- Update to 5.10.264.
- 6lowpan: fix NHC entry use-after-free on error path
- ACPI: IPMI: Fix message kref handling on dead device
- ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
- ACPI: resource: Amend kernel-doc style
- afs: Fix callback service message parsers to pass through -EAGAIN
- afs: Fix error code in afs_extract_vl_addrs()
- afs: Fix further netns teardown to cancel the preallocation charger
- afs: Fix netns teardown to cancel the preallocation charger
- afs: fix NULL pointer dereference in afs_get_tree()
- afs: Fix unchecked-length string display in debug statement
- afs: Fix vllist leak
- ALSA: aoa: check snd_ctl_new1() return value
- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
- ALSA: es1938: check snd_ctl_new1() return value
- ALSA: firewire: isight: bound the sample count to the packet payload
- ALSA: usb-audio: avoid kobject path lookup in DualSense match
- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
- ALSA: usb-audio: Roll back quirk control caches on write errors
- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
- ASoC: fsl: fsl_audmix: Validate written enum values
- ASoC: tegra: tegra210_ahub: Validate written enum value
- ata: pata_pxa: Fix DMA channel leak on probe error
- ata: sata_gemini: unwind clocks on IDE pinctrl errors
- audit: add audit_log_nf_skb helper function
- audit: Fix data races of skb_queue_len() readers on audit_queue
- audit: fix potential integer overflow in audit_log_n_hex()
- binder: fix UAF in binder_free_transaction()
- binder: fix UAF in binder_thread_release()
- bitops: make BYTES_TO_BITS() treewide-available
- Bluetooth: bnep: pin L2CAP connection during netdev registration
- Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
- Bluetooth: btintel: Check firmware version before download
- Bluetooth: btintel: Fix offset calculation boot address parameter
- Bluetooth: btrtl: validate firmware patch bounds
- Bluetooth: btusb: fix use-after-free on marvell probe failure
- Bluetooth: btusb: fix use-after-free on registration failure
- Bluetooth: btusb: fix wakeup source leak on probe failure
- Bluetooth: fix UAF in bt_accept_dequeue()
- Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
- Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
- Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
- Bluetooth: L2CAP: Fix not tracking outstanding TX ident
- Bluetooth: L2CAP: Fix regressions caused by reusing ident
- Bluetooth: L2CAP: validate option length before reading conf opt value
- bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
- bonding: 3ad: fix mux port state on oper down
- bpf: Fix stack slot index in nospec checks
- bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
- bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
- bpf: Update transport_header when encapsulating UDP tunnel in lwt
- bpftool: Use libbpf error code for flow dissector query
- btrfs: do not trim a device which is not writeable
- btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
- bus: mhi: host: Add alignment check for event ring read pointer
- bus: sunxi-rsb: Always check register address validity
- can: bcm: add missing rcu list annotations and operations
- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
- can: isotp: use unconditional synchronize_rcu() in isotp_release()
- cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
- char: tlclk: fix use-after-free in tlclk_cleanup()
- cifs: Create a new shared file holding smb2 pdu definitions
- cifs: remove check of list iterator against head past the loop body
- cifs: remove unused server parameter from calc_smb_size()
- clk: imx: Add check for kcalloc
- clk: qcom: a53: Corrected frequency multiplier for 1152MHz
- clk: scmi: Fix clock rate rounding
- configfs: fix lockless traversals of ->s_children
- coresight: cti: Fix DT filter signals silently ignored
- coresight: etb10: restore atomic_t for shared reading state
- cpu: hotplug: Preserve per instance callback errors
- cpufreq: conservative: Simplify frequency limit handling
- cpufreq: Documentation: fix conservative governor freq_step description
- cpufreq: Documentation: fix sampling_down_factor range
- cpufreq: Fix hotplug-suspend race during reboot
- cpufreq: intel_pstate: Sync policy->cur during CPU offline
- cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
- crypto: af_alg - Remove zero-copy support from skcipher and aead
- crypto: algif_skcipher - force synchronous processing on trees without ctx->state
- crypto: amcc - fix incorrect kernel-doc comment syntax in files
- crypto: amlogic - avoid double cleanup in meson_crypto_probe()
- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
- crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
- crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic
- crypto: atmel-sha204a - Mark OF related data as maybe unused
- crypto: caam - use print_hex_dump_devel to guard key hex dumps
- crypto: caam - use print_hex_dump_devel to guard key hex dumps again
- crypto: cavium/cpt - fix DMA cleanup using wrong loop index
