trace path (Hanlin Song)
- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (Sanjay Chitroda)
- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (Srinivas Kandagatla)
- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (Vladimir Zapolskiy)
- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (Suraj Gupta)
- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (Vladimir Zapolskiy)
- tools/bpf/bpftool: Reset vmlinux BTF after map commands (Yichong Chen)
- bpftool: Fix pretty print dump for maps without BTF loaded (Jiri Olsa)
- bpftool: Use libbpf_get_error() to check error (Hengqi Chen)
- bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls (Andrii Nakryiko)
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (Asad Kamal)
- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (Asad Kamal)
- perf tests: Fix flakiness in BPF counters test on hybrid systems (Ian Rogers)
- perf test: Fix perf stat --bpf-counters on hybrid machines (Namhyung Kim)
- perf test: Use sqrtloop workload to test bperf event (Tengda Wu)
- perf test stat_bpf_counter.sh: Stabilize the test results (Veronika Molnarova)
- perf test bpf-counters: Add test for BPF event modifier (Ian Rogers)
- perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test (Thomas Richter)
- perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning (Athira Rajeev)
- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (Sean Young)
- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (Sean Young)
- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (Daniel McCarthy)
- perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails (Zide Chen)
- drm/lima: call drm_mm_init() with a valid allocation range (Henrik Grimler)
- clk: imx: scu: drop redundant init.ops variable assignment (Brian Masney)
- ARM: imx: fix device_node refcount leaks in imx7_src_init() (Weigang He)
- ARM: imx: fix device_node refcount leak in imx_src_init() (Weigang He)
- clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller (Min zhang)
- ASoC: rt700-sdw: always drain jack work on remove (Runyu Xiao)
- clk: moxart: remove unused variables, fix refcount leak (Alexander A. Klimov)
- media: cec-pin: Fix event FIFO ordering (Gui-Dong Han)
- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (Weigang He)
- HID: roccat: bound device-supplied profile index (Michael Bommarito)
- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (Philipp Weber)
- smack: restrict smackfs/{direct,mapped} values to 0-255 (Konstantin Andreev)
- smack: deduplicate smackfs/{direct,mapped} file_operations (Konstantin Andreev)
- smack: simplify write handlers of sysfs entries (Dmitry Antipov)
- smack: fix incorrect task context in smack_msg_queue_msgrcv (Konstantin Andreev)
- Smack: fix W=1 build warnings (Casey Schaufler)
- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (Maxime Ripard)
- bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann)
- clk: meson: align gxbb_32k_clk_sel number of parents with actual count (Martin Blumenstingl)
- firmware: stratix10-svc: Add mutex in stratix10 memory management (Mahesh Rao)
- perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (Arnaldo Carvalho de Melo)
- batman-adv: bla: avoid CRC corruption due to parallel claim add (Sven Eckelmann)
- batman-adv: dat: atomically update mac addresses (Sven Eckelmann)
- ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (Sean Shen)
- ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei)
- net: hns3: don't auto enable misc vector (Jian Shen)
- bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (Jiayuan Chen)
- bridge: mrp: reject zero test interval to avoid OOM panic (Xiang Mei)
- net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang)
- net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (Jie Wang)
- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (Duoming Zhou)
- bpf: Guard stack limits against 32bit overflow (Andrei Matei)
- x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl)
- mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() (SJ Park)
- mm/damon/vaddr-kunit: check region count in three_regions test (SJ Park)
- mm/damon/vaddr: drop last same folio access check optimization (SJ Park)
- mm/damon/core-kunit: check region count before testing in split_at() (SJ Park)
- xhci: fix lost bounce buffers on TDs spanning several ring segments (Arthur Gautier)
- drm/nouveau: Use write-combined maps for coherent (Faith Ekstrand)
- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (Sunil Khatri)
- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (Thadeu Lima de Souza Cascardo)
- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (Kavan Smith)
- drm/gud: validate TV mode names before creating enum property (Tao Yu)
- drm/gud: NUL-terminate TV mode names read from the device (Deepanshu Kartikey)
- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (Harry Wentland)
- drm/hibmc: Fix list of formats on the primary plane (Thomas Zimmermann)
- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (Wentao Liang)
- drm: fix race between partial drm_dev_register() failure and ioctl (Danilo Krummrich)
- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (Johan Hovold)
- f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng)
- f2fs: return writeback error from collapse range (Wenjie Qi)
- f2fs: reject overlapping move range after len expansion (Hao-Qun Huang)
- f2fs: return symlink writeback errors (Wenjie Qi)
- scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (Nilesh Javali)
- scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics (Nilesh Javali)
- scsi: qla2xxx: Drop vport reference under lock in report ID acquisition (Nilesh Javali)
- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (Nilesh Javali)
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (Nilesh Javali)
- scsi: qla2xxx: Avoid double completion in async IOCB timeout (Nilesh Javali)
- scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (Nilesh Javali)
- scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (Nilesh Javali)
- scsi: qla2xxx: Don't query firmware state while chip is down (Nilesh Javali)
- scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (Nilesh Javali)
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (Nilesh Javali)
- scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (Nilesh Javali)
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (Nilesh Javali)
- scsi: qla2xxx: Serialize flash version read in reset handler (Nilesh Javali)
- scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (Nilesh Javali)
- scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (Nilesh Javali)
- scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() (Nilesh Javali)
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (Nilesh Javali)
- scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters (Nilesh Javali)
- scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (Nilesh Javali)
- scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (Nilesh Javali)
- scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (Nilesh Javali)
- media: vimc: fix pixel format lookup in enum_framesizes (Arash Golgol)
- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (Uday Khare)
- media: venus: fix payload size calculation in parse_raw_formats() (Mohammed EL Kadiri)
- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (Mohammed EL Kadiri)
- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (Biren Pandya)
- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (Ming Qian)
- media: tda18250: fix possible integer overflow (Ilya Krutskih)
- media: s2255: check firmware size before reading trailing marker (Lei Huang)
- media: s2255: bound JPEG frame size before copying into the buffer (HyeongJun An)
- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (Valery Borovsky)
- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (Valery Borovsky)
- media: rc: sunxi-cir: Unregister rc device on probe failure (Myeonghun Pak)
- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (Christian Hewitt)
- media: i2c: ov7740: fix use-after-destroy in remove (Biren Pandya)
- media: i2c: ov02a10: fix endpoint parsing use-after-free (Biren Pandya)
- media: go7007: defer the ALSA v4l2 put until card release (Shuangpeng Bai)
- media: em28xx: fix use-after-free of dev_next->devlist on disconnect (Jiangong.Han)
- media: em28xx: defer audio-only extension registration (Diego Fernando Mancera Gomez)
- media: cx23885: cancel NetUP CI work before teardown (Fan Wu)
- media: cx231xx: reject geometry changes while the VBI queue is busy (Bryam Vargas)
- media: cobalt: Avoid freeing ALSA private data twice (Ruoyu Wang)
- media: cedrus: fix memory leak in cedrus_init_ctrls() (Dawei Feng)
- media: cec: Serialize exclusive follower delivery (Ruoyu Wang)
- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (Yi Ding)
- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (Valery Borovsky)
- KVM: s390: Restore sigset on error path (Christian Borntraeger)
- KVM: s390: Zero initialize irq in reinject_machine_check (Christian Borntraeger)
- KVM: s390: Free guest debug data on vcpu destroy (Christian Borntraeger)
- KVM: s390: Fix old_data leak in guest debug error path (Christian Borntraeger)
- KVM: s390: Fix memory leak in guest debug handling (Christian Borntraeger)
- KVM: s390: Fix length check __import_wp_info() (Christian Borntraeger)
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (Carlos Lopez)
- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (Yosry Ahmed)
- KVM: nVMX: Always flush vpid02 on first use (Yosry Ahmed)
- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (Sanjay Chitroda)
- iio: srf04: fix pm_runtime handling on probe error path (Cong Nguyen)
- iio: light: gp2ap002: Disable regulators on resume failure (Laxman Acharya Padhya)
- iio: light: cm32181: return zero after writing calibscale (Giorgi Tchankvetadze)
- iio: gyro: mpu3050: fix sign of raw angular velocity readings (Cong Nguyen)
- iio: dac: m62332: Fix regulator reference count imbalance (Erick Henrique)
- iio: chemical: sgp30: Handle IAQ thread creation failure (Linmao Li)
- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (Moksh Panicker)
- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (WenTao Liang)
- AsoC: intel: sst: fix PCI device reference leak on probe failure (Haoxiang Li)
- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (Haoxiang Li)
- ASoC: cs35l34: drain threaded IRQ before runtime suspend (Runyu Xiao)
- ASoC: cs35l33: drain threaded IRQ before runtime suspend (Runyu Xiao)
- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (Linkai Gong)
- clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src (Stephan Gerhold)
- clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src (Stephan Gerhold)
- clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
- clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk (Stephan Gerhold)
