============================================================ Changelog-Zusammenfassung: 6.12.113 (longterm, Branch 6.12) ============================================================ Veröffentlicht: 2026-10-15 Quelle: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.113 501 Commits, davon ca. 427 Fixes, 1 CVE-Referenz(en) Meistbetroffene Bereiche: iio: 37 wifi: 33 Bluetooth: 28 usb: 27 net: 22 USB: 16 ASoC: 14 tty: 13 KI-Zusammenfassung: Linux 6.12.113 is a longterm maintenance release delivering a very large batch of bug fixes and hardening patches across nearly all subsystems, including networking (netfilter, mac80211, Bluetooth, mptcp, TCP/IP), storage (SMB/CIFS, NVMe, MTD, SCSI), graphics (AMD, Intel, VC4, Panthor), USB/serial, IIO, and core kernel areas like namespaces, cgroups, and KVM/arm64/riscv. Among the most notable security-relevant fixes are an out-of-bounds write in NVMe-oF authentication (nvmet_auth_challenge), an out-of-bounds read/write from unvalidated DataOffset in the SMB client's coalesce_t2(), an off-by-four bounds check flaw in the TPM2 get_random command, and a use-after-free in io_uring's task_work handling with SQPOLL. The release also addresses numerous use-after-free, memory-leak, and race-condition bugs in Bluetooth (btintel_pcie, RFCOMM, ISO, hci_core), USB serial/typec drivers, and the mount/namespace code to prevent overmount and unmount race exploits. Overall, this update focuses heavily on stability, memory-safety, and race-condition hardening rather than introducing new features. Alle Änderungen (501): - HID: steam: Clean up locking - HID: steam: Refactor registration - HID: steam: Rearrange teardown sequence - HID: steam: Fully unregister controller when hidraw is opened - sched_ext: Generate qseq from a per-task counter - drm/amd/display: Don't replace a sink mode that shares the native totals - can: fix unique skb identifier regression under RPS - wifi: mt76: mt7603: initialize global station WCID - netfilter: flowtable: fix offloaded ct timeout never being extended - netfilter: conntrack: fix erronous removal of offload bit - io_uring/waitid: fix KCSAN warning on io_waitid->head - io_uring/waitid: use io_waitid_remove_wq() consistently - drm/panthor: validate userspace queue count against initialized firmware slot count - drm/vc4: Fix binner slot allocation failing on an idle GPU - drm/vc4: Make v3d paths unavailable on any generation newer than vc4 - vsock: Fix memory leak in vmci_transport_recv_dgram_cb() - net: openvswitch: validate transport header presence in set_ipv6_addr - ptp: ocp: fix PCIe delay estimation calculation - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() - net/mlx5e: Order ICOSQ cc update after CQ doorbell - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down - drm/imagination: Fix reference and vm_bo handling in remap() - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() - bnxt_en: Fix driver init in kdump kernel - bnxt_en: Add bnxt_clear_bars() helper - pfcp: make sure the SEID is linear before reading it - net/sched: cls_route: reject change with no routing attribute - devlink: fix devlink_rel reference leak when notify work is pending - flow_dissector: avoid u16 truncation of skb->len when computing thoff - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() - cpuset: separate tmpmasks and cpuset allocation logic - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes - ASoC: adau1372: allow sleepy powerdown GPIOs - wifi: mt76: mt792x: pick the SAR table layout from the table itself - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit - wifi: mt76: mt7925: don't put the band auto marker in TGID - wifi: mt76: mt7915: disable rx napi when removing device - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown - btrfs: fix xattr replace when multiple xattrs are packed in the same item - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 - nvmet: use the local P2P device on metadata allocation failure - tee: optee: ffa: support shared memory offsets on large-page kernels - tee: optee: fix kernel-doc warnings - optee: sync secure world ABI headers - cxgb4/ch_ktls: disable softirqs around tid_list erases - amt: send the relay's General Query directly from the receive path - net/sched: em_text: reject unterminated algo before autoload - drm/vc4: Free the BO cache size list on teardown - drm/aspeed: Balance the display clock enable on teardown - gpio: exar: initialize the ID before registering its cleanup - drm/dp: don't mark the AUX backlight enabled when enabling failed - Bluetooth: btintel_pcie: Add shared HW reset for clean start - Bluetooth: btintel_pcie: Add recovery mechanism - Bluetooth: btintel_pcie: fix TX descriptor bounds check - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single - arm64: dts: lx2160a: fix incorrect