- crypto: ccp - Treat zero-length cert chain as query for blob lengths
- crypto: crypto4xx - Remove ahash-related code
- crypto: crypto4xx - Remove insecure and unused rng_alg
- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
- crypto: drbg - Fix returning success on failure in CTR_DRBG
- crypto: drbg - Fix the fips_enabled priority boost
- crypto: ecc - Fix carry overflow in vli multiplication
- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
- crypto: pcrypt - restore callback for non-parallel fallback
- crypto: qat - fix restarting state leak on allocation failure
- crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
- crypto: qat - validate RSA CRT component lengths
- crypto: rng - Free default RNG on module exit
- crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
- cxgb4: Fix decode strings dump for T6 adapters
- debugobjects: Plug race against a concurrent OOM disable
- device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
- dm era: fix NULL pointer dereference in metadata_open()
- dm era: fix out-of-bounds memory access for non-zero start sector
- dm thin metadata: fix metadata snapshot consistency on commit failure
- dm thin metadata: fix superblock refcount leak on snapshot shadow failure
- dmaengine: Fix possible use after free
- dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
- dm_early_create: fix freeing used table on dm_resume failure
- dm-ioctl: report an error if a device has no table
- dm-log: fix a bitset_size overflow on 32bit machines
- dm-stats: fix dm_jiffies_to_msec64
- dm-stats: fix merge accounting
- dm-verity: increase sprintf buffer size
- drbd: reject data replies with an out-of-range payload size
- driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
- drm/edid: fix OOB read in drm_parse_tiled_block()
- drm/i2c/sil164: Drop no-op remove function
- drm/msm/dp: fix HPD state status bit shift value
- drm/msm/dp: Fix the ISR_* enum values
- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
- drm/tidss: Drop extra drm_mode_config_reset() call
- exfat: bound uniname advance in exfat_find_dir_entry()
- ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
- f2fs: adjust zone capacity when considering valid block count
- f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
- f2fs: fix listxattr handling of corrupted xattr entries
- f2fs: fix potential deadlock in f2fs_balance_fs()
- f2fs: fix to round down start offset of fallocate for pin file
- f2fs: validate orphan inode entry count
- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
- fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
- fbdev: i740fb: fix potential memory leak in i740fb_probe()
- fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
- fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
- fbdev: s3fb: fix potential memory leak in s3_pci_probe()
- fbdev: sm501fb: Fix buffer errors in OF binding code
- fbdev: sm712: Fix operator precedence in big_swap macro
- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
- fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
- fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
- firmware_loader: Fix recursive lock in device_cache_fw_images()
- fs: efs: remove unneeded debug prints
- fsl/fman: Free init resources on KeyGen failure in fman_init()
- fuse: fix device node leak in cuse_process_init_reply()
- fuse: re-lock request before returning from fuse_ref_folio()
- gpio: eic-sprd: use raw_spinlock_t in the irq startup path
- gpio: htc-egpio: use managed gpiochip registration
- gpio: mvebu: fail probe if gpiochip registration fails
- gpio: pca953x: Make platform teardown callback return void
- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
- gpios: palmas: add .get_direction() op
- gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
- gue: validate REMCSUM private option length
- hdlc_ppp: sync per-proto timers before freeing hdlc state
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfs/hfsplus: prevent getting negative values of offset/length
- hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
- HID: add haptics page defines
- HID: appleir: fix UAF on pending key_up_timer in remove()
- HID: core: Fix OOB read in hid_get_report for numbered reports
- HID: lg-g15: cancel pending work on remove to fix a use-after-free
- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
- HID: multitouch: fix out-of-bounds bit access on mt_io_flags
- HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
- HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
- HID: wacom: stop hardware after post-start probe failures
- hwmon: adm1275: Prevent reading uninitialized stack
- hwmon: (asus_atk0110) Check package count before accessing element
- hwmon: (w83627hf) remove VID sysfs files on error and remove
- hwmon: (w83793) remove vrm sysfs file on probe failure
- hwrng: virtio: clamp device-reported used.len at copy_data()
- hwspinlock: qcom: avoid uninitialized struct members
- i2c: core: fix adapter debugfs creation