- batman-adv: bla: prevent CRC corruptions after claim flush (Sven Eckelmann)
- batman-adv: bla: fix freeing of claims on meshif deletion (Sven Eckelmann)
- batman-adv: dat: avoid unaligned fault in IP extraction (Sven Eckelmann)
- batman-adv: fix stale receive device on merged fragments (Zhiling Zou)
- mtd: rawnand: validate ONFI extended parameter page sections (Pengpeng Hou)
- mtd: mtdoops: free page bitmap when the backing MTD is removed (Xu Rao)
- mtd: afs: validate v2 image info bounds (Pengpeng Hou)
- parisc: Fix alignment of asm statements in head.S (Helge Deller)
- parisc: eisa: Fix infinite loop when parsing invalid IRQ value (Pei Xiao)
- nvdimm/btt: reject an arena whose nfree is below the lane count (Bryam Vargas)
- Revert 'irqchip/mbigen: Fix mbigen node address layout' (caina)
- nvmet-tcp: reject unsolicited H2CData PDUs (Shivam Kumar)
- nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (Shivam Kumar)
- nvme-tcp: check the data direction of a C2HData PDU (Yehyeong Lee)
- ALSA: pcm: Fix race between non-atomic ops and trigger-start (Takashi Iwai)
- ALSA: harmony: initialize locks before requesting IRQ (Runyu Xiao)
- i2c: mux: Fix channel node leak on adapter add failure (Ahmad Byagowi)
- i2c: core: fix debugfs UAF on adapter removal (Vasileios Almpanis)
- perf/x86/intel: Fix kernel address leakages in LBR stack (Dapeng Mi)
- Input: aiptek - switch to using dev_groups for driver-specific attributes (Dmitry Torokhov)
- Input: aiptek - validate raw macro indices before updating state (Pengpeng Hou)
- ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (Bradley Morgan)
- ata: ahci: work around lost interrupts on Marvell 88SE61xx (Hajo Noerenberg)
- block: flag zoned disks with GENHD_FL_NO_PART (Damien Le Moal)
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (Koichiro Den)
- dmaengine: dw-edma: Complete descriptors before pausing (Koichiro Den)
- dm: fix resume-vs-remove race (Mikulas Patocka)
- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (Ibrahim Hashimov)
- HID: rmi: fix OOB access with undersized RMI reports (Wei Jie Law)
- scsi: pm8001: Use rollback index when freeing MSI-X vectors (Runyu Xiao)
- scsi: target: iscsi: Reserve a terminator byte for the login payload (Sujal Tuladhar)
- thermal/drivers/qoriq: Disable clock on resume failure (Can Peng)
- thermal/drivers/imx: Disable clock on runtime resume failure (Can Peng)
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (Muhammad Bilal)
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (Muhammad Bilal)
- usb: gadget: fix null pointer dereference in usb_put_function_instance() (Jeffin Philip)
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (Lovekesh Solanki)
- usb: typec: ucsi: displayport: Fix OOB altmode array index (Jameson Thies)
- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (Andy Shevchenko)
- usb-storage: ene_ub6250: fix race between scan work and probe (Liu Qi)
- media: usbtv: keep device alive while ALSA card exists (Shuangpeng Bai)
- clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset (Stephan Gerhold)
- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (HyeongJun An)
- usb: image: mdc800: change kmalloc() to kzalloc() (Griffin Kroah-Hartman)
- espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca)
- scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (Petr Vaganov)
- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (Masami Hiramatsu (Google))
- tracing/mmiotrace: Remove reference to unused per CPU data pointer (Steven Rostedt)
- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin)
- net: ntb_netdev: Fix TX busy and drop handling (Koichiro Den)
- ALSA: seq: Fix port lock leak in deliver_to_subscribers() (Tzung-Bi Shih)
- selinux: reject an unclaimed class value in security_get_classes() (Bryam Vargas)
- selinux: avoid implicit conversions in services code (Christian Gottsche)
- fsnotify: Fix stale object mask after concurrent mark updates (Youngjae Kwon)
- entry: Fix seccomp bypass after ptrace with TSYNC (Jinjie Ruan)
- openvswitch: Fix CT limit teardown use-after-free (Yuqi Xu)
- net: openvswitch: fix kernel-doc warnings in internal headers (Ilya Maximets)
- net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (Norbert Szetei)
- net: skbuff: don't touch shared zerocopy state in skb_tx_error() (Norbert Szetei)
- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (Tzung-Bi Shih)
- udf: Fix i_lenExtents truncation on 32-bit kernels (Zhan Xusheng)
- timer: Keep debugobjects state consistent in migrate_timer_list() (Thomas Gleixner)
- taskstats: fix cpumask parsing cutting off the last character (Bradley Morgan)
- smack: fix cred UAF in smack_file_send_sigiotask() (Jann Horn)
- signal: avoid shared siginfo namespace rewrites (Bradley Morgan)
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (Myeonghun Pak)
- w1: ds28e17: reject an oversize length on an I2C block read (Maoyi Xie)
- vsock/virtio: flush works in dependency order (Chengfeng Ye)
- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (Runyu Xiao)
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (Abdun Nihaal)
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (Stanislaw Gruszka)
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (Fabio Estevam)
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (Abdun Nihaal)
- i3c: master: svc: bound IBI payload to the requested max_payload_len (Maoyi Xie)
- i3c: master: Fix info leak and UAF in device unregister path (Adrian Hunter)