pinmux - namespace: refuse an automount below a mount that is in no namespace - namei: don't reveal overmounted entries in refwalk - namespace: don't let a pseudo dentry become the root of a mount - dcache: don't put a mountpoint on a dentry that's being removed - namespace: check a submount for references right before unmounting it - fs: refuse fspick() on internal superblocks - namespace: don't copy an unmounted mount tree - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks - drm/amdgpu: make Mac FB workaround generic - drm/amdgpu: serialize vblank counter reads against GPU reset - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info - drm/amdkfd: align SDMA doorbell base for shader doorbell writes - drm/vc4: drain the hangcheck timer and works on V3D unbind - drm/imagination: Size page table preallocation by device address - drm/i915/gt: Unmask interrupts only when ACTIVE is true - drm/i915/gem: Prevent overstepping exec array boundary - drm/gud: don't keep a connector without a CRTC as connector_state - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown - Bluetooth: RFCOMM: free the skb when the DLC has no owner - Bluetooth: MGMT: Fix status of pending commands flushed on power off - Bluetooth: ISO: Serialize concurrent connect calls - Bluetooth: ISO: Reject concurrent BIS listener setup - Bluetooth: hci_sock: Serialize dead-device detachment - Bluetooth: btintel_pcie: use managed IRQ teardown - riscv: fix load_unaligned_zeropad() fixup for RV32 - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp - scsi: qedi: Initialize callback state before registration - pmdomain: rockchip: propagate subdomain add errors - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers - optee: register TEE devices only once fully initialized - openvswitch: fix soft lockup in the netlink flow dump - nvme: fix swapped ZRASF zone state values for full and read only - net: usb: ax88179_178a: fix rx frame length for non-last packets - net: sparx5: free the matchall entry on destroy - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() - net: dsa: microchip: fix KSZ8765 fiber detection - net: bridge: avoid recursive multicast port cleanup - net/smc: protect clcsock lifetime in smc_getname - net/packet: guard the ll header push in packet_rcv_spkt() - mmc: sdhci-sprd: disable runtime PM on remove - mmc: mtk-sd: Cancel request timeout work on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: cavium-octeon: destroy slot platform devices on remove - dm: fix reading free memory in do_resume - dm-snap: reject the transient exception store for snapshot-merge - dm-crypt: reject the lmk IV mode with AEAD ciphers - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them - memstick: core: wait for request completion before freeing card - KEYS: Fix add_key() race with keyring restriction - keys: finalize persistent keyring timeout after link attempt - ice: fix metadata_dst refcount handling on representor teardown - ibmveth: fix TX LTB and filter unwind on open-fail - ibmveth: h_free logical LAN on open-fail after register - gpio: xilinx: fix runtime PM leak on request error path - EDAC/amd64: Mask UMC chip select to the four implemented selects - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts - selinux: fix data race on AVC latest_notif - Revert "wifi: libertas: reject short monitor TX frames" - tipc: hold a reference to nodes found by link name - tipc: destroy topsrv workqueues before closing connections - tcp: reject net_iov in zerocopy receive mapping hints - swiotlb: fix default_swiotlb_limit() for non-growable default pool - strparser: make sure __strp_recv isn't running before tearing down the parser - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() - xen/netfront: don't leak the skb when xennet_fill_frags() fails - workqueue: Fix NULL current_pwq deref in chained work check - wireguard: noise: reject response consumption after intermediate initiation - wireguard: queueing: preserve tstamp_type when encapsulating packet - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() - vsock/virtio: account only unread bytes in read_skb() - usb: f81604: fix struct f81604_int_data size mismatch - dm ioctl: don't let data_start run past the buffer - cipso: adjust cached option offsets when removing CIPSO - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) - arm64: irq: exclude the softirq stack switch from KCOV - Input: xpad - add support for Corsair Novablade Pro - Input: ati_remote2 - fix type confusion in device attribute handlers - ipv6: do not warn on route notification size race - ipv4: do not warn on route notification size race - ipv4: stop route notification sizing when nexthop group shrinks - ipv4: stop exception dump when nexthop group shrinks - ipv4: stop PMTU walk when nexthop group shrinks - ipv4: validate checksum_start before completing checksum - crypto: drbg - Fix ineffective sanity check - wifi: ath12k: fix reusing m3 memory - Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING - mm/damon/core: fix unconditionally skip last region - mm/damon/core: do non-safe region walk on kdamond_apply_schemes() - f2fs: fix to reset all pinned status during fggc - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() - f2fs: fix to reclaim space in f2fs_allocate_pinning_section() - doc/netlink: netlink-raw: Add max check - tools: ynl: add scope qualifier for definitions - tools: ynl-gen: support limits using definitions - tools: ynl-gen: use names of constants in generated limits - iio: light: rohm-bu27034: Fix error return - iio: light: rohm-bu27034: Fix infinite delay on error - iio: bu27034: simplify using guard(mutex) - iio: cdc: ad7150: fix OF matching and publish module aliases - iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs - smb: client: only require read lease for size-extending preallocate - iio: adc: stm32-adc: fix possible division by zero in processed channel - iio: adc: axp288: Add TS bias override for Haier HV103H - iio: adc: max1363: sign-extend bipolar differential channel reads - iio: adc: aspeed: propagate reset deassert errors - iio: adc: aspeed: Simplify with dev_err_probe - iio: adc: ad_sigma_delta: fix use-after-free on unbind - iio: accel: kionix-kx022a: Prevent memory leak and fix state - iio: accel: kx022a: Use cleanup.h helpers - wifi: mac80211: set info->band for 802.3 encap offload frames - wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted - net: mana: remove double CQ cleanup in mana_create_rxq error path - net: mana: Skip WQ object destruction for uninitialized RXQ - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry - net/mlx5e: Prevent stale XSK buffer release on refill retry - fs: Free any excess xarray nodes in clear_inode() - wifi: mac80211: count only matching reservations in reserved switch - tty: port: fix tty_port_tty_vhangup() race - bnxt_en: fix DMA mapping length for padded small packets - ipv4: free inet_opt and ireq_opt after an RCU grace period - KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT - nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known - mtd: spinand: Enable QE on all dies - wifi: mac80211: shut down RX BA session timer on teardown - mtd: spinand: fix NULL pointer dereference with no ECC engine - drm/amd/display: Mark DCE 6.4 as not APU - i2c: xiic: preserve PEC byte length in SMBus block read setup - i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 - perf: Replace perf_event_header__init_id with full header init - tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 - tty: tty_port: restore TTY_IO_ERROR on activation failure - tty: tty_port: use guard()s - tty: introduce tty_port_tty guard() - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 - drm/amd/display: Preserve eDP mode on initial ASSR failure - USB: dwc2: shut down wakeup timer before freeing HCD state - usb: ohci-spear: disable controller wakeup on removal - usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() - drm/amdgpu: reset VI ASIC on MacBookPro14,3 - drm/amdgpu: reset VI ASIC on MacBookPro15,1 - fsverity: add dependency on 64K or smaller pages - KVM: arm64: Use stage-1 leaf size for VM_PFNMAP - arm64: errata: Add Cortex-A725 erratum 3821522 workaround - arm64: errata: Factor out broken AMU const counter cap - Bluetooth: Serialize SMP remote OOB data access - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown - arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64/fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only - perf: Require kernel access for text poke events - perf/core: Check kernel access when kernel callchains are requested - perf: Remove unnecessary parameter of security check - tty: fix saved termios reset race - usb: dwc3: gadget: fix IRQ storm on invalid event buffer count - drm/amd/display: Fix fast updates on DCE 8.1 - fs,fsverity: remove check for fsverity being enabled in setattr_prepare() - fs,fsverity: reject size changes on fsverity files in setattr_prepare - xen/netfront: drop RX packets with a short Ethernet header - net: usb: qmi_wwan: add Quectel EG120K-EA - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1 - KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor - mm: shmem: ignore sysfs configs for shmem forced collapse - mm: shmem: change shmem_huge_global_enabled() to return huge order bitmap - mm: factor out the order calculation into a new helper - mm: shmem: remove __shmem_huge_global_enabled() - netfs: clear post-EOF pagecache when extending a file via write - pfcp: fix socket lifetime on netdevice registration failure - mptcp: prevent race between disconnect() and rtx - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF - tty/vt: use guard()s - console: introduce console_lock guard()s - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read - svcrdma: Use svc_xprt_put to free listener on create failure - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save - jfs: fix array-index-out-of-bounds read in add_missing_indices - ipv6: use RCU in ip6_output() - iio: trigger: cancel reenable_work before freeing trigger - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler - iio: proximity: sx9324: Correct proximity channel resolution - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure - iio: proximity: isl29501: Fix return type of isl29501_register_write - iio: proximity: aw96103: validate firmware data length - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup - iio: light: gp2ap020a00f: drain irq_work after free_irq - iio: imu: adis16480: fix unprotected debugfs reads - iio: imu: adis16400: fix unprotected debugfs reads - iio: health: max30102: fix NULL dereference in interrupt handler - iio: gyro: adis16136: fix unprotected debugfs reads - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. - iio: buffer: serialize buffer teardown with mode claims - iio: admv1013: initialize callback mutex before registering notifier - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure - iio: adc: stm32-adc: fix check on internal channel availability - iio: adc: pac1934: check ACPI label duplication - iio: accel: sca3000: fix frequency divider condition check - iio: accel: kxcjk-1013: reject duplicate event disable - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races - smb: client: discard post-EOF pagecache when extending a file via copy range - smb: client: discard post-EOF pagecache when extending a file via zero range - thunderbolt: Reject oversized XDomain properties responses - thunderbolt: Disable CL states for the Anker Prime TB5 dock - thunderbolt: Fix KASAN reported use-after-free when request is canceled - USB: serial: option: add Compal EXC-T1 support - USB: serial: option: add Quectel RG660QB - USB: serial: option: add Compal EXM-G1x support - USB: serial: option: add Quectel EG060W - USB: serial: option: add support for SIMCom SIM8260C - USB: serial: fix ioctl hangup race - USB: serial: fix driver deregistration order - USB: serial: fix dynamic id driver deregistration race - USB: serial: ssu100: fix baud rate overflow - USB: serial: quatech2: fix baud rate overflow - USB: serial: cp210x: add Corsair AX1500i Power Supply - wifi: mac80211: handle empty FILS association request payload - wifi: mac80211: fix mesh fast xmit path deletion UAF - wifi: mac80211: release mesh path quota on failed additions - wifi: mac80211: reject invalid 320 MHz CSA bandwidth - wifi: mac80211: minstrel_ht: validate fixed rate index - wifi: mac80211: keep fallback association elements alive - wifi: mac80211: account proxy paths against the mesh path limit - wifi: mac80211: drain PS delivery work during station teardown - wifi: mac80211: keep paired old chanctx alive - wifi: iwlegacy: 3945: free EEPROM data on remove - wifi: cw1200: fix TX padding OOB read leaking heap data to device - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy - KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified - mtd: spinand: fix zero oobavail when no ECC engine is used - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ - mtd: block2mtd: Fix divide error when erase_size is zero - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() - nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT - nvme-multipath: fix underflow in ANA log bounds checks - tpm: fix off-by-four bounds check in tpm2_get_random() - net: extend IPv6 exthdr detection of tunneled packets - HID: multitouch: stop the release timer from being rearmed on remove - ipvs: bound LBLCR and LBLC cache growth - io_uring: fix task_work add use-after-free with SQPOLL - Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() - Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() - Bluetooth: hci_core: Serialize fragmented ISO packet queueing - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems - Bluetooth: hci_conn: Lock parent access during enhanced SCO setup - Bluetooth: hci_sync: Fix inquiry cache use-after-free - Bluetooth: RFCOMM: Fix initial port reference race - i2c: xiic: don't clobber msg->len to signal block-read completion - EDAC/altera: Fix memory leak on dci allocation failure - ALSA: ua101: reject mismatched capture/playback packet sizes - ALSA: seq: Serialize compat port-info ioctls - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type - ASoC: codecs: max98363: fix uninitialized stream_config->type - serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL - serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() - serial: tegra: don't clear the Tx FIFO on an Rx-only reset - serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() - serial: fix TIOCMIWAIT race - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() - tty: serial: max3100: shut down timer before freeing port - tty: abort break signalling on hangup - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup - tty: vcc: zero-initialize control packet in vcc_send_ctl() - tty: amiserial: fix broken TIOCMIWAIT - tty: vt: fix memory leak in vc_allocate() - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe - usb: cdns3: fix use-after-free in cdns3_gadget_exit() - usb: typec: ucsi: displayport: Current CAM OOB index fixup - usb: typec: ucsi: Get the connector fwnode based on reg value - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() - usb: typec: tipd: don't send GAID when probe fails in APP mode - usb: typec: tcpm: recover after failure to start the frs ams - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints - usb: chipidea: tegra: disable runtime PM on resume failure - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC - USB: gadget: dummy-hcd: Fix wait for outstanding request completions - usb: gadget: aspeed-vhub: cancel wake work on device removal - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path - usb: typec: anx7411 - stop the IRQ before destroying the workqueue - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd - usb: gadget: midi2: Fix the jack descriptor array sizes - usb: ohci-st: disable controller wakeup on removal - usb: ohci-s3c2410: disable controller wakeup on removal - usb: ohci-da8xx: disable controller wakeup on cleanup - usb: octeon-hcd: fix the FIFO-flush timeout computation - usb: hub: use shorter 120ms post resume hold for SS root hubs - usb: storage: sierra_ms: reject short SWoC info transfers - USB: serial: fix port tear down use-after-free - USB: cdc-acm: skip URB restart in port_shutdown if disconnected - USB: cdc-acm: fix racy TIOCMIWAIT implementation - soc: qcom: geni-se: Correct QUP Core ICC vote constants - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure - Input: synaptics - limit T440p InterTouch quirk to LEN0036 - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 - Input: s6sy761 - fix resume ordering and restore sensing - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 - kgdboc: Fix tty driver reference leak in configure_kgdboc() - binder: fix leaked fd fixups on TF_UPDATE_TXN supersede - binder: fix is_failure flag for superseded transaction cleanup - drm/amdgpu: fix ACP MFD device leak on init failure - drm/amdgpu: fix IP instance memory leak on kobject add failure - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() - drm/mediatek: Fix ovl adaptor platform device leak - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device - drm/radeon: Read the VRAM VBIOS signature with readb() - drm/amdgpu/gfx6: fix firmware leak on teardown - drm/amd/pm/si: Fix updating clock limits on AC/DC - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend - PCI: Accept AtomicOps already enabled by the hypervisor - ALSA: ice1712: Fix the error handling via auto-cleanup at probe - ALSA: core: Define auto-cleanup for snd_card_free() - perf: Fix race between perf_event_exit_task() and perf_pending_task() - i2c: at91: release DMA channels when probe defers - net: mvneta: clear XDP pfmemalloc flag between frames - xdp, xsk: constify read-only arguments of some static inline helpers - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() - net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference - net: sparx5: make ports inherit the switch base mac address type - net: microchip: vcap: stop scanning after deleting key field - netfilter: flowtable: generalize pending status bit - netfilter: conntrack: rework offload nf_conn timeout extension logic - netfilter: conntrack: remove skb argument from nf_ct_refresh - netfilter: bpf: reject invalid NAT manipulation types - ipvs: filter some flags received in the backup server - ipvs: do not create invisible templates - ipvs: fix missing counter decrement in lblc - tcp: refresh TS.Recent for accepted old ACKs - net: ethernet: mtk_eth_soc: allocate dummy netdev sooner - net: cap skb->queue_mapping when the tx queue is picked - net: bcmgenet: fix NULL dereference in set_coalesce before first open - virtio_blk: set the zone write granularity - net/sched: sch_codel: match the no-drop threshold to the packet size - net/sched: fq_codel: match the no-drop threshold to the packet size - net: restrict SO_RESERVE_MEM to TCP sockets and cap max value - net-memcg: Introduce mem_cgroup_sk_enabled(). - net-memcg: Introduce mem_cgroup_from_sk(). - net: Clean up __sk_mem_raise_allocated(). - mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n. - memcg: convert