- i2c: core: fix adapter registration race
- i2c: core: fix hang on adapter registration failure
- i2c: core: fix irq domain leak on adapter registration failure
- i2c: core: fix NULL-deref on adapter registration failure
- i2c: mediatek: fix WRRD for SoCs without auto_restart option
- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
- i2c: stm32f7: truncate clock period instead of rounding it
- i3c: master: Prevent reuse of dynamic address on device add failure
- IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
- IB/mlx4: Fix refcount leak in add_port() error path
- ieee802154: admin-gate legacy LLSEC dump operations
- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
- ieee802154: ca8210: fix cas_ctl leak on spi_async failure
- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
- ieee802154: fix kernel-infoleak in dgram_recvmsg()
- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
- iio: accel: bmc150: clamp the device-reported FIFO frame count
- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
- iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
- iio: adc: lpc32xx: Initialize completion before requesting IRQ
- iio: adc: spear: Initialize completion before requesting IRQ
- iio: adc: ti-ads124s08: Return reset GPIO lookup errors
- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
- iio: common: st_sensors: honour channel endianness in read_axis_data
- iio: event: Fix event FIFO reset race
- iio: gyro: bmg160: bail out when bandwidth/filter is not in table
- iio: gyro: bmg160: wait full startup time after mode change at probe
- iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
- iio: imu: inv_icm42600: fix timestamp clock period by using lower value
- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
- iio: imu: inv_icm42600: make timestamp module chip independent
- iio: imu: inv_icm42600: stabilized timestamp in interrupt
- iio: imu: inv_mpu6050: fix frequency setting when chip is off
- iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
- iio: imu: st_lsm6dsx: deselect shub page before reading whoami
- iio: invensense: fix odr switching to same value
- iio: invensense: fix timestamp glitches when switching frequency
- iio: invensense: remove redundant initialization of variable period
- iio: light: al3010: fix incorrect scale for the highest gain range
- iio: light: gp2ap002: fix runtime PM leak on read error
- iio: light: opt3001: fix missing state reset on timeout
- iio: light: si1133: prevent race condition on timeout
- iio: light: si1133: reset counter to prevent race condition
- iio: light: veml6030: fix channel type when pushing events
- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
- iio: magnetometer: ak8975: fix potential kernel stack memory leak
- iio: make invensense timestamp module generic
- iio: move inv_icm42600 timestamp module in common
- iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
- Input: elan_i2c - prevent division by zero and arithmetic underflow
- Input: goodix - clamp the device-reported contact count
- Input: iforce - bound the device-reported force-feedback effect index
- Input: ims-pcu - add response length checks
- Input: ims-pcu - fix DMA mapping violation in line setup
- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
- Input: ims-pcu - fix type confusion in CDC union descriptor parsing
- Input: ims-pcu - fix use-after-free and double-free in disconnect
- Input: ims-pcu - release data interface on disconnect
- Input: ims-pcu - validate control endpoint type
- Input: maplecontrol - set driver data before registering input device
- Input: maple_keyb - set driver data before registering input device
- Input: maplemouse - fix NULL pointer dereference in open()
- Input: maplemouse - set driver data before registering input device
- Input: mms114 - fix multi-touch slot corruption
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
- Input: touchwin - reset the packet index on every complete packet
- iommu/amd: Fix a stale comment about which legacy mode is user visible
- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
- ipv4: fib: Don't ignore error route in local/main tables.
- ipv4: igmp: remove multicast group from hash table on device destruction
- ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
- ipv6: fix error handling in disable_ipv6 sysctl
- ipv6: fix error handling in disable_policy sysctl
- ipv6: fix error handling in forwarding sysctl
- ipv6: fix error handling in ignore_routes_with_linkdown sysctl
- ipv6: fix lockdep splat in in6_dump_addrs()
- ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
- ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
- ipv6: guard against possible NULL deref in __in6_dev_stats_get()
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
- ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
- ipv6: mcast: Fix potential UAF in MLD delayed work
- ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
- ipv6: mcast: Replace locking comments with lockdep annotations.
- ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
- ipvs: ensure inner headers in ICMP errors are in headroom
- ipvs: fix more places with wrong ipv6 transport offsets
- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
- ipvs: pass parsed transport offset to state handlers
- ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
- ipvs: use parsed transport offset in SCTP state lookup
- ipvs: use parsed transport offset in TCP state lookup
- irqchip/crossbar: Fix parent domain resource leak
- irqchip/crossbar: Use correct index in crossbar_domain_free()
- isofs: bound Rock Ridge symlink components to the SL record
- kcm: use WRITE_ONCE() when changing lower socket callbacks
- kconfig: fix potential NULL pointer dereference in conf_askvalue
- KEYS: Use acquire when reading state in keyring search
- KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
- leds: lm3601x: Improve error reporting for problems during .remove()
- leds: lm3697: Remove duplicated error reporting in .remove()
- leds: uleds: Fix potential buffer overread
- lib/test_meminit: use && for bools
- llc: fix SAP refcount leak in llc_ui_autobind()
- llc: fix SAP refcount leak when creating incoming sockets
- lockd: Plug nlm_file leak when nlm_do_fopen() fails
- lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
- mac802154: remove interfaces with RCU list deletion
- macsec: fix promiscuity refcount leak in macsec_dev_open()
- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
- media: atomisp: replace boolean comparison of values with bool variables
- media: cedrus: Fix failure to clean up hardware on probe failure
- media: qcom: venus: drop extra padding in NV12 raw size calculation
- media: rockchip: rga: fix too small buffer size
- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
- media: staging: media: atomisp: Fix alignment and line length issues
- media: staging: media: atomisp: Fix sh_css.c brace coding style issues
- media: staging: media: atomisp: Fix the rest of sh_css.c brace issues
- media: staging: media: atomisp: Replace if else clause with a ternary
- media: uvcvideo: Avoid partial metadata buffers
- media: uvcvideo: Fix buffer sequence in frame gaps
- memstick: ms_block: reject a card that reports too many blocks
- mfd: cros_ec: Delay dev_set_drvdata() until probe success
- mfd: sm501: Fix reference leak on failed device registration
- mfd: tps6586x: Fix OF node refcount
- mld: add mc_lock for protecting per-interface mld data
- mld: add new workqueues for process mld events
- mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
- mld: convert from timer to delayed work
- mld: convert ifmcaddr6 to RCU
- mld: convert ip6_sf_list to RCU
- mld: convert ipv6_mc_socklist->sflist to RCU
- mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
- mld: get rid of inet6_dev->mc_lock
- mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
- mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC
- mmc: vub300: defer reset until cmd_mutex is unlocked
- mm/fake-numa: fix under-allocation detection in uniform split
- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
- mtd: onenand: samsung: report DMA completion timeouts
- mtd: rawnand: fix condition in 'nand_select_target()'
- mtd: rawnand: fsl_ifc: return errors for failed page reads
- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
- mtd: slram: remove failed entries from the device list
- mtd: spi-nor: Drop duplicate Kconfig dependency
- net: af_key: initialize alg_key_len for IPComp states
- net: atm: reject out-of-range traffic classes in QoS validation
- net: Drop the lock in skb_may_tx_timestamp()
- net: dsa: sja1105: round up PTP perout pin duration
- net: ena: clean up XDP TX queues when regular TX setup fails
- net: ethernet: rmnet: Always subtract MAP header
- net: ethernet: rmnet: Support for ingress MAPv5 checksum offload
- net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
- net: ife: require ETH_HLEN to be pullable in ife_decode()
- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
- net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
- net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
- net: liquidio: fix BAR resource leak on PF number failure
- net: mld: fix reference count leak in mld_{query | report}_work()
- net: mvneta: re-enable percpu interrupt on resume
- net: psample: fix info leak in PSAMPLE_ATTR_DATA
- net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
- net: qualcomm: rmnet: add tx packets aggregation
- net: qualcomm: rmnet: don't use C bit-fields in rmnet checksum header
- net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros
- net: qualcomm: rmnet: simplify some byte order logic
- net: qualcomm: rmnet: use masks instead of C bit-fields
- net: qualcomm: rmnet: validate MAP frame length before ingress parsing
- net: sit: require CAP_NET_ADMIN in the device netns for changelink
- net: skmsg: preserve sg.copy across SG transforms
- net: sungem: fix probe error cleanup
- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
