# changelog

author: jiazhenyuan <jiazhenyuan@uniontech.com> - 1.26.2-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix dbus-daemon error when systemd-resolved service was not enabled


author: gaoxingwang <gaoxingwang@huawei.com> - 1.26.2-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:sync from upstream, fix wrongly considering ipv6.may-fail for ipv4


author: zengwefeng <zwfeng@huawei.com> - 1.26.2-11
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix crash in nm_wildcard_match_check
         fix leak of NMOvsdbPrivate db_uuid


author: gaoxingwang <gaoxingwang@huawei.com> - 1.26.2-12
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:libnm: fix leak and return failures from nm_client_load_connections()


author: lifeifei <lifeifei@kylinos.cn> - 1.26.2-12.p06
changelog:
  - Type:CVE
  - ID:[TASK#601939]
  - SUG:NA
  - DESC:fix cve-2025-9615.
         Optimize the compilation parameters in the spec, and resolve compilation issues.


author: yaoxin <yao_xin001@hoperun.com> - 1.2.24-1
changelog:
  - Update to 1.2.24:
    * Fixed formatting of ipsec.conf snippet. This is a security
    issue with severity of "Important." (CVE-2024-9050)
    * Added support for "require-id-on-certificate" setting.
    * Updated Georgian, Slovenian and Ukrainian translations.


author: houhongxun <houhongxun@kylinos.cn> - 0.6.55-2.p01
changelog:
  - Type:update
  - ID:Task#171032
  - SUG:NA
  - DESC:sync kylin modification: fix user display problem in control center or when login
  	add patch: accountsservice-0.6.54-kylin-1000-users-issue.patch(liujilin)


author: tiandongdong <tiandongdong@kylinos.com> - 2.2.53-14
changelog:
  - Type:CVEs
  - ID: [BUG#629329]
  - SUG: NA
  - DESC:  Backport upstream patch Fix CVE-2026-54369 CVE-2026-54370
  - New API acl_get_file_at, acl_set_file_at, acl_extended_file_at, acl_delete_def_file_at
  - New provided symbol LIBACL_1_3 for new API in libacl
  - The change that commands like 'getfacl -P symlink' or 'setfacl -P symlink' will fail now

  - Preserve the failed status when processing multiple files 2.2.53-13
  - fix src_repo in yaml file  2.2.53-12
  - backport upstream patch to fix segfault on allocation failure 2.2.53-11
  - backport upstream patch to avoid NULL dereferences 2.2.53-10


author: openEuler Buildteam <buildteam@openeuler.org> - 0.16-16
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: change file from /etc/logrotate.d/aide/aide.logrotate to /etc/logrotate.d/aide


author: yixiangzhike <yixiangzhike007@163.com> - 0.16.2-5
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: backport upstream patches to strengthen malloc,calloc,realloc,strdup


author: yueyuankun <yueyuankun@kylinos.cn> - 33.19-31.p09
changelog:
  - Type:bugfix
  - ID:Bug#121227
  - SUG:NA
  - DESC:Remove the iso9660 label media from the unknown group, 
         and solve the problem that EFI partitions cannot be deleted during U disk installation


author: Xiao Zai <xiaozai@kylinos.cn> - 33.19-31.p10
changelog:
  - Type:NA
  - ID: Task#91852
  - SUG:NA
  - DESC: add codes for pks group 
  - Add Patches: anaconda-33.19-kylin-0022-add-codes-for-pks-group.patch


author: Xiao Zai <xiaozai@kylinos.cn> - 33.19-31.p11
changelog:
  - Type: bugfix
  - ID: BUG#126426 
  - SUG: NA
  - DESC: fix the bug for pks installation 
  - Add Patches: anaconda-33.19-kylin-0023-fix-pks-installation.patch


author: Xiao Zai <xiaozai@kylinos.cn> - 33.19-31.p14
changelog:
  - Type: NA 
  - ID: TASK#106954
  - SUG: NA
  - DESC: disable the kernel audit 
  - Add Patches: anaconda-33.19-kylin-0026-disable-audit.patch


author: Xiao Zai <xiaozai@kylinos.cn> - 33.19-31.p16
changelog:
  - Type: NA 
  - ID: BUG#160996
  - SUG: NA
  - DESC: We can't fetch the 'DeviceName' while the source type is URL 
  - Add Patches: anaconda-33.19-kylin-0028-fix-bug160996.patch


author: huangwenhua <huangwenhua@kylinos.cn> - 9100h-39.p01
changelog:
  - Type: update
  - ID: [Task#165758]
  - SUG: NA
  - DESC: revise the expression of sensitive words
  	fix regenerate dict.args.in


author: wanghao <wanghao2@kylinos.cn>-2.13.3-0.2.p03
changelog:
  - Type: bugfix
  - ID: [BUG#174866]
  - SUG:NA
  - DESC: 修复使用systemctl查看apparmor状态显示failed的bug
  -	修复模式设置时报错的问题
  -	  add patch: apparmor-fix-systemctl-get-status-failed-bug.patch


author: majianhan <majianhan@kylinos.cn> - 3.3.1-27
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5203 CVE-2025-5204


author: tanyulong <tanyulong@kylinos.cn>-1.17.0-3.p09
changelog:
  - Type:bugfix
  - ID:[BUG#115244]
  - SUG:NA
  - DESC:fix document viewer crashes when clicking to present
  - Add Patches:atril-1.17.0-kylin-fix-bug-115244.patch


author: douyan <douyan@kylinos.cn> - 1.17.0-3.p10
changelog:
  - Type: update
  - ID:   [TASK#187126]
  - SUG:  NA
  - DESC: add atril-1.17.0-kylin-add-zh_HK-translation.patch


author: Shijie Luo<luoshijie1@huawei.com> - 2.4.48-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:restart
  - DESC:fix error condition of while loop 
         in 0001-bypass-wrong-output-when-enabled-selinux.patch.


author: shixuantong<shixuantong@huawei.com> - 0.3.6-25
changelog:
  - Type:cves
  - ID:CVE-2017-6828 CVE-2017-6829 CVE-2017-6831 CVE-2017-6838 CVE-2017-6839
  - SUG:NA
  - DESC:fix CVE-2017-6828 CVE-2017-6829 CVE-2017-6831 CVE-2017-6838 CVE-2017-6839


author: yixiangzhike <yixiangzhike007@163.com> - 3.0-4
changelog:
  - backport some patches
     Add missing call to free_interpretation_list
     fix 2 more issues found by fuzzing
     Fix an auparse memory leak caused in recent glibc
     Fix double free with corrupted logs
     Turn libaucommon into a libtool convenience library
     Fix the closing timing of audit_fd
     Fix some string length issues
     Move the free_config to success path
     Check for fuzzer induced invalid value
     error out if log is mangled
     Dont run off the end with corrupt logs
     Another hardening measure for corrupted logs
     Fix busy loop in normalizer when logs are corrupt
     Better fix for busy loop in normalizer when logs are corrupt
     flush uid gid caches when user group added deleted modified
     In auditd check if log_file is valid before closing handle
     Check ctime return code
     When interpreting if val is NULL return an empty string
     auditd.service Restart on failure ignoring some exit
     In auditd close the logging file descriptor when logging is suspended


author: wanghao <wanghao2@kylinos.cn> - 3.0-5.se.09
changelog:
  - Type:update
  - ID:[Task#75532]
  - SUG:NA
  - DESC: 添加kysec补丁
  -         add patch: audit-3.0.20200318-kysec.patch
  -       audit服务可以手动停止
  -         add patch: audit-3.0-systemctl-faied.patch
  -       修改auditd-config.c文件
  -         add patch: audit-3.0-modify-auditd-config.patch
  -       添加mips支持
  -         add patch: audit-3.0-adopt-mips.patch
  -       改进mips相关little_endian默认值设置为1
  -         add patch: audit-3.0-modify-mips.patch
  -       删除littlt-endian的判断
  -         add patch: audit-3.0-delete-littlt-endian.patch
  -       添加loongarch64相关支持
  -         add patch: audit-3.0-add-loongarch64.patch


author: wanghao <wanghao2@kylinos.cn> - 3.0-6.se.01
changelog:
  - Type: bugfix
  - ID:[Bug#113316]
  - SUG:NA
  - DESC: 将audit.log文件权限改为600，pidfild文件权限改为644
  -         add patch: audit-3.0-modify-logfile-and-pidfile-permissions.patch


author: wanghao <wanghao2@kylinos.cn> - 3.0-6.se.02
changelog:
  - Type: bugfix
  - ID:[Bug#135593]
  - SUG:NA
  - DESC: 修复修改删除audit.log后日志为空的问题
  -         add patch: audit-3.0-fix-modify-or-del-audit-log-bug.patch


author: sunjin <sunjin@kylinos.cn> - 3.0-6.se.03
changelog:
  - Type:bugfix
  - ID:无
  - SUG:NA
  - DESC:
  -      解决ausyscall --dump看不到系统符号问题
  -      添加补丁audit-3.0-fix-syscall-error.patch


author: wanghao <wanghao2@kylinos.cn> - 3.0-6.se.04
changelog:
  - Type: update
  - ID:[任务#157794]
  - SUG:NA
  - DESC: 将修改的权限恢复至开源状态
  -         add patch: audit-3.0-restore-file-permission-settings.patch


author: liwei <liwei@kylinos.cn> - 3.0-6.se.05
changelog:
  - Type:Task
  - ID:162340
  - SUG:NA
  - DESC: audit设备管控需求合入通用,添加程序黑名单类型
  - add patch: audit-3.0-program-blacklist-type.patch


author: wanghao <wanghao2@kylinos.cn> - 3.0-6.se.06
changelog:
  - Type: bugfix
  - ID:[BUG#188168]
  - SUG:NA
  - DESC: 添加kysec_ppro和kysec_netctl日志类型
  -	  add patch: audit-3.0-add-kysec-ppro-and-netctl-audit-type.patch


author: mengchaoming<mengchaoming@kylinos.cn> -3.0-10.se.06
changelog:
  -Type:Update
  -ID:[Task#186427]
  -SUG:NA
  -DESC:backport patches from upstream:patch25->patch34
    del golang_arches for check
    fix another krb5 memory leak
    asprintf can return a negative number patch
    Cleanup gssapi code
    In auditd release the async flush lock on stop
    auditd cleanup krb5 memory leaks on error paths
    audisp remote cleanup krb5 memory leaks on error paths
    Final kerberos leak fixups
    time_t is not an int anymore
    krb5_cc_store_cred takes custody of my_creds so we do not need to keep it around


author: pengxi<pengxi@kylinos.cn> -3.0-10.se.07
changelog:
  - Type: bugfix
  - ID:[BUG#235394]
  - SUG:NA
  - DESC: autrace在loongarch64下插入规则失败
  -         add patch: audit-3.0-fix-rule-insert-error-on-loongarch64.patch
  -       添加loongarch64系统调用表
  -         add patch: audit-3.0-add-syscall-table-for-loongarch64.patch


author: openEuler Buildteam <buildteam@openeuler.org> - 1.12.0-1
changelog:
  - Type:enhancement
  - Id:NA
  - SUG:NA
  - DESC:Reduce the amount of memory needed to evaluate complex path expressions
    against large files,Fix a segfault on OSX when 'augmatch' is run without any
    arguments (Issue #556),update gnulib to 91584ed6.


author: huayadong <huayadong@kylinos.cn> - 0.8-11.p01
changelog:
  - Type: CVE
  - ID  : [Task#482351]
  - SUG : NA
  - DESC: fix CVE-2024-52616, add Patch6010: 0001-Properly-randomize-query-id-of-DNS-packets.patch


author: shenyangyang<shenyangyang4@huawei.com> - 5.0-16
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Rebuild for openEuler-rpm-config moving /usr/lib/rpm/openEuler/xxxx
         to /usr/lib/xxxx


author: licihua<licihua@huawei.com> - 5.0-17
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: fix quoted null string removal when using shell word expansion pattern operators


author: Xiao Zai<xiaozai@kylinos.cn> - 5.0-17.p01
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC: sync the spec change from  5.0-14.se.01.p01 to fix the bug#68292 for v10 sp1


author: wanghao <wanghao2@kylinos.cn> - 5.0-17.p01.se.01
changelog:
  - Type:update
  - ID:[Task#75532]
  - SUG:NA
  - DESC: 添加kysec执行检查
  -         add patch: bash-5.0-check-kysec.patch
  -       优化source提示翻译
  -       修复source可以对白名单标记为unknown的脚本文件进行调用的问题
  -         add patch: bash-5.0-fix-source-exe-sh.patch


author: wanghao <wanghao2@kylinos.cn> - 5.0-17.p01.se.02
changelog:
  - Type:update
  - ID:[Task#75532]
  - SUG:NA
  - DESC: 将链接库的方式改为使用dlopen打开
  -         add patch:  bash-5.0-use-dlopen-libkysec.patch


author: Shi Jingying <shijingying@kylinos.cn> - 5.0-17.p02.se.02
changelog:
  - Type: update
  - ID: [Task#102285]
  - SUG: NA
  - DESC: recover the `history -c` operation of the non root user
  -        add patch1004 bash-5.0-recover-non-root-user-to-clear-history.patch


author: wanghao <wanghao2@kylinos.cn> - 5.0-17.p01.se.03
changelog:
  - Type:update
  - ID:[Task#105711]
  - SUG:NA
  - DESC: 在kysec_execl_check之前添加kysec_status的状态检查，如果关闭,则不调用libkysec库
  -         add patch: bash-5.0-add-kysec-status-check.patch


author: wanghao <wanghao2@kylinos.cn> - 5.0-17.p01.se.04
changelog:
  - Type: bugfix
  - ID:[BUG#144176]
  - SUG:NA
  - DESC: 修复source可以执行标记为unknown的脚本文件
  -         add patch: bash-5.0-fix-source-execute-script-bug.patch


author: zhangzikang <zhangzikang@kylinos.cn> - 0.15.0-1.p02
changelog:
  - Type:update
  - ID:TASK#169384
  - SUG:NA
  - DESC: add loongarch support
          0001-kylin-bcc-add-loongarch-support.patch
          0002-kylin-bcc_fix_conv_regs_issue.patch
          0003-kylin-bcc_fix_uprobe_libc_so.patch


author: zhangzikang <zhangzikang@kylinos.cn> - 0.15.0-1.p03
changelog:
  -Type:bugfix
  -ID:Bug#194974
  -SUG:NA
  -DESC:Fix identifier BPF_PSEUDO_FUNC undeclared error
        add BTF_KIND_DATASEC for libbpf.h btf_is_datase when make bcc


author: zhangzikang <zhangzikang@kylinos.cn> - 0.15.0-1.p04.01
changelog:
  - Type:cve
  - ID:Bug#517535
  - SUG:NA
  - DESC:Fix tcpdrop kprobe point to kfree_skb_reason
         modify kfunc support
         Fix CVE-2024-2314


author: hanzhijun <hanzhijun1@huawei.com> - 9.11.21-3
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix the difference at the macro definition using clock gettime instead of gettimeofda


author: jinshuaiyu <jinshuaiyu@kylinos.com> - 9.11.21-10.p02
changelog:
  - Type:CVE
  - ID:CVE-2022-2906 CVE-2022-2881 CVE-2022-2795 CVE-2022-38178 CVE-2022-38177
  - SUG:NA
  - DESC:fix CVE-2022-2906 CVE-2022-2881 CVE-2022-2795 CVE-2022-38178 CVE-2022-38177


author: huangyu <huangyu106@huawei.com> - 32:9.11.21-14
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix output expected information when install bing-sdborbind-sdb-chroot


author: huangyu <huangyu106@huawei.com> - 32:9.11.21-14
changelog:
  - Type:CVE
  - ID:CVE-2022-2906 CVE-2022-38177 CVE-2022-38178 CVE-2022-2795 CVE-2022-2881
  - SUG:NA
  - DESC:FIX CVE-2022-2906CVE-2022-38177CVE-2022-38178CVE-2022-2795CVE-2022-2881


author: yueyuankun <yueyuankun@kylinos.cn> - 2.34-19.p01
changelog:
  - Type:bugfix
  - ID:task#108856
  - SUG:NA
  - DESC:rebuild libbfd.a libiberty.a libopcodes.a with -fPIC for inclusion into shared libraries


author: guochao <guochao@kylinos.cn> - 2.34-19.p02
changelog:
  - Type:CVE
  - ID:CVE-2022-48064 CVE-2022-47011 CVE-2022-47008 CVE-2021-46174 CVE-2022-47696
  - SUG:NA
  - DESC:Fix CVE-2022-48064 CVE-2022-47011 CVE-2022-47008 CVE-2021-46174 CVE-2022-47696


author: pengxu <pengxu@kylinos.cn> - 2.34-33.p03
changelog:
  - Type:cves
  - ID:CVE-2025-7545
  - SUG:NA
  - DESC: Fix CVE-2025-7545: heap-based buffer overflow in objcopy.


author: gaoyukun <gaoyukun@kylinos.cn> - 2.34-33.p02
changelog:
  - Type:update
  - ID:TASK#414527
  - SUG:NA
  - DESC:1.rebuild libbfd.a libiberty.a libopcodes.a with -fPIC for inclusion into shared libraries
         2.merge openEuler aarch64 EFI support and fix the compatibility issues
         3.Patch is different from sp3, so add 1 to the version number


author: pengxu <pengxu@kylinos.cn> - 2.34-33.p05
changelog:
  - Type:cves
  - ID:BUG#515223
  - SUG:NA
  - DESC: 1.Fix CVE-2025-5244: bfd nullpointer protection.
          2.Fix CVE-2025-5245: debug nullpointer protection.


author: pengxu <pengxu@kylinos.cn> - 2.34-33.p06
changelog:
  - Type:cves
  - ID:CVE-2025-11412 CVE-2022-38533 CVE-2022-47007 CVE-2022-47010 CVE-2022-47695 CVE-2022-48063 CVE-2022-48065 CVE-2025-11494 CVE-2025-11840 CVE-2025-8225 CVE-2026-6846
  - SUG:NA
  - DESC: Fix CVE-2025-11412:Fixed a segmentation fault in bfd_elf_gc_record_vtentry in elflink.c
          CVE-2022-38533:Fixed a heap buffer overflow during strip operations in coffcode.h
          CVE-2022-47007:Fixed a memory leak in stab_demangle_v3_arg in stabs.c
          CVE-2022-47010:Fixed a memory leak in pr_function_type in prdbg.c
          CVE-2022-47695:Fixed a segmentation fault in compare_symbols in objdump.c
          CVE-2022-48063:Fixed excessive memory allocation when parsing corrupted ELF files in objdump.c
          CVE-2022-48065:Fixed a memory leak in find_abstract_instance in dwarf2.c
          CVE-2025-11494:Fixed incorrect discarding of the _GLOBAL_OFFSET_TABLE_ symbol in x86 linkers
          CVE-2025-11840:Fixed a segmentation fault in coffcode.h
          CVE-2025-8225:Fixed a memory leak in debug_information in dwarf.c
          CVE-2026-6846:Fixed a buffer overflow in xcoff_link_add_symbols in xcofflink.c


author: panxiaohe <panxiaohe@huawei.com> - 3.6.4-2
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:use make macros to run check in parallel;
         fix a concurrent build issue in examples


author: pengxu <pengxu@kylinos.cn> - 3.6.4-3.p01
changelog:
  - Type:cves
  - ID:CVE-2026-56390
  - SUG:NA
  - DESC:Fix CVE-2026-56390: Fixed a path traversal vulnerability that allowed arbitrary file writes via crafted %output or %header directives in untrusted grammar files


author: huangmincai <huangmincai@kylinos.cn> - 3.1.3-1.se.04
changelog:
  - Type:bugfix
  - ID:[BUG# 122967,111929,122620]
  - SUG:NA
  - DESC:
  - 		1.修复因安全加固导致保护箱授权框认证失败问题;
  		2.更改快捷键,由ctrl改为alt;
  		3.去除冗余的提示信息.


author: huangmincai <huangmincai@kylinos.cn> - 3.1.3-1.se.05
changelog:
  - Type:bugfix
  - ID:[BUG# 116890, 122619]
  - SUG:NA
  - DESC:
  - 		1.修复首次创建保护箱及导入密钥时界面翻译错误问题;
  - 		2.修复锁定保护箱时不能关闭窗口问题;


author: peijiankang <peijiankang@kylinos.cn> - 3.1.3-1.se.09
changelog:
  - Type: bugfix
  - ID:   [TASK#195945]
  - SUG:  NA
  - DESC: add 0001-add-libboxmanage-zh_HK-translations.patch


