- Update to 5.10.271.
- 9p: invalidate readdir buffer on seek
- ACPICA: add boundary checks in acpi_ps_get_next_field()
- ACPICA: add boundary checks in two places
- ACPICA: Add package limit checks in parser functions
- ACPICA: Add validation for node in acpi_ns_build_normalized_path()
- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
- ACPICA: Fix condition check in acpi_ps_parse_loop()
- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
- ACPICA: Prevent adding invalid references
- ACPICA: validate byte_count in acpi_ps_get_next_package_length()
- ACPICA: validate handler object type in two places
- affs: handle set_blocksize failures
- af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
- ALSA: caiaq: Fix potential double-free at error path
- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
- ALSA: es18xx: check control allocation before private data setup
- ALSA: hda: trace PCM open only after assigning a stream
- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
- ALSA: pcm: set timer->private_data before registering the PCM timer
- ALSA: seq: oss: Reject reads that cannot fit the next event
- ALSA: us122l: Prevent write upgrades for read mappings
- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
- ALSA: usb-audio: Add quirk for Novation Mininova
- ALSA: usb-audio: Add quirk for YAMAHA CDS3000
- ALSA: usb-audio: caiaq: validate EP1 reply lengths
- ALSA: usx2y: Drain pending US-428 pipe-4 output commands
- ASoC: ab8500: Correct digital interface format setup
- ASoC: ab8500: Repair the DAPM capture graph
- ASoC: ab8500: Reset the audio block before configuring it
- ASoC: ab8500: Update to modern clocking terminology
- ASoC: ab8500: Validate and program TDM slots correctly
- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
- ASoC: bcm: bcm63xx: Publish the OF module aliases
- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
- ASoC: codecs: rk3328: Use managed GPIO and clock helpers
- ASoC: Intel: catpt: Complete coredump handling
- ASoC: Intel: SST: Publish the PCI module aliases
- ASoC: mt6351: Publish the OF module alias
- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
- ASoC: rt5645: Perform the initial jack detect at probe
- ASoC: sprd: validate compress buffer sizes against fixed allocations
- ASoC: sti: initialize IRQ lock before requesting IRQ
- ASoC: ti: omap3pandora: update board check to use DT compatible
- ASoC: ux500: Correct MSP frame and bit clock setup
- ASoC: ux500: Fix MSP stream lifecycle handling
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
- ASoC: ux500: Program the MSP FIFO watermarks
- ASoC: ux500: Propagate MSP setup errors
- ASoC: ux500: remove platform_data support
- ASoC: ux500: remove stedma40 references
- ASoC: ux500: Request the MSP MMIO resource
- ASoC: ux500: Validate MSP DAI configuration
- ata: ahci: fail probe if BAR too small for claimed ports
- ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
- ata: libata-pmp: add JMicron JMS562 quirk
- autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
- batman-adv: dat: atomically update mac addresses
- befs: handle set_blocksize failures
- bfs: handle set_blocksize failures
- bitfield: wire __bf_shf to __builtin_ctzll
- blk-cgroup: fix leaks and online flag on radix_tree_insert failure
- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
- Bluetooth: btusb: fix NXP IW610 composite device handling
- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
- Bluetooth: hci_sock: reject out-of-range OCF values
- Bluetooth: hci_sock: validate event length before filtering
- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
- Bluetooth: L2CAP: Fix deadlock
- Bluetooth: L2CAP: validate connectionless PSM length
- Bluetooth: L2CAP: validate frame length before control and FCS access
- Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
- Bluetooth: SMP: reject Security Request over BR/EDR
- bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
- bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
- bonding: do not clear curr_active_slave prematurely when releasing all slaves
- bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
- bpf: Fix bpf_skb_change_tail wrt csum partial skbs
- bpf: Fix bpf_sock context code generation
- bpf: Fix NULL-ptr-deref in btf_var_show()
- bpf: Fix NULL-ptr-deref when showing a void BTF type
- bpf: Fix out-of-bounds read of rtt_min in sock_ops
- bpf: NUL-terminate replaced sysctl value
- bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
- bridge: Do not suppress ARP probes and DAD NS unconditionally
- btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
- btrfs: detach failed sprout device from transaction update list
- btrfs: do not force reloc root creation during qgroup_account_snapshot()
- btrfs: fix reloc root cleanup in merge_reloc_roots()
- btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
- btrfs: return an error from btrfs_record_root_in_trans