- net: usb: lan78xx: disable VLAN filter in promiscuous mode
- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
- net/9p: fix race condition on rdma->state in trans_rdma.c
- netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
- netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
- netfilter: ebtables: module names must be null-terminated
- netfilter: ebtables: terminate table name before find_table_lock()
- netfilter: ebtables: Use vmalloc_array() to improve code
- netfilter: ebtables: zero chainstack array
- netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
- netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
- netfilter: ipset: fix race between dump and ip_set_list resize
- netfilter: nf_conncount: callers must hold rcu read lock
- netfilter: nf_conncount: fix zone comparison in tuple dedup
- netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
- netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
- netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
- netfilter: nf_log: validate MAC header was set before dumping it
- netfilter: nf_nat_sip: reload possible stale data pointer
- netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
- netfilter: nfnl_cthelper: apply per-class values when updating policies
- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
- netfilter: nft_synproxy: stop bypassing the priv->info snapshot
- netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
- netfilter: xt_cluster: reject template conntracks in hash match
- netfilter: xt_nat: reject unsupported target families
- netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
- netfilter: xt_u32: reject invalid shift counts
- net/mlx5: Fix L3 tunnel entropy refcount leak
- net/sched: cake: reject overhead values that underflow length
- net/sched: cls_bpf: prevent unbounded recursion in offload rollback
- net/sched: hhf: clear heavy-hitter state on reset
- net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
- net/sched: sch_drr: annotate data-races around cl->deficit
- net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
- net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
- net/sched: sch_hfsc: Don't make class passive twice
- net/sched: sch_htb: annotate data-races (I)
- net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
- nfsd: change nfs4_client_to_reclaim() to allocate data
- nfsd: move name lookup out of nfsd4_list_rec_dir()
- nfsd: release layout stid on setlease failure
- nfsd: reset write verifier on deferred writeback errors
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
- NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
- NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
- NFSv4/flexfiles: reject zero filehandle version count
- NFSv4/pnfs: defer return_range callbacks until after inode unlock
- nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
- nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
- nvdimm/btt: Free arenas on btt_init() error paths
- nvme-multipath: fix flex array size in struct nvme_ns_head
- nvmet-rdma: handle inline data with a nonzero offset
- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
- nvmet-tcp: fix race between ICReq handling and queue teardown
- ocfs2: avoid moving extents to occupied clusters
- ocfs2: don't BUG_ON an invalid journal dinode
- ocfs2: fix buffer head management in ocfs2_read_blocks()
- ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
- ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
- ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
- ocfs2: kill osb->system_file_mutex lock
- ocfs2: rebase copied fsdlm LVB pointers in locking_state
- ocfs2: reject dinodes whose i_rdev disagrees with the file type
- ocfs2: reject dinodes with non-canonical i_mode type
- ocfs2: reject FITRIM ranges shorter than a cluster
- ocfs2: reject non-inline dinodes with i_size and zero i_clusters
- ocfs2: use kzalloc for quota recovery bitmap allocation
- ocfs2/dlm: require a ref for locking_state debugfs open
- octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
- orangefs: keep the readdir entry size 64-bit in fill_from_part()
- partitions: aix: bound the pp_count scan to the ppe array
- PCI: Add kerneldoc for pci_resize_resource()
- PCI: altera: Do not dispose parent IRQ mapping
- PCI: altera: Fix resource leaks on probe failure
- PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
- PCI: Fix restoring BARs on BAR resize rollback path
- PCI: Free saved list without holding pci_bus_sem
- PCI: host-common: Request bus reassignment when not probe-only
- PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
- PCI: mediatek: Convert bool to single quirks entry and bitmap
- PCI: mediatek: Fix IRQ domain leak when port fails to enable
- PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
- PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
- PCI: mediatek: Use actual physical address instead of virt_to_phys()
- PCI: Move Resizable BAR code to rebar.c
- PCI: Prevent resource tree corruption when BAR resize fails