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-43.0.v2207
changelog:
  - KYLIN: selftests/net: enable lo.accept_local in psock_snd (luyun) [task:84718]
  - selftests/net: improve descriptions for XFAIL cases in psock_snd.sh (Po-Hsu Lin) [task:84718]
  - ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE (Jann Horn) [bug:120181] {CVE-2022-30594}
  - net/sched: cls_u32: fix netns refcount changes in u32_change() (Eric Dumazet) [bug:120187] {CVE-2022-29581}
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (Duoming Zhou)
  - nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs (Duoming Zhou) [bug:120196] {CVE-2022-1734}
  - nfc: replace improper check device_is_registered() in netlink related functions (Duoming Zhou)
  - KYLIN: 3rd/sietium: sietium driver update (yangdeyi)
  - pwm:loongson: Perfect pwm-ls driver (lvyanbing)
  - ls2k1000: pwm: build as module support (suijingfeng)
  - pwm:loongson: fix up variable overflow (Yangyinglu)
  - Loongson2K: pwm: Pass PWM controller clock-frequency through device tree. (Ming Wang)
  - LoongArch: Set CONFIG_MEGARAID_SAS to m by default (Tianli Xiong)
  - gmac:The initial value of rx_watchdog is reduced to 5 (zhangtianyang)
  - LoongArch: LSVZ: fix pmu function (zhaotianrui)
  - LoongArch: module: Add plt section support (liweihao)
  - Revert "LoongArch: LSVZ: handle irq directly in kvm exception context" (王建兴)
  - LoongArch: Add vbios passed through ACPI table (liuyun)
  - LoongArch: Add gop support (liuyun)
  - LoongArch: Fix the usage of the suspend address (yangqiming)
  - Loongarch: fixup gcsr (Wang liupu)
  - loongarch: configs: make r8111G nic use r8168 driver use by default (Yinbo Zhu)
  - LoongArch: kprobe: Rewrite kprobe_handler implementation (Qing Zhang)
  - LoongArch: Remove relocations of REL type (Youling Tang)
  - objtool: LoongArch: Remove unused macro definitions (Youling Tang)
  - pci/quirks: ls7a2000: fix pm transition of devices under pcie port (Jianmin Lv)
  - KYLIN: config: Supports KAE engine drivers (pengcan) [bug:119799]
  - selftests/seccomp: allow clock_nanosleep instead of nanosleep (Thadeu Lima de Souza Cascardo) [task:69904]
  - KYLIN: arm64: use correct format characters (huhai)
  - KYLIN: Revert "optee: add ACPI support for Phytium" (huanfuxi) [task:84829]
  - net: phy: improve phy_init_hw (Heiner Kallweit) [bug:118542]
  - KYLIN: found-commit-all-deps: tips max_level correct (Jackie Liu)
  - KYLIN: config: enable kfence for x86 and arm64 (Jackie Liu) [task:68770]
  - KYLIN: mm/kfence: print disabling or re-enabling message (Jackie Liu)
  - kfence: allow use of a deferrable timer (Marco Elver) [task:68770]
  - kfence: test: try to avoid test_gfpzero trigger rcu_stall (Peng Liu) [task:68770]
  - kunit: make kunit_test_timeout compatible with comment (Peng Liu) [task:68770]
  - kunit: fix UAF when run kfence test case test_gfpzero (Peng Liu) [task:68770]
  - kfence: alloc kfence_pool after system startup (Tianchen Ding) [task:68770]
  - kfence: allow re-enabling KFENCE after system startup (Tianchen Ding) [task:68770]
  - mm/kfence: remove unnecessary CONFIG_KFENCE option (tangmeng) [task:68770]
  - net: preserve skb_end_offset() in skb_unclone_keeptruesize() (Eric Dumazet) [task:68770]
  - net: add skb_set_end_offset() helper (Eric Dumazet) [task:68770]
  - kfence: make test case compatible with run time set sample interval (Peng Liu) [task:68770]
  - kfence: fix memory leak when cat kfence objects (Baokun Li) [task:68770]
  - kfence: default to dynamic branch instead of static keys mode (Marco Elver) [task:68770]
  - kfence: always use static branches to guard kfence_alloc() (Marco Elver) [task:68770]
  - kfence: shorten critical sections of alloc/free (Marco Elver) [task:68770]
  - kfence: add note to documentation about skipping covered allocations (Marco Elver) [task:68770]
  - kfence: limit currently covered allocations when pool nearly full (Marco Elver) [task:68770]
  - kfence: move saving stack trace of allocations into __kfence_alloc() (Marco Elver) [task:68770]
  - kfence: count unexpectedly skipped allocations (Marco Elver) [task:68770]
  - net: add and use skb_unclone_keeptruesize() helper (Eric Dumazet) [task:68770]
  - kfence: test: fail fast if disabled at boot (Marco Elver) [task:68770]
  - kfence: show cpu and timestamp in alloc/free info (Marco Elver) [task:68770]
  - kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE (Marco Elver) [task:68770]
  - kfence, x86: only define helpers if !MODULE (Marco Elver) [task:68770]
  - kfence: skip all GFP_ZONEMASK allocations (Alexander Potapenko) [task:68770]
  - kfence: move the size check to the beginning of __kfence_alloc() (Alexander Potapenko) [task:68770]
  - kfence: defer kfence_test_init to ensure that kunit debugfs is created (Weizhao Ouyang) [task:68770]
  - kfence: unconditionally use unbound work queue (Marco Elver) [task:68770]
  - kfence: use TASK_IDLE when awaiting allocation (Marco Elver) [task:68770]
  - kfence: use power-efficient work queue to run delayed work (Marco Elver) [task:68770]
  - kfence: maximize allocation wait timeout duration (Marco Elver) [task:68770]
  - kfence: await for allocation using wait_event (Marco Elver) [task:68770]
  - kfence: zero guard page after out-of-bounds access (Marco Elver) [task:68770]
  - kfence, x86: fix preemptible warning on KPTI-enabled systems (Marco Elver) [task:68770]
  - kfence: make compatible with kmemleak (Marco Elver) [task:68770]
  - kfence, slab: fix cache_alloc_debugcheck_after() for bulk allocations (Marco Elver) [task:68770]
  - kfence: add test suite (Marco Elver) [task:68770]
  - kfence, Documentation: add KFENCE documentation (Marco Elver) [task:68770]
  - mm, kfence: insert KFENCE hooks for SLUB (Alexander Potapenko) [task:68770]
  - mm, kfence: insert KFENCE hooks for SLAB (Alexander Potapenko) [task:68770]
  - kfence: use pt_regs to generate stack trace on faults (Marco Elver) [task:68770]
  - arm64, kfence: enable KFENCE for ARM64 (Marco Elver) [task:68770]
  - x86, kfence: enable KFENCE for x86 (Alexander Potapenko) [task:68770]
  - mm: add Kernel Electric-Fence infrastructure (Alexander Potapenko) [task:68770]
  - kunit: Don't fail test suites if one of them is empty (Andy Shevchenko)
  - kunit: remove timeout dependence on sysctl_hung_task_timeout_seconds (Alan Maguire) [task:68770]
  - kunit: allow kunit tests to be loaded as a module (Alan Maguire)
  - kunit: hide unexported try-catch interface in try-catch-impl.h (Alan Maguire)
  - kunit: move string-stream.h to lib/kunit (Alan Maguire)
  - kunit: fix failure to build without printk (Brendan Higgins)
  - MAINTAINERS: add entry for KUnit the unit testing framework (Brendan Higgins)
  - Documentation: kunit: add documentation for KUnit (Brendan Higgins)
  - kunit: defconfig: add defconfigs for building KUnit tests (Brendan Higgins)
  - kunit: tool: add Python wrappers for running KUnit tests (Felix Guo)
  - kunit: test: add tests for KUnit managed resources (Avinash Kondareddy)
  - kunit: test: add the concept of assertions (Brendan Higgins)
  - kunit: test: add tests for kunit test abort (Brendan Higgins)
  - kunit: test: add support for test abort (Brendan Higgins)
  - objtool: add kunit_try_catch_throw to the noreturn list (Brendan Higgins)
  - kunit: test: add initial tests (Brendan Higgins)
  - lib: enable building KUnit in lib/ (Brendan Higgins)
  - kunit: test: add the concept of expectations (Brendan Higgins)
  - kunit: test: add assertion printing library (Brendan Higgins)
  - kunit: test: add string_stream a std::stream like string builder (Brendan Higgins)
  - kunit: test: add test resource management API (Brendan Higgins)
  - kunit: test: add KUnit test runner core (Brendan Higgins)
  - include/linux/slab.h: fix sparse warning in kmalloc_type() (Vlastimil Babka)
  - string.h: Add str_has_prefix() helper function (Steven Rostedt (VMware))
  - mm/vmalloc.c: improve vfree() kerneldoc (Andrey Ryabinin)
  - mm, slab: shorten kmalloc cache names for large sizes (Vlastimil Babka)
  - mm, proc: add KReclaimable to /proc/meminfo (Vlastimil Babka)
  - mm: rename and change semantics of nr_indirectly_reclaimable_bytes (Vlastimil Babka)
  - dcache: allocate external names from reclaimable kmalloc caches (Vlastimil Babka)
  - mm, slab/slub: introduce kmalloc-reclaimable caches (Vlastimil Babka)
  - mm, slab: combine kmalloc_caches and kmalloc_dma_caches (Vlastimil Babka)
  - mm/slub.c: switch to bitmap_zalloc() (Andy Shevchenko)
  - selftests: gpio: restructure Makefile (Fathi Boudra) [task:83556]
  - KYLIN: ACPI: Limit max_cstate to 1 on Hygon platforms (huhai)
  - KYLIN: Revert "KYLIN: x86/hygon: use IDLE_POLL to disable c-state and idle routine" (huhai)
  - KYLIN: Revert "KYLIN: x86/hygon: Can not use IDLE_POLL in hyper" (huhai)
  - KYLIN: config: add support for test_bpf (xiaolinkui) [task:84711]
  - selftests/tls: Add MSG_WAITALL in recv() syscall (Vakul Garg) [task:84719]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-44.0.v2207
changelog:
  - selftest: txtimestamp: fix net ns entry logic (Paolo Pisati) [task:88343]
  - selftests: timestamping: Fix SIOCGSTAMP undeclared build failure (Shuah Khan) [task:88343]
  - selftests: fix timestamping Makefile (Deepa Dinamani) [task:88343]
  - selftests: add missing include unistd (Deepa Dinamani) [task:88343]
  - selftests/txtimestamp: Fix an equals vs assign bug (Dan Carpenter) [task:88343]
  - selftests: add txtimestamp kselftest (Willem de Bruijn) [task:88343]
  - selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet (Willem de Bruijn) [task:88343]
  - selftests: expand txtimestamp with cmsg support (Willem de Bruijn) [task:88343]
  - KYLIN: fs/pipe: Solve the problem of LTP smoketest failure (yijiangshan) [bug:120350]
  - hsr: use netdev_err() instead of WARN_ONCE() (Taehee Yoo)
  - crypto: api - Check spawn->alg under lock in crypto_drop_spawn (Herbert Xu)
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra) [bug:121496] {CVE-2022-1729}
  - floppy: disable FDRAWCMD by default (Willy Tarreau) [bug:121514] {CVE-2022-1836}
  - KYLIN: configs: disable ser_gigaset & gigaset (Jackie Liu)
  - KYLIN: security/kysec: fix code style issue (huanfuxi)
  - KYLIN: sync-stable: discard unwanted newlines (Jackie Liu)
  - Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" (Linus Torvalds) [bug:112032] {CVE-2022-0854}
  - swiotlb: fix info leak with DMA_FROM_DEVICE (Halil Pasic) [bug:112032] {CVE-2022-0854}
  - KYLIN: configs: disable CMA all platform default (Jackie Liu) [task:87802]
  - scsi: iscsi: Fix unbound endpoint error handling (Mike Christie) [task:84035]
  - scsi: iscsi: Fix conn cleanup and stop race during iscsid restart (Mike Christie) [task:84035]
  - scsi: iscsi: Fix endpoint reuse regression (Mike Christie) [task:84035]
  - scsi: iscsi: Fix offload conn cleanup when iscsid restarts (Mike Christie) [task:84035]
  - scsi: iscsi: Move iscsi_ep_disconnect() (Mike Christie) [task:84035]
  - scsi: iscsi: Drop temp workq_name (Mike Christie) [task:84035]
  - scsi: iscsi: Use the session workqueue for recovery (Mike Christie) [task:84035]
  - scsi: iscsi: ql4xxx: Use per-session workqueue for unbinding (Mike Christie) [task:84035]
  - scsi: iscsi: Remove iscsi_scan_finished() (Mike Christie) [task:84035]
  - scsi: iscsi: Speed up session unblocking and removal (Mike Christie) [task:84035]
  - scsi: iscsi: Fix recovery and unblocking race (Mike Christie) [task:84035]
  - scsi: iscsi: Fix set_param() handling (Mike Christie) [task:84035]
  - scsi: iscsi: Flush block work before unblock (Mike Christie) [task:84035]
  - scsi: iscsi: Fix in-kernel conn failure handling (Mike Christie) [task:84035]
  - scsi: iscsi: Rel ref after iscsi_lookup_endpoint() (Mike Christie) [task:84035]
  - scsi: iscsi: Force immediate failure during shutdown (Mike Christie) [task:84035]
  - scsi: iscsi: Stop queueing during ep_disconnect (Mike Christie) [task:84035]
  - scsi: iscsi: Fix iSCSI cls conn state (Mike Christie) [task:84035]
  - scsi: iscsi: Fix race condition between login and sync thread (Gulam Mohamed) [task:84035]
  - scsi: iscsi: Optimize work queue flush use (Mike Christie) [task:84035]
  - scsi: iscsi: Change iSCSI workqueue max_active back to 1 (Bob Liu) [task:84035]
  - scsi: iscsi: Fix deadlock on recovery path during GFP_IO reclaim (Gabriel Krisman Bertazi) [task:84035]
  - scsi: iscsi: Register sysfs for iscsi workqueue (Bob Liu) [task:84035]
  - scsi: iscsi: Report connection state in sysfs (Gabriel Krisman Bertazi) [task:84035]
  - scsi: iscsi: Perform connection failure entirely in kernel space (Bharath Ravi) [task:84035]
  - kselftest: Minimise dependency of get_size on C library interfaces (Siddhesh Poyarekar)
  - arm64: Make debug exception handlers visible from RCU (Masami Hiramatsu) [task:87978]
  - KYLIN: xfs: fix xfs shutdown filesystem by security_inode_alloc failed (Jackie Liu) [task:85662]
  - KYLIN: Revert "signal: fix kabi changes in struct task_struct" (Jackie Liu)
  - KYLIN: Revert "futex: sched: fix kabi broken in task_struct" (Jackie Liu)
  - KYLIN: Revert "futex: sched: fix UAF when free futex_exit_mutex in free_task()" (Jackie Liu)
  - KYLIN: Revert "pid: fix imbalanced calling of cgroup_threadgroup_change_begin/end()" (Jackie Liu)
  - KYLIN: Revert "pid: fix return value when copy_process() failed" (Jackie Liu)
  - KYLIN: gitmessage: drop branch name in patchs comment (Jackie Liu)
  - KYLIN: tools/test: fix arm64 rtnetlink.sh fail. (zhaochenguang) [task:84712]
  - KYLIN: selftesting: update kylinos generic defcfg (zhaochenguang) [task:84712]
  - KYLIN: Revert "bpf, tests: Add tail call test suite" (xiaolinkui) [task:84711]
  - KYLIN: Revert "bpf/tests: Fix error in tail call limit tests" (xiaolinkui) [task:84711]
  - KYLIN: x86: config: add support for test_bpf (xiaolinkui) [task:84711]
  - bpf: test_bpf: add init_net to dev for flow_dissector (Song Liu) [task:84711]
  - UBUNTU: SAUCE: selftests: net: fix "from" match test in fib_rule_tests.sh (Marcelo Henrique Cerri) [task:84716]
  - KYLIN: x86/configs: Align default configuration options based on CentOS and openEuler (leixiang) [task:64045]
  - selftests: Update fib_tests to handle missing ping6 (David Ahern)
  - fib_tests: Add tests for invalid metric on route (David Ahern) [task:84713]
  - fib_tests: Add tests for metrics on routes (David Ahern) [task:84713]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-45.0.v2207
changelog:
  - KYLIN: sync-stable: support setting level (Jackie Liu)
  - tcp: resalt the secret every 10 seconds (Eric Dumazet)
  - Bluetooth: hci_h5: fix memory leak in h5_close (Anant Thazhemadam)
  - Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() (Peilin Ye) [task:91469]
  - Bluetooth: Fix null pointer dereference in hci_event_packet() (Anmol Karn)
  - KYLIN: arm64: Add kernel parameter for CPU0 hotplug and remove config switch (yijiangshan) [bug:122008]
  - KYLIN: ngbe: Make use of cpumask_local_spread to improve RSS locality (xiaolinkui)
  - KYLIN: ngbe: enable cpumask for wangxun (xiaolinkui)
  - crypto: arm64/ghash-neon - bump priority to 150 (Ard Biesheuvel)
  - crypto: xts - simplify error handling in ->create() (Eric Biggers) [task:90975]
  - crypto: lrw - simplify error handling in create() (Eric Biggers) [task:90975]
  - crypto: arm64/gcm-ce - implement 4 way interleave (Ard Biesheuvel) [task:91194]
  - crypto: aes-generic - drop key expansion routine in favor of library version (Ard Biesheuvel)
  - KYLIN: crypto: zhaoxin-aes - switch to library version of key expansion routine (Jackie Liu)
  - crypto: arm64/aes-ce - switch to library version of key expansion routine (Ard Biesheuvel)
  - crypto: arm64/aes-neonbs - switch to library version of key expansion routine (Ard Biesheuvel)
  - crypto: arm64/aes-ccm - switch to AES library (Ard Biesheuvel)
  - crypto: arm/aes-neonbs - switch to library version of key expansion routine (Ard Biesheuvel)
  - crypto: arm64/ghash - switch to AES library (Ard Biesheuvel) [task:91194]
  - crypto: safexcel/aes - switch to library version of key expansion routine (Ard Biesheuvel)
  - crypto: cesa/aes - switch to library version of key expansion routine (Ard Biesheuvel)
  - crypto: padlock/aes - switch to library version of key expansion routine (Ard Biesheuvel)
  - crypto: x86/aes - drop scalar assembler implementations (Ard Biesheuvel)
  - crypto: x86/aes-ni - switch to generic for fallback and key routines (Ard Biesheuvel)
  - crypto: aes - create AES library based on the fixed time AES code (Ard Biesheuvel)
  - crypto: aes/fixed-time - align key schedule with other implementations (Ard Biesheuvel)
  - crypto: aes - rename local routines to prevent future clashes (Ard Biesheuvel)
  - crypto: arm/aes-ce - cosmetic/whitespace cleanup (Ard Biesheuvel)
  - crypto: arm64/ghash - register PMULL variants as separate algos (Ard Biesheuvel) [task:91194]
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) [bug:123678] {CVE-2022-32296}
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Pablo Neira Ayuso) [bug:123674] {CVE-2022-1966}
  - KYLIN: loongarch/config: enable some filesystem for loongarch (wangxuewen) [bug:122374]
  - KYLIN: include: Added an arm64 macro to limit the cacheline (pengcan) [task:85182]
  - KYLIN: scripts: add a script to compile and check kabi automatically (Zhengyuan Liu)
  - KYLIN: lib/raid: check recv algo performance for test (Zhengyuan Liu) [task:90865]
  - lib/raid6: Include <asm/ppc-opcode.h> for VPERMXOR (Paul Menzel) [task:90865]
  - lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 (Paul Menzel) [task:90865]
  - lib/raid6/test: fix multiple definition linking error (Dirk Müller) [task:90865]
  - lib/raid6: Use strict priority ranking for pq gen() benchmarking (Dirk Müller) [task:90865]
  - lib/raid6: skip benchmark of non-chosen xor_syndrome functions (Dirk Müller) [task:90865]
  - lib/raid6: Let $(UNROLL) rules work with macOS userland (John Millikin) [task:90865]
  - lib/raid6/test: fix build on distros whose /bin/sh is not bash (Masahiro Yamada) [task:90865]
  - md/raid6: fix algorithm choice under larger PAGE_SIZE (Zhengyuan Liu) [task:90865]
  - raid6/test: fix a compilation warning (Zhengyuan Liu) [task:90865]
  - lib/raid6: fix unnecessary rebuild of vpermxor*.c (Masahiro Yamada) [task:90865]
  - lib/raid6: refactor unroll rules with pattern rules (Masahiro Yamada) [task:90865]
  - kbuild: remove redundant target cleaning on failure (Masahiro Yamada) [task:90865]
  - lib/raid6: remove duplicated CFLAGS_REMOVE_altivec8.o (Masahiro Yamada) [task:90865]
  - RAID/s390: remove invalid 'r' inline asm operand modifier (Vasily Gorbik) [task:90865]
  - lib/raid6: arm: optimize away a mask operation in NEON recovery routine (Ard Biesheuvel) [task:90865]
  - lib/raid6: use vdupq_n_u8 to avoid endianness warnings (ndesaulniers@google.com) [task:90865]
  - lib/raid6: add option to skip algo benchmarking (Daniel Verkamp) [task:90865]
  - lib/raid6: sort algos in rough performance order (Daniel Verkamp) [task:90865]
  - lib/raid6: check for assembler SSSE3 support (Daniel Verkamp) [task:90865]
  - lib/raid6: avoid __attribute_const__ redefinition (Daniel Verkamp) [task:90865]
  - lib/raid6: add missing include for raid6test (Daniel Verkamp) [task:90865]
  - Revert "md/raid6: fix algorithm choice under larger PAGE_SIZE" (Zhengyuan Liu) [task:90865]
  - crypto: algapi - make crypto_drop_spawn() a no-op on uninitialized spawns (Eric Biggers) [task:90975]
  - dm: do not use waitqueue for request-based DM (Ming Lei) [task:88844]
  - blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight() (Ming Lei) [task:88844]
  - dm mpath: pass IO start time to path selector (Gabriel Krisman Bertazi) [task:88844]
  - dm rq: remove unused arguments from rq_completed() (Mike Snitzer) [task:88844]
  - blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight() (Jens Axboe) [task:88844]
  - KYLIN: Revert "KYLIN: kabi: fix kabi for part->in_flight" (zhanggenjian) [task:88844]
  - net: virtio_net_hdr_to_skb: count transport header in UFO (Jonathan Davies) [task:84718]
  - selftests/net: remove min gso test in packet_snd (Dust Li) [task:84718]
  - net: be more gentle about silly gso requests coming from user (Eric Dumazet) [task:84718]
  - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid (Luiz Augusto von Dentz)
  - Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails (Wang Hai)
  - Bluetooth: Fix use after free in hci_send_acl (Luiz Augusto von Dentz)
  - net/qrtr: fix __netdev_alloc_skb call (Pavel Skripkin)
  - Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data (Gopal Tiwari) [bug:122252]
  - KYLIN: Optimized unixbench tests of Kunpeng 920 (pengcan) [task:85182]
  - KYLIN: security/kysec: optimize process path getting in ppro monitor (yangzhao)
  - KYLIN: security/kysec: remove script checking in kysec_task_kill() (yangzhao) [bug:119471]
  - KYLIN: KYLIN-MAINTAINER: add kylinos maintainer map (Jackie Liu)
  - KYLIN: optee: add ACPI support for Phytium (huanfuxi) [task:84829]
  - KYLIN: sort-commit-by-upstream: fix output patch's format (Jackie Liu)
  - KYLIN: security/kysec: allow killed by itself in kysec_task_kill() (yangzhao)
  - KYLIN: Revert "KYLIN: security/kysec: fix can kill protect task" (yangzhao) [bug:119840]
  - KYLIN: security/kysec: optimize kysec module code (yangzhao) [task:83026]
  - KYLIN: security/kysec: modify inode security mutex to spinlock (yangzhao) [task:83026]
  - KYLIN: security/kysec: implementation of exectl func in bprm_check hook (yangzhao) [task:83026]
  - KYLIN: Loongarch/pci: Set default vga boot device (Zhenneng Li) [task:88294, bug:120253]
  - KYLIN: vga: move fixup_vga to common code (Zhenneng Li)
  - HYGON: newfeature: crypto: ccp: Process multiple VQ commands once for SM4/SM4-CTR ccp. (Yabin Li) [task:84397]
  - HYGON: bugfix: crypto: ccp: It prompt failed when encrypted size is 64KB. (Yabin Li) [task:84397]
  - HYGON: newfeature: crypto: ccp: Process multiple VQ commands once for SM3 ccp. (Yabin Li) [task:84397]
  - HYGON: newfeature: crypto: ccp: Modify value of COMMANDS_PER_QUEUE from 16 to 8192. (Yabin Li) [task:84397]
  - HYGON: bugfix: crypto: ccp: Only handle interrupts by completion, eliminating by empty queue. (Yabin Li) [task:84397]
  - HYGON: bugfix: crypto: ccp: It prompt ILLEGAL_MEM_ADDR when using PSPCCP. (Yabin Li) [task:84397]
  - HYGON: newfeature: Crypto: ccp: Optimize the exchanging context data between crypto and driver. (Yabin Li) [task:84397]
  - KYLIN: sync-stable: add feature find fix commit (Jackie Liu)
  - KYLIN: found-commit-all-deps: Prevent circular lookup dependencies (Jackie Liu)
  - KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID (Paolo Bonzini) [bug:121506] {CVE-2022-1789}


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-46.0.v2207
changelog:
  - LOONGSON: drm/loongson: Resolve 7A2000 vbltest and pageflip errors (liweitao) [task:90934]
  - LOONGSON: drm/loongson: Fixed 7A1000 fbcon screen failure (liweitao) [task:90934]
  - LOONGSON: drm/loongson: loongson_fbdev_init() should called after hotplug works (Sui Jingfeng) [task:90934]
  - LOONGSON: drm/loongson: fix black screen on netboot install of loongnix (Sui Jingfeng) [task:90934]
  - bpf: Add BTF_KIND_FLOAT to uapi (Ilya Leoshkevich) [task:91016]
  - libbpf: Fix type compatibility check copy-paste error (Andrii Nakryiko) [task:91016]
  - libbpf: Implement enum value-based CO-RE relocations (Andrii Nakryiko) [task:91016]
  - libbpf: Implement type-based CO-RE relocations support (Andrii Nakryiko) [task:91016]
  - libbpf: Improve relocation ambiguity detection (Andrii Nakryiko) [task:91016]
  - libbpf: Clean up and improve CO-RE reloc logging (Andrii Nakryiko) [task:91016]
  - libbpf: Improve error logging for mismatched BTF kind cases (Andrii Nakryiko) [task:91016]
  - libbpf: Disable -Wswitch-enum compiler warning (Andrii Nakryiko) [task:91016]
  - libbpf: Ignore incompatible types with matching name during CO-RE relocation (Andrii Nakryiko) [task:91016]
  - libbpf: Fix realloc usage in bpf_core_find_cands (Andrii Nakryiko) [task:91016]
  - libbpf: Improve handling of failed CO-RE relocations (Andrii Nakryiko) [task:91016]
  - libbpf: Support CO-RE relocations for LDX/ST/STX instructions (Andrii Nakryiko) [task:91016]
  - libbpf: Support flexible arrays in CO-RE (Andrii Nakryiko)
  - KYLIN: security/kysec: remove unused variables in kysec_task_kill() (yangzhao)
  - KYLIN: security/kysec: fix bug with .viminfo is set to readonly label (yangzhao) [bug:120931]
  - xfs: Fix false positive lockdep warning with sb_internal & fs_reclaim (Waiman Long) [bug:120083]
  - xfs: rename the speculative block allocation reclaim toggle functions (Darrick J. Wong) [bug:120083]
  - block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern (Haimin Zhang) [bug:112037] {CVE-2022-0494}
  - KYLIN: sync-stable: force reset author every time (Jackie Liu)


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-47.0.v2207
changelog:
  - afs: Fix infinite loop found by xfstest generic/676 (David Howells)
  - sctp: use call_rcu to free endpoint (Xin Long) [bug:124648] {CVE-2022-20154}
  - mmc: block: fix read single on recovery logic (Christian Löhle) [bug:124636] {CVE-2022-20008}
  - io_uring: clean up ->files grabbing (Pavel Begunkov) [task:91386]
  - io_uring: don't rely on weak ->files references (Jens Axboe) [task:91386]
  - io_uring: enable task/files specific overflow flushing (Jens Axboe) [task:91386]
  - io_uring: return cancelation status from poll/timeout/files handlers (Jens Axboe) [task:91386]
  - io_uring: unconditionally grab req->task (Jens Axboe) [task:91386]
  - io_uring: move dropping of files into separate helper (Jens Axboe) [task:91386]
  - io_uring: allow timeout/poll/files killing to take task into account (Jens Axboe) [task:91386]
  - KYLIN: security/kysec: fix panic when 3adm opened and kysec disabled (yangzhao) [bug:124729]
  - KYLIN: security: fix soft lockup bug in security_socket_getpeersec_stream() when security closed (yangzhao) [bug:124559]
  - KYLIN: security/kysec: remove set default rule in module (huanfuxi) [task:91912, bug:124516, bug:109500]
  - KYLIN: Revert "KYLIN: fs/proc: add PKS marking into /proc/osinfo" (huanfuxi)
  - dma-direct: Force unencrypted DMA under SME for certain DMA masks (Tom Lendacky) [bug:122774]
  - dma-direct: Make DIRECT_MAPPING_ERROR viable for SWIOTLB (Robin Murphy) [bug:122774]
  - MIPS: Fix `dma_alloc_coherent' returning a non-coherent allocation (Maciej W. Rozycki) [bug:122774]
  - swiotlb: don't dip into swiotlb pool for coherent allocations (Christoph Hellwig) [bug:122774]
  - swiotlb: refactor swiotlb_map_page (Christoph Hellwig) [bug:122774]
  - swiotlb: use swiotlb_map_page in swiotlb_map_sg_attrs (Christoph Hellwig) [bug:122774]
  - swiotlb: merge swiotlb_unmap_page and unmap_single (Christoph Hellwig) [bug:122774]
  - swiotlb: remove the overflow buffer (Christoph Hellwig) [bug:122774]
  - dma-mapping: merge direct and noncoherent ops (Christoph Hellwig) [bug:122774]
  - dma-mapping: move the dma_coherent flag to struct device (Christoph Hellwig) [bug:122774]
  - KYLIN: osinfo: show working platform (Jackie Liu)
  - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (Eric Dumazet)