- btrfs: tree-checker: print dev extent offset in error message
- can: ems_usb: validate CPC message lengths
- char/nvram: Remove redundant nvram_mutex
- cifs: validate idmap key payload length
- clk: at91: pmc: #undef field_{get,prep}() before definition
- clk: keystone: don't cache clock rate
- clk: renesas: cpg-mssr: Add number of clock cells check
- clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
- clk: socfpga: agilex: implement l3_main_free_clk
- configfs_depend_prep(): pass configfs_dirent instead of dentry
- cpufreq: initialize policy rwsem before sysfs publication
- cpufreq: zero-initialize policy cpumask before sysfs publication
- crypto: atmel-ecc - add support for atecc608b
- crypto: sun8i-ce - Remove crypto_rng interface
- crypto: sun8i-ss - Remove crypto_rng interface
- dma-coherent: report a failed reserved memory assignment
- dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
- dmaengine: Fix device kref underflow in dma_chan_put()
- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
- dmaengine: sprd: Fix runtime PM reference leak in probe
- dmaengine: sun6i: fix non-atomic read of DMA position registers
- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
- dmaengine: wait for RCU readers before releasing dma_device
- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
- dma-mapping: simplify dma_init_coherent_memory
- dm/amdgpu: fix malformed link_settings debugfs output
- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
- drm/amd/display: Fix CRC open failure during active rendering
- drm/amd/display: set new_stream to NULL after release
- drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
- drm/amd/pm/si: Fix updating clock limits from power states
- drm/gma500: return errors from Oaktrail HDMI I2C reads
- drm/i915: Fix memory leak in query_perf_config_list()
- drm/msm/adreno: fix autosuspend cleanup during teardown
- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
- drm/nouveau: fix autosuspend cleanup during teardown
- drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- drm/nouveau: fix double-free in nvif_vmm_dtor
- drm/nouveau: Fix gem reference leak in validate_init()
- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
- drm/panel: simple: Add AM-1280800W8TZQW-T00H
- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
- drm/virtio: fix object leak when drm_gem_handle_create() fails
- drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
- drop_monitor: synchronize tracepoint unregistration on error path
- e1000e: limit endianness conversion to boundary words
- EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
- exec: do_close_on_exec() before taking exec_update_lock
- f2fs: validate inline dentry name lengths before conversion
- fbdev: pm2fb: unwind WC setup on probe failure
- fbdev: vfb: defer cleanup until the last reference
- fou: Fix use-after-free in fou_create()
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- freevxfs: don't BUG() on unknown typed-extent type
- fsl/fman: Fix clk reference leak in read_dts_node()
- fuse: set ff->flock only on success
- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- gpio: dwapb: Mask interrupts at hardware initialization
- gpio: pisosr: Read "ngpios" as u32
- gpio: zynq: fix runtime PM leak on request error path
- hfs: rework hfsplus_readdir() logic
- hfsplus: fix issue of direct writes beyond end-of-file
- hfsplus: rework hfsplus_readdir() logic
- HID: alps: fix use-after-free on input2 registration failure
- HID: hyperv: streamline driver probe to avoid devres issues
- HID: logitech-hidpp: fix race condition when accessing stale stack pointer
- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- hpfs: handle set_blocksize failures
- hsr: broadcast netlink notifications in the device's net namespace
- hwmon: (adt7462) Add of_match_table to support devicetree
- hwmon: (applesmc) fix key backlight workqueue leak on register failure
- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
- hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
- hwmon: (w83793) release probe data through kref
- i2c: at91: release DMA channels on remove and probe error
- i2c: imx: release DMA channels on probe error
- i2c: smbus: reject oversized block transfers in the common path
- IB/IPoIB: Avoid restoring OPER_UP after multicast flush
- IB/iser: Align coding style across driver
- IB/iser: reject a remote invalidation of an unregistered direction
- IB/iser: Remove iser_reg_data_sg helper function
- IB/iser: Use iser_fr_desc as registration context
- IB/isert: wait for deferred control PDU completions before releasing the connection
- IB/mlx4: Fix use-after-free on pkey sysfs registration failure
- ice: pass the return value of skb_checksum_help()
- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
- iio: accel: mma8452: switch to non-devm request_threaded_irq()
- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