- dm-switch: use WRITE_ONCE() in switch_region_table_write() (Haotian Zhang)
- dm-stats: fix a crash if allocation of per-cpu data fails (Mikulas Patocka)
- arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() (Nathan Chancellor)
- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (Naman Jain)
- ALSA: virmidi: Check card index validity at probe (Takashi Iwai)
- ALSA: serial-u16550: Check card index validity at probe (Takashi Iwai)
- ALSA: portman2x4: Check card index validity at probe (Takashi Iwai)
- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (Runyu Xiao)
- ALSA: mts64: Check card index validity at probe (Takashi Iwai)
- ALSA: mpu401: Check card index validity at probe (Takashi Iwai)
- ALSA: bcd2000: clear the URB pointers on disconnect (Baul Lee)
- ALSA: aloop: Check card index validity at probe (Takashi Iwai)
- ALSA: 6fire: bound the MIDI event length from the device (Baul Lee)
- seg6: reset IP6CB after IPv6 decapsulation (Zhiling Zou)
- net: cap advertised IP tunnel headroom (Zhiling Zou)
- net/smc: fix socket refcount leak in smc_switch_conns() (Hidayath Khan)
- net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den)
- net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den)
- NTB: ntb_transport: Reject oversized TX buffers (Koichiro Den)
- NTB: ntb_transport: Fail TX enqueue when the QP link is down (Koichiro Den)
- NTB: ntb_transport: Recycle TX entries before client callbacks (Koichiro Den)
- net: openvswitch: fix nf_connlabels leak in ovs_ct_init (Ruoyu Wang)
- net: openvswitch: fix flow mask use-after-free on flow deletion (Ilya Maximets)
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada)
- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (Fabio Porcedda)
- slip: fix use-after-free in sl_sync() (Aleksandr Khromov)
- xdp: fix zero-copy frame layout (Weiming Shi)
- net/iucv: filter frames in afiucv_hs_rcv() by ingress device (Alexandra Winter)
- ipmi: si: Fix NULL pointer dereference after failed registration (Seiji Nishikawa)
- ipmi: ipmb: validate write message length (Yousef Alhouseen)
- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (Kuan-Wei Chiu)
- platform/chrome: sensorhub: Bound the EC-reported sensor number (Bryam Vargas)
- mmc: via-sdmmc: stop card-detect handling on probe failure (Fan Wu)
- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (HyeongJun An)
- iommu/vt-d: Fix no_iommu to disable platform opt-in (Kevin Tian)
- PCI/proc: Use file_ns_capable() when checking config space read access (Krzysztof Wilczynski)
- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczynski)
- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (Krzysztof Wilczynski)
- PCI: meson: Fix GPIO state while requesting PERST# (Ronald Claveau)
- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (Mohamad Raizudeen)
- s390/dasd: Propagate partial completion length across ERP recovery (Stefan Haberland)
- s390/dasd: Guard sysfs discipline callbacks against unallocated private data (Stefan Haberland)
- s390/dasd: Do not complete a failed ESE read as successful (Stefan Haberland)
- power: supply: max17040: synchronize work cancellation on suspend (Jianing Li)
- power: supply: ucs1002: fix use-after-free on remove (Fan Wu)
- power: supply: twl4030_charger: cancel workers via devm (Maoyi Xie)
- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (Fan Wu)
- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (Jameson Thies)
- power: supply: cros_usbpd-charger: bound the EC-reported port count (Bryam Vargas)
- power: supply: bq256xx: drain usb_work before freeing the charger (Fan Wu)
- power: supply: bq24257: fix use-after-free on remove (Fan Wu)
- sctp: fix stream->outcnt underflow on duplicate RECONF responses (Jun Yang)
- sctp: distinguish sequence zero from wildcard in reconf lookup (Jun Yang)
- sctp: fix NULL deref on untransmitted RECONF completion (Weiming Shi)
- sctp: drop a chunk if its transport was removed (Hyunwoo Kim)
- sctp: stop processing a packet once its association is deleted (Hyunwoo Kim)
- nvme-tcp: reject a read that transferred too few bytes (Yehyeong Lee)
- nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (Yehyeong Lee)
- nvme: zero the discard fallback page (Yehyeong Lee)
- nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path (Ewan D. Milne)
- lockd: pin next file across nlm_inspect_file lock-drop (Michael Bommarito)
- hwmon: (max6621) fix temperature clamp range (Cong Nguyen)
- hwmon: (max6621) fix negative temperature offset and crit readings (Cong Nguyen)
- openvswitch: only skb_tx_error() a packet we are about to drop (Norbert Szetei)
- openrisc: fix arbitrary kernel memory access via or1k_atomic syscall (Ali Ahmet Memis)
- ocfs2: fix readdir position truncation on 32-bit kernels (Zhan Xusheng)
- ocfs2: cluster: fix o2hb_dependent_users leak on pin failure (Joseph Qi)
- ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item (Joseph Qi)
- ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (Joseph Qi)
- ocfs2: validate rl_used against rl_count in refcount block validator (Ibrahim Hashimov)
- ocfs2: validate lengths in dlm_mig_lockres_handler (Bryam Vargas)
- ocfs2: bound namelen in dlm_migrate_request_handler (Bryam Vargas)
- ocfs2: always run deallocs on copy-on-write completion (Dmitry Antipov)
- orangefs: skip leading spaces before parsing client debug masks (Zhiling Zou)
- orangefs: fix double-free of trailer_buf on readdir copy failure (Yifei Gao)
- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (WenTao Liang)
- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (WenTao Liang)
- RDMA/ucma: Lock the handler in ucma_set_ib_path() (Norbert Szetei)
- RDMA/cxgb4: Cancel reg_work before freeing device on remove (Fan Wu)
- qede: Fix NULL pointer dereference in TPA fragment processing (Vaibhav Nagare)
- remoteproc: scp: Fix device reference leak on failed lookup (Johan Hovold)
- rpmsg: glink: smem: order FIFO read after availability check (Chunkai Deng)
- staging: media: tegra-video: vi: fix probe failure on skipped last port (Hao-Qun Huang)
- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (Doruk Tan Ozturk)
- udf: reject VAT indexes equal to the entry count (David Lee)
- svcrdma: Fix pcl_for_each_segment for empty chunks (Chris Mason)
- svcrdma: Fix offset arithmetic in read_chunk_range (Chris Mason)
- SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (Chuck Lever)
- sunrpc: init gssp_lock before publishing proc entry (Chris Mason)
- SUNRPC: harden gss_unwrap_resp_priv length checks (Chris Mason)
- SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat (Chris Mason)
- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (Chris Mason)
- SUNRPC: always drain cache_cleaner before destroying a cache_detail (Jeff Layton)
- sunrpc: route to a populated pool in svc_pool_for_cpu() (Jeff Layton)
- SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (Chris Mason)
- mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (Harshit Varu)
- mpls: reload header after pskb_may_pull() (Qing Ming)
- md: do overflow check for sb->bblog_shift in super_1_load() (Coly Li)
- libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (Bryam Vargas)
- ipv6: use RCU iterator to dump route exceptions (Yuyang Huang)
- ip6_gre: fix hardware header length for NBMA tunnels (Zhiling Zou)
- ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (Zhiling Zou)
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (Valentin Kindschi)
- Bluetooth: RFCOMM: serialize security confirmation handling (Chengfeng Ye)
- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (Gongwei Li)
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (Guangshuo Li)
- cpufreq: schedutil: Fix rate limit overflow (Hui Su)
- dm array: reject an array block whose value size is not the caller's (Bryam Vargas)
- dm raid1: reserve space for NUL-terminator in build_constructor_string() (Ilya Krutskih)
- dm-era: fix shadowed superblock leak on take-snap failure (liyouhong)
- bnx2x: fix double free in bnx2x_init_firmware() error path (Jiangshan Yi)
- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (Christoph Zwerschke)
- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (Christoph Zwerschke)
- auxdisplay: charlcd: cancel backlight work on registration failure (Hongyan Xu)
- ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (Niklas Cassel)
- alpha: marvel: Fix lock ordering in init_io7_irqs() (Matt Turner)
- alpha: marvel: Fix irq_set_status_flags to use correct IRQ number (Matt Turner)
- alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() (Krzysztof Wilczynski)
- hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (Ivaylo Dimitrov)
- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (Tien Sung Ang)
- forcedeth: fix off-by-one when saving/restoring non-PCI config space (Marek Czernohous)
- fbdev: uvesafb: unregister connector callback on init failure (Myeonghun Pak)
- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (Florian Fuchs)
- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (Runyu Xiao)
- fat: restore original value when fat_ent_write failed (Yemu Lu)
- ecryptfs: show filename encryption options (Yichong Chen)
- ecryptfs: release message context on send failure (Yichong Chen)
- ecryptfs: reject too-small tag 70 packets (Yichong Chen)
- ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (HanQuan)
- ecryptfs: pass packet set buffer size to parser (Yichong Chen)
- ecryptfs: hold msg ctx list lock when cleaning daemon queue (Yichong Chen)
- ecryptfs: fix tag 11 packet exact-fit size check (Yichong Chen)
- eCryptfs: bound the packet-length peek to the user buffer (Pengpeng Hou)
- fs/ntfs3: bound page_lcns[] index by the log record (Konstantin Komarov)
- fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (Samuel Page)
- fs/ntfs3: validate dirty page table on log replay (Xiang Mei)
- HID: mcp2221: validate report size in mcp2221_raw_event() (Jiangshan Yi)
- HID: sensor: custom: Fix field sysfs group cleanup on failure (Haoxiang Li)
- HID: roccat: free buffered reports when destroying device (Xu Rao)
- HID: picolcd: clamp eeprom debugfs read to bytes actually received (Ibrahim Hashimov)
- audit: avoid dropping live tree ref on fsnotify rule autoremove (Jeremy Jean)
- ceph: bound xattr value length in __build_xattrs() (Michael Bommarito)
- ceph: bound num_export_targets array for mds info v2/v3 (Michael Bommarito)
- ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (Jeremy Jean)
- ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (Xiubo Li)
- libceph: reject buckets with mismatched CRUSH ids (Jeremy Jean)
- NFSD: Prevent lock owner use-after-free during client teardown (Chuck Lever)
- nfsd: revoke copy-notify stateids before dropping their reference (Jeff Layton)
- nfsd: reject reclaim LOCK after RECLAIM_COMPLETE (Jeff Layton)
- nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (Robbie Ko)