memcg->socket_pressure to u64 - tipc: prevent GCM nonce reuse on peer key changes - octeontx2-af: mcs: Fix SC resource cleanup loop - net/mlx5: Fix slab-out-of-bounds when handling team device events - net/mlx5: LAG, Refactor lag logic - net: systemport: Fix RUNT MIB counter register offset calculation - net: systemport: Fix buffer overflow in bcm_sysport_get_stats() - Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister - netfilter: ipset: do not update comments from kernel-side adds - ipv6: fix prefix route expiry in modify_prefix_route() - net/sched: cls_api: reclaim an empty proto on the error path - net/mctp: publish the mctp_dev only after it is initialised - Bluetooth: btintel: validate DDC record lengths - Bluetooth: hci_core: free the HCI ID if naming fails - ASoC: codecs: rt274: Fix format setting for 44100 rate - ASoC: codecs: rt286: Revert delay value for jack setup - wifi: mac80211: prevent AP VLAN tx from other interfaces - wifi: mac80211: Add 802.3 multicast encapsulation offload support - wifi: mac80211: Add multicast to unicast support for 802.3 path - wifi: cfg80211: preserve hidden-group beacon IE ownership - rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() - rtc: ac100: Fix clock provider use-after-free on probe failure - rtc: Switch back to struct platform_driver::remove() - rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE - wifi: ath9k: reject short WMI command responses - wifi: ath11k: reset ar->num_stations on hardware start - ASoC: tegra: Fix ASRC Stream6 input threshold control - wifi: wfx: validate MIB read length before copying to caller - ASoC: wm8903: Move the DRC QR threshold to the register that holds it - of/overlay: don't create "//" paths for fragments targeting the root - of/overlay: don't leak fragment references when changeset init fails - random: fix vgetrandom_opaque_params kernel-doc - nvmet: preserve device path on allocation failure - mtd: core: call _get_device() with the master MTD - iio: accel: kionix-kx022a: Fix array boundary check - mm/damon/core: don't skip damos_adjust_quota() while esz is not zero - random: vDSO: avoid call to memset() when zeroing reserved parameter - perf/core: Fix WARN in perf_sigtrap() - mm/secretmem: properly account locked pages - ALSA: line6: reject oversized playback packets - ALSA: caiaq: unregister the input device when probe fails - wifi: wlcore: Fix runtime PM leak in wlcore_remove() - vt: skip screen update for DEC alignment test on backgroup consoles - rds_tcp: close NULL deref window in rds_tcp_set_callbacks - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions - virt: vmgenid: set driver_data before registering notification handlers - tpm: Disable TPM on null key name mismatch - sctp: check RCV_SHUTDOWN after the sendmsg connect wait - rtc: spear: initialize IRQ state before requesting alarm IRQ - rtc: ac100: Assign .num before accessing .hws - net/packet: prevent TX_RING byte count overflow - netfilter: nft_flow_offload: drop flowtable reference on init error path - net: fix checksum offsets in skb_splice_from_iter() - of/overlay: only treat a positive changeset id as registered - of/overlay: put property on deadprops only after changeset add succeeds - of/irq: Fix remaining refcount leaks in of_irq_init() - kprobes: Skip disarmed probes when checking optkprobe overlap - HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request - audit: fix exe mark UAF in kill_rules() - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices - neighbour: Skip default parms when resumed in neightbl_dump_info(). - xfs: fix cursor and pointer handling when recovering iunlink buckets - smb: client: close completed creates on compound wait errors - Bluetooth: ISO: release unused CIS holds after channel attach - Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths - smb: client: close handle after create-context parsing failure - smb/client: pass cifs_open_info_data to SMB2_open() - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() - ASoC: SOF: ipc4/Intel: Add support for library restore firmware functionality - ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of sof_ipc4_fw_data - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table - ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture - bpf, xdp: move offload check into dev_xdp_install() - RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() - xfs: don't let memory failures leak blocks and kill repairs - smb: client: use finish_no_open() for non-regular inodes - selftests/mm: hugetlb-mremap: add setup of HugeTLB pages - KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction - KVM: arm64: nv: Fix life cycle of the nested_mmus array - smb: client: fix cifsFileInfo reference leak in deferred close - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()