- ima: return error early if file xattr cannot be changed
- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
- Input: eeti_ts - publish the OF module alias
- Input: evdev - zero absinfo before partial copy in EVIOCSABS
- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
- Input: soc_button_array - check btns_desc->package.count
- Input: soc_button_array - fix MS Surface Pro 11 probe failure
- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
- Input: trackpoint - fix the inertia attribute name in the ABI document
- Input: xpad - add support for Victrix Pro BFG Controller
- Input: xpad - fix PDP Marvel Xbox 360 controller
- Input: zero ff_effect before compat copy in input_ff_effect_from_user
- iomap: iomap: fix memory corruption when recording errors during writeback
- iommu/rockchip: disable fetch dte time limit
- ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
- ip_gre: Reject enabling collect metadata through changelink
- ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
- ipv4: fib: bound automatic table ID allocation
- ipv6: addrconf: fix temp address generation after prefix deprecation
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- ipv6: fix fib6 walker UAF on seq stop
- ipv6: Honor oif when choosing nexthop for locally generated traffic
- ipv6: mcast: extend RCU protection in igmp6_send()
- ipv6: Select best matching nexthop object in fib6_table_lookup()
- ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- ipv6: sr: restore network header before routing and forwarding
- ipv6: xfrm: use full sockets in local error paths
- ipvs: fix reversed sequence option serialization
- ipvs: reject invalid states in connection template sync records
- ipvs: revalidate ihl before icmp_send
- irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
- isofs: handle set_blocksize failures
- jfs: handle set_blocksize failures
- kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
- keys: fix lost wakeup when reaping a dead key type
- keys: translate request_key_auth pid for the reading procfs instance
- KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
- KVM: PPC: Book3S HV: Set irqfd->producer only on success
- lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
- lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
- leds: pca9532: Don't stop blinking for non-zero brightness
- leds: uleds: Return -EFAULT on copy_to_user() failure
- libceph: Reject monmaps advertising zero monitors
- Linux 5.10.271
- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
- llc: reserve device headroom for allocated frames
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev
- mailbox: Make mbox_send_message() return error code when tx fails
- md/raid5: let stripe batch bm_seq comparison wrap-safe
- media: dm1105: fix missing error check for dma_alloc_coherent
- media: em28xx-video: fix missing res_free() on init_usb_xfer failure
- media: hevc: add bounded tile-count helpers
- media: imon: Add iMON VFD HID OEM v1.2 key mappings
- media: rc: mceusb: Add support for 04eb:e033
- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
- media: video-i2c: fix buffer queue ordering
- minix: handle set_blocksize failures
- mips: cps: Assemble jr.hb with an R2 ISA level
- MIPS: Octeon: apply USB FDT fixups also when USB is modular
- mmc: core: Fix OF node reference leak on card add failure
- mmc: davinci: avoid NULL deref of host->data in IRQ handler
- mmc: davinci: fix mmc_add_host order in probe
- mmc: mxcmmc: cancel data work and watchdog on remove
- mmc: sdhci_am654: Reset command and data lines on failed tuning
- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
- mmc: sdio_uart: fix xmit_fifo leak when the port table is full
- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
- mmc: spi: reset bytes_xfered before retrying CRC failures
- mptcp: avoid unneeded actions on subflow reset
- mptcp: close race between scheduler and state change
- mptcp: hold mptcp socket before calling tcp_done
- mptcp: syncookies: remember the request backup flag
- net: add and use skb_unclone_keeptruesize() helper
- net: add skb_set_end_offset() helper
- net: amd-xgbe: discard rx packets with bad FCS
- net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
- net: arp: terminate device name before lookup
- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- net: atl1c: fix soft lockup on out-of-range tpd_cons read
- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- net: au1000: move free_irq out of the close-time spinlocked section
- net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
- net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
- net: cpsw_new: unregister devlink on port registration failure
- net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
- net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
- net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
- net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