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-48.0.v2207
changelog:
  - KYLIN: config: set yutai phy driver config to M. (zhaochenguang) [task:94950]
  - KYLIN: security/kysec: allow record audit log when kysec enabled (yangzhao)
  - faddr2line: Fix overlapping text section failures, the sequel (Josh Poimboeuf)
  - scripts/faddr2line: Fix overlapping text section failures (Josh Poimboeuf)
  - KYLIN: kysec: fix potential out-of-bounds access issues of name (Jackie Liu)
  - KYLIN: kysec: Use pr_debug instead of manual implementation (Jackie Liu)
  - KYLIN: kysec: Remove unnecessary zeroing (Jackie Liu)
  - KYLIN: kysec: use pr_fmt auto generate prefix (Jackie Liu)
  - KYLIN: kysec: adjust kysec disabled state of hooks (Jackie Liu)
  - KYLIN: kysec: exit the thread when kysec is closed (Jackie Liu)
  - KYLIN: osinfo: make uptime pretty for human beings (Jackie Liu)
  - x86/speculation/mmio: Print SMT warning (Josh Poimboeuf) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - KVM: x86/speculation: Disable Fill buffer clear within guests (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation/srbds: Update SRBDS mitigation selection (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - Documentation: Add documentation for Processor MMIO Stale Data (Pawan Gupta) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/cpu: Add another Alder Lake CPU to the Intel family (Gayatri Kammela) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - cpu/speculation: Add prototype for cpu_show_srbds() (Guenter Roeck) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - KVM: VMX: Mark RCX, RDX and RSI as clobbered in vmx_vcpu_run()'s asm blob (Sean Christopherson) [bug:125047]
  - KVM: VMX: fix crash cleanup when KVM wasn't used (Vitaly Kuznetsov) [bug:125047]
  - KVM: s390: vsie: Fix delivery of addressing exceptions (David Hildenbrand) [bug:125047]
  - KVM: s390: vsie: Fix region 1 ASCE sanity shadow address checks (David Hildenbrand) [bug:125047]
  - KVM: VMX: Always VMCLEAR in-use VMCSes during crash with kexec support (Sean Christopherson) [bug:125047]
  - KVM: nVMX: Properly handle userspace interrupt window request (Sean Christopherson) [bug:125047]
  - KVM: x86: Gracefully handle __vmalloc() failure during VM allocation (Sean Christopherson) [bug:125047]
  - KVM: x86: Allocate new rmap and large page tracking when moving memslot (Sean Christopherson) [bug:125047]
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela) [bug:125047] {CVE-2022-21125, CVE-2022-21123, CVE-2022-21166}
  - KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm blobs (Sean Christopherson) [bug:125047]
  - KVM: VMX: Zero out *all* general purpose registers after VM-Exit (Sean Christopherson) [bug:125047]
  - KYLIN: phy:fix fiber and utp can't up at the same time (zhaochenguang) [task:69009]
  - KYLIN: crypto: add sm2 module (yushanshan) [bug:125310]
  - KYLIN: config: enable logitech wheels configuration and force feedback support (Jackie Liu) [task:94256]
  - KYLIN: kernel.spec: fix upgrade from SP1 to SP3 (Jackie Liu) [bug:124466]
  - xfs: cover the log during log quiesce (Brian Foster) [task:82242]
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Brian Foster) [task:82242]
  - xfs: make use of the l_targ field in struct xlog (Christoph Hellwig) [task:82242]
  - xfs: separate log cleaning from log quiesce (Brian Foster) [task:82242]
  - xfs: don't drain buffer lru on freeze and read-only remount (Brian Foster) [task:82242]
  - xfs: rename xfs_wait_buftarg() to xfs_buftarg_drain() (Brian Foster) [task:82242]
  - xfs: ratelimit unmount time per-buffer I/O error alert (Brian Foster) [task:82242]
  - KYLIN: mod-blacklist.sh: drop blacklist of nft_chain_*.ko (Jackie Liu)
  - KYLIN: backport-tools: add convert-to-lts tool (Jackie Liu)
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman) [bug:124640] {CVE-2022-32981}
  - libbpf: Avoid false unuinitialized variable warning in bpf_core_apply_relo (Andrii Nakryiko) [task:93705]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-49.0.v2207
changelog:
  - fs: sysfs_emit: Remove PAGE_SIZE alignment check (Lucas Wei)
  - workqueue: Add RCU annotation for pwq list walk (Sebastian Andrzej Siewior)
  - xfs: fix unused log variable in xfs_log_cover() (Brian Foster)
  - netfilter: nf_tables: do not leave dangling pointer in nf_tables_set_alloc_name (Eric Dumazet) [task:95868]
  - netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup() (Qian Cai) [task:95868]
  - netfilter: nf_tables: fix infinite loop when expr is not available (Florian Westphal) [task:95868]
  - netfilter: nf_tables: autoload modules from the abort path (Pablo Neira Ayuso) [task:95868]
  - netfilter: ecache: don't look for ecache extension on dying/unconfirmed conntracks (Florian Westphal) [task:95868]
  - rcu: Add support for consolidated-RCU reader checking (Joel Fernandes (Google))
  - rcu: Remove redundant debug_locks check in rcu_read_lock_sched_held() (Joel Fernandes (Google))
  - treewide: Rename rcu_dereference_raw_notrace() to _check() (Joel Fernandes (Google))
  - netfilter: nft_meta: skip EAGAIN if nft_meta_bridge is not a module (Pablo Neira Ayuso)
  - netfilter: nf_tables: force module load in case select_ops() returns -EAGAIN (Pablo Neira Ayuso)
  - netfilter: nf_tables: add nft_expr_type_request_module() (Pablo Neira Ayuso)
  - ftrace: Create new ftrace_internal.h header (Steven Rostedt (VMware))
  - KYLIN: sched: Improve spawn test of UnixBench (liwanwu) [bug:119995]
  - KYLIN: net: socket server performance optimization (luoqing) [bug:120014]
  - KYLIN: security/kysec: reduce repeated judgments in kysec_get_status() (yangzhao)
  - KYLIN: fs: Optimize unixbench's file copy test (pengcan) [bug:121719]
  - KYLIN: usb: Improves USB2.0 write performance for External HDD device(0x0b05:0x1932) (Hu Xiaoying) [task:89793]
  - sched/fair: Add document for burstable CFS bandwidth (Huaixin Chang) [task:94280]
  - sched/fair: Add cfs bandwidth burst statistics (Huaixin Chang) [task:94280]
  - sched/fair: Introduce the burstable CFS controller (Huaixin Chang) [task:94280]
  - sched: Defend cfs and rt bandwidth quota against overflow (Huaixin Chang) [task:94280]
  - KYLIN: add linux_headers_install.sh script to build out of tree modules (George Guo) [task:94951]
  - KYLIN: loongarch/config: support parport as module (wangxuewen) [task:95203]
  - KYLIN: io_uring: fix missing remove ITER_KVEC (Jackie Liu) [task:96351]
  - KYLIN: ft-hda: solve ft-hda losing when reboot (songxiebing) [task:93001]
  - hwmon: (scpi-hwmon) shows the negative temperature properly (Riwen Lu) [bug:56117]
  - io_uring: fix ignoring xa_store errors (Pavel Begunkov) [task:95530]
  - io_uring: Fix XArray usage in io_uring_add_task_file (Matthew Wilcox (Oracle)) [task:95530]
  - io_uring: don't run task work on an exiting task (Jens Axboe) [task:95530]
  - task_work: only grab task signal lock when needed (Jens Axboe) [task:95530]
  - io_uring: no need to call xa_destroy() on empty xarray (Jens Axboe) [task:96230]
  - tc-tests: test denial of 'goto chain' for exceed traffic in police.json (Davide Caratti)
  - xfs: don't reserve per-AG space for an internal log (Darrick J. Wong) [task:82242]
  - KYLIN: Revert "KYLIN: logo: Change YHKYLIN logo to KYLINSOFT." (Jackie Liu) [task:74569]
  - KYLIN: kysec: Optimize the operation of kysec under file paths (Jackie Liu)
  - KYLIN: kysec: Use static_key instead of unlikely to further optimize efficiency (Jackie Liu)
  - KYLIN: loongarch/config: Add support for two filesystems on loongarch (wangxuewen) [bug:122374]
  - xhci: Keep interrupt disabled in initialization until host is running. (Hongyu Xie) [task:95460]
  - KYLIN: kysec: Fix kysec crash due to kysec_is_disabled bug (Jackie Liu) [task:95345]
  - KYLIN: kysec: Optimize kysec_is_disabled branch prediction (Jackie Liu)