- nfsd: initialize copy-notify stateid before publishing it (Jeff Layton)
- nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (Jeff Layton)
- nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (Jeff Layton)
- nfsd: fix version mismatch loops in nfsd_acl_init_request() (Jeff Layton)
- nfsd: fix cpntf publish race in nfs4_init_cp_state (Chris Mason)
- nfsd: check client ownership when cancelling a copy-notify stateid (Jeff Layton)
- nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (Jeff Layton)
- nfsd: add filehandle match check to nfsd4_delegreturn() (Jeff Layton)
- nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (Jeff Layton)
- nfsd: validate symlink target length in NFSv4 CREATE (Jeff Layton)
- nfsd: sample writeback error cursor before async COPY loop (Chuck Lever)
- nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types (Jeff Layton)
- nfsd: Reset write verifier when async COPY writeback fails (Chuck Lever)
- NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (Junrui Luo)
- NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (Mike Snitzer)
- NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (Michael Bommarito)
- NFSD: Fix off-by-one in DRC bucket pruning limit (Chuck Lever)
- NFSD: Encode only the status in NFS-ACL v2 GETACL error replies (Chuck Lever)
- ubifs: fix out-of-bounds read in signature length check (Ibrahim Hashimov)
- of: fix out-of-bounds read in of_alias_scan() stem parser (Abdurrahman Hussain)
- nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (Ryusuke Konishi)
- media: vicodec: fix out-of-bounds write in FWHT encoder (Junrui Luo)
- media: cec: stm32: prevent out-of-bounds write on RX overflow (Weigang He)
- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (Vincent Mailhol)
- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (Xingrui Li)
- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (Daisuke Matsuda)
- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (Neill Kapron)
- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (Jeffin Philip)
- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (Yun Zhou)
- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (Myeonghun Pak)
- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (Sonali Pradhan)
- USB: phy: fsl-usb: fix missing static keywords (Johan Hovold)
- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (Francesco Lavra)
- staging: greybus: hid: fix SET_REPORT return value (Hao-Qun Huang)
- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (Hans Verkuil)
- rapidio: mport_cdev: fix use-after-free in dma_req_free() (James Kim)
- powerpc/powermac: fix OF node refcount (Bartosz Golaszewski)
- tracing: Fix crash passing ERR_PTR to kthread_stop() (Hui Su)
- x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() (Kiryl Shutsemau (Meta))
- tools/compiler: match glibc 2.42 definition of __attribute_const__ (Joy H.J. Lee)
- mm: memcg: stop reclaim when a limit update is superseded (Guopeng Zhang)
- mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (Breno Leitao)
- include/linux/list.h: mark list_add and __list_add as __always_inline (Jordan R Abrahams-Whitehead)
- timers/itimer: Zero-init old itimerval before copy to userspace (Jeremy Jean)
- clocksource/drivers/timer-sun4i: Advertise a real minimum delta (Felix Yan)
- alpha: don't leak hardware-fabricated FP exception bits to user space (Matt Turner)
- alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally (Matt Turner)
- ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai)

Related CVEs

CVE-2026-80726

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	kernel-uek-5.15.0-325.221.6.1.el8uek.src.rpm	e18f0e22aed11455622135930c1857d636fabd05880c24c3ae24809151eec741	-	ol8_aarch64_UEKR7
	bpftool-5.15.0-325.221.6.1.el8uek.aarch64.rpm	91d7aebef5cebb60ef402294d237450310d0e8a6c67865a75fdc3442cd99583e	-	ol8_aarch64_UEKR7
	kernel-uek-5.15.0-325.221.6.1.el8uek.aarch64.rpm	545c21857ee2863889bb4a54d885918c9104f2f883fc1a77f0b1aafb2815bf79	-	ol8_aarch64_UEKR7
	kernel-uek-container-5.15.0-325.221.6.1.el8uek.aarch64.rpm	482c6a6c57e24ee3efb607c209a59b68408321ce1161ceca2028889669b43390	-	ol8_aarch64_UEKR7
	kernel-uek-container-debug-5.15.0-325.221.6.1.el8uek.aarch64.rpm	aff5905898442f3b2eceb79abb60d8aa4dd4d5facb3d6939af1b782b211593a7	-	ol8_aarch64_UEKR7
	kernel-uek-core-5.15.0-325.221.6.1.el8uek.aarch64.rpm	433a44d0da79212a5f10f2c49741513d7775e61476731f3fe07f9363e10e7dad	-	ol8_aarch64_UEKR7
	kernel-uek-debug-5.15.0-325.221.6.1.el8uek.aarch64.rpm	8a853668b5612832df6ca4302420ca7eda652b8d11f981eafb5ee514f2b7f7ca	-	ol8_aarch64_UEKR7
	kernel-uek-debug-core-5.15.0-325.221.6.1.el8uek.aarch64.rpm	7aa46d5d6ac274b848ebbf0bbcea762ddedd5bb13483dede73f50cb8bf093a57	-	ol8_aarch64_UEKR7
	kernel-uek-debug-devel-5.15.0-325.221.6.1.el8uek.aarch64.rpm	7eb93aecfc578bd1fe5c88295d70eed6fea002c6ff0e7e7f6f6ddf1bdade0928	-	ol8_aarch64_UEKR7
	kernel-uek-debug-modules-5.15.0-325.221.6.1.el8uek.aarch64.rpm	d326fa9facf1977204a18e47f8202d7bff8be9cf7ab29c1b37cee447f8ee3e84	-	ol8_aarch64_UEKR7
	kernel-uek-debug-modules-extra-5.15.0-325.221.6.1.el8uek.aarch64.rpm	5365eda4a9154e089318d0443716f02a6c41aea9922508175c8ee2bcfd40c19f	-	ol8_aarch64_UEKR7
	kernel-uek-devel-5.15.0-325.221.6.1.el8uek.aarch64.rpm	04bae8e4205f6d212efb3789c26c5288256ba80dff61e6c2f4158f920741394e	-	ol8_aarch64_UEKR7
	kernel-uek-doc-5.15.0-325.221.6.1.el8uek.noarch.rpm	cc6c37d1da5afb2d823f75b0874c9dd2e338a05b5f54e26326385c9d69cf526d	-	ol8_aarch64_UEKR7