- net: dsa: sja1105: flower: reject cross-chip redirect
- net: ethernet: cortina: Ack RX overrun interrupt correctly
- net: ethernet: cortina: Count dropped frames as NAPI work
- net: ethernet: cortina: Count RX descriptors for freeq refill
- net: ethernet: cortina: Count RX drops once per frame
- net: ethernet: cortina: Finish RX updates before NAPI completion
- net: ethernet: cortina: Fix budget accounting
- net: ethernet: cortina: No mapping is a dropped rx
- net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
- net: fddi: skfp: fix NULL deref when setting the MAC address while down
- net: gue: reject invalid REMCSUM offsets
- net: hinic: fix mailbox segment buffer overflow
- net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
- net: hso: fix TIOCMIWAIT race
- net: ibm: emac: mal: fix potential system hang in mal_remove()
- net: ibm: emac: Reserve VLAN header in MJS limit
- net: lock the socket in sock_gettstamp()
- net: mpls: clear inner_protocol when the last label is popped
- net: mvpp2: prevent buffer overflow in page_pool allocation
- net: netsec: fix device_node reference leak on phy_np
- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- net: openvswitch: fix use-after-free of the flow table mask array
- net: preserve skb_end_offset() in skb_unclone_keeptruesize()
- net: qrtr: fix node refcount leak on ctrl packet alloc failure
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
- net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
- net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
- net: stmmac: Remove some unnecessary void pointers
- net: stmmac: selftests: Capture all packets for vlan checks
- net: stmmac: selftests: Check the dev->features for S-TAG offload testing
- net: stmmac: selftests: Support running selftests on DSA conduits
- net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
- net: sun4i-emac: fix missing of_node_put() for phy_node
- net: usb: catc: bound the RX packet length in catc_rx_done()
- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
- net: usb: qmi_wwan: add MeiG SRM813Q
- net: usb: sr9700: include receive overhead in the length check
- net: xfrm: reject unrepresentable espintcp transport headers
- net: xps: reject an out of range traffic class
- netfilter: flowtable: allow unidirectional rules
- netfilter: flowtable: hold reference on ct until flow is released
- netfilter: flowtable: publish HW_DEAD after worker is done
- netfilter: ip6_tables: set F_PROTO when proto value is nonzero
- netfilter: ip6t_rpfilter: reject routes without inet6_dev
- netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- netfilter: ipset: mark the rcu locked areas properly
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
- netfilter: nf_conntrack_expect: zero at allocation time
- netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
- netfilter: nfnetlink_log: cope with concurrent instance destruction
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
- netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
- netfilter: nft_nat: fully initialise new_addr in netmap setup
- netfilter: nft_set_pipapo_avx2: add missing vzeroupper
- netfilter: nft_synproxy: use the family-aware checksum helper
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
- netlabel: fix IPv6 unlabeled address add error handling
- net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
- net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
- net/mlx5e: Fix setting RS FEC after remapping
- net/packet: avoid truncating TPACKET_V3 private size
- net/packet: clear RX owner on VNET header error
- net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
- net/rds: acquire the fastpath locks in rds_conn_shutdown()
- net/rds: clear cp_flags bits individually in rds_conn_path_reset()
- net/rds: don't let rds_conn_shutdown() consume a concurrent drop
- net/rds: Don't sleep inside rds_ib_conn_path_shutdown
- net/rds: fix tcp stream corruption with large pages
- net/rds: Pass a pointer to virt_to_page()
- net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
- net/rds: use clear_bit_unlock() in release_refill()
- net/rds: use wq_has_sleeper() in release_in_xmit()
- net/sched: act_api: budget all shared attributes in notify skbs
- net/sched: act_api: size the RTM_GETACTION reply from the actions
- net/sched: act_csum: don't mangle UDP tunnel GSO packets
- net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
- net/sched: act_gate: budget the per-entry list in get_fill_size
- net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
- net/sched: cls_route: free emptied bucket on filter move
- net/sched: drr: clamp quantum in change class
- net/sched: ets: clamp quantum in parse and fallback paths
- net/sched: fq_pie: clamp quantum in change path
- net/sched: hhf: cap hh_flows_limit at change time
- net/sched: hhf: clamp quantum in change and init paths
- net/sched: pie: clamp psched_mtu in pie_drop_early
