============================================================ Changelog-Zusammenfassung: 6.18.57 (longterm, Branch 6.18) ============================================================ Veröffentlicht: 2026-10-15 Quelle: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.57 621 Commits, davon ca. 496 Fixes, 1 CVE-Referenz(en) Meistbetroffene Bereiche: wifi: 33 bpf: 30 net: 28 Bluetooth: 20 btrfs: 19 namespace: 15 drm/amd/display: 13 accel/amdxdna: 13 KI-Zusammenfassung: Linux 6.18.57 (longterm) delivers a very large stabilization and hardening update spanning networking (bnxt_en, mlx5, mt76/mac80211, bridge/netfilter, ipv4/ipv6, netfilter nf_tables), filesystems (btrfs, ext4/ext2, XFS, NFS/NFSD, SMB/CIFS/ksmbd, gfs2, namespace/mount handling), block/storage (md raid, dm-crypt/dm-integrity, NVMe, SCSI/UFS), GPU drivers (amdgpu/amdkfd, i915, xe, vc4, panthor), and architecture code (x86, arm64, riscv, LoongArch, powerpc, s390). Numerous UAF, double-free, memory-leak, and race-condition fixes were applied across Bluetooth (RFCOMM/SCO/ISO/hci_sync), BPF verifier/runtime, and mount namespace handling, alongside substantial churn in SUNRPC (switching to crypto/krb5), workqueue management, and wifi/mt76 driver robustness. Key security-relevant fixes include s390/zcrypt CCA/EP11 CPRB length and overflow checks to prevent speculative/out-of-bounds memory reads, several BPF verifier fixes rejecting invalid pointer/BTF accesses and preventing UAF via RCU pointer invalidation, PCI core fixes closing a use-after-free and TOCTOU race in dynamic ID probing, and ksmbd fixes for path-traversal bypass, slab-out-of-bounds reads, and UAF/double-free races in oplock/lock handling. No major new subsystem anomalies are noted beyond the expected volume of backported CVE and regression fixes typical of a longterm maintenance release. Alle Änderungen (621): - HID: steam: Clean up locking - HID: steam: Refactor registration - HID: steam: Rearrange teardown sequence - HID: steam: Fully unregister controller when hidraw is opened - sched_ext: Generate qseq from a per-task counter - drm/amd/display: Don't replace a sink mode that shares the native totals - regulator: of: fill in supply names in of_regulator_bulk_get_all() - SUNRPC: Add Kconfig dependency on CRYPTO_KRB5 - can: fix unique skb identifier regression under RPS - xfs: fix exchange-range-to-eof file size exchange - xfs: stop exchanging reflink flags when exchanging mappings - xfs: remove duplicate INO1_WRITTEN check - ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons - ACPI: scan: Do not mark button ACPI devices as wakeup-capable - workqueue: Annotate alloc_workqueue_va() with __printf(1, 0) - accel/amdxdna: Fix crash when destroying a suspended hardware context - accel/amdxdna: Fix race condition when checking rpm_on - accel/amdxdna: Resume power for creating and destroying hardware context - s390/zcrypt: Pad trailing CCA or EP11 message with zeros - s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing - s390/zcrypt: Improve EP11 CPRB length and overflow checks - s390/zcrypt: Improve CCA CPRB length and overflow checks - workqueue: fix devm_alloc_workqueue() va_list misuse - netfs: Fix missing alloc tagging of direct mempool allocations - net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT - media: verisilicon: Fix kernel panic due to __initconst misuse - netfs, afs: Fix symlink reading - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() - btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock - drm/panthor: validate userspace queue count against initialized firmware slot count - x86/CPU/AMD: Fix AMD TLBI Erratum #1718 - drm/vc4: Fix binner slot allocation failing on an idle GPU - vsock: Fix memory leak in vmci_transport_recv_dgram_cb() - net: openvswitch: validate transport header presence in set_ipv6_addr - ptp: ocp: fix PCIe delay estimation calculation - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() - net/mlx5e: Order ICOSQ cc update after CQ doorbell - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down - drm/imagination: Fix reference and vm_bo handling in remap() - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() - bnxt_en: Re-write the BARs following any type of PCIe errors - bnxt_en: Drop pci_save_state() after pci_restore_state() - bnxt_en: Delay for 5 seconds after AER DPC for all chips - bnxt_en: Fix driver init in kdump kernel - bnxt_en: Add bnxt_clear_bars() helper - pfcp: make sure the SEID is linear before reading it - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET - Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification" - net/sched: cls_route: reject change with no routing attribute - devlink: fix devlink_rel reference leak when notify work is pending - net: sparx5: start the TOD counters on non-PTP lan969x variants - flow_dissector: avoid u16 truncation of skb->len when computing thoff - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() - spi: sg2044-nor: Honor SPI clock limits - spi: sg2044-nor: Return transfer errors - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes - ASoC: adau1372: allow sleepy powerdown GPIOs - Revert "wifi: ath12k: add panic handler" - wifi: mt76: mt792x: pick the SAR table layout from the table itself - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit - wifi: mt76: mt7925: don't put the band auto marker in TGID - wifi: mt76: mt7915: disable rx napi when removing device - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown - wifi: mt76: use ALTX queue for packets to disassociated stations - wifi: mt76: route nullfunc frames to PSD/ALTX queue - wifi: mt76: account non-AQL frames per peer rather than per link - wifi: mt76: add PS buffering support for HW-managed TIM drivers - wifi: mac80211: add ieee80211_txq_aql_pending() - wifi: mac80211: add AQL support for multicast packets - wifi: mt76: don't return TXQ when exceeding max non-AQL packets - riscv: vector: Fix output operands in context save - riscv: vector: Fix data pointer constraints in context save/restore - net: make dev_xdp_sb_prog_count() see programs attached through a link - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums - btrfs: fix lost error return value in btrfs_listxattr() - btrfs: fix xattr replace when multiple xattrs are packed in the same item - btrfs: unlock inode and extent in caller when io_uring read extent fails - btrfs: free iov when btrfs_uring_read_extent() fails - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio - zloop: zero out only the unread tail of short reads - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 - nvmet: use the local P2P device on metadata allocation failure - nvmet: return Invalid Field for invalid NSIDs feature 82h - ice: Restore Ordered MMIO Writes for Tx Doorbells - tee: optee: ffa: support shared memory offsets on large-page kernels - tee: optee: fix kernel-doc warnings - cxgb4/ch_ktls: disable softirqs around tid_list erases - amt: send the relay's General Query directly from the receive path - net/sched: em_text: reject unterminated algo before autoload - drm/vc4: Free the BO cache size list on teardown - drm/aspeed: Balance the display clock enable on teardown - gpio: exar: initialize the ID before registering its cleanup - drm/dp: don't mark the AUX backlight enabled when enabling failed - Bluetooth: btintel_pcie: Add shared HW reset for clean start - Bluetooth: btintel_pcie: fix TX descriptor bounds check - fs: don't let a migrating task hide its reference from do_umount() - fs: move mntput_no_expire() slowpath into a dedicated routine - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single - arm64: dts: lx2160a: fix incorrect pinmux - smb/server: fix tree connection leak in smb2_tree_connect() - ksmbd: convert tree_conns_lock to rw_semaphore - printk: Don't WARN on kthread_run failure. - bpf: check_cond_jmp_op(): properly infer if register is null - net: stmmac: fix dma mapping leak in stmmac_tso_xmit() - ipv6: mcast: use rcu_assign_pointer() for __rcu list updates - ipv6: mcast: annotate data-races around mca_users - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge - bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks - bpf: Mark syscall helpers as sleepable - ring-buffer: Add checking nr_subbufs to persistent ring buffer validation - ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer - bpf: zero extend the result of an arena 32-bit cmpxchg - bpf: don't rewrite bpf_fastcall patterns entered by a jump - bpf: Don't infer non-NULL from a pointer with an unbounded offset - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs - bpf: Mark NULL kptr stores precise - bpf: Preserve inner map identity in callback frames - tracing: Fix subbuf resize races with trace_pipe_raw readers - bpf: mark a NULL call argument precise - iommu/riscv: Serialize command queue publishing - virtio_ring: fix stale descriptor flags after a failed packed add - vduse: validate virtqueue alignment - vhost: invalidate vring access on IOTLB transitions - tracing: Take trace_array reference when opening a tracer options file - drm/amdgpu: skip the VMID 0 flush for VRAM - smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid - smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() - ksmbd: fix maximum allowed access checks - ksmbd: remove redundant DACL check in smb_check_perm_dacl - remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 - powerpc/xive: propagate IPI init errors to prevent use-after-free - powerpc/xive: add error return value to xive_smp_probe() - ACPI: bus: Introduce acpi_bus_get_primary_device() - drm/xe: don't WARN on kernel job timeout when device already wedged - nfsd: convert nfsd_net boolean flags to unsigned long flags word - nfsd: use workqueue enable/disable APIs for v4_end_grace sync - dm-pcache: validate seg_id fields from persistent memory - drm/amd/display: Fix dangling pointer in plane reset function - drm/amd/display: Fix dangling pointer in CRTC reset function - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout - uprobes/x86: Move optimized uprobe from nop5 to nop10 - bpf: Reject MEM_ALLOC BTF accesses past object bounds - bpf: Reject writes through untrusted BTF pointers - platform/x86: dell-wmi-base: Fix handling of ultra performance key - bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max - usb: gadget: uac: validate rate list length before storing - platform/x86: asus-wmi: fix resource leaks on probe failure - esp: do not unref managed frag pages in esp_ssg_unref() - RDMA/rvt: Return NULL after port allocation failure - fs/resctrl: Fix UAF from worker threads when domains are removed - cxl/features: Serialize multi-part Get/Set Feature transfers - firmware: arm_scmi: Fix SCMI device destroy lifetimes - firmware: arm_scmi: Fix OF node reference handling - firmware: arm_scmi: Clear SystemPower flag on create failure - ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() - bpf: Fix WARNING in bpf_tracing_link_release - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip - scsi: ufs: core: Validate string descriptors - scsi: ufs: core: Convert string descriptor format macros to enum - iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() - PCI: Fix UAF when probe runs concurrent to dyn ID removal - PCI: Fix dyn_id add TOCTOU - PCI: Make pci_match_one_device() match on ID instead of device - RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() - nvmet: fix return status of RMI log page on allocation failure - drm/panthor: Add vm_bind region with kbo range overlap check - wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() - md: remove REQ_NOWAIT support from raid1/10/456 - wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() - wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete - wifi: mt76: cancel reset and rc work on device unregister - bpf: Reject >8 byte return values on return-reading trampoline paths - wifi: mt76: mt7996: clear stale link state on full reset - arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry - wifi: nl80211: clean up color-change beacon data on errors - wifi: brcmfmac: fix P2P action frame handling without device vif - serial: core: do fallible allocations before the console can be registered - serial: core: clear freed pointers on uart_register_driver() failure - tty: skip cdev_del() when no cdev is registered - HID: logitech-hidpp: Fix FF device cleanup on init failure - ublk: validate auto buf reg before taking uring_cmd - bpf: Invalidate RCU pointers after final spin unlock - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers - thermal: hwmon: Remove hwmon class device along with its parent - ocfs2: o2hb: quiesce negotiate handlers and timeout work - ocfs2/heartbeat: fix slot mapping rollback leaks on error paths - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Remove trace_in argument from __bpf_get_stack - bpf: Factor callchain_finalize function from __bpf_get_stack - bpf: Factor callchain_store function from __bpf_get_stack - drm/amd/display: Resize MST HDCP per-connector arrays to 32 - drm/amd/display: disable replay when crc source is enabled - coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable - scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails - scsi: sd: Move the sd_config_discard() function definition - btrfs: check if root is readonly when setting posix acl - btrfs: apply the AUTO_K(V)FREE macros throughout the code - btrfs: zoned: flush active metadata block group at btree_writepages() start - iommu/vt-d: Fix iopf_refcount leak on RID domain replacement - iommu: Pass in old domain to attach_dev callback functions - NFS: Return a delegation the client fails to record - bpf: Compare iterator types during state pruning - clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type - nvmet: fix max_qid race between configfs and controller allocation - blk-iolatency: clear delay state when freeing policy data - blk-iocost: clear delay state when freeing policy data - blk-cgroup: delay freeing policy data after rcu grace period - bpf: Check pointer type for all atomic RMW paths - ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() - ksmbd: serialize oplock close with pending break ownership - ksmbd: defer publishing granted locks to prevent UAF/double-free race - ksmbd: safely discard unregistered deferred locks - ksmbd: detach blocked lock requests before freeing - ksmbd: scope session state changes to bound connections - dpll: fix NULL deref in dpll_device_ops() during teardown race - virtio_net: Fix resize of the RX ring - irqchip/gic-v5: Clear per-CPU IRS data on teardown - ip6mr: do not clone dst in ip6mr_cache_report() - net: bridge: arp/nd proxy: fix reading neigh ha - vxlan: fix reading neigh ha - NFSv4.1: zero referring call lists before decoding - net/sched: account classifier filter allocations to memcg - fuse: Fix the condition to enable over-io-uring - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt - Bluetooth: do not leak an hci_conn when a second LE connect is rejected - net: mana: Cap MSI-X vectors to the device MSI-X table size - octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() - netfilter: nf_tables: skip double clone set expressions on element insert - KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped - LoongArch: KVM: Validate MSI data before routing it to EIOINTC - LoongArch: KVM: Get VM PMU capability from HW GCFG register - media: chips-media: wave5: Resume device before setting EOS flag - drm/amdgpu: force complete the KIQ ring fences on reset - drm/amdgpu: force complete the MES ring fences on reset - zram: fix out-of-bounds access in writeback_store() - lockd, nfsd: RCU-protect nlmsvc_ops dispatch - nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths - ceph: fix UAF in check_new_map() on session freed during unlock - cifs: call pagecache_isize_extended() in cifs_setsize() when extending - ext2: Fix lost inode updates for IS_SYNC inodes - kho: fix size calculation in kho_preserved_memory_reserve() - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 - SUNRPC: Switch MIC token verification to crypto/krb5 - SUNRPC: Switch MIC token generation to crypto/krb5 - SUNRPC: Switch wrap token decryption to crypto/krb5 - SUNRPC: Switch wrap token encryption to crypto/krb5 - SUNRPC: Prepare crypto/krb5 encryption and checksum handles - SUNRPC: Add errno-to-GSS status conversion helper - SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx - svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails - svcrdma: wake sq waiters when the transport closes - svcrdma: Add Write chunk WRs to the RPC's Send WR chain - RISC-V: KVM: Fix PMU event info array size overflow - KVM: riscv: Fix Spectre-v1 in PMU counter access - ntb: Store original DMA address for future release - NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers - NTB: core: Add .get_dma_dev() callback to ntb_dev_ops - tipc: avoid busy looping in tipc_exit_net() - fbdev: Wrap user-invoked calls to fb_set_var() in helper - drm/amdkfd: Add bounds check for CRAT subtype length - drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - drm/amd/display: check if dml21_add_phantom_plane() is successful - dmaengine: idxd: fix double free of wq, engine, and group structs - idpf: bound interrupt-vector register fill to the allocated array - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - soc: xilinx: Fix race condition in event registration - drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info() - drivers: firmware: xilinx: Add unique family code for all platforms - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - btrfs: lzo: reject compressed segment that overflows the compressed input - optee: ffa: Add NULL check in optee_ffa_lend_protmem - scsi: core: pair EH runtime PM get and put - ovpn: defer key slot crypto freeing to workqueue - ipvs: revalidate ihl to prevent out-of-bounds access - eth: bnxt: avoid deadlock when canceling IRQ affinity notifier - eth: bnxt: decrease indent in bnxt_request_irq() - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock - soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read - btrfs: lzo: reject