	kernel-uek-modules-5.15.0-325.221.6.1.el8uek.aarch64.rpm	33e8bfa52699d18ded1f1b63365598cb673ca50d68c7bbb6b0246f041a01843f	-	ol8_aarch64_UEKR7
	kernel-uek-modules-extra-5.15.0-325.221.6.1.el8uek.aarch64.rpm	4aff4f0f7668d85bd31c1de6320a509e5880a946424b0a999e5c54a41a8f263a	-	ol8_aarch64_UEKR7
Oracle Linux 8 (x86_64)	kernel-uek-5.15.0-325.221.6.1.el8uek.src.rpm	e18f0e22aed11455622135930c1857d636fabd05880c24c3ae24809151eec741	-	ol8_x86_64_UEKR7
	bpftool-5.15.0-325.221.6.1.el8uek.x86_64.rpm	5e3587c36213a6ed8605e506cd292e57d1f2e3f1b5a3ac4fa1529a3cdb5545b8	-	ol8_x86_64_UEKR7
	kernel-uek-5.15.0-325.221.6.1.el8uek.x86_64.rpm	835eee7c3e8ba9afecbc5e1ce7966ed07268130d4e5e9c6a5802e252ddfcca06	-	ol8_x86_64_UEKR7
	kernel-uek-container-5.15.0-325.221.6.1.el8uek.x86_64.rpm	84221bc36131a74b5482567352c481427f303b9903dbadbb556cc3127d034fb6	-	ol8_x86_64_UEKR7
	kernel-uek-container-debug-5.15.0-325.221.6.1.el8uek.x86_64.rpm	7ac857c68cc4e6501133c82308437eb7654d3b3a207d0fc32555a65034e6cde0	-	ol8_x86_64_UEKR7
	kernel-uek-core-5.15.0-325.221.6.1.el8uek.x86_64.rpm	c32244a47831c7137cb9ade9fd0338e9819708926957a6b7a1a0072ca5712163	-	ol8_x86_64_UEKR7
	kernel-uek-debug-5.15.0-325.221.6.1.el8uek.x86_64.rpm	dd32c55d1f8c1d109d883f011210d5359161bfc07876392ac5b2527945ada165	-	ol8_x86_64_UEKR7
	kernel-uek-debug-core-5.15.0-325.221.6.1.el8uek.x86_64.rpm	d76c46e3ba66f6ff41d325378d3f4c046546e54b6f1f58dd3f5ee4e3b21b9783	-	ol8_x86_64_UEKR7
	kernel-uek-debug-devel-5.15.0-325.221.6.1.el8uek.x86_64.rpm	cfa2ee2781f8bf43cec9d0a8ebba6630eca2421f667753243ff62a3f6ce75270	-	ol8_x86_64_UEKR7
	kernel-uek-debug-modules-5.15.0-325.221.6.1.el8uek.x86_64.rpm	296ca9c0da09d80c6f4be3a369544b8613569060c3f6e5607cf84445fcdaf691	-	ol8_x86_64_UEKR7
	kernel-uek-debug-modules-extra-5.15.0-325.221.6.1.el8uek.x86_64.rpm	d913da8c71d7effb367e3068f935ecb926588870943c7329aaf49cc086fc1e8c	-	ol8_x86_64_UEKR7
	kernel-uek-devel-5.15.0-325.221.6.1.el8uek.x86_64.rpm	ea2f1ef57b653804b00a97d5585ec68bbaa3fbb22224e5d174b87452c97fc190	-	ol8_x86_64_UEKR7
	kernel-uek-doc-5.15.0-325.221.6.1.el8uek.noarch.rpm	cc6c37d1da5afb2d823f75b0874c9dd2e338a05b5f54e26326385c9d69cf526d	-	ol8_x86_64_UEKR7
	kernel-uek-modules-5.15.0-325.221.6.1.el8uek.x86_64.rpm	4c29bf4d0b2f761c2d005d17529d0e08a5ba49fdbe5e1a1153be0b322c61a95f	-	ol8_x86_64_UEKR7
	kernel-uek-modules-extra-5.15.0-325.221.6.1.el8uek.x86_64.rpm	4cb310ac96d2401def0aefdc50bfedf874034a689c3d9b7b9638bcc6801edf71	-	ol8_x86_64_UEKR7
Oracle Linux 9 (aarch64)	kernel-uek-5.15.0-325.221.6.1.el9uek.src.rpm	d964d72863eadac9cfe9199b4224457694e48e3ee05bd46c36a1173e16acfd2d	-	ol9_aarch64_baseos_latest
	kernel-uek-5.15.0-325.221.6.1.el9uek.src.rpm	d964d72863eadac9cfe9199b4224457694e48e3ee05bd46c36a1173e16acfd2d	-	ol9_aarch64_u8_baseos_patch
	bpftool-5.15.0-325.221.6.1.el9uek.aarch64.rpm	ed693278c3a6756594f4542a16a9e1b8f5b387e0e40f43eaab583307c415e7ff	-	ol9_aarch64_baseos_latest
	bpftool-5.15.0-325.221.6.1.el9uek.aarch64.rpm	ed693278c3a6756594f4542a16a9e1b8f5b387e0e40f43eaab583307c415e7ff	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-5.15.0-325.221.6.1.el9uek.aarch64.rpm	dcc0338de66724db6bacd5d850b1513145481cb2a6adb13007df37affa1127d1	-	ol9_aarch64_baseos_latest
	kernel-uek-5.15.0-325.221.6.1.el9uek.aarch64.rpm	dcc0338de66724db6bacd5d850b1513145481cb2a6adb13007df37affa1127d1	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-container-5.15.0-325.221.6.1.el9uek.aarch64.rpm	29185b0b507f2b44e24f913929d91b2cdeda51203c8f77a2b77fd6958a5b3778	-	ol9_aarch64_baseos_latest
	kernel-uek-container-5.15.0-325.221.6.1.el9uek.aarch64.rpm	29185b0b507f2b44e24f913929d91b2cdeda51203c8f77a2b77fd6958a5b3778	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-container-debug-5.15.0-325.221.6.1.el9uek.aarch64.rpm	3abcc0876369e5aec8cde184c653bea39d803abdaebca7af8d9e4f09eb1e91e6	-	ol9_aarch64_baseos_latest
	kernel-uek-container-debug-5.15.0-325.221.6.1.el9uek.aarch64.rpm	3abcc0876369e5aec8cde184c653bea39d803abdaebca7af8d9e4f09eb1e91e6	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-core-5.15.0-325.221.6.1.el9uek.aarch64.rpm	486e55ce996bb30728a51c4a278dce591b488f3358dd9cfdd1ba8c5c1ed71dc2	-	ol9_aarch64_baseos_latest
	kernel-uek-core-5.15.0-325.221.6.1.el9uek.aarch64.rpm	486e55ce996bb30728a51c4a278dce591b488f3358dd9cfdd1ba8c5c1ed71dc2	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-debug-5.15.0-325.221.6.1.el9uek.aarch64.rpm	113d903cc0a63605bec3a6f944e2e2dcc9c8134319e98703f7c1381ff72e91d0	-	ol9_aarch64_baseos_latest
	kernel-uek-debug-5.15.0-325.221.6.1.el9uek.aarch64.rpm	113d903cc0a63605bec3a6f944e2e2dcc9c8134319e98703f7c1381ff72e91d0	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-debug-core-5.15.0-325.221.6.1.el9uek.aarch64.rpm	f2e9b7a60c077ffd7a3a67d24d05c9bcf277c53a67dcc1bb696767abf07392a8	-	ol9_aarch64_baseos_latest
	kernel-uek-debug-core-5.15.0-325.221.6.1.el9uek.aarch64.rpm	f2e9b7a60c077ffd7a3a67d24d05c9bcf277c53a67dcc1bb696767abf07392a8	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-debug-devel-5.15.0-325.221.6.1.el9uek.aarch64.rpm	44d3f961de8bbfe285790eea4a778ee9cd4e5134ccd0d41de6ed1a194f3b8195	-	ol9_aarch64_baseos_latest
	kernel-uek-debug-devel-5.15.0-325.221.6.1.el9uek.aarch64.rpm	44d3f961de8bbfe285790eea4a778ee9cd4e5134ccd0d41de6ed1a194f3b8195	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-debug-modules-5.15.0-325.221.6.1.el9uek.aarch64.rpm	3d17d868ad79a03830153f2b2cc6cad25dcddf079ea18def03f7f68a04ea76f2	-	ol9_aarch64_baseos_latest