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-50.0.v2207
changelog:
  - KYLIN: fix errors when run ./linux-headers-$version.sh (George Guo) [task:94951]
  - KYLIN: net: replace cpumask_equal with cpumask_subset (xiaolinkui) [task:97876]
  - KYLIN: loongarch: fix io_uring series system call exception (Enze Li) [bug:124889]
  - selftests/x86/mov_ss_trap: Fix the SYSENTER test (Andy Lutomirski)
  - KYLIN: x86: debug_defconfig: more netfilter test module (Jackie Liu)
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (huhai) [task:94748]
  - io_uring: Convert advanced XArray uses to the normal API (Matthew Wilcox (Oracle)) [task:98126]
  - exec: Move io_uring_task_cancel after the point of no return (Eric W. Biederman) [task:97817]
  - futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI (Thomas Gleixner) [task:87159]
  - clocksource/drivers/arm_arch_timer: Use stable count reader in erratum sne (Keqian Zhu) [task:87159]
  - futex: Adjust absolute futex timeouts with per time namespace offset (Andrei Vagin) [task:87159]
  - arm64: vdso32: make vdso32 install conditional (Frank van der Linden) [task:87159]
  - ARM64: vdso32: Install vdso32 from vdso_install (Stephen Boyd) [task:87159]
  - vdso/treewide: Add vdso_data pointer argument to __arch_get_hw_counter() (Thomas Gleixner) [task:87159]
  - timekeeping/vsyscall: Provide vdso_update_begin/end() (Thomas Gleixner) [task:87159]
  - lib/vdso: Allow to add architecture-specific vdso data (Sven Schnelle) [task:87159]
  - arm64: enable time namespace support (Andrei Vagin) [task:87159]
  - arm64/vdso: Restrict splitting VVAR VMA (Andrei Vagin) [task:87159]
  - arm64/vdso: Handle faults on timens page (Andrei Vagin) [task:87159]
  - arm64/vdso: Add time namespace page (Andrei Vagin) [task:87159]
  - arm64/vdso: Zap vvar pages when switching to a time namespace (Andrei Vagin) [task:87159]
  - arm64/vdso: use the fault callback to map vvar pages (Andrei Vagin) [task:87159]
  - futex: Remove unused or redundant includes (André Almeida) [task:87159]
  - arm64: compat: Allow 32-bit vdso and sigpage to co-exist (Will Deacon) [task:87159]
  - mmap locking API: initial implementation as rwsem wrappers (Michel Lespinasse) [task:87159]
  - x86/vdso: Unbreak paravirt VDSO clocks (Thomas Gleixner) [task:87159]
  - lib/vdso: Provide sanity check for cycles (again) (Thomas Gleixner) [task:87159]
  - clocksource: Remove obsolete ifdef (Thomas Gleixner) [task:87159]
  - selftests/timens: handle a case when alarm clocks are not supported (Andrei Vagin) [task:87159]
  - arm64: vdso: Add --eh-frame-hdr to ldflags (Vincenzo Frascino) [task:87159]
  - arm64: vdso: Add -fasynchronous-unwind-tables to cflags (Vincenzo Frascino) [task:87159]
  - arm64: vdso: use consistent 'map' nomenclature (Mark Rutland) [task:87159]
  - arm64: vdso: use consistent 'abi' nomenclature (Mark Rutland) [task:87159]
  - arm64: vdso: simplify arch_vdso_type ifdeffery (Mark Rutland) [task:87159]
  - arm64: vdso: remove aarch32_vdso_pages[] (Mark Rutland) [task:87159]
  - arm64: vdso: Add '-Bsymbolic' to ldflags (Vincenzo Frascino) [task:87159]
  - kbuild: fix DT binding schema rule again to avoid needless rebuilds (Masahiro Yamada) [task:87159]
  - x86/vdso/vdso2c: Convert iterators to unsigned (Dmitry Safonov) [task:87159]
  - x86/vdso/vdso2c: Correct error messages on file open (Dmitry Safonov) [task:87159]
  - vdso/datapage: Use correct clock mode name in comment (Christian Brauner) [task:87159]
  - proc, time/namespace: Show clock symbolic names in /proc/pid/timens_offsets (Andrei Vagin) [task:87159]
  - arm64: vdso: don't free unallocated pages (Mark Rutland) [task:87159]
  - time/namespace: Add max_time_namespaces ucount (Dmitry Safonov) [task:87159]
  - time/namespace: Fix time_for_children symlink (Michael Kerrisk (man-pages)) [task:87159]
  - um: Fix header inclusion (Vincenzo Frascino) [task:87159]
  - lib/vdso: Enable common headers (Vincenzo Frascino) [task:87159]
  - x86/vdso: Enable x86 to use common headers (Vincenzo Frascino) [task:87159]
  - arm64: vdso32: Include common headers in the vdso library (Vincenzo Frascino) [task:87159]
  - arm64: vdso: Include common headers in the vdso library (Vincenzo Frascino) [task:87159]
  - arm64: Introduce asm/vdso/processor.h (Vincenzo Frascino) [task:87159]
  - arm64: vdso32: Code clean up (Vincenzo Frascino) [task:87159]
  - linux/elfnote.h: Replace elf.h with UAPI equivalent (Vincenzo Frascino) [task:87159]
  - common: Introduce processor.h (Vincenzo Frascino) [task:87159]
  - linux/ktime.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/jiffies.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/time64.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/time32.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/time.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/math64.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/clocksource.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - arm64: Introduce asm/vdso/clocksource.h (Vincenzo Frascino) [task:87159]
  - x86: Introduce asm/vdso/clocksource.h (Vincenzo Frascino) [task:87159]
  - linux/limits.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/bits.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - linux/const.h: Extract common header for vDSO (Vincenzo Frascino) [task:87159]
  - arm64: compat: Fix syscall number of compat_clock_getres (Vincenzo Frascino) [task:87159]
  - selftests/timens: Remove duplicated include <time.h> (YueHaibing) [task:87159]
  - sys/sysinfo: Respect boottime inside time namespace (Cyril Hrubis) [task:87159]
  - kbuild: fix DT binding schema rule to detect command line changes (Masahiro Yamada) [task:87159]
  - clocksource/drivers/arm_arch_timer: Fix vDSO clockmode when vDSO disabled (Vincenzo Frascino) [task:87159]
  - lib/vdso: Allow architectures to provide the vdso data pointer (Christophe Leroy) [task:87159]
  - lib/vdso: Allow architectures to override the ns shift operation (Christophe Leroy) [task:87159]
  - lib/vdso: Allow fixed clock mode (Christophe Leroy) [task:87159]
  - lib/vdso: Move VCLOCK_TIMENS to vdso_clock_modes (Thomas Gleixner) [task:87159]
  - lib/vdso: Avoid highres update if clocksource is not VDSO capable (Thomas Gleixner) [task:87159]
  - lib/vdso: Cleanup clock mode storage leftovers (Thomas Gleixner) [task:87159]
  - ARM/arm64: vdso: Use common vdso clock mode storage (Thomas Gleixner) [task:87159]
  - x86/vdso: Use generic VDSO clock mode storage (Thomas Gleixner) [task:87159]
  - clocksource: Add common vdso clock mode storage (Thomas Gleixner) [task:87159]
  - x86/vdso: Move VDSO clocksource state tracking to callback (Thomas Gleixner) [task:87159]
  - clocksource: Cleanup struct clocksource and documentation (Thomas Gleixner) [task:87159]
  - lib/vdso: Allow the high resolution parts to be compiled out (Thomas Gleixner) [task:87159]
  - x86/vdso: Mark the TSC clocksource path likely (Thomas Gleixner) [task:87159]
  - selftests: use LDLIBS for libraries instead of LDFLAGS (Dmitry Safonov)
  - KVM: x86: reorganize pvclock_gtod_data members (Paolo Bonzini) [task:87159]
  - MAINTAINERS: Correct path to time namespace source file (Dmitry Safonov) [task:87159]
  - MIPS: syscalls: fix indentation of the 'SYSNR' message (Alexander Lobakin) [task:87159]
  - lib/vdso: Update coarse timekeeper unconditionally (Thomas Gleixner) [task:87159]
  - lib/vdso: Make __arch_update_vdso_data() logic understandable (Thomas Gleixner) [task:87159]
  - lib/vdso: Only read hrtimer_res when needed in __cvdso_clock_getres() (Christophe Leroy) [task:87159]
  - selftests/timens: Check for right timens offsets after fork and exec (Andrei Vagin) [task:87159]
  - selftests/timens: Add a simple perf test for clock_gettime() (Andrei Vagin) [task:87159]
  - selftests/timens: Add timer offsets test (Andrei Vagin) [task:87159]
  - selftests/timens: Add procfs selftest (Dmitry Safonov) [task:87159]
  - selftests/timens: Add a test for clock_nanosleep() (Andrei Vagin) [task:87159]
  - selftests/timens: Add a test for timerfd (Andrei Vagin) [task:87159]
  - selftests/timens: Add Time Namespace test for supported clocks (Dmitry Safonov) [task:87159]
  - fs/proc: Introduce /proc/pid/timens_offsets (Andrei Vagin) [task:87159]
  - x86/vdso: Zap vvar pages when switching to a time namespace (Dmitry Safonov) [task:87159]
  - x86/vdso: On timens page fault prefault also VVAR page (Dmitry Safonov) [task:87159]
  - x86/vdso: Handle faults on timens page (Dmitry Safonov) [task:87159]
  - time: Allocate per-timens vvar page (Dmitry Safonov) [task:87159]
  - x86/vdso: Add time napespace page (Dmitry Safonov) [task:87159]
  - x86/vdso: Provide vdso_data offset on vvar_page (Dmitry Safonov) [task:87159]
  - lib/vdso: Prepare for time namespace support (Thomas Gleixner) [task:87159]
  - x86/vdso: Restrict splitting VVAR VMA (Dmitry Safonov) [task:87159]
  - fs/proc: Respect boottime inside time namespace for /proc/uptime (Dmitry Safonov) [task:87159]
  - posix-timers: Make clock_nanosleep() time namespace aware (Andrei Vagin) [task:87159]
  - hrtimers: Prepare hrtimer_nanosleep() for time namespaces (Andrei Vagin) [task:87159]
  - alarmtimer: Make nanosleep() time namespace aware (Andrei Vagin) [task:87159]
  - posix-timers: Make timer_settime() time namespace aware (Andrei Vagin) [task:87159]
  - timerfd: Make timerfd_settime() time namespace aware (Andrei Vagin) [task:87159]
  - time: Add do_timens_ktime_to_host() helper (Andrei Vagin) [task:87159]
  - posix-clocks: Wire up clock_gettime() with timens offsets (Andrei Vagin) [task:87159]
  - posix-timers: Use clock_get_ktime() in common_timer_get() (Andrei Vagin) [task:87159]
  - posix-clocks: Introduce clock_get_ktime() callback (Andrei Vagin) [task:87159]
  - alarmtimer: Provide get_timespec() callback (Andrei Vagin) [task:87159]
  - alarmtimer: Rename gettime() callback to get_ktime() (Andrei Vagin) [task:87159]
  - posix-clocks: Rename .clock_get_timespec() callbacks accordingly (Andrei Vagin) [task:87159]
  - posix-clocks: Rename the clock_get() callback to clock_get_timespec() (Andrei Vagin) [task:87159]
  - time: Add timens_offsets to be used for tasks in time namespace (Andrei Vagin) [task:87159]
  - ns: Introduce Time Namespace (Andrei Vagin) [task:87159]
  - lib/vdso: Mark do_hres() and do_coarse() as __always_inline (Andrei Vagin) [task:87159]
  - lib/vdso: Avoid duplication in __cvdso_clock_getres() (Christophe Leroy) [task:87159]
  - lib/vdso: Add unlikely() hint into vdso_read_begin() (Andrei Vagin) [task:87159]
  - lib/vdso: Let do_coarse() return 0 to simplify the callsite (Christophe Leroy) [task:87159]
  - x86/vdso: Remove unused VDSO_HAS_32BIT_FALLBACK (Vincenzo Frascino) [task:87159]
  - arm64: compat: vdso: Remove unused VDSO_HAS_32BIT_FALLBACK (Vincenzo Frascino) [task:87159]
  - lib/vdso: Remove checks on return value for 32 bit vDSO (Vincenzo Frascino) [task:87159]
  - lib/vdso: Remove VDSO_HAS_32BIT_FALLBACK (Vincenzo Frascino) [task:87159]
  - lib/vdso: Build 32 bit specific functions in the right context (Vincenzo Frascino) [task:87159]
  - arm64: compat: vdso: Expose BUILD_VDSO32 (Vincenzo Frascino) [task:87159]
  - raid6/test: fix a compilation error (Zhengyuan Liu) [task:87159]
  - lib/vdso: Make __cvdso_clock_getres() static (Vincenzo Frascino) [task:87159]
  - y2038: vdso: change time_t to __kernel_old_time_t (Arnd Bergmann) [task:87159]
  - y2038: add __kernel_old_timespec and __kernel_old_time_t (Arnd Bergmann) [task:87159]
  - selftests: gen_kselftest_tar.sh: Do not clobber kselftest/ (Kees Cook) [task:87159]
  - selftests: breakpoints: Fix a typo of function name (Masami Hiramatsu) [task:87159]
  - timekeeping/vsyscall: Update VDSO data unconditionally (Huacai Chen) [task:87159]
  - KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti) [task:87159]
  - lib/vdso: Make clock_getres() POSIX compliant again (Thomas Gleixner) [task:87159]
  - selftests: Add kselftest-all and kselftest-install targets (Shuah Khan) [task:87159]
  - um: Fix VDSO compiler warning (Johannes Berg) [task:87159]
  - ipc: fix sparc64 ipc() wrapper (Arnd Bergmann) [task:87159]
  - timekeeping/vsyscall: Prevent math overflow in BOOTTIME update (Thomas Gleixner) [task:87159]
  - selftests: use "$(MAKE)" instead of "make" (Ilya Leoshkevich) [task:87159]
  - arm64: compat: vdso: Use legacy syscalls as fallback (Thomas Gleixner) [task:87159]
  - x86/vdso/32: Use 32bit syscall fallback (Thomas Gleixner) [task:87159]
  - lib/vdso/32: Provide legacy syscall fallbacks (Thomas Gleixner) [task:87159]
  - lib/vdso: Move fallback invocation to the callers (Thomas Gleixner) [task:87159]
  - lib/vdso/32: Remove inconsistent NULL pointer checks (Thomas Gleixner) [task:87159]
  - kselftest: save-and-restore errno to allow for %m formatting (Aleksa Sarai)
  - arm64: vdso: Cleanup Makefiles (Vincenzo Frascino) [task:87159]
  - arm64: vdso: fix flip/flop vdso build bug (Naohiro Aota) [task:87159]
  - linux/bits.h: make BIT(), GENMASK(), and friends available in assembly (Masahiro Yamada) [task:87159]
  - x86/vdso: Fix flip/flop vdso build bug (Naohiro Aota) [task:87159]
  - timekeeping/vsyscall: Use __iter_div_u64_rem() (Arnd Bergmann) [task:87159]
  - arm64: compat: Fix __arch_get_hw_counter() implementation (Vincenzo Frascino) [task:87159]
  - arm64: Fix __arch_get_hw_counter() implementation (Vincenzo Frascino) [task:87159]
  - lib/vdso: Make delta calculation work correctly (Thomas Gleixner) [task:87159]
  - arm64: compat: No need for pre-ARMv7 barriers on an ARMv8 system (Catalin Marinas) [task:87159]
  - arm64: vdso: Remove unnecessary asm-offsets.c definitions (Catalin Marinas) [task:87159]
  - vdso: Remove superfluous #ifdef __KERNEL__ in vdso/datapage.h (Catalin Marinas) [task:87159]
  - x86/vdso: Add clock_gettime64() entry point (Vincenzo Frascino) [task:87159]
  - x86/vdso: Add clock_getres() entry point (Vincenzo Frascino) [task:87159]
  - x86/vdso: Switch to generic vDSO implementation (Vincenzo Frascino) [task:87159]
  - arm64: vdso: Enable vDSO compat support (Vincenzo Frascino) [task:87159]
  - arm64: compat: Get sigreturn trampolines from vDSO (Vincenzo Frascino) [task:87159]
  - arm64: elf: VDSO code page discovery (Vincenzo Frascino) [task:87159]
  - arm64: compat: VDSO setup for compat layer (Vincenzo Frascino) [task:87159]
  - arm64: vdso: Refactor vDSO code (Vincenzo Frascino) [task:87159]
  - arm64: compat: Add vDSO (Vincenzo Frascino) [task:87159]
  - arm64: compat: Generate asm offsets for signals (Vincenzo Frascino) [task:87159]
  - arm64: compat: Expose signal related structures (Vincenzo Frascino) [task:87159]
  - arm64: compat: Add missing syscall numbers (Vincenzo Frascino) [task:87159]
  - arm64: vdso: Build vDSO with -ffixed-x18 (Peter Collingbourne) [task:87159]
  - arm64: vdso: Substitute gettimeofday() with C implementation (Vincenzo Frascino) [task:87159]
  - timekeeping: Provide a generic update_vsyscall() implementation (Vincenzo Frascino) [task:87159]
  - lib/vdso: Add compat support (Vincenzo Frascino) [task:87159]
  - lib/vdso: Provide generic VDSO implementation (Vincenzo Frascino) [task:87159]
  - vdso: Define standardized vdso_datapage (Vincenzo Frascino) [task:87159]
  - hrtimer: Split out hrtimer defines into separate header (Vincenzo Frascino) [task:87159]
  - clocksource/drivers/arm_arch_timer: Don't trace count reader functions (Julien Thierry) [task:87159]
  - selftests: vm: Fix test build failure when built by itself (Shuah Khan) [task:87159]
  - tests: fix pidfd-test compilation (Christian Brauner) [task:87159]
  - arm64: arch_timer: mark functions as __always_inline (Anders Roxell) [task:87159]
  - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 223 (Thomas Gleixner) [task:87159]
  - selftests: Remove forced unbuffering for test running (Kees Cook) [task:87159]
  - arm64: vdso: Explicitly add build-id option (Laura Abbott) [task:87159]
  - selftests: fix bpf build/test workflow regression when KBUILD_OUTPUT is set (Shuah Khan) [task:87159]
  - selftests: fix install target to use default install path (Shuah Khan) [task:87159]
  - x86/vdso: Remove hpet_page from vDSO (Jia Zhang) [task:87159]
  - clocksource/arm_arch_timer: Use arch_timer_read_counter to access stable counters (Marc Zyngier) [task:87159]
  - clocksource/arm_arch_timer: Remove use of workaround static key (Marc Zyngier) [task:87159]
  - clocksource/arm_arch_timer: Drop use of static key in arch_timer_reg_read_stable (Marc Zyngier) [task:87159]
  - clocksource/arm_arch_timer: Direcly assign set_next_event workaround (Marc Zyngier) [task:87159]
  - arm64: Use arch_timer_read_counter instead of arch_counter_get_cntvct (Marc Zyngier) [task:87159]
  - watchdog/sbsa: Use arch_timer_read_counter instead of arch_counter_get_cntvct (Marc Zyngier) [task:87159]
  - arm64: arch_timer: Ensure counter register reads occur with seqlock held (Will Deacon) [task:87159]
  - selftests: Add test plan API to kselftest.h and adjust callers (Kees Cook)
  - selftests: Move test output to diagnostic lines (Kees Cook)
  - selftests: Distinguish between missing and non-executable (Kees Cook)
  - selftests: Add plan line and fix result line syntax (Kees Cook)
  - selftests: Extract logic for multiple test runs (Kees Cook)
  - selftests: Use runner.sh for emit targets (Kees Cook)
  - selftests: Extract single-test shell logic from lib.mk (Kees Cook)
  - arm64: compat: Add KUSER_HELPERS config option (Vincenzo Frascino) [task:87159]
  - arm64: compat: Refactor aarch32_alloc_vdso_pages() (Vincenzo Frascino) [task:87159]
  - arm64: compat: Split kuser32 (Vincenzo Frascino) [task:87159]
  - arm64: compat: Alloc separate pages for vectors and sigpage (Vincenzo Frascino) [task:87159]
  - selftests: fix headers_install circular dependency (Shuah Khan) [task:87159]
  - x86/vdso: Rename variable to fix -Wshadow warning (Leonardo Brás) [task:87159]
  - arm64: vdso: Fix clock_getres() for CLOCK_REALTIME (Vincenzo Frascino) [task:87159]
  - arch: add pidfd and io_uring syscalls everywhere (Arnd Bergmann)
  - arm64: vdso: use $(LD) instead of $(CC) to link VDSO (Masahiro Yamada) [task:87159]
  - arm64: vdso: fix and clean-up Makefile (Masahiro Yamada) [task:87159]
  - perf tools: Update x86's syscall_64.tbl, no change in tools/perf behaviour (Arnaldo Carvalho de Melo) [task:87159]
  - linux/kernel.h: split *_MAX and *_MIN macros into <linux/limits.h> (Masahiro Yamada) [task:87159]
  - linux/kernel.h: use 'short' to define USHRT_MAX, SHRT_MAX, SHRT_MIN (Masahiro Yamada) [task:87159]
  - selftests: add tests for pidfd_send_signal() (Christian Brauner)
  - checksyscalls: fix up mq_timedreceive and stat exceptions (Arnd Bergmann) [task:87159]
  - time: Add time_types.h (Deepa Dinamani) [task:87159]
  - sh: fix build error for invisible CONFIG_BUILTIN_DTB_SOURCE (Masahiro Yamada) [task:87159]
  - y2038: add 64-bit time_t syscalls to all 32-bit architectures (Arnd Bergmann)
  - socket: Add struct __kernel_sock_timeval (Deepa Dinamani) [task:87159]
  - arch: sparc: Override struct __kernel_old_timeval (Deepa Dinamani) [task:87159]
  - kbuild: add real-prereqs shorthand for $(filter-out FORCE,$^) (Masahiro Yamada) [task:87159]
  - kbuild: simplify rules of data compression with size appending (Masahiro Yamada) [task:87159]
  - alpha: add generic get{eg,eu,g,p,u,pp}id() syscalls (Arnd Bergmann)
  - alpha: add standard statfs64/fstatfs64 syscalls (Arnd Bergmann)
  - sparc64: fix sparc_ipc type conversion (Arnd Bergmann)
  - sh: remove duplicate unistd_32.h file (Arnd Bergmann)
  - arch: add pkey and rseq syscall numbers everywhere (Arnd Bergmann)
  - ipc: rename old-style shmctl/semctl/msgctl syscalls (Arnd Bergmann)
  - arch: add split IPC system calls where needed (Arnd Bergmann)
  - sh: add statx system call (Arnd Bergmann)
  - m68k: assign syscall number for seccomp (Arnd Bergmann)
  - ARM: add kexec_file_load system call number (Arnd Bergmann)
  - ARM: add migrate_pages() system call (Arnd Bergmann)
  - alpha: wire up io_pgetevents system call (Arnd Bergmann)
  - ia64: assign syscall numbers for perf and seccomp (Arnd Bergmann)
  - ia64: add statx and io_pgetevents syscalls (Arnd Bergmann)
  - alpha: update syscall macro definitions (Arnd Bergmann)
  - s390: fix system call tracing (Heiko Carstens) [task:87159]
  - arm64: asm-offsets: remove unused offsets (Andrew Murray) [task:87159]
  - s390: remove compat_wrapper.c (Arnd Bergmann)
  - s390: autogenerate compat syscall wrappers (Arnd Bergmann)
  - s390: use generic UID16 implementation (Arnd Bergmann)
  - ipc: introduce ksys_ipc()/compat_ksys_ipc() for s390 (Arnd Bergmann)
  - s390: open-code s390_personality syscall (Arnd Bergmann)
  - kbuild: remove unused baseprereq (Masahiro Yamada) [task:87159]
  - kbuild: clean up rule_dtc_dt_yaml (Masahiro Yamada) [task:87159]
  - tools headers uapi: Sync copy of asm-generic/unistd.h with the kernel sources (Arnaldo Carvalho de Melo) [task:87159]
  - arm64: compat: Hook up io_pgetevents() for 32-bit tasks (Will Deacon)
  - arm64: replace arm64-obj-* in Makefile with obj-* (Masahiro Yamada) [task:87159]
  - alpha: generate uapi header and syscall table header files (Firoz Khan)
  - alpha: add system call table generation support (Firoz Khan)
  - alpha: add __NR_syscalls along with NR_SYSCALLS (Firoz Khan)
  - alpha: remove CONFIG_OSF4_COMPAT flag from syscall table (Firoz Khan)
  - alpha: move __IGNORE* entries to non uapi header (Firoz Khan)
  - powerpc: add system call table generation support (Firoz Khan)
  - sh: add system call table generation support (Firoz Khan)
  - sh: add __NR_syscalls along with NR_syscalls (Firoz Khan)
  - mips: add system call table generation support (Firoz Khan)
  - seccomp, s390: fix build for syscall type change (Tycho Andersen)
  - kbuild: Add support for DT binding schema checks (Rob Herring) [task:87159]
  - parisc: add system call table generation support (Firoz Khan)
  - parisc: move __IGNORE* entries to non uapi header (Firoz Khan)
  - asm-generic: add kexec_file_load system call to unistd.h (AKASHI Takahiro)
  - x86/vdso: Remove obsolete "fake section table" reservation (Sean Christopherson) [task:87159]
  - m68k: Add system call table generation support (Firoz Khan)
  - xtensa: add system call table generation support (Firoz Khan)
  - riscv: add asm/unistd.h UAPI header (David Abdurachmanov) [task:87159]
  - sparc: add system call table generation support (Firoz Khan)
  - sparc: move __IGNORE* entries to non uapi header (Firoz Khan)
  - microblaze: add system call table generation support (Firoz Khan)
  - ia64: add system call table generation support (Firoz Khan)
  - builddeb: Fix inclusion of dtbs in debian package (Rob Herring) [task:87159]
  - tools arch uapi: Update asm-generic/unistd.h and arm64 unistd.h copies (Arnaldo Carvalho de Melo) [task:87159]
  - x86: convert vdso to use vm_fault_t (Matthew Wilcox) [task:87159]
  - mm: introduce vmf_insert_pfn_prot() (Matthew Wilcox) [task:87978]
  - mm: remove vm_insert_mixed() (Matthew Wilcox) [task:87978]
  - cramfs: convert to use vmf_insert_mixed (Nicolas Pitre) [task:87978]
  - mm: convert to use vm_fault_t (Souptick Joarder) [task:87978]
  - kbuild: remove unneeded link_multi_deps (Masahiro Yamada) [task:87159]
  - x86/vdso: Initialize the CPU/node NR segment descriptor earlier (Chang S. Bae) [task:87159]
  - x86/vdso: Introduce helper functions for CPU and node number (Chang S. Bae) [task:87159]
  - x86/segments/64: Rename the GDT PER_CPU entry to CPU_NUMBER (Chang S. Bae) [task:87159]
  - x86/vdso: Rearrange do_hres() to improve code generation (Andy Lutomirski) [task:87159]
  - x86/vdso: Document vgtod_ts better (Andy Lutomirski) [task:87159]
  - x86/vdso: Remove "memory" clobbers in the vDSO syscall fallbacks (Andy Lutomirski) [task:87159]
  - x66/vdso: Add CLOCK_TAI support (Thomas Gleixner) [task:87159]
  - x86/vdso: Move cycle_last handling into the caller (Thomas Gleixner) [task:87159]
  - x86/vdso: Simplify the invalid vclock case (Thomas Gleixner) [task:87159]
  - x86/vdso: Replace the clockid switch case (Thomas Gleixner) [task:87159]
  - x86/vdso: Collapse coarse functions (Thomas Gleixner) [task:87159]
  - x86/vdso: Collapse high resolution functions (Thomas Gleixner) [task:87159]
  - x86/vdso: Introduce and use vgtod_ts (Thomas Gleixner) [task:87159]
  - x86/vdso: Use unsigned int consistently for vsyscall_gtod_data:: Seq (Thomas Gleixner) [task:87159]
  - x86/vdso: Enforce 64bit clocksource (Thomas Gleixner) [task:87159]
  - x86/time: Implement clocksource_arch_init() (Thomas Gleixner) [task:87159]
  - clocksource: Provide clocksource_arch_init() (Thomas Gleixner) [task:87159]
  - kbuild: consolidate Devicetree dtb build rules (Rob Herring) [task:87159]
  - nios2: use common rules to build built-in dtb (Rob Herring) [task:87159]
  - powerpc: build .dtb files in dts directory (Rob Herring) [task:87159]
  - nios2: build .dtb files in dts directory (Rob Herring) [task:87159]
  - scripts/dtc: Update to upstream version v1.4.7-14-gc86da84d30e4 (Rob Herring) [task:87159]
  - RISC-V: Request newstat syscalls (Guenter Roeck) [task:87159]
  - y2038: socket: Change recvmmsg to use __kernel_timespec (Arnd Bergmann) [task:87159]
  - y2038: Remove newstat family from default syscall set (Arnd Bergmann)
  - y2038: globally rename compat_time to old_time32 (Arnd Bergmann) [task:87978]
  - alpha: use alpha_ni_syscall only for syscall zero (Al Viro)
  - KYLIN: Revert "arm64: arch_timer: Disable CNTVCT_EL0 trap if workaround is enabled" (Jackie Liu)
  - KYLIN: Revert "arm64:vdso: Rewrite gettimeofday into C." (Jackie Liu)
  - KYLIN: Revert "arm64: arch_timer: Ensure counter register reads occur with seqlock held" (Jackie Liu)
  - KYLIN: Revert "arm64: vdso: Fix clock_getres() for CLOCK_REALTIME" (Jackie Liu)
  - KYLIN: Revert "arm64: vdso: do cntvct workaround in the VDSO" (Jackie Liu)
  - KYLIN: Revert "arm64: vdso: move vdso_fix into struct vdso_data" (Jackie Liu)
  - KYLIN: Revert "arm64: arch_timer: only do cntvct workaround on VDSO path on D05" (Jackie Liu)
  - KYLIN: Revert "KYLIN: arm/arch_timer: fix build missing CONFIG_HISILICON_ERRATUM_161010101" (Jackie Liu)
  - KYLIN: Revert "clocksource/drivers/arch_timer: Fix vdso_fix compile error for arm32" (Jackie Liu)
  - KYLIN: Revert "arm64:ilp32: add vdso-ilp32 and use for signal return" (Jackie Liu)
  - netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c. (David Wilder) [task:95566]
  - netfilter: ip6tables: Split ip6t_unregister_table() into pre_exit and exit helpers. (David Wilder) [task:95566]
  - netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c. (David Wilder) [task:95566]
  - netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers. (David Wilder) [task:95566]
  - netns: restore ops before calling ops_exit_list (Li RongQing) [task:95566]
  - netns: add pre_exit method to struct pernet_operations (Eric Dumazet) [task:95566]
  - KYLIN: scsi: Add SCSI_DH* config for loongarch. (cuitao) [task:92151]
  - KYLIN: security/kysec: update kysec_mempro module (huanfuxi) [bug:128578]
  - drm/ast: Create the driver for ASPEED proprietory Display-Port (KuoHsiang Chou) [task:94616]
  - drm/ast: Create threshold values for AST2600 (KuoHsiang Chou) [task:94616]
  - drm/ast: Enable the supporting of wide screen on AST2600 (KuoHsiang Chou) [task:94616]
  - drm/ast: Create chip AST2600 (KuoHsiang Chou) [task:94616]
  - NETSWIFT :txgbe: update the driver to 1.3.2 (luoqing) [task:92912]
  - NETSWIFT :txgbe: FIX : fix compile in linux 3.10 (mengyuanlou) [task:92912]
  - NETSWIFT :txgbe: ADD : add flash unlock when upgrade image (mengyuanlou) [task:92912]
  - NETSWIFT :txgbe: FIX : fix some kr flow (mengyuanlou) [task:92912]
  - NETSWIFT :txgbe: fix bug when 1820 is in 1G sfp speed mode, link partner (linglingzhang) [task:92912]
  - NETSWIFT :txgbe: add support for oem ssid and svid (linglingzhang) [task:92912]
  - NETSWIFT :txgbe: add pcie recover switch (zhengzhenpeng) [task:92912]
  - NETSWIFT :txgbe: fix pcie recover bugs (zhengzhenpeng) [task:92912]
  - NETSWIFT :txgbe: FIX : fix vxlan/geneve port not set to hardware (mengyuanlou) [task:92912]
  - NETSWIFT: ngbe: update the driver to 1.2.2 (luoqing) [task:92912]
  - NETSWIFT :ngbe: ADD : add yt 101 mode support (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: FIX : fix compile in ubuntu 21.10 (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: busfix linkspeed setup failed when link is down (zhengzhenpeng) [task:92912]
  - NETSWIFT :ngbe: ADD-add-link-retry-switch-to-configure (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: add support for oem ssid and svid (linglingzhang) [task:92912]
  - NETSWIFT :ngbe: ADD : add yt8531s id support (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: read flash from flash only in phy init (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: ADD : add retry use an err bit (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: CH : use sw configure efuse (mengyuanlou) [task:92912]
  - NETSWIFT :ngbe: add pcie recover switch (zhengzhenpeng) [task:92912]
  - NETSWIFT :ngbe: fix pcie recover bugs (zhengzhenpeng) [task:92912]
  - NETSWIFT :ngbe: fix phy set to force 100M autoneg off with partner (zhengzhenpeng) [task:92912]
  - WIREGUARD-LINUX-COMPAT: net: WireGuard secure network tunnel (Jason A. Donenfeld) [task:90253]
  - vt: drop old FONT ioctls (Jiri Slaby) [bug:128721] {CVE-2021-33656}
  - KYLIN: debug_defconfig: enable CONFIG_UBSAN (Jackie Liu)
  - KYLIN: sync-stable: fix wrong exit status when failed (Jackie Liu)
  - crypto: hisilicon delete invlaid api and config (Yu'an Wang) [bug:122239]
  - crypto: hisilicon - add CRYPTO_TFM_REQ_MAY_BACKLOG flag judge in sec_process() (Yu'an Wang) [bug:122239]
  - uacce: misc fixes (Yu'an Wang) [bug:122239]
  - misc/uacce: fixup out-of-bounds array write (Yu'an Wang) [bug:122239]
  - crypto/sec: add aead support for user-side (Yu'an Wang) [bug:122239]
  - UACCE: backport from mainline (Yu'an Wang) [bug:122239]
  - crypto: hisilicon-Cap block size at 2^31 (Yu'an Wang) [bug:122239]
  - crypto: hisilicon-hpre add req check when callback (Yu'an Wang) [bug:122239]
  - crypto: hisilicon- count send_ref when sending bd (Yu'an Wang) [bug:122239]
  - crypto: hisilicon-enhancement of qm DFX (Yu'an Wang) [bug:122239]
  - crypto: hisilicon-memory management optimization (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: fix packet loss for acc (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/sec: modify driver to adapt dm-crypt (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: reinforce reset failure scene (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/zip: fix decompress a empty file (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/hpre: dfx for IO operation and delay (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/sec: Overall optimization of sec code (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: optimize the maximum number of VF and delete invalid addr (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: optimize set hw_reset flag logic for user (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: fixup the problem of wrong judgement of used (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: Move all the same logic functions of hisilicon crypto to qm (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: fix the way judge whether q stop in user space (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: fixup compilation dependency (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/rde: optimize debug regs clear logic (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/sec: change sec_control reg config (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/hpre: add likely and unlikey in result judgement (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/hpre: optimize key process before free (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: remove invalid addr print (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/zip: use offset fields in sqe to avoid SG_SPLIT (Yu'an Wang) [bug:122239]
  - crypto/hisilicon/qm: fix wrong number of sg elements after dma map (Yu'an Wang) [bug:122239]
  - uacce: Remove uacce mode 1 relatives (Yu'an Wang) [bug:122239]
  - drivers/crypto/hisilicon: Remove uacce mode 1 logic below hisilicon (Yu'an Wang) [bug:122239]
  - drivers/crypto/hisilicon/sec2: add initial configuration in sec_engine_init (Yu'an Wang) [bug:122239]
  - KYLIN:crypto/hisilicon: The driver version is aligned to the Euler kernel (liyouhong) [bug:122239]
  - EULER: memcg: update the child's qos_level synchronously in memcg_qos_write() (Jing Xiangfeng) [task:85149]
  - EULER: memcg: Add static key for memcg priority (Jing Xiangfeng) [task:85149]
  - EULER: memcg: fix kabi broken when enable CONFIG_MEMCG_QOS (Jing Xiangfeng) [task:85149]
  - EULER: memcg: support priority for oom (Jing Xiangfeng) [task:85149]
  - selftest: kvm: Reorder vcpu_load_state steps for AMX (gehao) [task:88336]
  - selftests: kvm: Fix set_regs fail (gehao) [task:88363]
  - selftests: kvm/evmcs_test: complete I/O before migrating guest state (gehao) [task:88363]
  - KVM: selftests: complete IO before migrating guest state (gehao) [task:88336]
  - KVM: selftests: disable stack protector for all KVM tests (Sean Christopherson) [task:88336]
  - KVM: selftests: explicitly disable PIE for tests (Sean Christopherson) [task:88336]
  - KVM: arm64: vgic-its: Change default outer cacheability for {PEND, PROP}BASER (Alexander Graf) [task:97316]
  - Bluetooth: stop proccessing malicious adv data (Pavel Skripkin) [task:97308]
  - io_uring: Fix use of XArray in __io_uring_files_cancel (Matthew Wilcox (Oracle))
  - Bluetooth: hci_event: Fix checking for invalid handle on error status (Luiz Augusto von Dentz) [task:96848]
  - Bluetooth: hci_event: Ignore multiple conn complete events (Soenke Huster) [task:96848]
  - KYLIN: arm64: debug_defconfig: disable debug kobject (Jackie Liu)
  - KYLIN: debug_defconfig: make kmemleak off default (Jackie Liu)
  - KYLIN: net: genric phy driver 'ethtool -i' display error. (zhaochenguang) [task:90223]
  - KYLIN: net: loongson gmac add 'ethtool -i' info. (zhaochenguang) [bug:120208]
  - KYLIN: sound/soc: add the CJC8988 driver provided by loongson (Yongzhen Zhang) [task:91306]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-51.0.v2207
changelog:
  - KYLIN: sched: reserve some field for sched_statistics (Zhengyuan Liu)
  - ext4: make variable "count" signed (Ding Xiang)
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko) [bug:129870] {CVE-2022-33744}
  - xen/blkfront: force data bouncing when backend is untrusted (Roger Pau Monne) [bug:129843] {CVE-2022-33742}
  - xen/netfront: force data bouncing when backend is untrusted (Roger Pau Monne) [bug:129847] {CVE-2022-33741}
  - xen/netfront: fix leaking data in shared pages (Roger Pau Monne) [bug:129851] {CVE-2022-33740}
  - xen/blkfront: fix leaking data in shared pages (Roger Pau Monne) [bug:129856] {CVE-2022-26365}
  - net: rose: fix UAF bugs caused by timer handler (Duoming Zhou) [bug:129862] {CVE-2022-2318}
  - ext4: avoid cycles in directory h-tree (Jan Kara) [bug:129812] {CVE-2022-1184}
  - ext4: verify dir block before splitting it (Jan Kara) [bug:129812] {CVE-2022-1184}
  - floppy: use a statically allocated error counter (Willy Tarreau) [bug:129818] {CVE-2022-1652}
  - ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock (Takashi Iwai) [bug:129791] {CVE-2022-1048}
  - ALSA: pcm: Fix races among concurrent prealloc proc writes (Takashi Iwai) [bug:129791] {CVE-2022-1048}
  - ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls (Takashi Iwai) [bug:129791] {CVE-2022-1048}
  - ALSA: pcm: Fix races among concurrent read/write and buffer changes (Takashi Iwai) [bug:129791] {CVE-2022-1048}
  - ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (Takashi Iwai) [bug:129791] {CVE-2022-1048}
  - xen/pvcalls: use alloc/free_pages_exact() (Juergen Gross) [bug:129775] {CVE-2022-23041}
  - xen/netfront: react properly to failing gnttab_end_foreign_access_ref() (Juergen Gross) [bug:129758] {CVE-2022-23042}
  - xen/9p: use alloc/free_pages_exact() (Juergen Gross) [bug:129775] {CVE-2022-23041}
  - xen/gnttab: fix gnttab_end_foreign_access() without page specified (Juergen Gross) [bug:129775] {CVE-2022-23041}
  - xen: remove gnttab_query_foreign_access() (Juergen Gross)
  - xen/gntalloc: don't use gnttab_query_foreign_access() (Juergen Gross) [bug:129771] {CVE-2022-23039}
  - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status (Juergen Gross) [bug:129767] {CVE-2022-23036}
  - xen/grant-table: add gnttab_try_end_foreign_access() (Juergen Gross) [bug:129783, bug:129767] {CVE-2022-23036, CVE-2022-23038}
  - xen/xenbus: don't let xenbus_grant_ring() remove grants in error case (Juergen Gross) [bug:129763] {CVE-2022-23040}
  - xen/scsifront: don't use gnttab_query_foreign_access() for mapped status (Juergen Gross) [bug:129783] {CVE-2022-23038}
  - xen/netfront: don't use gnttab_query_foreign_access() for mapped status (Juergen Gross) [bug:129779] {CVE-2022-23037}
  - video: fbdev: sm712fb: Fix crash in smtcfb_read() (Helge Deller) [bug:129866] {CVE-2022-2380}
  - HID: holtek: fix mouse probing (Benjamin Tissoires)
  - hamradio: improve the incomplete fix to avoid NPD (Lin Ma) [bug:129795] {CVE-2022-1195}
  - HID: google: add eel USB id (xiazhengqiao) [bug:129822] {CVE-2022-20132}
  - HID: add USB_HID dependancy to hid-prodikeys (Greg Kroah-Hartman) [bug:129822] {CVE-2022-20132}
  - HID: add USB_HID dependancy to hid-chicony (Greg Kroah-Hartman) [bug:129822] {CVE-2022-20132}
  - HID: add USB_HID dependancy on some USB HID drivers (Greg Kroah-Hartman) [bug:129822] {CVE-2022-20132}
  - HID: check for valid USB device for many HID drivers (Greg Kroah-Hartman) [bug:129822] {CVE-2022-20132}
  - HID: wacom: fix problems when device is not a valid USB device (Greg Kroah-Hartman) [bug:129822] {CVE-2022-20132}
  - HID: add hid_is_usb() function to make it simpler for USB detection (Greg Kroah-Hartman) [bug:129822] {CVE-2022-20132}
  - hamradio: remove needs_free_netdev to avoid UAF (Lin Ma) [bug:129795] {CVE-2022-1195}
  - hamradio: defer 6pack kfree after unregister_netdev (Lin Ma) [bug:129795] {CVE-2022-1195}
  - hamradio: defer ax25 kfree after unregister_netdev (Lin Ma) [bug:129795] {CVE-2022-1195}
  - net: hamradio: fix memory leak in mkiss_close (Pavel Skripkin) [bug:129795] {CVE-2022-1195}
  - HID: google: add don USB id (Shou-Chieh Hsu) [bug:129822] {CVE-2022-20132}
  - xen/xenbus: Fix granting of vmalloc'd memory (Simon Leiner)
  - xen-netfront: fix potential deadlock in xennet_remove() (Andrea Righi)
  - HID: google: add moonball USB id (Chen-Tsung Hsieh) [bug:129822] {CVE-2022-20132}
  - net_sched: fix a crash in tc_new_tfilter() (Cong Wang) [bug:129750] {CVE-2021-39713}
  - net: sched: make function qdisc_free_cb() static (Wei Yongjun)
  - net: sched: use Qdisc rcu API instead of relying on rtnl lock (Vlad Buslov) [bug:129750] {CVE-2021-39713}
  - net: sched: add helper function to take reference to Qdisc (Vlad Buslov)
  - net: sched: extend Qdisc with rcu (Vlad Buslov)
  - net: sched: rename qdisc_destroy() to qdisc_put() (Vlad Buslov)
  - net: core: netlink: add helper refcount dec and lock function (Vlad Buslov)
  - netlink: fix doc about nlmsg_parse/nla_validate (Nicolas Dichtel) [task:96091]
  - netlink: Fix nlmsg_parse as a wrapper for strict message parsing (David Ahern) [task:96091]
  - bpf: Add classid helper only based on skb->sk (Daniel Borkmann) [task:96091]
  - bpf: Allow to retrieve cgroup v1 classid from v2 hooks (Daniel Borkmann) [task:96091]
  - tcp_cubic: refactor code to perform a divide only when needed (Eric Dumazet) [task:96091]
  - tcp_cubic: make Hystart aware of pacing (Eric Dumazet) [task:96091]
  - tcp_cubic: tweak Hystart detection for short RTT flows (Eric Dumazet) [task:96091]
  - tcp_cubic: switch bictcp_clock() to usec resolution (Eric Dumazet) [task:96091]
  - tcp_cubic: remove one conditional from hystart_update() (Eric Dumazet) [task:96091]
  - tcp_cubic: optimize hystart_update() (Eric Dumazet) [task:96091]
  - net: relax SO_TXTIME CAP_NET_ADMIN check (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: do not call fq_peek() twice per packet (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: add horizon attribute (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: enable use of hrtimer slack (Eric Dumazet) [task:96091]
  - net_sched: do not reprogram a timer about to expire (Eric Dumazet) [task:96091]
  - net_sched: add qdisc_watchdog_schedule_range_ns() (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: properly set sk->sk_pacing_status (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: remove one obsolete check in fq_dequeue() (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: handle non connected flows (Eric Dumazet) [task:96091]
  - net_sched: sch_fq: do not assume EDT packets are ordered (Eric Dumazet) [task:96091]
  - netlink: add strict parsing for future attributes (Johannes Berg) [task:96091]
  - netlink: re-add parse/validate functions in strict mode (Johannes Berg) [task:96091]
  - netlink: make validation more configurable for future strictness (Johannes Berg) [task:96091]
  - netlink: add NLA_MIN_LEN (Johannes Berg) [task:96091]
  - netlink: add validation function to policy (Johannes Berg) [task:96091]
  - netlink: add attribute range validation to policy (Johannes Berg) [task:96091]
  - net_sched: sch_fq: avoid calling ktime_get_ns() if not needed (Eric Dumazet) [task:96091]
  - bpf: make bpf_skb_ecn_set_ce callable from BPF_PROG_TYPE_SCHED_ACT (Peter Oskolkov) [task:96091]
  - bpf: sync bpf.h to tools and update bpf_helpers.h (brakmo) [task:96091]
  - net_sched: sch_fq: add dctcp-like marking (Eric Dumazet) [task:96091]
  - tcp: tsq: no longer use limit_output_bytes for paced flows (Eric Dumazet) [task:96091]
  - tcp: get rid of tcp_tso_should_defer() dependency on HZ/jiffies (Eric Dumazet) [task:96091]
  - net: support 64bit rates for getsockopt(SO_MAX_PACING_RATE) (Eric Dumazet) [task:96091]
  - tcp: cdg: use tcp high resolution clock cache (Eric Dumazet) [task:96091]
  - KYLIN: LoongArch/spiflash: fix ls_spiflash initialization code error (wangxuewen) [bug:120279]
  - KYLIN: x86/config: enable QOS_SCHED and QOS_SCHED_SMT_EXPELLER (Zhengyuan Liu) [task:97062]
  - KYLIN: arm64/config: enable QOS_SCHED (Zhengyuan Liu) [task:97062]
  - EULER: sched: Add tracepoint for qos smt expeller (Guan Jing) [task:97063]
  - EULER: sched: Add statistics for qos smt expeller (Guan Jing) [task:97063]
  - EULER: sched: Implement the function of qos smt expeller (Guan Jing) [task:97063]
  - EULER: sched: Introduce qos smt expeller for co-location (Guan Jing) [task:97063]
  - EULER: sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} (Zhang Qiao) [task:85149]
  - EULER: sched: Throttle offline task at tracehook_notify_resume() (Zhang Qiao) [task:85149]
  - EULER: sched/qos: Remove dependency CONFIG_x86 (Zhang Qiao) [task:85149]
  - EULER: sched/fair: Add qos_throttle_list node in struct cfs_rq (Zhang Qiao) [task:85149]
  - EULER: sched: Introduce handle priority reversion mechanism (Zheng Zucheng) [task:85149]
  - unicore32: Fix __ARCH_WANT_STAT64 definition (Arnd Bergmann) [task:98950]
  - asm-generic: unistd.h: fixup broken macro include. (Guo Ren) [task:98950]
  - ntp/y2038: Remove incorrect time_t truncation (Arnd Bergmann) [task:98950]
  - ipc: fix semtimedop for generic 32-bit architectures (Arnd Bergmann) [task:98950]
  - asm-generic: Make time32 syscall numbers optional (Arnd Bergmann) [task:98950]
  - asm-generic: Drop getrlimit and setrlimit syscalls from default list (Yury Norov) [task:98950]
  - csky: System Call (Guo Ren) [task:98950]
  - compat ABI: use non-compat openat and open_by_handle_at variants (Yury Norov) [task:98950]
  - y2038: rename old time and utime syscalls (Arnd Bergmann) [task:98950]
  - y2038: remove struct definition redirects (Arnd Bergmann) [task:98950]
  - y2038: use time32 syscall names on 32-bit (Arnd Bergmann) [task:98950]
  - vfs: replace current_kernel_time64 with ktime equivalent (Arnd Bergmann) [task:98950]
  - y2038: syscalls: rename y2038 compat syscalls (Arnd Bergmann) [task:98950]
  - y2038: socket: Add compat_sys_recvmmsg_time64 (Arnd Bergmann) [task:98950]
  - y2038: futex: Add support for __kernel_timespec (Arnd Bergmann) [task:98950]
  - y2038: signal: Add compat_sys_rt_sigtimedwait_time64 (Arnd Bergmann) [task:98950]
  - x86/x32: use time64 versions of sigtimedwait and recvmmsg (Arnd Bergmann) [task:98950]
  - timex: change syscalls to use struct __kernel_timex (Deepa Dinamani) [task:98950]
  - timex: use __kernel_timex internally (Deepa Dinamani) [task:98950]
  - sparc64: add custom adjtimex/clock_adjtime functions (Arnd Bergmann) [task:98950]
  - time: fix sys_timer_settime prototype (Arnd Bergmann) [task:98950]
  - time: Add struct __kernel_timex (Deepa Dinamani) [task:98950]
  - time: make adjtime compat handling available for 32 bit (Arnd Bergmann) [task:98950]
  - y2038: signal: Change rt_sigtimedwait to use __kernel_timespec (Arnd Bergmann) [task:98950]
  - y2038: sched: Change sched_rr_get_interval to use __kernel_timespec (Arnd Bergmann) [task:98950]
  - y2038: utimes: Rework #ifdef guards for compat syscalls (Arnd Bergmann) [task:98950]
  - y2038: Compile utimes()/futimesat() conditionally (Arnd Bergmann) [task:98950]
  - y2038: Change sys_utimensat() to use __kernel_timespec (Arnd Bergmann) [task:98950]
  - asm-generic: Remove empty asm/unistd.h (Arnd Bergmann) [task:98950]
  - asm-generic: Remove unneeded __ARCH_WANT_SYS_LLSEEK macro (Arnd Bergmann) [task:98950]
  - y2038: Remove stat64 family from default syscall set (Arnd Bergmann) [task:98950]
  - y2038: __get_old_timespec32() can be static (kbuild test robot) [task:98950]
  - KYLIN: x86: debug_defconfig: more kselftest modules (Jackie Liu)
  - KYLIN: x86: debug_defconfig: more test modules for debug kernel (Jackie Liu)
  - KYLIN: arm64: debug_defconfig: more test modules for debug kernel (Jackie Liu)
  - KYLIN: mm: fix free_pages_bootmem bug in loongarch when system booting (husong)
  - GNET: change gnet_speed_flg priv to fix problem when rebind gnet. (liusicong) [task:96195]
  - LoongArch: Add generic efi stub support (liuyun) [task:96195]
  - efi/libstub: Move the function prototypes to header file (Atish Patra) [task:96195]
  - efi/libstub: Move arm-stub to a common file (Atish Patra) [task:96195]
  - LoongArch: adjust memory space for module load (liweihao) [task:96195]
  - LoongArch:LSVZ: disable pv timer when vcpu is reset (Mao Bibo) [task:96195]
  - LoongArch: LSVZ: redefine hypercall service return code (Jianxing Wang) [task:96195]
  - LoongArch: LSVZ: import no_pvipi and no_pvtime setup param (Jianxing Wang) [task:96195]
  - fdt: Update CRC check for rng-seed (Hsin-Yi Wang) [task:97875]
  - include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap (Christian Borntraeger) [task:97875]
  - random: quiet urandom warning ratelimit suppression message (Jason A. Donenfeld) [task:97875]
  - random: schedule mix_interrupt_randomness() less often (Jason A. Donenfeld) [task:97875]
  - random: credit cpu and bootloader seeds by default (Jason A. Donenfeld) [task:97875]
  - random: account for arch randomness in bits (Jason A. Donenfeld) [task:97875]
  - random: mark bootloader randomness code as __init (Jason A. Donenfeld) [task:97875]
  - random: avoid checking crng_ready() twice in random_init() (Jason A. Donenfeld) [task:97875]
  - crypto: drbg - make reseeding from get_random_bytes() synchronous (Nicolai Stange) [task:97875]
  - crypto: drbg - always try to free Jitter RNG instance (Stephan Müller) [task:97875]
  - crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() (Nicolai Stange) [task:97875]
  - crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() (Nicolai Stange) [task:97875]
  - crypto: drbg - prepare for more fine-grained tracking of seeding state (Nicolai Stange) [task:97875]
  - crypto: drbg - always seeded with SP800-90B compliant noise source (Stephan Müller) [task:97875]
  - crypto: drbg - add FIPS 140-2 CTRNG for noise source (Stephan Mueller) [task:97875]
  - Revert "random: use static branch for crng_ready()" (Jason A. Donenfeld) [task:97875]
  - random: check for signals after page of pool writes (Jason A. Donenfeld) [task:97875]
  - random: wire up fops->splice_{read,write}_iter() (Jens Axboe) [task:97875]
  - random: convert to using fops->write_iter() (Jens Axboe) [task:97875]
  - random: move randomize_page() into mm where it belongs (Jason A. Donenfeld) [task:97875]
  - random: move initialization functions out of hot pages (Jason A. Donenfeld) [task:97875]
  - random: use proper return types on get_random_{int,long}_wait() (Jason A. Donenfeld) [task:97875]
  - random: remove extern from functions in header (Jason A. Donenfeld) [task:97875]
  - random: use static branch for crng_ready() (Jason A. Donenfeld) [task:97875]
  - random: credit architectural init the exact amount (Jason A. Donenfeld) [task:97875]
  - random: handle latent entropy and command line from random_init() (Jason A. Donenfeld) [task:97875]
  - random: use proper jiffies comparison macro (Jason A. Donenfeld) [task:97875]
  - random: remove ratelimiting for in-kernel unseeded randomness (Jason A. Donenfeld) [task:97875]
  - random: avoid initializing twice in credit race (Jason A. Donenfeld) [task:97875]
  - random: use symbolic constants for crng_init states (Jason A. Donenfeld) [task:97875]
  - siphash: use one source of truth for siphash permutations (Jason A. Donenfeld) [task:97875]
  - random: help compiler out with fast_mix() by using simpler arguments (Jason A. Donenfeld) [task:97875]
  - random: do not use input pool from hard IRQs (Jason A. Donenfeld) [task:97875]
  - random: order timer entropy functions below interrupt functions (Jason A. Donenfeld) [task:97875]
  - random: do not pretend to handle premature next security model (Jason A. Donenfeld) [task:97875]
  - random: do not use batches when !crng_ready() (Jason A. Donenfeld) [task:97875]
  - random: insist on random_get_entropy() existing in order to simplify (Jason A. Donenfeld) [task:97875]
  - xtensa: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - sparc: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - um: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - x86/tsc: Use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - nios2: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - arm: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - mips: use fallback for random_get_entropy() instead of just c0 random (Jason A. Donenfeld) [task:97875]
  - m68k: use fallback for random_get_entropy() instead of zero (Jason A. Donenfeld) [task:97875]
  - timekeeping: Add raw clock fallback for random_get_entropy() (Jason A. Donenfeld) [task:97875]
  - powerpc: define get_cycles macro for arch-override (Jason A. Donenfeld) [task:97875]
  - alpha: define get_cycles macro for arch-override (Jason A. Donenfeld) [task:97875]
  - parisc: define get_cycles macro for arch-override (Jason A. Donenfeld) [task:97875]
  - s390: define get_cycles macro for arch-override (Jason A. Donenfeld) [task:97875]
  - ia64: define get_cycles macro for arch-override (Jason A. Donenfeld) [task:97875]
  - init: call time_init() before rand_initialize() (Jason A. Donenfeld) [task:97875]
  - random: fix sysctl documentation nits (Jason A. Donenfeld) [task:97875]
  - random: document crng_fast_key_erasure() destination possibility (Jason A. Donenfeld) [task:97875]
  - random: make random_get_entropy() return an unsigned long (Jason A. Donenfeld) [task:97875]
  - random: check for signals every PAGE_SIZE chunk of /dev/[u]random (Jason A. Donenfeld) [task:97875]
  - random: check for signal_pending() outside of need_resched() check (Jann Horn) [task:97875]
  - random: do not allow user to keep crng key around on stack (Jason A. Donenfeld) [task:97875]
  - random: do not split fast init input in add_hwgenerator_randomness() (Jan Varho) [task:97875]
  - random: mix build-time latent entropy into pool at init (Jason A. Donenfeld) [task:97875]
  - random: re-add removed comment about get_random_{u32,u64} reseeding (Jason A. Donenfeld) [task:97875]
  - random: treat bootloader trust toggle the same way as cpu trust toggle (Jason A. Donenfeld) [task:97875]
  - random: skip fast_init if hwrng provides large chunk of entropy (Jason A. Donenfeld) [task:97875]
  - random: check for signal and try earlier when generating entropy (Jason A. Donenfeld) [task:97875]
  - random: reseed more often immediately after booting (Jason A. Donenfeld) [task:97875]
  - random: make consistent usage of crng_ready() (Jason A. Donenfeld) [task:97875]
  - random: use SipHash as interrupt entropy accumulator (Jason A. Donenfeld) [task:97875]
  - random: replace custom notifier chain with standard one (Jason A. Donenfeld) [task:97875]
  - random: don't let 644 read-only sysctls be written to (Jason A. Donenfeld) [task:97875]
  - random: give sysctl_random_min_urandom_seed a more sensible value (Jason A. Donenfeld) [task:97875]
  - random: do crng pre-init loading in worker rather than irq (Jason A. Donenfeld) [task:97875]
  - random: unify cycles_t and jiffies usage and types (Jason A. Donenfeld) [task:97875]
  - random: cleanup UUID handling (Jason A. Donenfeld) [task:97875]
  - random: only wake up writers after zap if threshold was passed (Jason A. Donenfeld) [task:97875]
  - random: round-robin registers as ulong, not u32 (Jason A. Donenfeld) [task:97875]
  - random: clear fast pool, crng, and batches in cpuhp bring up (Jason A. Donenfeld) [task:97875]
  - random: pull add_hwgenerator_randomness() declaration into random.h (Jason A. Donenfeld) [task:97875]
  - random: check for crng_init == 0 in add_device_randomness() (Jason A. Donenfeld) [task:97875]
  - random: unify early init crng load accounting (Jason A. Donenfeld) [task:97875]
  - random: do not take pool spinlock at boot (Jason A. Donenfeld) [task:97875]
  - random: defer fast pool mixing to worker (Jason A. Donenfeld) [task:97875]
  - random: rewrite header introductory comment (Jason A. Donenfeld) [task:97875]
  - random: group sysctl functions (Jason A. Donenfeld) [task:97875]
  - random: group userspace read/write functions (Jason A. Donenfeld) [task:97875]
  - random: group entropy collection functions (Jason A. Donenfeld) [task:97875]
  - random: group entropy extraction functions (Jason A. Donenfeld) [task:97875]
  - random: group initialization wait functions (Jason A. Donenfeld) [task:97875]
  - random: remove whitespace and reorder includes (Jason A. Donenfeld) [task:97875]
  - random: remove useless header comment (Jason A. Donenfeld) [task:97875]
  - random: introduce drain_entropy() helper to declutter crng_reseed() (Jason A. Donenfeld) [task:97875]
  - random: deobfuscate irq u32/u64 contributions (Jason A. Donenfeld) [task:97875]
  - random: add proper SPDX header (Jason A. Donenfeld) [task:97875]
  - random: remove unused tracepoints (Jason A. Donenfeld) [task:97875]
  - random: remove ifdef'd out interrupt bench (Jason A. Donenfeld) [task:97875]
  - random: tie batched entropy generation to base_crng generation (Jason A. Donenfeld) [task:97875]
  - random: zero buffer after reading entropy from userspace (Jason A. Donenfeld) [task:97875]
  - random: remove outdated INT_MAX >> 6 check in urandom_read() (Jason A. Donenfeld) [task:97875]
  - random: use hash function for crng_slow_load() (Jason A. Donenfeld) [task:97875]
  - random: absorb fast pool into input pool after fast load (Jason A. Donenfeld) [task:97875]
  - random: do not xor RDRAND when writing into /dev/random (Jason A. Donenfeld) [task:97875]
  - random: ensure early RDSEED goes through mixer on init (Jason A. Donenfeld) [task:97875]
  - random: inline leaves of rand_initialize() (Jason A. Donenfeld) [task:97875]
  - random: use RDSEED instead of RDRAND in entropy extraction (Jason A. Donenfeld) [task:97875]
  - random: fix locking in crng_fast_load() (Dominik Brodowski) [task:97875]
  - random: remove batched entropy locking (Jason A. Donenfeld) [task:97875]
  - random: remove use_input_pool parameter from crng_reseed() (Eric Biggers) [task:97875]
  - random: make credit_entropy_bits() always safe (Jason A. Donenfeld) [task:97875]
  - random: always wake up entropy writers after extraction (Jason A. Donenfeld) [task:97875]
  - random: use linear min-entropy accumulation crediting (Jason A. Donenfeld) [task:97875]
  - random: simplify entropy debiting (Jason A. Donenfeld) [task:97875]
  - random: use computational hash for entropy extraction (Jason A. Donenfeld) [task:97875]
  - random: only call crng_finalize_init() for primary_crng (Dominik Brodowski) [task:97875]
  - random: access primary_pool directly rather than through pointer (Dominik Brodowski) [task:97875]
  - random: continually use hwgenerator randomness (Dominik Brodowski) [task:97875]
  - random: simplify arithmetic function flow in account() (Jason A. Donenfeld) [task:97875]
  - random: access input_pool_data directly rather than through pointer (Jason A. Donenfeld) [task:97875]
  - random: cleanup fractional entropy shift constants (Jason A. Donenfeld) [task:97875]
  - random: prepend remaining pool constants with POOL_ (Jason A. Donenfeld) [task:97875]
  - random: de-duplicate INPUT_POOL constants (Jason A. Donenfeld) [task:97875]
  - random: remove unused OUTPUT_POOL constants (Jason A. Donenfeld) [task:97875]
  - random: rather than entropy_store abstraction, use global (Jason A. Donenfeld) [task:97875]
  - random: remove unused extract_entropy() reserved argument (Jason A. Donenfeld) [task:97875]
  - random: remove incomplete last_data logic (Jason A. Donenfeld) [task:97875]
  - random: cleanup integer types (Jason A. Donenfeld) [task:97875]
  - random: cleanup poolinfo abstraction (Jason A. Donenfeld) [task:97875]
  - random: fix typo in comments (Schspa Shi) [task:97875]
  - random: don't reset crng_init_cnt on urandom_read() (Jann Horn) [task:97875]
  - random: avoid superfluous call to RDRAND in CRNG extraction (Jason A. Donenfeld) [task:97875]
  - random: early initialization of ChaCha constants (Dominik Brodowski) [task:97875]
  - random: initialize ChaCha20 constants with correct endianness (Eric Biggers) [task:97875]
  - random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs (Jason A. Donenfeld) [task:97875]
  - random: harmonize "crng init done" messages (Dominik Brodowski) [task:97875]
  - random: mix bootloader randomness into pool (Jason A. Donenfeld) [task:97875]
  - random: do not re-init if crng_reseed completes before primary init (Jason A. Donenfeld) [task:97875]
  - random: do not sign extend bytes for rotation when mixing (Jason A. Donenfeld) [task:97875]
  - random: use BLAKE2s instead of SHA1 in extraction (Jason A. Donenfeld) [task:97875]
  - random: remove unused irq_flags argument from add_interrupt_randomness() (Sebastian Andrzej Siewior) [task:97875]
  - random: document add_hwgenerator_randomness() with other input functions (Mark Brown) [task:97875]
  - crypto: blake2s - adjust include guard naming (Eric Biggers) [task:97875]
  - crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h> (Eric Biggers) [task:97875]
  - MAINTAINERS: co-maintain random.c (Jason A. Donenfeld) [task:97875]
  - random: remove dead code left over from blocking pool (Eric Biggers) [task:97875]
  - random: avoid arch_get_random_seed_long() when collecting IRQ randomness (Ard Biesheuvel) [task:97875]
  - random: add arch_get_random_*long_early() (Mark Rutland) [task:97875]
  - powerpc: Use bool in archrandom.h (Richard Henderson) [task:97875]
  - linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check (Richard Henderson) [task:97875]
  - linux/random.h: Use false with bool (Richard Henderson) [task:97875]
  - linux/random.h: Remove arch_has_random, arch_has_random_seed (Richard Henderson) [task:97875]
  - s390: Remove arch_has_random, arch_has_random_seed (Richard Henderson) [task:97875]
  - powerpc: Remove arch_has_random, arch_has_random_seed (Richard Henderson) [task:97875]
  - x86: Remove arch_has_random, arch_has_random_seed (Richard Henderson) [task:97875]
  - random: avoid warnings for !CONFIG_NUMA builds (Mark Rutland) [task:97875]
  - random: split primary/secondary crng init paths (Mark Rutland) [task:97875]
  - random: remove some dead code of poolinfo (Yangtao Li) [task:97875]
  - random: fix typo in add_timer_randomness() (Yangtao Li) [task:97875]
  - random: Add and use pr_fmt() (Yangtao Li) [task:97875]
  - random: convert to ENTROPY_BITS for better code readability (Yangtao Li) [task:97875]
  - random: remove unnecessary unlikely() (Yangtao Li) [task:97875]
  - random: remove kernel.random.read_wakeup_threshold (Andy Lutomirski) [task:97875]
  - random: delete code to pull data into pools (Andy Lutomirski) [task:97875]
  - random: remove the blocking pool (Andy Lutomirski) [task:97875]
  - random: fix crash on multiple early calls to add_bootloader_randomness() (Dominik Brodowski) [task:97875]
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky) [task:97875]
  - random: make /dev/random be almost like /dev/urandom (Andy Lutomirski) [task:97875]
  - random: ignore GRND_RANDOM in getentropy(2) (Andy Lutomirski) [task:97875]
  - random: add GRND_INSECURE to return best-effort non-cryptographic bytes (Andy Lutomirski) [task:97875]
  - random: Add a urandom_read_nowait() for random APIs that don't warn (Andy Lutomirski) [task:97875]
  - random: Don't wake crng_init_wait when crng_init == 1 (Andy Lutomirski) [task:97875]
  - lib/crypto: sha1: re-roll loops to reduce code size (Jason A. Donenfeld) [task:97875]
  - lib/crypto: blake2s: move hmac construction into wireguard (Jason A. Donenfeld) [task:97875]
  - crypto: blake2s - generic C library implementation and selftest (Jason A. Donenfeld) [task:97875]
  - Revert "hwrng: core - Freeze khwrng thread during suspend" (Herbert Xu) [task:97875]
  - char/random: Add a newline at the end of the file (Borislav Petkov) [task:97875]
  - random: Use wait_event_freezable() in add_hwgenerator_randomness() (Stephen Boyd) [task:97875]
  - fdt: add support for rng-seed (Hsin-Yi Wang) [task:97875]
  - random: Support freezable kthreads in add_hwgenerator_randomness() (Stephen Boyd) [task:97875]
  - random: fix soft lockup when trying to read from an uninitialized blocking pool (Theodore Ts'o) [task:97875]
  - latent_entropy: avoid build error when plugin cflags are not set (Vasily Gorbik) [task:97875]
  - random: document get_random_int() family (George Spelvin) [task:97875]
  - random: move rand_initialize() earlier (Kees Cook) [task:97875]
  - random: only read from /dev/random after its pool has received 128 bits (Theodore Ts'o) [task:97875]
  - drivers/char/random.c: make primary_crng static (Rasmus Villemoes) [task:97875]
  - drivers/char/random.c: remove unused stuct poolinfo::poolbits (Rasmus Villemoes) [task:97875]
  - drivers/char/random.c: constify poolinfo_table (Rasmus Villemoes) [task:97875]
  - random: fix data race on crng init time (Eric Biggers) [task:97875]
  - random: fix data race on crng_node_pool (Eric Biggers) [task:97875]
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky) [task:97875]
  - char/random: silence a lockdep splat with printk() (Sergey Senozhatsky) [task:97875]
  - random: try to actively add entropy rather than passively wait for it (Linus Torvalds) [task:97875]
  - Revert "alinux: random: speed up the initialization of module" (huhai) [task:97875]
  - Revert "random: only read from /dev/random after its pool has received 128 bits" (huhai) [task:97875]
  - Revert "random: fix soft lockup when trying to read from an uninitialized blocking pool" (huhai) [task:97875]
  - uapi: rename ext2_swab() to swab() and share globally in swab.h (Yury Norov) [task:97875]
  - KYLIN: xhci: fix Etron controller reset device problem (xuping) [bug:123907]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-52.0.v2207
changelog:
  - KYLIN: kabi_whitelist: remove the indentation in front of each item (Zhengyuan Liu) [task:74080]
  - KYLIN: scripts/make-kabi: support items in whitelist begin with indentation (Zhengyuan Liu) [task:74080]
  - KYLIN: Module.kabi: update Module.kabi based on the new whitelist (Zhengyuan Liu) [task:74080]
  - KYLIN: kabi_whitelist: append redhat8's kabi items (Zhengyuan Liu) [task:74080]
  - KYLIN: x86/paravirt: fix build if !CONFIG_PARAVIRT_SPINLOCKS & CONFIG_PARAVIRT (Jackie Liu) [task:101368, task:101367]
  - sched/core: Convert vcpu_is_preempted() from macro to an inline function (Qian Cai) [task:101368, task:101367]
  - KYLIN: kabi_whitelist: append HuaWei's ultrapath symbol to whitelist (Zhengyuan Liu) [task:74080]
  - KYLIN: kabi_whitelist: append TianGou's symbol to whitelist (Zhengyuan Liu) [task:90224]
  - KYLIN: kabi_whitelist: simplify current whitelist (Zhengyuan Liu) [task:74080]
  - KYLIN: kabi_whitelist: sort the kabi whitelist (Zhengyuan Liu) [task:74080]
  - net: sched: don't set tunnel for decap action (Vlad Buslov) [bug:128966]
  - net: sched: flower: only return error from hw offload if skip_sw (Vlad Buslov) [bug:128966]
  - xsk: Fix xsk_umem_xdp_frame_sz() (Björn Töpel) [bug:128966]
  - xdp: For Intel AF_XDP drivers add XDP frame_s (Jesper Dangaard Brouer) [bug:128966]
  - cls_api: add translator to flow_action representation (Pablo Neira Ayuso) [bug:128966]
  - net: sched: sample: allow accessing psample_group with rtnl (Vlad Buslov) [bug:128966]
  - net/sched: add police action to the hardware intermediate representation (Pieter Jansen van Vuuren) [bug:128966]
  - net/sched: add sample action to the hardware intermediate representation (Pieter Jansen van Vuuren) [bug:128966]
  - flow_offload: add wake-up-on-lan and queue to flow_action (Pablo Neira Ayuso) [bug:128966]
  - net/flow_dissector: add connection tracking dissection (Paul Blakey) [bug:128966]
  - KYLIN: fbdev/efifb: enable efifb for inno card by default (yangdeyi) [task:88651]
  - tcp: use alloc_large_system_hash() to allocate table_perturb (Muchun Song)
  - xhci: turn off port power in shutdown (Mathias Nyman) [task:99634]
  - xhci: stop polling roothubs after shutdown (Henry Lin) [task:99634]
  - xhci: make xhci_handshake timeout for xhci_reset() adjustable (Mathias Nyman) [task:99634]
  - xhci: bail out early if driver can't accress host in resume (Mathias Nyman) [task:99634]
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau) [task:99634]
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau) [task:99634]
  - tcp: add small random increments to the source port (Willy Tarreau) [task:99634]
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau) [task:99634]
  - tcp: add some entropy in __inet_hash_connect() (Eric Dumazet) [task:99634]
  - swiotlb: skip swiotlb_bounce when orig_addr is zero (Liu Shixin) [task:99634]
  - KYLIN: add graphics card priority for x86 (yangdeyi) [task:88651]
  - KYLIN: vga: add inno graphics card priority (yangdeyi) [task:88651]
  - KYLIN: 3rd/inno: add inno driver support (yangdeyi) [task:88651]
  - i40iw: Remove setting of VMA private data and use rdma_user_mmap_io (Shiraz Saleem) [bug:130467]
  - KYLIN: x86/paravirt: useless assignment instructions cause Unixbench full core performance degradation (chenke) [task:99415]
  - x86/module: Fix the paravirt vs alternative order (Peter Zijlstra) [task:99415]
  - x86/paravirt: Add new features for paravirt patching (Juergen Gross) [task:99415]
  - crypto: drbg - fix error return code in drbg_alloc_state() (Wei Yongjun) [task:101008]
  - lib: vdso: Remove CROSS_COMPILE_COMPAT_VDSO (Vincenzo Frascino)
  - arm64: vdso32: Remove jump label config option in Makefile (Vincenzo Frascino)
  - arm64: vdso32: Detect binutils support for dmb ishld (Vincenzo Frascino)
  - arm64: vdso: Remove stale files from old assembly implementation (Vincenzo Frascino)
  - arm64: vdso32: Fix broken compat vDSO build warnings (Vincenzo Frascino)
  - arm64: vdso: Fix Makefile regression (Vincenzo Frascino)
  - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Pavel Skripkin) [bug:120191] {CVE-2022-1679}
  - drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions (Joe Perches) [bug:124652] {CVE-2022-20166}
  - drivers/base/cpu: Simplify s*nprintf() usages (Takashi Iwai)
  - xfs: don't set bmapi total block req where minleft is (Brian Foster) [bug:128797]
  - netfilter: nf_tables: stricter validation of element data (Pablo Neira Ayuso) [bug:129113] {CVE-2022-34918}
  - f2fs: fix to do sanity check on segment/section count (Chao Yu) [task:98376] {CVE-2019-19449}
  - f2fs: fix wrong total_sections check and fsmeta check (Wang Xiaojun) [task:98376] {CVE-2019-19449}
  - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik) [task:98376] {CVE-2019-19448}
  - KYLIN: box: Fix Use-After-Free caused by parallel access (Jackie Liu) [task:98126, task:99088, task:99013]
  - KYLIN: sw64: fix incompatible pointer of __kernel_timex (Jackie Liu) [task:99336, task:99333]
  - mips: generate uapi header and system call table files (Firoz Khan) [task:99337, task:99334]
  - mips: remove unused macros (Firoz Khan) [task:99337, task:99334]
  - mips: add +1 to __NR_syscalls in uapi header (Firoz Khan) [task:99337, task:99334]
  - mips: rename scall64-64.S to scall64-n64.S (Firoz Khan) [task:99337, task:99334]
  - mips: add __NR_syscalls along with __NR_Linux_syscalls (Firoz Khan) [task:99334, task:99337]
  - mips: remove syscall table entries (Firoz Khan) [task:99337, task:99334]
  - io_uring: drop 'ctx' ref on task work cancelation (Jens Axboe)