inline extents without valid headers - accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() - accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() - bpf: Fix netns reference imbalance in conntrack kfuncs - vhost_iotlb: bound map allocation in add_range - eventfs: Use children field for rcu head and add memory barriers - btrfs: skip global block reserve accounting for rescue mounts - btrfs: warn about extent buffer that can not be released - btrfs: only invalidate btree inode pages after all ebs are released - btrfs: split btrfs_fs_closing() and change return type to bool - KVM: arm64: vgic: Fix race between LPI release and re-registration - nexthop: take nh->lock for f6i_list walks in replace check and notify - nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush - xsk: reclaim invalid Tx descriptors in ZC batch path - xsk: provide sufficient space in pool->tx_descs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - netfs: Fix folio_queue ENOMEM in writeback by adding a mempool - Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs - net: Convert proto_ops bind() callbacks to use sockaddr_unsized - hdlc_ppp: fix potential null pointer in ppp_cp_event logging - Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback - octeontx2-af: Block VFs from clobbering special CGX PKIND state - s390/zcrypt: Close speculative mem read possibility - s390/zcrypt: Rework domain processing within zcrypt device driver - s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code - drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport - md/raid1,raid10: fix error-path detection with md_cloned_bio() - md/raid1,raid10: fix bio accounting for split md cloned bios - md/raid1,raid10: fix deadlock in read error recovery path - md: replace wait loop with wait_event() in md_handle_request() - wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() - wifi: ath12k: fix inconsistent arvif state in vdev_create error paths - ocfs2: validate fast symlink target during inode read - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - wifi: mac80211: bound S1G TIM PVB walk to the TIM element - wifi: ieee80211: split S1G definitions out - ixgbe: do not configure xps for XDP queues - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ext4: add mext_check_validity() to do basic check - iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path - cxl/region: Block region delete during region creation - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding - RDMA/bnxt_re: Free CQ toggle page after firmware teardown - RDMA/bnxt_re: Add a max slot check for SQ - net: serialize netif_running() check in enqueue_to_backlog() - net: fully inline backlog_unlock_irq_restore() - net: optimize enqueue_to_backlog() for the fast path - fs/ntfs3: call _ntfs_bad_inode() when failing to rename - fs/ntfs3: Reformat code and update terminology - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - md/raid1: fix writes_pending and barrier reference leaks on write failures - md/raid10: fix writes_pending leak on write request failures - bpf: Guard conntrack opts error writes - bpf: net: netfilter: drop dead NULL checks - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock - xen/pvcalls: bound backend response req_id before indexing rsp[] - iomap: release pages on atomic dio size mismatch - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - Bluetooth: 6lowpan: avoid untracked enable work - accel/amdxdna: Fix VMA access race - accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval - accel/amdxdna: Fill invalid payload for failed command - net/liquidio: drop cached VF pci_dev LUT - accel/amdxdna: reject user command submission without a command BO - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC - wifi: mac80211: validate extension-frame layout before RX - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains - drm/amd/display: use kvzalloc to allocate struct dc - wifi: cfg80211: use wiphy work for socket owner autodisconnect - bpf: Fix UAF in sock clone early bailouts - bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c - drm/xe/guc: Keep scheduler timeline name alive - drm/xe/guc: Hold device ref until queue teardown completes - bnxt_en: Handle partially initialized auxiliary devices - fwctl/bnxt_en: Refactor aux bus functions to be more generic - tipc: serialize udp bearer replicast list updates - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths - cifs: prevent readdir from changing file size due to stale directory metadata - drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers - LoongArch: BPF: Zero-extend signed ALU32 div/mod results - idpf: fix max_vport related crash on allocation error during init - drm/i915/gt: Fix NULL deref on sched_engine alloc failure - drm/amdgpu: Fix kernel panic during driver load failure - ksmbd: prevent path traversal bypass by restricting caseless retry - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon - KVM: guest_memfd: Treat memslot binding offset+size as unsigned values - netfs: Fix zeropoint update where i_size > remote_i_size - drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() - erofs: fix metabuf leak in inode xattr initialization - net: hsr: defer node table free until after RCU readers - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - netfs: Fix missing barriers when accessing stream->subrequests locklessly - afs: Fix the locking used by afs_get_link() - cachefiles: Fix error return when vfs_mkdir() fails - nvme-pci: fix dma_vecs leak on p2p memory - nvme-pci: fix dma mapping leak on data setup error - ACPI: button: Fix ACPI GPE handler leak during removal - ACPI: button: Tweak acpi_button_remove() - ACPI: button: Convert the driver to a platform one - ACPI: button: Adjust event notification routines - net/sched: fix packet loop on netem when duplicate is on - net: Introduce skb tc depth field to track packet loops - KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor - drm/amdgpu: fix amdgpu_hmm_range_get_pages - netfilter: nf_tables: add hook transactions for device deletions - f2fs: read COW data with the original inode during atomic write - fbdev: omap2: fix use-after-free in omapfb_mmap - fbdev: omap2: fix inconsistent lock returns in omapfb_mmap - power: supply: max77705: Free allocated workqueue and fix removal order - power: supply: max77705: Drop duplicated IRQ error message - workqueue: devres: Add device-managed allocate workqueue - net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - wifi: cfg80211: enforce HE/EHT cap/oper consistency - ptp: ocp: fix resource freeing order - ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware - ublk: reset per-IO canceled flag on each fetch - powerpc/64s: Fix unmap race with PMD migration entries - greybus: raw: fix use-after-free on cdev close - f2fs: fix data loss caused by incorrect use of nat_entry flag - ice: fix double-free of tx_buf skb - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() - ice: fix race condition in TX timestamp ring cleanup - ice: reshuffle and group Rx and Tx queue fields by cachelines - ceph: put folios not suitable for writeback - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() - drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure - drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure - Revert "net/smc: Introduce TCP ULP support" - drm/amdgpu/userq: fix access to stale wptr mapping - pseries/papr-hvpipe: Fix race with interrupt handler - papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() - drm/amd/display: Fix dc_link NULL handling in HPD init - media: iris: fix use-after-free of fmt_src during MBPF check - media: iris: turn platform caps into constants - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - udf: fix partition descriptor append bookkeeping - gfs2: fix memory leaks in gfs2_fill_super error path - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn - gfs2: Get rid of delayed withdraws - gfs2: Asynchronous withdraw - gfs2: Add clean argument to lm_unmount hook - gfs2: Clean up quotad timeout handling - gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit - ASoC: amd: acp-mach-common: Add missing error check for clock acquisition - scsi: qla2xxx: Completely fix fcport double free - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC - media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure - btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() - btrfs: remove 'reserved' argument from btrfs_pin_extent() - btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() - hfs: Replace BUG_ON with error handling for CNID count checks - ASoC: qcom: q6asm: drop DSP responses for closed data streams - ASoC: qcom: q6asm: handle the responses after closing - drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 - drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - mshv: Fix error handling in mshv_region_pin - mshv: Move region management to mshv_regions.c - mshv: Centralize guest memory region destruction - mshv: Refactor and rename memory region handling functions - static_call: allow using STATIC_CALL_TRAMP_STR() from assembly - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists - ALSA: ctxfi: Check the error for index mapping - ALSA: ctxfi: Refactor resource alloc for sparse mappings - ALSA: ctxfi: Use explicit output flag for DAIO resources - ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init() - Bluetooth: hci_event: move wake reason storage into validated event handlers - net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path - net: ti: icssg-prueth: Make emac_run_xdp function independent of page - net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues - ti: icssg: convert to ndo_hwtstamp API - blktrace: fix __this_cpu_read/write in preemptible context - accel/amdxdna: Fix NULL pointer dereference of mgmt_chann - PCI: endpoint: Add missing NULL check for alloc_workqueue() - PCI: Add WQ_PERCPU to alloc_workqueue() users - accel/amdxdna: Fix potential NULL pointer dereference in context cleanup - accel/amdxdna: Add hardware specific attributes - accel/amdxdna: Enhance runtime power management - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands - namespace: handle mount locking for automounts correctly - namespace: never expire a locked mount - namespace: refuse an automount below a mount that is in no namespace - fcntl: refuse F_SET_RW_HINT on an immutable inode - namei: don't reveal overmounted entries in refwalk - namespace: unhash a dentry before detaching the mounts on it - namespace: don't let a pseudo dentry become the root of a mount - dcache: don't put a mountpoint on a dentry that's being removed - namespace: check the mounts before reading their parents in pivot_root() - namespace: remove the fsnotify marks of a mount namespace in process context - namespace: look at the topmost mount for a mount namespace file - namespace: check a recursive bind mount for mount namespace loops - namespace: check a submount for references right before unmounting it - namespace: queue a mount only once for mount notifications - namespace: check the target before walking it in do_mount_setattr() - fs: refuse fspick() on internal superblocks - namespace: don't copy an unmounted mount tree - namespace: don't inherit MNT_UMOUNT in clone_mnt() - namespace: reset the old parent's ->overmount in mnt_change_mountpoint() - fs: don't silently unmount busy mounts - mount: keep a copied mount unbindable - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs - drm/amdgpu/userq: return the memdup_user() error for the user MQD - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks - drm/amdgpu: make Mac FB workaround generic - drm/amdgpu: serialize vblank counter reads against GPU reset - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info - drm/amdkfd: align SDMA doorbell base for shader doorbell writes - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin - drm/xe: Fix shrinker accounting double-subtraction on nested external pins - drm/vmwgfx: validate pitch coming from userspace - drm/vc4: Fix firmware reference leak in vc4_drm_bind() - drm/vc4: drain the hangcheck timer and works on V3D unbind - drm/imagination: Size page table preallocation by device address - drm/i915/gt: Unmask interrupts only when ACTIVE is true - drm/i915/gem: Prevent overstepping exec array boundary - drm/gud: don't keep a connector without a CRTC as connector_state - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown - Bluetooth: RFCOMM: free the skb when the DLC has no owner - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() - Bluetooth: MGMT: Fix status of pending commands flushed on power off - Bluetooth: ISO: Serialize concurrent connect calls - Bluetooth: ISO: Reject concurrent BIS listener setup - Bluetooth: hci_sync: Fix command skb lifetime during scan setup - Bluetooth: hci_sock: Serialize dead-device detachment - Bluetooth: btintel_pcie: use managed IRQ teardown - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header - riscv: futex: untag the user pointer before the atomic access - riscv: fix load_unaligned_zeropad() fixup for RV32 - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp - scsi: qedi: Initialize callback state before registration - pmdomain: rockchip: propagate subdomain add errors - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers - optee: register TEE devices only once fully initialized - openvswitch: fix soft lockup in the netlink flow dump - nvme: fix swapped ZRASF zone state values for full and read only - net: team: free skb when broadcast has no txable port - net: team: stop reusing skb after queue override - net: usb: ax88179_178a: fix rx frame length for non-last packets - net: sparx5: free the matchall entry on destroy - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() - net: dsa: microchip: fix KSZ8765 fiber detection - net: bridge: avoid recursive multicast port cleanup - net/smc: protect clcsock lifetime in smc_getname - net/packet: guard the ll header push in packet_rcv_spkt() - mmc: sdhci-sprd: disable runtime PM on remove - mmc: mtk-sd: Cancel request timeout work on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: cavium-octeon: destroy slot platform devices on remove - dm: fix reading free memory in do_resume - dm-snap: reject the transient exception store for snapshot-merge - dm-integrity: fix buffer overflow in inline mode with large tag size - dm-crypt: reject the lmk IV mode with AEAD ciphers - mm: don't schedule deferred kernel page table freeing while booting - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them - memstick: core: wait for request completion before freeing card - KEYS: Fix add_key() race with keyring restriction - keys: finalize persistent keyring timeout after link attempt - ice: fix metadata_dst refcount handling on representor teardown - ice: fix use-after-free in dynamic port cleanup - ibmveth: fix TX LTB and filter unwind on open-fail - ibmveth: h_free logical LAN on open-fail after register - gve: fix XSK buffer leak on error descriptor - gve: fix XSK buffer leak when rings are stopped - gve: fix napi_disable deadlock when attempting to disable XSK pools - gpio: xilinx: fix runtime PM leak on request error path - gpio: mpsse: fix race when arming the IRQ poll worker - EDAC/amd64: Mask UMC chip select to the four implemented selects - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts - selinux: fix data race on AVC latest_notif - Revert "wifi: libertas: reject short monitor TX frames" - tipc: hold a reference to nodes found by link name - tipc: destroy topsrv workqueues before closing connections - tcp: reject net_iov in zerocopy receive mapping hints - swiotlb: fix default_swiotlb_limit() for non-growable default pool - strparser: make sure __strp_recv isn't running before tearing down the parser - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() - xen/netfront: don't leak the skb when xennet_fill_frags() fails - workqueue: Fix NULL current_pwq deref in chained work check - wireguard: noise: reject response consumption after intermediate initiation - wireguard: queueing: preserve tstamp_type when encapsulating packet - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() - wifi: mt76: mt7603: initialize global station WCID - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() - vsock/virtio: account only unread bytes in read_skb() - usb: f81604: fix struct f81604_int_data size mismatch - dm ioctl: don't let data_start run past the buffer - cipso: adjust cached option offsets when removing CIPSO - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) - arm64: irq: exclude the softirq stack switch from KCOV - ALSA: hda/tas2781: Accept V1 calibration data without CRC - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers - Input: xpad - add support for Corsair Novablade Pro - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox - Input: ati_remote2 - fix type confusion in device attribute handlers - ipv6: do not warn on route notification size race - ipv4: do not warn on route notification size race - ipv4: stop route notification sizing when nexthop group shrinks - ipv4: stop exception dump when nexthop group shrinks - ipv4: stop PMTU walk when nexthop group shrinks - rust_binder: reschedule node refcount update on thread exit - ipv4: validate checksum_start before completing checksum - ipv6: Fix redirect exception creation for UDP/RAW sockets - crypto: drbg - Fix ineffective sanity check - net: dsa: mt7530: fix .get_stats64 sleeping in atomic context - f2fs: fix to reset all pinned status during fggc - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() - accel/amdxdna: Bound the sync_bo flush range to the BO size - ynl: fix schema check errors - doc/netlink: netlink-raw: Add max check - netfs: zero the tail of a short DIO/unbuffered read - net: mana: Skip WQ object destruction for uninitialized RXQ - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry - net/mlx5e: Prevent stale XSK buffer release on refill retry - fs: Free any excess xarray nodes in clear_inode() - bnxt_en: fix DMA mapping length for padded small packets