	kernel-uek-debug-modules-5.15.0-325.221.6.1.el9uek.aarch64.rpm	3d17d868ad79a03830153f2b2cc6cad25dcddf079ea18def03f7f68a04ea76f2	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-debug-modules-extra-5.15.0-325.221.6.1.el9uek.aarch64.rpm	7fc8f9929f4aed4cfc4e0f9e1fa23bbdc9626017fb9fdbe991983602d817bea0	-	ol9_aarch64_baseos_latest
	kernel-uek-debug-modules-extra-5.15.0-325.221.6.1.el9uek.aarch64.rpm	7fc8f9929f4aed4cfc4e0f9e1fa23bbdc9626017fb9fdbe991983602d817bea0	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-devel-5.15.0-325.221.6.1.el9uek.aarch64.rpm	12077a0edca9fe362cacd5f56c829111a3897ead0f6e8cfc7c19815e3610151f	-	ol9_aarch64_baseos_latest
	kernel-uek-devel-5.15.0-325.221.6.1.el9uek.aarch64.rpm	12077a0edca9fe362cacd5f56c829111a3897ead0f6e8cfc7c19815e3610151f	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-doc-5.15.0-325.221.6.1.el9uek.noarch.rpm	358f0f185b442208a9867d3a149a76d1e95385e9461ef375581f1b1c5156e962	-	ol9_aarch64_baseos_latest
	kernel-uek-doc-5.15.0-325.221.6.1.el9uek.noarch.rpm	358f0f185b442208a9867d3a149a76d1e95385e9461ef375581f1b1c5156e962	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-modules-5.15.0-325.221.6.1.el9uek.aarch64.rpm	d5affb14ecd8fc6e16aca370f80c789e7904fcef90666b51d22b4f94cc6a4e69	-	ol9_aarch64_baseos_latest
	kernel-uek-modules-5.15.0-325.221.6.1.el9uek.aarch64.rpm	d5affb14ecd8fc6e16aca370f80c789e7904fcef90666b51d22b4f94cc6a4e69	-	ol9_aarch64_u8_baseos_patch
	kernel-uek-modules-extra-5.15.0-325.221.6.1.el9uek.aarch64.rpm	9691364dcc7a2a6e8cfeac5b1ae180875948d15c233e964c67a130d8f5408bf1	-	ol9_aarch64_baseos_latest
	kernel-uek-modules-extra-5.15.0-325.221.6.1.el9uek.aarch64.rpm	9691364dcc7a2a6e8cfeac5b1ae180875948d15c233e964c67a130d8f5408bf1	-	ol9_aarch64_u8_baseos_patch
	kernel-uek64k-5.15.0-325.221.6.1.el9uek.aarch64.rpm	d17e3c3ca817d37730140abc8ccd3d29b83253d809a99cc908a43afbb3cafc57	-	ol9_aarch64_baseos_latest
	kernel-uek64k-5.15.0-325.221.6.1.el9uek.aarch64.rpm	d17e3c3ca817d37730140abc8ccd3d29b83253d809a99cc908a43afbb3cafc57	-	ol9_aarch64_u8_baseos_patch
	kernel-uek64k-core-5.15.0-325.221.6.1.el9uek.aarch64.rpm	514ed5b4e6350896f131799e67a76f8eb2e85ffc673f3e6d4ed7b6dacf4474bc	-	ol9_aarch64_baseos_latest
	kernel-uek64k-core-5.15.0-325.221.6.1.el9uek.aarch64.rpm	514ed5b4e6350896f131799e67a76f8eb2e85ffc673f3e6d4ed7b6dacf4474bc	-	ol9_aarch64_u8_baseos_patch
	kernel-uek64k-devel-5.15.0-325.221.6.1.el9uek.aarch64.rpm	64289f589c4900c7d0b756f15698c5a576fe220f85eb8b471a3fc3cea23139d4	-	ol9_aarch64_baseos_latest
	kernel-uek64k-devel-5.15.0-325.221.6.1.el9uek.aarch64.rpm	64289f589c4900c7d0b756f15698c5a576fe220f85eb8b471a3fc3cea23139d4	-	ol9_aarch64_u8_baseos_patch
	kernel-uek64k-modules-5.15.0-325.221.6.1.el9uek.aarch64.rpm	1f303cd32491207858ca7ba0a7485a2bcc86d4e9d0e9f2da0e1955458d747e58	-	ol9_aarch64_baseos_latest
	kernel-uek64k-modules-5.15.0-325.221.6.1.el9uek.aarch64.rpm	1f303cd32491207858ca7ba0a7485a2bcc86d4e9d0e9f2da0e1955458d747e58	-	ol9_aarch64_u8_baseos_patch
	kernel-uek64k-modules-extra-5.15.0-325.221.6.1.el9uek.aarch64.rpm	eddc9d8270ad5b6fd08632a43ec14a3acc110764d38b3e2d2d4a3541993a0049	-	ol9_aarch64_baseos_latest
	kernel-uek64k-modules-extra-5.15.0-325.221.6.1.el9uek.aarch64.rpm	eddc9d8270ad5b6fd08632a43ec14a3acc110764d38b3e2d2d4a3541993a0049	-	ol9_aarch64_u8_baseos_patch
Oracle Linux 9 (x86_64)	kernel-uek-5.15.0-325.221.6.1.el9uek.src.rpm	d964d72863eadac9cfe9199b4224457694e48e3ee05bd46c36a1173e16acfd2d	-	ol9_x86_64_UEKR7
	bpftool-5.15.0-325.221.6.1.el9uek.x86_64.rpm	f34558910267b6d180ae96c0c4f654e1642c9e3b7d24c8d55e96047d510938f1	-	ol9_x86_64_UEKR7
	kernel-uek-5.15.0-325.221.6.1.el9uek.x86_64.rpm	db392e190387d73b77317b72cb0294274c27ac933f9572b6543b3324044ee7fb	-	ol9_x86_64_UEKR7
	kernel-uek-container-5.15.0-325.221.6.1.el9uek.x86_64.rpm	b67e176e018b35cf85b05404d2bb22dbedfb5d8e387829ba691a7898879039e4	-	ol9_x86_64_UEKR7
	kernel-uek-container-debug-5.15.0-325.221.6.1.el9uek.x86_64.rpm	9819e74632d168172fd9e5e7330a75d5533ab2fc03309e7585cd7033877e94b3	-	ol9_x86_64_UEKR7
	kernel-uek-core-5.15.0-325.221.6.1.el9uek.x86_64.rpm	0809ee9f42f1d8e9f0da09ab57e588e53f34ef370c5708e7bf4fb3986904d3d3	-	ol9_x86_64_UEKR7
	kernel-uek-debug-5.15.0-325.221.6.1.el9uek.x86_64.rpm	857fbc9306b776e047045c701421c77d3f3496c9e588577ffed6aff24c00bbfa	-	ol9_x86_64_UEKR7
	kernel-uek-debug-core-5.15.0-325.221.6.1.el9uek.x86_64.rpm	e10408a6e14f093e0ba91532d0bda3da00dda897e2f0ad3db5b9e0c2a306dbff	-	ol9_x86_64_UEKR7
	kernel-uek-debug-devel-5.15.0-325.221.6.1.el9uek.x86_64.rpm	cc23068568623c8bd491635a440205ded3b836f52ae460b17a09ebec5abdfa0f	-	ol9_x86_64_UEKR7
	kernel-uek-debug-modules-5.15.0-325.221.6.1.el9uek.x86_64.rpm	e36a0686ab79c71b583104d8aa7e8f391d8918343dd9802fe474bdb29cebc0f6	-	ol9_x86_64_UEKR7
	kernel-uek-debug-modules-extra-5.15.0-325.221.6.1.el9uek.x86_64.rpm	d78305eb46883918fa206702bd7b64e2a28fd08f74fb8bded04e6a5b34afef50	-	ol9_x86_64_UEKR7
	kernel-uek-devel-5.15.0-325.221.6.1.el9uek.x86_64.rpm	fba076d1dd745f0956bcbe162a4392e938a4d1e5ebd1d6fa88e061ffdb60dcde	-	ol9_x86_64_UEKR7
	kernel-uek-doc-5.15.0-325.221.6.1.el9uek.noarch.rpm	358f0f185b442208a9867d3a149a76d1e95385e9461ef375581f1b1c5156e962	-	ol9_x86_64_UEKR7
	kernel-uek-modules-5.15.0-325.221.6.1.el9uek.x86_64.rpm	c2f105c0398f917cb2d0e350f9b5d429f53ed529e7f776009ac308d5f812497e	-	ol9_x86_64_UEKR7
	kernel-uek-modules-extra-5.15.0-325.221.6.1.el9uek.x86_64.rpm	779a610ffc7e1a8f9f97cc5d8ee20f9f5b563ecc177592e112e57029b32d3fd3	-	ol9_x86_64_UEKR7

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team