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-52.25.v2207
changelog:
  - KYLIN: config/x86: disable kernel boot logo (Ou Shixiong) [bug:172747]
  - Revert "KYLIN: logo: put boot logo in the middle of the screen" (Ou Shixiong) [bug:172747]
  - KYLIN: config/sunway: disable kernel boot logo (Ou Shixiong) [bug:172747]
  - KYLIN: config/mips: disable kernel boot logo (Ou Shixiong) [bug:172747]
  - KYLIN: config/loongarch: disable kernel boot logo (Ou Shixiong) [bug:172747]
  - KYLIN: config/arm64: disable kernel boot logo (Ou Shixiong) [bug:172747]
  - KYLIN: backport-tools: add release-stable-kernel tool (Jackie Liu)
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li) [bug:172373] {CVE-2023-2513}
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li) [bug:172373]
  - REDHAT: mm/memcg: Free percpu stats memory of dying memcg's (Waiman Long) [bug:158690, task:139197]
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Jason Gunthorpe) [bug:170284] {CVE-2023-2176}
  - RDMA/core: Refactor rdma_bind_addr (Patrisious Haddad) [bug:170284] {CVE-2023-2176}
  - RDMA/cma: Do not change route.addr.src_addr outside state checks (Jason Gunthorpe) [bug:170284] {CVE-2023-2176}
  - RDMA/cma: Make the locking for automatic state transition more clear (Jason Gunthorpe) [bug:170284] {CVE-2023-2176}
  - Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" (Parav Pandit) [bug:170284] {CVE-2023-2176}
  - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests (Jason Gunthorpe) [bug:170284] {CVE-2023-2176}
  - KYLIN: security/selinux: use LSM stack API in setsecurity (penghuaihe) [task:151838]
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso) [task:152325] {CVE-2023-32233}
  - bpf: Permits pointers on stack for helper calls (Yonghong Song) [task:153389]
  - bpf: Handle spilled PTR_TO_BTF_ID properly when checking stack_boundary (Yonghong Song) [task:153389]
  - KYLIN: osinfo: Converting memory size to GB from KB (Jackie Liu)
  - netrom: Fix use-after-free caused by accept on already connected socket (Hyunwoo Kim) [bug:172362] {CVE-2023-32269}
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang) [bug:172377, bug:172369] {CVE-2023-33203, CVE-2023-2483}
  - LOONGSON: drm/loongson: do not load loongson drm driver if ls2k500 bmc been found. (Chong Qiao) [task:148849]
  - LOONGSON: drm/loongson: Improve 7A2000 VGA hot plug detection process. (lichenyang) [task:148849]
  - LOONGSON: drm/loongson: Fix connector detect error in bridge phy. (lichenyang) [task:148849]
  - LOONGSON: drm/loongson: Improve bridge phy bind process. (lichenyang) [task:148849]
  - LOONGSON: drm/loongson: Support 4K@30Hz resolution in loongson. (lichenyang) [task:148849]
  - LOONGSON: fbdev: ls2k500 sfb add module device table to enable module auto load. (Chong Qiao) [task:148849]
  - LOONGSON: fbdev: ls2k500 sfb add set par to support resolution setup. (Chong Qiao) [task:148849]
  - LOONGSON: fbdev: ls2k500sfb gpio irq handler stop all cpus to wait pcie training done. (Chong Qiao) [task:148849]
  - LOONGSON: fbdev: ls2k500 sfb add gpio request fail process. (Chong Qiao) [task:148849]
  - LOONGSON: fbdev: ls2k500 sfb add gpio interrupt notification process when ls2k500 watchdog bite. (Chong Qiao) [task:148849]
  - LOONGSON: fbdev: ls2k500 sfb add interrupt process for bmc reboot. (Chong Qiao) [task:148849]
  - KYLIN: modify the changelog in CHANGELOG.md (Jiangshan Yi) [task:153030]
  - KYLIN: loongarch: Restore macro definition for PC (JiangXiujie) [task:77681]
  - paride: fix up build warning on mips platforms (Greg Kroah-Hartman) [task:77681]
  - mksysmap: Fix the mismatch of 'L0' symbols in System.map (Youling Tang) [task:140522]
  - mksysmap: Fix the mismatch of '.L' symbols in System.map (ashimida) [task:140522]
  - sctp: leave the err path free in sctp_stream_init to sctp_stream_free (Xin Long) [bug:170287] {CVE-2023-2177}
  - sctp: fix err handling of stream initialization (Marcelo Ricardo Leitner) [bug:170287]
  - sctp: fix memleak on err handling of stream initialization (Marcelo Ricardo Leitner) [bug:170287]
  - net: sctp: Fix negotiation of the number of data streams. (David Laight) [bug:170287]
  - sctp: convert to genradix (Kent Overstreet) [bug:170287]
  - generic radix trees (Kent Overstreet) [bug:170287]
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) [bug:170280] {CVE-2023-2124}
  - bpf: Set the number of exception entries properly for subprograms (Yonghong Song) [task:149989]
  - OPENEULER: Revert "ipvlan: Modify the value of ipvlan modes" (Lu Wei) [task:151834]
  - scsi: dpt_i2o: Remove obsolete driver (Arnd Bergmann) [bug:170296] {CVE-2023-2007}
  - KYLIN: bpf: fix build without barrier_nospec (Jackie Liu) [task:151751, task:151749, task:151304]
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [bug:170253] {CVE-2023-1989}
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (Jisoo Jang) [bug:170231] {CVE-2023-1380}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) [bug:170241] {CVE-2023-1855}
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang) [bug:170245] {CVE-2023-1859}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) [bug:170258] {CVE-2023-1990}
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) [bug:170264] {CVE-2023-30772}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li) [bug:170267] {CVE-2023-2002}
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) [bug:170271] {CVE-2023-2162}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) [bug:170275] {CVE-2023-0459}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) [bug:170291] {CVE-2023-2194}
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer) [bug:170300] {CVE-2023-2269}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) [bug:170304] {CVE-2023-0458}
  - mm, oom: remove 'prefer children over parent' heuristic (Shakeel Butt) [task:151498]
  - blk-mq-sched: Fix blk_mq_sched_free_tags() build warning (zhanggenjian) [task:122387]
  - KYLIN: rpmbuild: delete meaningless changelog in kernel.spec (Jiangshan Yi) [task:150163]
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung) [bug:170041] {CVE-2023-2248}
  - KYLIN: security/kysec: fix wrong variable name (mengdehui@kylinos.cn) [bug:168035]
  - bpf, arm64: Add BPF exception tables (Jean-Philippe Brucker) [task:149989]
  - arm64: bpf: do not allocate executable memory (Ard Biesheuvel) [task:149989]
  - KYLIN: Revert "arm64/bpf: Remove 128MB limit for BPF JIT programs" (Jackie Liu) [task:149989]
  - bpf, arm64: Optimize AND,OR,XOR,JSET BPF_K using arm64 logical immediates (Luke Nelson) [task:149989]
  - bpf: Fix the off-by-two error in range markings (Maxim Mikityanskiy) [task:149989]
  - bpf: Fix up register-based shifts in interpreter to silence KUBSAN (Daniel Borkmann) [task:149989]
  - bpf: Prevent increasing bpf_jit_limit above max (Lorenz Bauer) [task:149989]
  - bpf: Do not use ax register in interpreter on div/mod (Daniel Borkmann) [task:149989] {CVE-2021-3444}
  - bpf: Support writable context for bare tracepoint (Hou Tao) [task:149989]
  - trace: bpf: Allow bpf to attach to bare tracepoints (Qais Yousef) [task:149989]
  - KYLIN: btlock: fix warning comparison of distinct pointer types (Jackie Liu)
  - KYLIN: Makefile: Use .sourceversion to generate SOURCE_VERSION (Jackie Liu)
  - KYLIN: security/kysec: Fix crash when kysec from enable to disable (mengdehui@kylinos.cn) [bug:168035]
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot) [task:147537]
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao) [task:147537]
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) [task:147538]
  - bpf: Fix bug in mmap() implementation for BPF array map (Andrii Nakryiko)
  - bpf: Fix an error code in check_btf_func() (Dan Carpenter)
  - bpf: Reliably preserve btf_trace_xxx types (Andrii Nakryiko) [task:149481]
  - bpf: Add typecast to raw_tracepoints to help BTF generation (Alexei Starovoitov) [task:149481]
  - KYLIN: fbdev: disable ls2k500sfb support for arm (oushixiong) [task:148849]
  - Revert "KYLIN: arm64/configs: add CONFIG_FB_LS2K500=m" (oushixiong) [task:148849]
  - xhci: guard accesses to ep_state in xhci_endpoint_reset() (Jonathan Bell) [task:149417]
  - xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed (Ding Hui) [task:149417]
  - xfs: bulkstat should copy lastip whenever userspace supplies one (Darrick J. Wong) [task:82242]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-52.30.v2207
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng) [task:177236] {CVE-2023-42753}
  - xfs: check sb_meta_uuid for dabuf buffer recovery (Dave Chinner) [bug:194635]
  - Revert "NFS: Don't call generic_error_remove_page() while holding locks" (wolfgang huang) [bug:194658]
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) [bug:189726] {CVE-2023-3772}
  - scsi: smartpqi: Fix byte aligned writew for ARM servers (Don Brace) [task:170135]
  - squashfs: fix xattr id and id lookup sanity checks (Phillip Lougher) [task:158827, bug:195777]
  - squashfs: add more sanity checks in id lookup (Phillip Lougher) [task:158034, bug:195777]
  - squashfs: add more sanity checks in xattr id lookup (Phillip Lougher) [task:158034, bug:195777]
  - squashfs: fix inode lookup sanity checks (Sean Nyekjaer) [task:158827, bug:195777]
  - squashfs: add more sanity checks in inode lookup (Phillip Lougher) [task:158034, bug:195777]
  - sched/rt: Optimize checking group RT scheduler constraints (Konstantin Khlebnikov) [task:173985]
  - NETSWIFT: ngbe: Fix: fix call trace caused by xdp (lingfuyi) [task:174284]
  - PCI: Allow VPD access for QLogic ISP2722 (Arun Easi) [bug:187138]
  - resolve compiling error for previous rcu patches (lifangxu) [task:174840]
  - x86/cpu: Avoid cpuinfo-induced IPIing of idle CPUs (Paul E. McKenney) [bug:190769]
  - x86/cpu: Avoid cpuinfo-induced IPI pileups (Paul E. McKenney) [bug:190769]
  - x86/cpu: Disable frequency requests via aperfmperf IPI for nohz_full CPUs (Konstantin Khlebnikov) [bug:190769]
  - rcu: Provide rcu_irq_exit_check_preempt() (Thomas Gleixner) [bug:190769]
  - rcu: Provide rcu_irq_exit_preempt() (Thomas Gleixner) [bug:190769]