- net/sched: reject IDR error pointers when deleting actions
- net/sched: sch_drr: make cl->quantum lockless
- net_sched: sch_fq_pie: implement lockless fq_pie_dump()
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
- net/sched: sch_teql: fix shadowed err in __teql_resolve()
- net/sched: sfq: clamp quantum in change path
- net/smc: check smcd_v2_ext_offset when receiving proposal msg
- net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
- nfc: fix use-after-free in nfc_get_local_general_bytes
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- nfc: llcp: fix -ENOMEM on connect with zero-length service name
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
- nfc: llcp: Fix race condition in accept_queue lifecycle
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
- nfc: llcp: fix slab-out-of-bounds reads when logging service names
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
- nfc: nfcmrvl: validate helper command length before pull
- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
- nfc: port100: reject frames whose declared length exceeds the received data
- nfc: st21nfca: remove redundant assignment to variable i
- nfc: st21nfca: validate ISO15693 inventory length
- nfc: st21nfca: validate received frame size
- ocfs2: make ocfs2_calc_xattr_init() return void
- omfs: handle set_blocksize failures
- openvswitch: avoid reallocating confirmed conntrack labels
- OPP: of: Fix potential multiplication overflow when calculating freq
- PCI: altera: Protect root bus removal with rescan lock
- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
- PCI: iproc: Protect root bus removal with rescan lock
- PCI: mediatek: Protect root bus removal with rescan lock
- PCI: rockchip: Protect root bus removal with rescan lock
- PCI: Stop setting cached power state to 'unknown' on unbind
- PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
- perf/ftrace: Fix WARNING in __unregister_ftrace_function
- phonet: check register_netdevice_notifier() error in phonet_device_init()
- pinctrl: single: free the IRQ on domain creation failure
- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
- ppp: ppp_async: simplify tty disc_data access
- ppp_async: drop the errored frame instead of resetting its headroom
- qnx4: handle set_blocksize failures
- rculist: add list_splice_rcu() for private lists
- RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
- RDMA/mad: Fix receive buffer leak when PKey enforcement fails
- RDMA/mlx5: Fix state and counter desync on loopback enable failure
- RDMA/mlx5: Use QP port when decoding responder CQEs
- RDMA/siw: Bound fragmented header copies by the remaining length
- RDMA/siw: Cleanup siw_accept
- RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
- RDMA/siw: Introduce siw_cep_set_free_and_put
- RDMA/ucma: Serialize join and leave on copy_to_user failure
- rds: annotate data-race around rs_seen_congestion
- rds: filter RDS_INFO_* getsockopt by caller's netns
- rds: ib: Clear the sg list when mapping an MR fails
- rds: ib: use rds_conn_drop() on protocol version mismatch
- Reapply "bluetooth/l2cap: sync sock recv cb and release"
- Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
- Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
- Revert "bluetooth/l2cap: sync sock recv cb and release"
- Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int"
- Revert "perf cs-etm: Flush thread stacks after decoder reset"
- rtc: aspeed: add AST2700 compatible
- rtc: bq32000: add delay between RTC reads
- scripts: modpost: detect and report truncated buf_printf() output
- scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- scsi: pm8001: Reject firmware update in fatal error state
- scsi: pm8001: Reject non-fatal dump when controller is crashed
- scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_check_session_usage_count()
- scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_close_session()
- scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
- scsi: target: iscsi: Handle abort for WRITE_PENDING cmds
- scsi: target: iscsi: Redo iscsit_check_session_usage_count() return code
- scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd
- sctp: avoid livelock while updating retransmit path
- sctp: discard the rest of the packet on a stale-cookie error
- sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
- sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
- sctp: Unwind address notifier registration on failure
- seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
- selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
- selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
- selinux: always fill AVC decision in avc_has_perm_noaudit()
- serial: 8250: fix possible ISR soft lockup
- soundwire: cadence_master: wait and cancel cdns->work before clock stop
- soundwire: only handle alert events when the peripheral is attached
- soundwire: validate DT compatible before parsing it