- PCI: rcar-host: Remove unused LIST_HEAD(res)
- PCI: Skip Resizable BAR restore on read error
- perf/x86/amd/core: Always use the NMI latency mitigation
- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
- platform/x86: xo15-ebook: Fix wakeup source and GPE handling
- PM: sleep: Use complete() in device_pm_sleep_init()
- pNFS/filelayout: fix cheking if a layout is striped
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race
- posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
- power: supply: charger-manager: fix refcount leak in is_full_charged()
- proc: only bump parent nlink when registering directories
- proc: protect ptrace_may_access() with exec_update_lock (FD links)
- proc: protect ptrace_may_access() with exec_update_lock (part 1)
- proc: rename proc_setattr to proc_nochmod_setattr
- proc: use generic setattr() for /proc/$PID/net
- pwm: imx27: Fix variable truncation in .apply()
- qede: fix off-by-one in BD ring consumption on build_skb failure
- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
- RDMA/hns: Fix arithmetic overflow in calc_hem_config()
- RDMA/hns: Fix warning in poll cq direct mode
- RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
- RDMA/mlx5: Fix undefined shift of user RQ WQE size
- RDMA/siw: bound Read Response placement to the RREAD length
- RDMA/srpt: fix integer overflow in immediate data length check
- regulator: core: Make regulator_lock_two() logic easier to follow
- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
- reset: sunxi: fix memory region leak on ioremap failure
- Revert "x86/bugs: Make Safe-RET robust against interrupt injection"
- ring-buffer: Fix event length with forced 8-byte alignment
- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
- rtc: cmos: unregister HPET IRQ handler on probe failure
- rtc: ds1307: Fix off-by-one issue with wday for rx8130
- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
- rtmutex: Use waiter::task instead of current in remove_waiter()
- sched/fair: Only update stats for allowed CPUs when looking for dst group
- sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
- scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
- scsi: pm8001: Fix error code in non_fatal_log_show()
- scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
- scsi: sg: Report request-table problems when any status is set
- scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
- sctp: hold socket lock when dumping endpoints in sctp_diag
- sctp: validate embedded address parameter length
- sctp: validate STALE_COOKIE cause length before reading staleness
- seg6: validate SRH length before reading fixed fields
- selftests/mm: allow PUD-level entries in compound testcase of hmm tests
- selftests/mm: clarify alternate unmapping in compaction_test
- serial: 8250_mid: Disable DMA for selected platforms
- serial: 8250_mid: Remove 8250_pci usage
- serial: 8250_omap: clear rx_running on zero-length DMA completes
- serial: msm: Disable DMA for kernel console UART
- skmsg: convert struct sk_msg_sg::copy to a bitmap
- smb: client: Fix next buffer leak in receive_encrypted_standard()
- smb: client: fix overflow in passthrough ioctl bounds check
- smb: client: harden POSIX SID length parsing
- smb: client: mask server-provided mode to 07777 in modefromsid
- smb: client: restrict implied bcc[0] exemption to responses without data area
- smb: client: use unaligned reads in parse_posix_ctxt()
- smb2: small refactor in smb2_check_message()
- smb/client: preserve errors from smb2_set_sparse()
- soc: fsl: qe: panic on ioremap() failure in qe_reset()
- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
- spi: ep93xx: fix double-free of zeropage on DMA setup failure
- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
- spi: sh-msiof: abort transfers when reset times out
- spi: uniphier: Fix completion initialization order before devm_request_irq()
- spi: xilinx: use FIFO occupancy register to determine buffer size
- staging: media: atomisp: reduce load_primary_binaries() stack usage
- staging: most: video: avoid double free on video register failure
- staging: nvec: fix use-after-free in nvec_rx_completed()
- staging: rtl8723bs: clean up comparsions to NULL
- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
- staging: rtl8723bs: Fix space issues
- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
- staging: rtl8723bs: remove 5Ghz code blocks
- staging: rtl8723bs: remove 5Ghz code related to channel plan definition
- staging: rtl8723bs: remove all 5Ghz network types
- staging: rtl8723bs: remove commented out condition
- staging: rtl8723bs: remove commented out RT_ASSERT occurrences
- staging: rtl8723bs: remove DBG_871X log argument
- staging: rtl8723bs: split too long line
- sysfs: clamp show() return value in sysfs_kf_read()
- tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
- thermal: hwmon: Fix critical temperature attribute removal
- thermal: intel: Fix dangling resources on thermal_throttle_online() failure
- time: Fix off-by-one in compat settimeofday() usec validation