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-52.31.v2207
changelog:
  - xfs: drop submit side trans alloc for append ioends (Brian Foster) [task:168909]
  - xfs: turn io_append_trans into an io_private void pointer (Christoph Hellwig) [task:168909]
  - xfs: refactor the ioend merging code (Christoph Hellwig) [task:168909]
  - xfs: simplify xfs_ioend_can_merge (Christoph Hellwig) [task:168909]
  - xfs: allow merging ioends over append boundaries (Christoph Hellwig) [task:168909]
  - xfs: merge adjacent io completions of the same type (Darrick J. Wong) [task:168909]
  - xfs: remove unused m_data_workqueue (Darrick J. Wong) [task:168909]
  - xfs: implement per-inode writeback completion queues (Darrick J. Wong) [task:168909]
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (Lin Ma) [task:179856] {CVE-2023-3863}
  - nfc: llcp: simplify llcp_sock_connect() error paths (Krzysztof Kozlowski) [task:179856]
  - nfc: llcp: nullify llcp_sock->dev on connect() error paths (Krzysztof Kozlowski) [task:179856]
  - nfc: Fix to check for kmemdup failure (Aditya Pakki) [task:179856]
  - io_uring: always grab file table for deferred statx (Jens Axboe) [task:179249] {CVE-2022-20568}
  - io_uring: disable polling pollfree files (Pavel Begunkov) [task:179288] {CVE-2022-3176}
  - Loongarch: Fix 'extioi' logic error (liubaolin) [task:180502]
  - LoongArch: Adjust {copy, clear}_user exception handler behavior (liubaolin) [task:180502]
  - LoongArch: ACPICA: Events: remove the global lock initialization (liubaolin) [task:180502]
  - LoongArch: Fix macro write_fcsr (liubaolin) [task:180502]
  - LoongArch: Fix return value underflow in exception path (liubaolin) [task:180502]
  - LoongArch: Tweak the BADV and CPUCFG.PRID lines in show_regs() (liubaolin) [task:180502]
  - LoongArch: Humanize the ECFG line when showing registers (liubaolin) [task:180502]
  - LoongArch: Humanize the EUEN line when showing registers (liubaolin) [task:180502]
  - LoongArch: Humanize the PRMD line when showing registers (liubaolin) [task:180502]
  - LoongArch: Humanize the CRMD line when showing registers (liubaolin) [task:180502]
  - LoongArch: Fix format of CSR lines during show_regs() (liubaolin) [task:180502]
  - LoongArch: Print symbol info for $ra and CSR.ERA only for kernel-mode contexts (liubaolin) [task:180502]
  - LoongArch: Print GPRs with ABI names when showing registers (liubaolin) [task:180502]
  - LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR (liubaolin) [task:180502]
  - char: pcmcia: remove all the drivers (Jiri Slaby) [task:177573] {CVE-2022-44033}
  - ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet) [task:179316, task:160493] {CVE-2020-36516}
  - OPENEULER: svm: Delete unused ioctl command (huhai) [task:180214] {CVE-2021-33639}
  - media: mceusb: Use USB_DIR_IN in read request (Hongyu Xie) [task:179257] {CVE-2022-3903}
  - media: mceusb: fix control-message timeouts (Johan Hovold) [bug:150405]
  - iomap: Set all uptodate bits for an Uptodate page (Matthew Wilcox (Oracle)) [bug:197566]
  - iomap: Use kzalloc to allocate iomap_page (Matthew Wilcox (Oracle)) [bug:197566]
  - security/kysec: fix possible memory leak in kysec_hash_sha256() (yangzhao) [task:126288]
  - security/kysec: fix the problem that the manufacturer program takes too long to open (wangkanglong) [bug:139540]
  - security/kysec: start menu freezes after opening Loongson browser (wangkanglong) [bug:102574]
  - security/kysec: add timeout for auth wait_event (yangzhao) [bug:169733, bug:170147]
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) {CVE-2023-45871}
  - netfilter: nfnetlink_osf: avoid OOB read (Wander Lairson Costa) {CVE-2023-39189}
  - Revert "NFS: Don't interrupt file writeout due to fatal errors" (ChenXiaoSong) [task:198290]
  - Revert "USB: core: Don't hold device lock while reading the "descriptors" sysfs file" (Hongyu Xie) [task:179861] {CVE-2023-37453}
  - OPENEULER: scripts: switch explicitly to Python 3 (Yi Li) [task:180198]
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng) [task:179901] {CVE-2023-31085}
  - remove the lightnvm subsystem (Christoph Hellwig) [task:179254] {CVE-2022-2991}
  - KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini) [task:179282] {CVE-2023-30456}
  - bpf, sockmap: fix deadlocks in the sockhash and sockmap (Xin Liu) [task:179888] {CVE-2023-0160}
  - bpf: Fix NULL event->prog pointer access in bpf_overflow_handler (Yonghong Song) [task:178877]
  - tweewide: Fix most Shebang lines (Finn Behrens)
  - media: dvb-core: Fix use-after-free due on race condition at dvb_net (Hyunwoo Kim) [task:179859] {CVE-2022-45886}
  - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 (Hyunwoo Kim) [task:179858] {CVE-2022-45919}
  - USB: ene_usb6250: Allocate enough memory for full object (Kees Cook) [task:166857] {CVE-2023-45862}
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng) {CVE-2023-31085}
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO (Lee, Chun-Yi) {CVE-2023-31083}
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith) {CVE-2023-1206}
  - xen/netback: Fix buffer overrun triggered by unusual packet (Ross Lagerwall) {CVE-2023-34319}
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (Steve Rutherford) [bug:193234]
  - dm: don't stop request queue after the dm device is suspended (Ming Lei) [task:172151]
  - dm rq: don't queue request to blk-mq during DM suspend (Ming Lei) [task:172151]
  - Revert "block: move blk_exit_queue into __blk_release_queue" (zhanggenjian) [task:177423]
  - Revert "block: free sched's request pool in blk_cleanup_queue" (zhanggenjian) [task:177423]
  - Revert "blk-mq: remove WARN_ON(!q->elevator) from blk_mq_sched_free_requests" (zhanggenjian) [task:177423]
  - Revert "block: adjust the position of the code section" (zhanggenjian) [task:177423]
  - Revert "blk-mq-sched: Fix blk_mq_sched_free_tags() build warning" (zhanggenjian) [task:177423]
  - KVM: SVM: document KVM_MEM_ENCRYPT_OP, let userspace detect if SEV is available (Paolo Bonzini) [bug:193234]
  - HYGON: KVM: SVM: Add support for different CSV guests to reuse the same ASID (hanliyang) [bug:193234]
  - KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails (Sean Christopherson) [bug:193234]
  - KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB (Sean Christopherson) [bug:193234]
  - KVM: SVM: Call SEV Guest Decommission if ASID binding fails (Alper Gun) [bug:193234]
  - KVM: SVM: Issue WBINVD after deactivating an SEV guest (Tom Lendacky) [bug:193234]
  - KVM: SVM: Reduce WBINVD/DF_FLUSH invocations (Tom Lendacky) [bug:193234]
  - KVM: SVM: Remove unneeded WBINVD and DF_FLUSH when starting SEV guests (Tom Lendacky) [bug:193234]
  - KVM: SVM: Guard against DEACTIVATE when performing WBINVD/DF_FLUSH (Tom Lendacky) [bug:193234]
  - KVM: SVM: Serialize access to the SEV ASID bitmap (Tom Lendacky) [bug:193234]
  - mm: always have io_remap_pfn_range() set pgprot_decrypted() (Jason Gunthorpe) [bug:193234]
  - HYGON: vfio/pci: Disable VFIO pci reset for hygon DCU device. (fangbaoshun) [bug:193234]
  - swiotlb: Remove call to sme_active() (Thiago Jung Bauermann) [bug:193234]
  - HYGON: KVM: SVM: Print Hygon CSV support info if support is detected (hanliyang) [bug:193234]
  - HYGON: crypto: ccp: Print Hygon CSV API version when CSV support is detected (hanliyang) [bug:193234]
  - HYGON: x86/cpu: Show Hygon csv feature in /proc/cpuinfo (hanliyang) [bug:193234]
  - HYGON: x86/csv: Print CSV info into the kernel log (hanliyang) [bug:193234]
  - HYGON: x86/kvm: Correct number of pages calculation in kvm_init_platform() (hanliyang) [bug:193234]
  - HYGON: x86/mm: Pass variable start to notify_range_enc_status_changed() in __set_memory_enc_dec() (hanliyang) [bug:193234]
  - x86/kvm: Add kexec support for SEV Live Migration. (Ashish Kalra) [bug:193234]
  - x86/kvm: Add guest support for detecting and enabling SEV Live Migration feature. (Ashish Kalra) [bug:193234]
  - EFI: Introduce the new AMD Memory Encryption GUID. (Ashish Kalra) [bug:193234]
  - mm: x86: Invoke hypercall when page encryption status is changed (Brijesh Singh) [bug:193234]
  - x86/kvm: Add AMD SEV specific Hypercall3 (Brijesh Singh) [bug:193234]
  - KVM: X86: Introduce KVM_HC_MAP_GPA_RANGE hypercall (Ashish Kalra) [bug:193234]
  - x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() (Isaku Yamahata) [bug:193234]
  - HYGON: Revert "crypto: ccp: Extend sev_user_data_status to provide more information about Hygon firmware" (hanliyang) [bug:193234]
  - HYGON: crypto: ccp: Fix a problem that vq thread may stuck when do multi process test. (Xiangyu Xu) [bug:193234]
  - HYGON: crypto: ccp - Add support for CMD HGSC_CERT_IMPORT (fangbaoshun) [bug:193234]
  - bpf: Don't use tnum_range on array range checking for poke descriptors (Daniel Borkmann) {CVE-2022-2905}
  - bpf: Fix incorrect verifier pruning due to missing register precision taints (Daniel Borkmann) {CVE-2023-2163}
  - security/kysec: use spin_lock_irq() instead of spin_lock() (huanfuxi) [bug:164413]
  - security/kysec: fix bug with deadlock when writing aufs files (yangzhao) [task:136839]
  - security/kysec: fix kmemleak of netctl (wangkanglong) [bug:190255]
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (xiaolinkui) [bug:195544]
  - gmjstcm: delete SMO0768 from TCM1 spi device id (Li ZhiGang) [task:175749]
  - mm/munlock: delete munlock_vma_pages_all(), allow oomreap (Hugh Dickins) [bug:163612, bug:188493, bug:188513, bug:189316]
  - netfilter: nft_exthdr: Search chunks in SCTP packets only (Phil Sutter) [bug:192914]
  - netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian (Stephen Suryaputra) [bug:192914]
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write (Florian Westphal) [bug:192914] {CVE-2023-4881}
  - netfilter: nft_exthdr: Fix for unsafe packet data read (Phil Sutter) [bug:192914]
  - netfilter: nft_exthdr: Support SCTP chunks (Phil Sutter) [bug:192914]
  - netfilter: nf_tables: add support for matching IPv4 options (Stephen Suryaputra) [bug:192914]
  - tpm: add TCM2.0 support in tpm_tis_spi (Li ZhiGang) [task:175234]
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou) [bug:189733] {CVE-2023-4132}
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou) [bug:189733] {CVE-2023-4132}
  - ipv6: do not leave garbage in rt->fib6_metrics (Eric Dumazet) [task:178045]
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa) [bug:197488] {CVE-2023-39192}
  - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [bug:197492] {CVE-2023-39193}
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma) [bug:197496] {CVE-2023-39194}
  - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu) [bug:189769] {CVE-2023-4387}
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (Zixuan Fu) [bug:189765] {CVE-2023-4385}
  - cec-api: prevent leaking memory through hole in structure (Hans Verkuil) [task:157172, bug:197484] {CVE-2020-36766}
  - net/sched: Retire rsvp classifier (Jamal Hadi Salim) [bug:196033] {CVE-2023-42755}
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) [bug:196022] {CVE-2023-4622}
  - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [bug:196026] {CVE-2023-42752}
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng) [task:177575] {CVE-2023-42754}
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim) [task:176709] {CVE-2022-45887}