- spi: zynqmp-gqspi: Use devm_spi_alloc_host()
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds
- staging: fbtft: make dirty_lock IRQ-safe
- SUNRPC: lock against ->sock changing during sysfs read
- sunvdc: fix -EIO issue due to lack of retries
- sunvdc: unmap LDC cookies when the descriptor send fails
- tcp: do not let tcp_rmem be set below 4096
- tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
- tcp: exclude old ACKs from tcp fast path
- tee: optee: Allow MT_NORMAL_TAGGED shared memory
- tg3: clean up PHYLIB resources on probe failure
- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
- thunderbolt: Keep the domain reference while processing hotplug
- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
- thunderbolt: Set tb->root_switch to NULL when domain is stopped
- tipc: Fix a data race on mon->peer_cnt in mon_timeout()
- tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- tracing: Free histogram the var ref when its initialization fails
- tracing/probes: Fix use-after-free on field name/type of events with multiple probes
- tty: make tty_ldisc_ops::hangup return void
- tunnels: Drop stale dst when building an ICMP error for PMTUD
- ufs: create the root dentry after loading cylinder metadata
- ufs: validate cylinder group metadata before caching it
- usb: core: hcd: fix possible deadlock in rh control transfers
- usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
- usb: host: add ARCH_AIROHA in XHCI MTK dependency
- usbip: vhci_hcd: fix NULL deref in status_show_vhci
- vhost-scsi: flush backend after device ioctls
- vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
- virtio-console: call scheduler when we free unused buffs
- virtio_console: do not free control-out buffers on remove
- virtio-pci: return IRQ_HANDLED after non-zero ISR
- vlan: ensure sufficient headroom in vlan_dev_hard_header()
- vsock: use sk_acceptq_is_full() helper in all transports
- vxlan: reject dynamic fdb entries that reference a nexthop id
- watchdog: digicolor: Avoid division by zero
- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
- watchdog: sunxi_wdt: preserve boot-enabled watchdog
- wifi: brcmfmac: fix lost 802.1x TX completion wakeup
- wifi: brcmsmac: fix UAF in brcms_free_timer()
- wifi: cfg80211: check IP header size in cfg80211_classify8021d()
- wifi: cfg80211: don't filter by BSS type when removing stale entries
- wifi: cfg80211: only group hidden BSSes with beacon entries
- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
- wifi: iwlegacy: fix broadcast stations deallocation
- wifi: iwlwifi: bound aligned TLV advance in FW parser
- wifi: iwlwifi: mvm: fix an off-by-1 boundary check
- wifi: libertas: reject short monitor TX frames
- wifi: libertas_tf: fix UAF in lbtf_free_adapter()
- wifi: libipw: fix key index receive bound checks
- wifi: libipw: reject too-short association responses
- wifi: libipw: reject too-short beacon and probe responses
- wifi: mac80211: always allow transmitting null-data on TXQs
- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- wifi: mac80211: don't access the TSF of a down interface
- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
- wifi: mac80211: validate deauth frame length before reason access
- wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
- wifi: mt76: transform aspm_conf for pci_disable_link_state
- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
- wifi: mwifiex: replace one-element arrays with flexible array members
- wifi: mwifiex: validate action frame fixed fields
- wifi: mwifiex: validate scan response extents
- wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
- wifi: p54: validate curve data length in the calibration curve converters
- wifi: ralink: RT2X00: init EEPROM properly
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
- wifi: rsi: fix heap OOB write on key removal
- wifi: rsi: validate beacon length before fixed buffer copy
- wifi: virt_wifi: don't transfer operstate before register
- wifi: virt_wifi: free skb when disconnected
- wifi: wilc1000: fix out-of-bounds read in P2P public action frames
- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
- wifi: wlcore: release runtime PM ref on regdomain config failure
- workqueue: Fix NULL current_pwq deref in flush dependency check
- x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
- xen/front-pgdir-shbuf: free grant reference head on errors
- xen/gntalloc: validate grant count before allocation
- xfrm: add extack support to verify_newsa_info
- xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead
- xfrm: add extack to verify_sec_ctx_len
- xfrm: avoid RCU warnings around the per-netns netlink socket
- xfrm: fix compat ALLOCSPI request use-after-free
- xfrm: propagate extack to all netlink doit handlers
- xhci: Prevent queuing new commands if xhci is inaccessible
- xprtrdma: Add request-pool slack for delayed recycling
- xsk: Use a 32-bit compare in xsk_map_gen_lookup