- tipc: fix out-of-bounds read in broadcast Gap ACK blocks
- tipc: fix UAF in tipc_l2_send_msg()
- tipc: prevent snt_unacked underflow on CONN_ACK
- tipc: require net admin for TIPCv2 netlink mutators
- tools lib api: Fix filename__write_int() writing uninitialized stack data
- tools lib api: Fix missing null termination in filename__read_int/ull()
- tools lib api: Fix mount_overload() snprintf truncation and toupper range
- tools/mm/slabinfo: fix total_objects attribute name
- tools/resolve_btfids: Emit warnings and patch zero id for missing symbols
- tools/resolve_btfids: Fix some error messages
- tools/virtio: check mmap return value in vringh_test
- tpm: fix event_size output in tpm1_binary_bios_measurements_show
- tpm: Make the TPM character devices non-seekable
- tracing: Prevent out-of-bounds read in glob matching
- tracing: probes: fix typo in a log message
- tracing/events: Fix to check the simple_tsk_fn creation
- tracing/probes: Fix double addition of offset for @+FOFFSET
- udf: validate free block extents against the partition length
- udf: validate sparing table length as an entry count, not a byte count
- udf: validate VAT header length against the VAT inode size
- udmabuf: fix DMA direction mismatch in release_udmabuf()
- usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- usb: cdc_acm: Add quirk for Uniden BC125AT scanner
- USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
- usb: free iso schedules on failed submit
- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
- usb: gadget: f_fs: initialize reset_work at allocation time
- usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
- usb: gadget: f_printer: take kref only for successful open
- usb: gadget: function: rndis: add length check for header
- usb: gadget: function: rndis: add length check to response query
- usb: gadget: function: Simplify diagnostic messaging in printer
- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
- usb: host: max3421: Reject hub port requests for non-existent ports
- USB: idmouse: fix use-after-free on disconnect race
- USB: iowarrior: fix use-after-free on disconnect
- usb: iowarrior: remove inherent race with minor number
- USB: ldusb: fix use-after-free on disconnect race
- USB: legousbtower: fix use-after-free on disconnect race
- USB: misc: uss720: unregister parport on probe failure
- usb: mtu3: unmap request DMA on queue failure
- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
- USB: serial: digi_acceleport: fix broken rx after throttle
- USB: serial: digi_acceleport: fix hard lockup on disconnect
- USB: serial: digi_acceleport: fix write buffer corruption
- USB: serial: option: add Telit Cinterion FE990D50 compositions
- usb: sl811-hcd: disable controller wakeup on remove
- USB: storage: include US_FL_NO_SAME in quirks mask
- usb: typec: tcpm: Fix VDM type for Enter Mode commands
- usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
- usb: typec: ucsi: Invert DisplayPort role assignment
- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
- USB: ulpi: fix memory leak on registration failure
- USB: usb-storage: ene_ub6250: restore media-ready check
- usb: xhci: Fix sleep in atomic context in xhci_free_streams()
- usbip: tools: support SuperSpeedPlus devices
- usbip: vudc: fix NULL deref in vep_dequeue()
- usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
- userfaultfd: gate must_wait writability check on pte_present()
- vfio/pci: Release the VGA arbiter client on register_device() failure
- vhost/vdpa: validate virtqueue index in mmap and fault paths
- virtio-mmio: fix device release warning on module unload
- virtio_net: disable cb when NAPI is busy-polled
- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
- wifi: ath9k: fix OOB access from firmware tx status queue ID
- wifi: mac80211: fix memory leak in ieee80211_register_hw()
- wifi: mac80211: free ack status frame on TX header build failure
- wifi: mwifiex: fix permanently busy scans after multiple roam iterations
- wifi: rt2x00: avoid full teardown before work setup in probe
- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
- workqueue: drop spurious '*' from print_worker_info() fn declaration
- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
- X.509: Fix validation of ASN.1 certificate header
- x86/boot: Reject too long acpi_rsdp= values
- x86/boot: Validate console=uart8250 baud rate to fix early boot hang
- x86/bugs: Make Safe-RET robust against interrupt injection
- x86/bugs: Make Safe-RET robust against interrupt injection
- x86/platform/olpc: xo15: Drop wakeup source on driver removal
- xen/gntdev: fix error handling in ioctl
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
- xfrm: use compat translator only for u64 alignment mismatch
- xfrm: validate selector family and prefixlen during match
- xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
- xfs: fix unreachable BIGTIME check in dquot flush validation
- xfs: reflect sb features in xfs_mount
- xfs: use null daddr for unset first bad log block