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-52.32.v2207
changelog:
  - vfio/pci: enable CONFIG_VFIO_PCI_VGA for x86 (Cong Liu) [task:184699]
  - drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer (Lu Yao) [task:184449]
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Jozsef Kadlecsik) [bug:195544]
  - Revert "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test" (xiaolinkui) [bug:195544]
  - ext4: forbid commit inconsistent quota data when errors=remount-ro (Ye Bin) [task:183005]
  - quota: fixup *_write_file_info() to return proper error code (Yangtao Li) [task:183005]
  - dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (Li Lingfeng) [task:183052]
  - dm bufio: do buffer cleanup from a workqueue (Mikulas Patocka) [task:183052]
  - dm bufio: introduce a global cache replacement (Mikulas Patocka) [task:183052]
  - dm bufio: introduce a global queue (Mikulas Patocka) [task:183052]
  - dm bufio: refactor adjust_total_allocated (Mikulas Patocka) [task:183052]
  - dm bufio: call adjust_total_allocated from __link_buffer and __unlink_buffer (Mikulas Patocka) [task:183052]
  - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (Zhihao Cheng) [task:183052]
  - dm thin metadata: add wrappers for managing write locking of metadata (Mike Snitzer) [task:183052]
  - dm: add disk before alloc dax (Li Lingfeng) [task:183060]
  - perf/cgroups: Install cgroup events to correct cpuctx (Song Liu) [task:184204]
  - ovl: adhere to the vfs_ vs. ovl_do_ conventions for xattrs (Miklos Szeredi) [task:186656] {CVE-2023-32629}
  - ext4: fix overflow in ext4_iomap_alloc() (Jan Kara) [task:156171]
  - ext4: Fix occasional generic/418 failure (Jan Kara) [task:156171]
  - ext4: do not block RWF_NOWAIT dio write on unallocated space (Jan Kara) [task:156171]
  - ext4: dio take shared inode lock when overwriting preallocated blocks (Zhang Yi) [task:156171]
  - ext4: optimize file overwrites (Ritesh Harjani) [task:156171]
  - ext4: Optimize ext4 DIO overwrites (Jan Kara) [task:156171]
  - ext4: Move to shared i_rwsem even without dioread_nolock mount opt (Ritesh Harjani) [task:156171]
  - ext4: Start with shared i_rwsem in case of DIO instead of exclusive (Ritesh Harjani) [task:156171]
  - ext4: introduce direct I/O write using iomap infrastructure (Matthew Bobrowski) [task:156171]
  - vfs: introduce file_modified() helper (Amir Goldstein) [task:156171]
  - ext4: remove unnecessary error check (Shi Siyuan) [task:156171]
  - ext4: update ext4_sync_file() to not use __generic_file_fsync() (Matthew Bobrowski) [task:156171]
  - ext4: move inode extension check out from ext4_iomap_alloc() (Matthew Bobrowski) [task:156171]
  - ext4: move inode extension/truncate code out from ->iomap_end() callback (Matthew Bobrowski) [task:156171]
  - ext4: introduce direct I/O read using iomap infrastructure (Matthew Bobrowski) [task:156171]
  - ext4: introduce new callback for IOMAP_REPORT (Matthew Bobrowski) [task:156171]
  - ext4: split IOMAP_WRITE branch in ext4_iomap_begin() into helper (Matthew Bobrowski) [task:156171]
  - ext4: move set iomap routines into a separate helper ext4_set_iomap() (Matthew Bobrowski) [task:156171]
  - ext4: update direct I/O read lock pattern for IOCB_NOWAIT (Matthew Bobrowski) [task:156171]
  - ext4: reorder map.m_flags checks within ext4_iomap_begin() (Matthew Bobrowski) [task:156171]
  - iomap: Allow forcing of waiting for running DIO in iomap_dio_rw() (Jan Kara) [task:156171]
  - iomap: move the iomap_dio_rw ->end_io callback into a structure (Christoph Hellwig) [task:156171]
  - iomap: split size and error for iomap_dio_rw ->end_io (Matthew Bobrowski) [task:156171]
  - Revert "Revert "ext4: Allow parallel DIO reads"" (Shida Zhang) [task:156171]
  - Revert "Revert "Revert "ext4: Allow parallel DIO reads""" (Shida Zhang) [task:156171]
  - Revert "ext4: update direct I/O read lock pattern for IOCB_NOWAIT" (Shida Zhang) [task:156171]
  - Revert "ext4: introduce direct I/O read using iomap infrastructure" (Shida Zhang) [task:156171]
  - scsi: lpfc: Fix missing part of code logic in lpfc_nvmet.c (huhai) [task:184502]
  - scsi: lpfc: Fix missing part of code logic in lpfc_sli.c (huhai) [task:184502]
  - scsi: lpfc: Fix missing part of code logic in lpfc_nvmet.c (huhai) [task:184502]
  - Revert "scsi: lpfc: Fix GFT_ID and PRLI logic for RSCN" (huhai) [task:184502]
  - perf/core: Fix cgroup event list management (Namhyung Kim) [task:184204]
  - perf/core: Optimize perf_install_in_event() (Peter Zijlstra) [task:184204]
  - perf: Rework perf_event_exit_event() (Peter Zijlstra) [task:184204]
  - EULER: perf: Revert "perf: Paper over the hw.target problems" (Yang Jihong) [task:184204]
  - perf: Fix function pointer case (Peter Zijlstra) [task:184204]
  - perf/core: Fix hardlockup failure caused by perf throttle (Yang Jihong) [task:184204]
  - perf/core: Fix the same task check in perf_event_set_output (Kan Liang) [task:184204]
  - perf: Fix possible memleak in pmu_dev_alloc() (Chen Zhongjin) [task:184204]
  - perf/core: Fix address filter parser for multiple filters (Adrian Hunter) [task:184204]
  - perf: Fix list corruption in perf_cgroup_switch() (Song Liu) [task:184204]
  - perf/ioctl: Add check for the sample_period value (Ravi Bangoria) [task:184204]
  - objtool: Don't fail on missing symbol table (Josh Poimboeuf) [task:185741]
  - EULER: arm64/mpam: mark partid non-exclusive if self-owned (Wang ShaoBo) [task:182928]
  - EULER: arm64/mpam: realign step entry when traversing rmid_transform (Wang ShaoBo) [task:182928]
  - tty: tty_jobctrl: fix pid memleak in disassociate_ctty() (Yi Yang) [task:182946]
  - OPENEULER: irqchip: gic-v3: Collection table support muti pages (wangwudi) [task:183007]
  - net: add vlan_get_protocol_and_depth() helper (Eric Dumazet) [task:182970]
  - net: tap: check vlan with eth_type_vlan() method (Menglong Dong) [task:182970]
  - ipv6: Fix use of anycast address with loopback (David Ahern) [task:184541, task:183477]
  - ipv6: Create init helper for fib6_nh (David Ahern) [task:184541, task:183477]
  - net/ipv6: Do not reset nl_net in ip6_route_info_create (David Ahern) [task:184541, task:183477]
  - ipv6: Move setting default metric for routes (David Ahern) [task:184541, task:183477]
  - net: rtmsg_to_fib6_config() - use new style struct initializer instead of memset (Maciej Żenczykowski) [task:184541, task:183477]
  - Revert "ipv6: Create init helper for fib6_nh" (luoqing) [task:183477]
  - Revert "ipv6: Fix use of anycast address with loopback" (luoqing) [task:183477]
  - nvmet: set loop queue's segment boundary mask as PAGE_SIZE - 1 (pengcan) [task:174281, task:175051, task:175046, bug:195690, bug:195682, bug:195676]
  - Revert "nvmet: fix building bvec from sg list" (pengcan) [task:174281, task:175051, task:175046, bug:195690, bug:195682, bug:195676]
  - nbd: fix race between nbd_alloc_config() and module removal (Yu Kuai) [task:162162]
  - OPENEULER: xhci: fix USB xhci controller issue (Longfang Liu) [task:182993]
  - OPENEULER: mm: disable kernelcore=mirror when no mirror memory (Ma Wupeng) [task:182939]
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy) [task:119087] {CVE-2022-3564}
  - io_uring: ensure IOPOLL locks around deferred work (Jens Axboe) [task:179887] {CVE-2023-21400}
  - io_uring: get rid of intermediate IORING_OP_CLOSE stage (Jens Axboe) [task:179891] {CVE-2023-1295}
  - fs: provide locked helper variant of close_fd_get_file() (Jens Axboe) [task:179891]
  - file: Rename __close_fd_get_file close_fd_get_file (Eric W. Biederman) [task:179891]
  - xen/events: replace evtchn_rwlock with RCU (Juergen Gross) {CVE-2023-34324}
  - xen/events: don't unmask an event channel when an eoi is pending (Juergen Gross) [task:158827]
  - xen/events: don't use chip_data for legacy IRQs (Juergen Gross)
  - XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information. (Thomas Gleixner) [task:157358]
  - spi: spi-ls: add slave enumeration support when using acpi (Liu Peibao) [task:118969, task:183450]
  - Loongson2K: SPI: Enable spi driver module (Yinbo Zhu) [task:118969, task:183450]
  - Loongson2K/Loongson7A: SPI: Add spi controller pm support (Yinbo Zhu) [task:118969, task:183450]
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys (Dheeraj Kumar Srivastava) [task:166857, task:182934]
  - sch_netem: fix issues in netem_change() vs get_dist_table() (Eric Dumazet) [task:182934]
  - sch_netem: acquire qdisc lock in netem_change() (Eric Dumazet) [task:166857, task:182934]
  - cgroup: Do not corrupt task iteration when rebinding subsystem (Xiu Jianfeng) [task:166857, task:182934]
  - loop: loop_set_status_from_info() check before assignment (Zhong Jinghua) [task:182968]
  - loop: Check for overflow while configuring loop (Siddh Raman Pant) [task:162162]
  - scsi: hisi_sas: Fix normally completed I/O analysed as failed (Xingui Yang) [task:182978]
  - net/mlx5: Allow async trigger completion execution on single CPU systems (Roy Novich) [task:182578]
  - net/mlx5: Fix possible use-after-free in async command interface (Tariq Toukan) [task:182578]
  - net/mlx5: rate limit alloc_ent error messages (Li RongQing) [task:182578]
  - net/mlx5: Fix a race on command flush flow (Moshe Shemesh) [task:182578]
  - Revert "net/mlx5: Add retry mechanism to the command entry index allocation" (Moshe Shemesh) [task:182578]
  - net/mlx5: Set command entry semaphore up once got index free (Moshe Shemesh) [task:182578]
  - lib/stackdepot.c: fix global out-of-bounds in stack_slabs (Alexander Potapenko) [task:155707, task:183063]
  - i40e: Fix uninitialized variable mfs_max (Colin Ian King) [bug:194556]
  - i40e: Add netlink callbacks support for software based DCB (Arkadiusz Kubalewski) [bug:194556]
  - i40e: Add init and default config of software based DCB (Arkadiusz Kubalewski) [bug:194556]
  - i40e: Add hardware configuration for software based DCB (Arkadiusz Kubalewski) [bug:194556]
  - i40e: remove unused defines (Jesse Brandeburg) [bug:194556]
  - i40e: Move client header location (Shiraz Saleem) [bug:194556]
  - drm/atomic-helper: Bump vblank timeout to 100 ms (Linus Walleij) [task:182959]
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one (Florian Westphal) {CVE-2023-39197}
  - net: sched: fix NULL pointer dereference in mq_attach (Zhengchao Shao) [task:183053]
  - perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled (Zhipeng Xie) [task:104354]
  - of: overlay: kmemleak in dup_and_fixup_symbol_prop() (Frank Rowand) [task:183064]
  - iommu/dma: Fix MSI reservation allocation (Marc Zyngier) [task:183064]
  - Revert "Revert "mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)"" (Shida Zhang) [task:82242, task:182892]
  - ipv6: Fix use of anycast address with loopback (David Ahern) [task:99622, task:183477]
  - ipv6: Create init helper for fib6_nh (user) [task:99622, task:183477]
  - security/kysec: update memory protect interface (huanfuxi) [bug:193040]
  - 3rd/hsdimm-lite: refactor the module (huanfuxi) [bug:193040]
  - loongarch/module: Reduce the PLT required memory size (liubaolin) [task:183312]
  - KVM: Don't set Accessed/Dirty bits for ZERO_PAGE (Sean Christopherson) [task:182171]
  - KVM: fix overflow of zero page refcount with ksm running (Zhuang Yanying) [task:157172]
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work() (Yoshihiro Shimoda) [task:181443] {CVE-2023-35827}


author: Jackie Liu <liuyun01@kylinos.cn> - 4.19.90-52.33.v2207
changelog:
  - bpf: skmsg, fix psock create on existing kcm/tls port (John Fastabend) [task:189070]
  - Revert "fs/pipe:dont need wake up self in a single process of ub" (xiaolinkui) [task:186974]
  - Revert "fs/pipe: Solve the problem of LTP smoketest failure" (xiaolinkui) [task:186974]
  - security/kysec: allow rsync to inherit trusted lable (huanfuxi) [bug:113477]
  - security/kysec: fix unnecessary inspection in kysec_hash_sync_label_unknown() (yangzhao) [task:126286]
  - security/kysec: fix possible NULL pointer in SM3_final() (yangzhao) [task:126283]
  - epoll: fix missing code of do_epoll_ctl (xiaolinkui) [task:186974]
  - jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev (Zhihao Cheng) [task:187896]
  - HYGON:: hct only build on X86 platform (yangdepei) [task:189463]
  - ring-buffer: Sync IRQ works before buffer destruction (Johannes Berg) [task:188435]
  - ipmi: fix SSIF not responding under certain cond. (Zhang Yuchen) [task:188418]
  - ipmi_ssif: Rename idle state and check (Corey Minyard) [task:188419]
  - serial: 8250: Fix serial8250_tx_empty() race with DMA Tx (Ilpo Järvinen) [task:188423]
  - tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH (Ilpo Järvinen) [task:188424]
  - af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). (Kuniyuki Iwashima) [task:188425]
  - of: Fix modalias string generation (Miquel Raynal) [task:188428]
  - dccp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima) [task:188412]
  - tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). (Kuniyuki Iwashima) [task:188412]
  - udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). (Kuniyuki Iwashima) [task:188412]
  - HYGON: Adding ioctl variables MCCP_SHARE_OP_DMA_UNMAP_ALL to distinguish between DMA_UNMAP and DMA_UNMAP_ALL. (Yabin Li) [task:174598]
  - HYGON: add mediated ccp support in virtual machine (Yabin Li) [task:174598]
  - HYGON: bugfix: fix phy addr check failed in hct.ko due to C-bit. (Yabin Li) [task:174598]
  - HYGON: Support interrupt request for HCT asynchronous mode (Yabin Li) [task:174598]
  - HYGON: newfeature: ccp: add hct module (yangdepei) [task:174598]
  - HYGON: Support tkm virtualization (niuyongwen) [task:174598]
  - HYGON: Support psp virtualization (niuyongwen) [task:174598]
  - HYGON: newfeature: common: Add psp mutex enable ioctl support (chench) [task:174598]
  - HYGON: newfeature: common: concurrent psp access support between user and kernel space (chench) [task:174598]
  - HYGON: crypto: ccp: Add support for issue commands in RING_BUFFER Mode (fangbaoshun) [task:174598]
  - HYGON: crypto: ccp: Implement SEV_RING_BUFFER command handler (fangbaoshun) [task:174598]
  - HYGON: crypto:ccp: Add the status dequeue API support for CSV RING_BUFFER Mode (fangbaoshun) [task:174598]
  - HYGON: crypto:ccp: Add the command enqueue API support for CSV RING_BUFFER Mode (fangbaoshun) [task:174598]
  - HYGON: crypto: ccp: Add the init and free API support for CSV RING_BUFFER Mode (fangbaoshun) [task:174598]
  - net: Add conditions for auto affinity (xiaolinkui) [task:187683]
  - sctp: Call inet6_destroy_sock() via sk->sk_destruct(). (Kuniyuki Iwashima) [task:188412]
  - dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions. (Kuniyuki Iwashima) [task:188414]
  - net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). (Kuniyuki Iwashima) [task:188413]
  - EULER: config: enable set the max iova mag size to 128 (Zhang Zekun) [task:183036]
  - EULER: iommu/iova: increase the iova_rcache depot max size (Zhang Zekun) [task:183036]
  - dm thin metadata: check fail_io before using data_sm (Li Lingfeng) [task:182982]
  - dm space maps: improve performance with inc/dec on ranges of blocks (Joe Thornber) [task:182982]
  - dm: don't lock fs when the map is NULL during suspend or resume (Li Lingfeng) [task:182983]
  - dm: don't lock fs when the map is NULL in process of resume (Li Lingfeng) [task:182983]
  - skbuff: Fix a race between coalescing and releasing SKBs (Liang Chen) [task:185227]
  - skbuff: fix coalescing for page_pool fragment recycling (Jean-Philippe Brucker) [task:185227]
  - skbuff: Fix a potential race while recycling page_pool packets (Ilias Apalodimas) [task:185227]
  - security/kyextend: Remove the default assignment of zero (chengang) [bug:189708]
  - NFS: make sure open context mode have FMODE_EXEC when file open for exec (ChenXiaoSong) [task:187717] {CVE-2022-24448}
  - NFSv4: fix open failure with O_ACCMODE flag (ChenXiaoSong) [task:187717] {CVE-2022-24448}
  - Revert "NFSv4: Handle the special Linux file open access mode" (ChenXiaoSong) [task:187717] {CVE-2022-24448}
  - EULER: net: hns3: update hns3 version to 23.7.1 (Yonglong Liu) [task:186993]
  - EULER: net: hns3: fix tx timeout issue (Jian Shen) [task:186991]
  - EULER: net: hns3: add barrier in vf mailbox reply process (Yonglong Liu) [task:182950]
  - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (Jie Wang) [task:182948]
  - nvmet: fix setting ns queue's segment boundary (pengcan) [task:187823]
  - Revert "Revert "nvmet: fix building bvec from sg list"" (pengcan) [task:187823]
  - config: disable unprivileged eBPF by default (chenyuan) [task:178019, task:186859]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.34.v2207
changelog:
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs (Yihang Li) [task:196398]
  - ida: Fix crash in ida_free when the bitmap is empty (Matthew Wilcox (Oracle)) [task:196096] {CVE-2023-6915}
  - drm/atomic: Fix potential use-after-free in nonblocking commits (Daniel Vetter) [task:196093] {CVE-2023-51043}
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig) [task:196092] {CVE-2023-51042}
  - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (Krzysztof Kozlowski) [task:196011] {CVE-2023-46343}
  - net: hns3: fix output information incomplete for dumping tx queue info with debugfs (Jie Wang) [task:183106]
  - net: hns3: fix reset delay time to avoid configuration timeout (Jie Wang) [task:182918]
  - security/kysec: bound pcr_extend with kysec status not exectl. (penghuaihe) [bug:210446, bug:210278, bug:210330, bug:210312]
  - security/kysec: encapsulate hash cal as a separate function (penghuaihe) [bug:210446, bug:210278, bug:210330, bug:210312]
  - stmmac: remove is_ft_mcu_ready when getting mac addr from nvmem (luyun) [task:18023, bug:210342]
  - config: Enable support for CFB mode (chengang) [bug:211037]
  - tty: fix hang on tty device with no_room set (Hui Li) [task:190651]
  - security/kysec: Fix inheritance error in parent process marking (chengang) [task:208546]
  - smb: client: fix potential OOB in smb2_dump_detail() (Paulo Alcantara) [task:195442] {CVE-2023-6610}
  - smb: client: fix OOB in receive_encrypted_standard() (Paulo Alcantara) [task:196094] {CVE-2024-0565}
  - media: v4l2-mem2mem: fix epoll() by calling poll_wait first (Hans Verkuil) [task:193171]
  - net/sched: cbs: Fix not adding cbs instance to list (Vinicius Costa Gomes) [task:193171]
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (Chengfeng Ye) [task:196364] {CVE-2024-0639}
  - LoongArch: driver : rnp: Fix the irq numbers of rnp dirver request. (liubaolin) [task:195831]
  - netfilter: ipset: Fix the last missing check of nla_parse_deprecated() (Jozsef Kadlecsik) [task:193171]
  - Revert "Revert "ima: check the xattr length of ima&evm before measurement"" (mengdehui) [task:195294]
  - Revert "Revert "ima: change the default hash algorithm to sha256"" (mengdehui) [task:195294]
  - net/vlan: include the shift in skb_vlan_tag_get_prio() (Michał Mirosław) [task:194897]
  - Loongson: Loongson3: numa: fix high_memory calculate. (Chong Qiao) [task:194608]
  - LoongArch: numa: fix high_memory calculate. (Chong Qiao) [task:194609]
  - spi: loongson: add bus driver for the loongson spi controller (Qiming Yang) [task:194611]
  - signal: Properly set TRACE_SIGNAL_LOSE_INFO in __send_signal (Eric W. Biederman)
  - release-stable-kernel: Add Zhengyuan Liu as Maintainer for SP3 (Jackie Liu)
  - Input: add bounds checking to input_set_capability() (Jeff LaBundy) [task:162162] {CVE-2022-48619}
  - Revert "ima: change the default hash algorithm to sha256" (liuqi) [task:192131]
  - Revert "ima: check the xattr length of ima&evm before measurement" (liuqi) [task:192131]
  - bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation (Jun'ichi Nomura) [bug:203534]
  - smb: client: fix OOB in smbCalcSize() (Paulo Alcantara) [task:193171] {CVE-2023-6606}
  - phy: fix driver name display error (xiaolinkui) [task:194225]
  - dm crypt: Initialize crypto wait structures (Damien Le Moal) [task:184881]
  - dm crypt: fix GFP flags passed to skcipher_request_alloc() (Mikulas Patocka) [task:184881]
  - dm crypt: reuse eboiv skcipher for IV generation (Ard Biesheuvel) [task:184881]
  - dm crypt: Implement Elephant diffuser for Bitlocker compatibility (Milan Broz) [task:184881]
  - dm crypt: implement eboiv - encrypted byte-offset initialization vector (Milan Broz) [task:184881]
  - vhost: use kzalloc() instead of kmalloc() followed by memset() (Prathu Baronia) [task:193171] {CVE-2024-0340}
  - bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func (Jiri Olsa) [task:190915]
  - Revert "security/kysec: add netlink_send hook into LSM." (tianyunnuan) [task:179762]
  - Revert "security/kysec: pk label limit is useful only in sm env." (tianyunnuan) [task:179762]
  - security/kysec: Fix bug of non-execution tcm2 extension (liuqi) [task:193262]
  - security/kysec: Fix build dependence with tpm (liuqi) [task:193237]
  - nbd: fix null-ptr-dereference while accessing 'nbd->config' (Li Nan) [task:184984]
  - nbd: factor out a helper to get nbd_config without holding 'config_lock' (Li Nan) [task:184984]
  - nbd: fold nbd config initialization into nbd_alloc_config() (Li Nan) [task:184984]
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao) [task:193171] {CVE-2023-6932}
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg (Hyunwoo Kim) [task:193171] {CVE-2023-51779}
  - net/rose: Fix Use-After-Free in rose_ioctl (Hyunwoo Kim) [task:193171] {CVE-2023-51782}
  - appletalk: Fix Use-After-Free in atalk_ioctl (Hyunwoo Kim) [task:193171] {CVE-2023-51781}
  - atm: Fix Use-After-Free in do_vcc_ioctl (Hyunwoo Kim) [task:193171] {CVE-2023-51780}
  - security/kysec: Fixed compilation errors without PROCESS PROTECT (chengang) [task:192327]
  - OPENEULER: irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801 (Xiang Chen) [task:183018]
  - irqchip/gic-v3-its: Make is_v4 use a TYPER copy (Marc Zyngier) [task:183018]
  - crypto: cryptd - Protect per-CPU resource by disabling BH. (Sebastian Andrzej Siewior) [task:184972]
  - blk-wbt: make enable_state more accurate (Yu Kuai) [task:184970]
  - ext4: turning quotas off if mount failed after enable quotas (Baokun Li) [task:184977]
  - OPENEULER: x86/kprobes: Fix the error judgment for debug exceptions (Li Huafei) [task:184976]
  - ipmi_si: fix a memleak in try_smi_init() (Yi Yang) [task:184979]
  - quota: simplify drop_dquot_ref() (Baokun Li) [task:184966]
  - quota: fix dqput() to follow the guarantees dquot_srcu should provide (Baokun Li) [task:184966]
  - quota: add new helper dquot_active() (Baokun Li) [task:184966]
  - quota: rename dquot_active() to inode_quota_active() (Baokun Li) [task:184966]
  - quota: factor out dquot_write_dquot() (Baokun Li) [task:184966]
  - quota: add dqi_dirty_list description to comment of Dquot List Management (Chengguang Xu) [task:184966]
  - quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list (Chengguang Xu) [task:184966]
  - jbd2: fix checkpoint cleanup performance regression (Zhang Yi) [task:184982]
  - jbd2: remove __journal_try_to_free_buffer() (Zhang Yi) [task:184983]
  - jbd2: fix a race when checking checkpoint buffer busy (Zhang Yi) [task:184983]
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint (Zhihao Cheng) [task:184983]
  - jbd2: remove journal_clean_one_cp_list() (Zhang Yi) [task:184983]
  - jbd2: remove t_checkpoint_io_list (Zhang Yi) [task:184983]
  - jbd2: recheck chechpointing non-dirty buffer (Zhang Yi) [task:184983]
  - security/kysec: implementation of dentry_create_files_as() hook (yangzhao) [bug:30065]
  - security/kysec: remove judgments greater than 32 signals (wangkanglong) [bug:111722]
  - security/kysec: filter signals which are not kill signal in task_kill() (yangzhao) [bug:107836]
  - security/kysec: use msleep_interruptible() instead of msleep() (yangzhao) [task:131471]
  - security/kysec: optimize kysec thread waiting mode by wait_event (yangzhao) [task:110527]
  - KVM: arm64: Fix clean dcache when vcpu is 0 (zhanghao1) [task:186056]
  - nfsd: Remove incorrect check in nfsd4_validate_stateid (Trond Myklebust) [task:184474]
  - nfsd4: kill warnings on testing stateids with mismatched clientids (J. Bruce Fields) [task:184474]
  - EULER: net: hns: fix wrong head when modify the tx feature when sending packets (Yonglong Liu) [task:182947]
  - KVM: SVM: Add 5-level page table support for SVM (Wei Huang) [bug:197000]
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua) [task:193171] {CVE-2023-7192}
  - HYGON: crypto: ccp: fix bug that SM2 encryption of long data causes kernel crash (liulanyi) [bug:207605]
  - security/kysec: Record TPM log using a kthread (liuqi) [task:181343]
  - security/kysec: Only record TPM log once per file (liuqi) [task:181343]
  - security/kysec: Add TPM based static measurement functions (huanfuxi) [task:177770, task:181343]
  - asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation (Linus Torvalds)
  - blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" (Ming Lei)
  - ipv4: Fix potential uninit variable access bug in __ip_make_skb() (Ziyang Xuan) [task:188430]
  - net/packet: convert po->auxdata to an atomic flag (Eric Dumazet) [task:188433]
  - net/packet: convert po->origdev to an atomic flag (Eric Dumazet) [task:188434]
  - nvmet: nul-terminate the NQNs passed in the connect command (Christoph Hellwig) [task:189180] {CVE-2023-6121}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.35.v2207
changelog:
  - USB: serial: pl2303: fix line-speed handling on newer chips (Johan Hovold) [bug:211186]
  - USB: serial: pl2303: add support for PL2303HXN (Charles Yeh) [bug:211186]
  - USB: serial: pl2303: fix tranceiver suspend mode (Johan Hovold) [bug:211186]
  - USB: serial: pl2303: fix non-supported xon/xoff (Johan Hovold) [bug:211186]
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) [task:199635] {CVE-2023-6931}
  - loop: loop_set_status_from_info() check before assignment (Zhong Jinghua) [task:192988]
  - loop: Check for overflow while configuring loop (Siddh Raman Pant) [task:192988]
  - loop: Factor out configuring loop from status (Martijn Coenen) [task:192988]
  - Revert "loop: Check for overflow while configuring loop" (zhanggenjian) [task:192988]
  - loop: properly observe rotational flag of underlying device (Holger Hoffstätte) [task:192988]
  - loop: Refactor loop_set_status() size calculation (Martijn Coenen) [task:192988]
  - loop: Factor out setting loop device size (Martijn Coenen) [task:192988]
  - loop: Remove sector_t truncation checks (Martijn Coenen) [task:192988]
  - loop: Call loop_config_discard() only after new config is applied (Martijn Coenen) [task:192988]
  - Revert "loop: loop_set_status_from_info() check before assignment" (zhanggenjian) [task:192988]
  - tcm: support tpmrm function of ax99100_spi interface TCM module (jiangxiujie) [task:198010]
  - LoongArch: Clean up play_dead code (Yangyinglu) [task:198660]
  - LoongArch:LSVZ: remove uncached_acc CSR emulation (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: rename gcsr_readq with gcsr_read (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: rename wait instruction with idle (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: remove unused variable (Mao Bibo) [task:118969]
  - LoongArch: delete struct boot_mem_map (liuyun) [task:198660]
  - LoongArch:LSVZ: set guestid variable at percpu area (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: rename lvz_trap_handle_xxx with _kvm_handle_xxx (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: kvm code cleanup v2 (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: kvm code cleanup on mm (Mao Bibo) [task:198660]
  - LoongArch:LSVZ: kvm code cleanup (Mao Bibo) [task:198660]
  - PCI: Add ACS quirk for Wangxun NICs (Mengyuan Lou) [task:195929]
  - PCI: Unify ACS quirk desired vs provided checking (Bjorn Helgaas) [task:195929]
  - PCI: Add ACS quirk for iProc PAXB (Abhinav Ratna) [task:195929]
  - PCI: Make ACS quirk implementations more uniform (Bjorn Helgaas) [task:195929]
  - rpmbuild: Choose the algorithm for module signing based on the config (chengang) [task:197392]
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv (Sharath Srinivasan) [task:198453] {CVE-2024-23849}
  - scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan() (Tuo Li) [task:198457] {CVE-2024-24855}
  - dm: limit the number of targets and parameter size area (Mikulas Patocka) [task:198455] {CVE-2023-52429}
  - dm ioctl: log an error if the ioctl structure is corrupted (Mikulas Patocka) [task:198455]
  - jfs: fix log->bdev_handle null ptr deref in lbmStartIO (Lizhi Xu) [task:196809]
  - scsi: fcoe: pass in fcoe_rport structure instead of fc_rport_priv (Hannes Reinecke) [task:197881]
  - scsi: libfc: Whitespace cleanup in libfc.h (Hannes Reinecke) [task:197881]
  - netfilter: nf_tables: Reject tables of unsupported family (Phil Sutter) [task:196095] {CVE-2023-6040}
  - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (Dan Carpenter) [task:196363] {CVE-2024-0607}
  - security/kysec: Resolve abnormal KYSEC audit log issues (chengang) [bug:210410]
  - block: fix NULL pointer dereference in account statistics with IDE (Logan Gunthorpe) [task:196111]
  - block: account statistics for passthrough requests (Logan Gunthorpe) [task:196111]
  - machine_t: Limit specific architecture judgment functions (Jackie Liu)
  - LoongArch: hugepage table replace tlb (liuyun) [task:198242]
  - ZHAOXIN: Update PMU uncore dump bug patch (leoliu-oc) [bug:203040]
  - ZHAOXIN: Update PMU support for Zhaoxin KX-7000 (leoliu-oc) [bug:203040]
  - ZHAOXIN: Fix Zhaoxin PMU uncore kdump fail bug (leoliu-oc) [bug:203040]
  - arch/x86: avoid redefinition issues (liwanwu) [bug:203040]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.36.v2207
changelog:
  - package: Fix packing problem when building rpm packages (Jiangshan Yi) [task:171572, task:201386]
  - rpmbuild: support srpm when need (Jackie Liu) [task:201386]
  - net: openvswitch: fix race on port output (Felix Huettner) [task:202729]
  - i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails (Qinglang Miao) [task:201794] {CVE-2020-36782}
  - net: sched: sch_teql: fix null-pointer dereference (Pavel Tikhomirov) [task:215813]
  - mm: swapoff: shmem_unuse() stop eviction without igrab() (Hugh Dickins) [task:199161]
  - mm: swapoff: take notice of completion sooner (Hugh Dickins) [task:199161]
  - mm: swapoff: remove too limiting SWAP_UNUSE_MAX_TRIES (Hugh Dickins) [task:199161]
  - mm: swapoff: shmem_find_swap_entries() filter out other types (Hugh Dickins) [task:199161]
  - mm: swap: properly update readahead statistics in unuse_pte_range() (Andrea Righi) [task:199161]
  - mm: rid swapoff of quadratic complexity (Vineeth Remanan Pillai) [task:199161]
  - mm: refactor swap-in logic out of shmem_getpage_gfp (Vineeth Remanan Pillai) [task:199161]
  - shmem: Convert shmem_add_to_page_cache to XArray (Matthew Wilcox) [task:199161]
  - shmem: Convert find_swap_entry to XArray (Matthew Wilcox) [task:199161]
  - shmem: Convert shmem_confirm_swap to XArray (Matthew Wilcox) [task:199161]
  - shmem: Convert shmem_radix_tree_replace to XArray (Matthew Wilcox) [task:199161]
  - LoongArch:modify vfat and nls936 config to y (liubaolin) [task:193507]
  - LoongArch:LSVZ: disable hugepage during migration process (Bibo Mao) [task:198660]
  - LoongArch: LSVZ: Fix huge page check issue (liubaolin) [task:198660]
  - LoongArch: Flush the cache of PTW when creating new page table. (liubaolin) [task:198660]
  - LoongArch: Introduce hardware page table walk (liubaolin) [task:198660]
  - irqchip/loongarch: Improve extioi code for guest cpu (liubaolin) [task:198660]
  - LoongArch: Fix initrd parsing in the small fdt method (Youling Tang) [task:198660]
  - LoongArch: Fix the initrd parsing on the command line (yangqiming) [task:198660]
  - LoongArch: Efistub support V40 interface (yangqiming) [task:198660]
  - LoongArch: Fix kexec operation failed to resolve initrd on V4.0 interface (Youling Tang) [task:198660]
  - LoongArch: Support initrd passing by systemtable (Jianmin Lv) [task:198660]
  - irqchip: irq-loongarch-extioi: fix code error (Baoqi Zhang) [task:198660]
  - irqchip: irq-loongarch-extioi: update dt parameters (Liu Peibao) [task:198660]
  - loongarch: fix enable_pcie_wakeup() called twice (mengyingkun) [task:198660]
  - LoongArch: Rename csr register Help functions (Yanteng Si) [task:198660]
  - x86/alternatives: add missing insn.h include (Dave Hansen) [task:198393]
  - x86/alternatives: Sync bp_patching update for avoiding NULL pointer exception (Masami Hiramatsu) [task:198393]
  - x86/kprobes: Fix ordering while text-patching (Peter Zijlstra) [task:198393]
  - x86/alternatives: Add and use text_gen_insn() helper (Peter Zijlstra) [task:198393]
  - x86/alternatives, jump_label: Provide better text_poke() batching interface (Peter Zijlstra) [task:198393]
  - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [task:198393]
  - x86/jump_label: Make tp_vec_nr static (YueHaibing) [task:198393]
  - x86/jump_label: Batch jump label updates (Daniel Bristot de Oliveira) [task:198393]
  - x86/jump_label: Add a __jump_label_set_jump_code() helper (Daniel Bristot de Oliveira) [task:198393]
  - x86/alternative: Batch of patch operations (Daniel Bristot de Oliveira) [task:198393]
  - x86/kprobes: Prohibit probing on functions before kprobe_int3_handler() (Masami Hiramatsu) [task:198393]
  - rcu: Refactor rcu_{nmi,irq}_{enter,exit}() (Byungchul Park) [task:198393]
  - x86/alternatives: Remove the return value of text_poke_*() (Nadav Amit) [task:198393]
  - x86/jump-label: Remove support for custom text poker (Nadav Amit) [task:198393]
  - x86/jump_label: Use text_poke_early() during early init (Nadav Amit) [task:198393]
  - x86/jump_label: Switch to jump_entry accessors (Ard Biesheuvel) [task:198393]
  - jump_label: Implement generic support for relative references (Ard Biesheuvel) [task:198393]
  - jump_label: Abstract jump_entry member accessors (Ard Biesheuvel) [task:198393]
  - KVM: arm64: pmu: Reset sample period on overflow handling (Marc Zyngier) [task:197911]
  - KVM: arm/arm64: Remove pmc->bitmask (Andrew Murray) [task:197911]
  - kylin/gmjstcm:Adapting TCM1.0 to x86 (wudandan) [task:195669]
  - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (Hao Sun) [task:200744] {CVE-2024-26589}
  - crypto: enable SM3_GENERIC configs (chengang) [bug:215175]
  - vhost_net: revert upend_idx only on retriable error (Andrey Smetanin) [task:201250]
  - netfilter: nf_tables: don't skip expired elements during walk (Florian Westphal) [task:179882] {CVE-2023-4244}
  - netfilter: nft_set_rbtree: Add missing expired checks (Phil Sutter) [task:179882]
  - EDAC/thunderx: Fix possible out-of-bounds string access (Arnd Bergmann) [task:200669] {CVE-2023-52464}
  - blk-mq: fix IO hang from sbitmap wakeup race (Ming Lei)
  - Makefile: add mips and loongarch SRCARCH (Li ZhiGang) [task:199827]
  - security/ima&evm: change default hash algorithm to sha256 (liuqi) [task:192131]
  - security/ima&evm: fix xattr check error (liuqi) [task:192131]
  - f2fs: explicitly null-terminate the xattr list (Eric Biggers) [task:200626] {CVE-2023-52436}
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Zhipeng Lu) [task:200671] {CVE-2023-52469}
  - net: qualcomm: rmnet: fix global oob in rmnet_policy (Lin Ma) [task:200745] {CVE-2024-26597}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Linus Torvalds) [task:200749] {CVE-2024-26602}
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Tony Lindgren) [task:200752] {CVE-2024-26600}
  - binder: signal epoll threads of self-work (Carlos Llamas) [task:200750] {CVE-2024-26606}
  - CIFS: Fix retry mid list corruption on reconnects (Pavel Shilovsky) [task:197803]
  - net: devlink: skip info_get op call if it is not defined in dumpit (Jiri Pirko) [task:199476]
  - Revert "optimize: rm redundant code in kysec fpro" (penghuaihe) [bug:207104]
  - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (Gui-Dong Han) [task:199813] {CVE-2024-24860}
  - Bluetooth: Move {min,max}_key_size debugfs into hci_debugfs_create_le (Marcel Holtmann) [task:199813]
  - Bluetooth: Add support for LE ping feature (Spoorthi Ravishankar Koppad) [task:199813]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.37.v2207
changelog:
  - scripts: add a script to calculate tasks (Zhengyuan Liu)
  - Revert "GRT: net: fix some warning by gcc" (zhulei) [task:215796]
  - clk: sunxi-ng: Unregister clocks/resets when unbinding (Samuel Holland) [task:212525, task:215462] {CVE-2021-47205}
  - Revert "clk: sunxi-ng: add support for the Allwinner A100 CCU" (Jiangshan Yi) [task:215462]
  - Revert "clk: sunxi-ng: Add support for the Allwinner H616 CCU" (Jiangshan Yi) [task:215462]
  - Revert "clk: sunxi-ng: Unregister clocks/resets when unbinding" (Jiangshan Yi) [task:215462]
  - clk: Add of_clk_hw_register() API for early clk drivers (Stephen Boyd) [task:212789, task:215462]
  - clk: Prepare for clk registration API that uses DT nodes (Stephen Boyd) [task:212789, task:215462]
  - GRT: net: fix some warning by gcc (zhulei) [task:215796]
  - security/kysec: Fixed kernel compilation security warnings (mengdehui) [task:215795]
  - security/kysec: fix some code still run when pcr closed (mengdehui) [bug:217795]
  - securirty/kysec: fix dentry info mem leak (mengdehui) [bug:217795]
  - security/kysec: Add mount_lock when traversing mnt list (mengdehui) [bug:217795]
  - security/kysec: Add fault tolerance when sb_sec is NULL (mengdehui) [bug:217795]
  - NETSWIFT: txgbe: fix some warning by gcc (zhulei) [task:215796]
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Kunwu Chan) [task:207382] {CVE-2023-52607}
  - powerpc/mm: fix a warning when a cache is common to PGD and hugepages (Christophe Leroy) [task:207382] {CVE-2023-52607}
  - powerpc/mm: replace hugetlb_cache by PGT_CACHE(PTE_T_ORDER) (Christophe Leroy) [task:207382] {CVE-2023-52607}
  - Revert "i40e: The state of phy may not be correct during power-on" (xiaolinkui) [task:210775]
  - ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (Duoming Zhou) [task:209227, task:214895] {CVE-2024-26654}
  - ALSA: sh: Fix compile warning wrt const (Takashi Iwai) [task:155707, task:214895]
  - ALSA: aica: Fix a long-time build breakage (Takashi Iwai) [task:153627, task:214895]
  - LoongArch:adjust the calc method of number of packages. (wanghongliang) [task:209781]
  - LoongArch:irqchip/loongarch-extioi:Fix ext irq route error. (wanghongliang) [task:209781]
  - cpufreq: loongson3-acpi: Initialize the value of policy->cur (mengyingkun) [task:209781]
  - ipmi: ls2k500 kcs ipmi add nolock version support. (Chong Qiao) [task:209781]
  - irqchip/loongarch-extioi: Fix ext irq route fail when some cpus offline (Juxin Gao) [task:209781]
  - OPENEULER: SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers (zhanglei) [task:205210]
  - arm64/config: CONFIG_PHYTIUM_MBOX=m (chizhiling) [bug:221940]
  - OPENEULER: mailbox: add phytium mailbox driver (Chen Ziqiang) [bug:221940]
  - scsi: qedf: Add pointer checks in qedf_update_link_speed() (Javed Hasan) [task:206931] {CVE-2021-47077}
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts (Chun-Yi Lee) [task:194976] {CVE-2023-6270}
  - thermal: Fix NULL pointer dereferences in of_thermal_ functions (Subbaraman Narayanamurthy) [task:212533] {CVE-2021-47202}
  - tracing/trigger: Fix to return error if failed to alloc snapshot (Masami Hiramatsu (Google)) [task:212517] {CVE-2024-26920}
  - x86, relocs: Ignore relocations in .notes section (Kees Cook) [task:212412] {CVE-2024-26816}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [task:209259] {CVE-2024-26644}
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop] (Mukesh Ojha) [task:209249] {CVE-2023-52635}
  - nilfs2: fix potential bug in end_buffer_async_write (Ryusuke Konishi) [task:210283] {CVE-2024-26685}
  - aoe: avoid potential deadlock at set_capacity (Maksim Kiselev) [task:210627] {CVE-2024-26775}
  - clk: sunxi-ng: Unregister clocks/resets when unbinding (Samuel Holland) [task:212525] {CVE-2021-47205}
  - clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock (Icenowy Zheng) [task:155707]
  - clk: sunxi-ng: Add support for the Allwinner H616 CCU (Andre Przywara) [task:212525]
  - clk: sunxi-ng: add support for the Allwinner A100 CCU (Yangtao Li) [task:212525]
  - clk: sunxi: Don't call clk_hw_get_name() on a hw that isn't registered (Stephen Boyd) [task:212525]
  - clk: sunxi-ng: v3s: add Allwinner V3 support (Icenowy Zheng) [task:212525]
  - clk: sunxi-ng: v3s: add the missing PLL_DDR1 (Icenowy Zheng) [task:153627]
  - clk: sunxi-ng: v3s: Use local parent references for CLK_FIXED_FACTOR (Chen-Yu Tsai) [task:212525]
  - clk: sunxi-ng: switch to of_clk_hw_register() for registering clks (Chen-Yu Tsai) [task:212525]
  - clk: sunxi-ng: h6: Preset hdmi-cec clock parent (Jernej Skrabec) [task:212525]
  - clk: sunxi-ng: f1c100s: fix USB PHY gate bit offset (Icenowy Zheng) [task:212525]
  - clk: sunxi-ng: add support for suniv F1C100s SoC (Mesih Kilinc) [task:212525]
  - x86/alternatives: Disable KASAN in apply_alternatives() (Kirill A. Shutemov) [task:205153] {CVE-2023-52504}
  - binder: fix race between mmput() and do_exit() (Carlos Llamas) [task:207402] {CVE-2023-52609}
  - reiserfs: Avoid touching renamed directory if parent does not change (Jan Kara) [task:207282] {CVE-2023-52591}
  - bnxt_en: Fix RX consumer index logic in the error path. (Michael Chan) [task:206925] {CVE-2021-47015}
  - bnxt_en: Reduce unnecessary message log during RX errors. (Michael Chan) [task:206925]
  - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume (Yu Kuai) [task:210625]
  - md: Don't ignore suspended array in md_check_recovery() (Yu Kuai) [task:210625] {CVE-2024-26758}
  - vfio/pci: Lock external INTx masking ops (Alex Williamson) [task:210634] {CVE-2024-26810}
  - rt2x00: initialize last_reset (Stanislaw Gruszka) [task:207285]
  - rt2x00: clear IV's on start to fix AP mode regression (Stanislaw Gruszka) [task:207285] {CVE-2023-52595}
  - rt2x00: add restart hw (Stanislaw Gruszka) [task:207285]
  - rt2800: add pre_reset_hw callback (Stanislaw Gruszka) [task:207285]
  - rt2800: initial watchdog implementation (Stanislaw Gruszka) [task:207285]
  - rt2800: add helpers for reading dma done index (Stanislaw Gruszka) [task:207285]
  - rt2x00: allow to specify watchdog interval (Stanislaw Gruszka) [task:207285]
  - rt2x00: use different txstatus timeouts when flushing (Stanislaw Gruszka) [task:207285]
  - rt2x00: do not check for txstatus timeout every time on tasklet (Stanislaw Gruszka) [task:207285]
  - rt2800mmio: use txdone/txstatus routines from lib (Stanislaw Gruszka) [task:207285]
  - rt2800: move usb specific txdone/txstatus routines to rt2800lib (Stanislaw Gruszka) [task:207285]
  - net/smc: remove device from smcd_dev_list after failed device_add() (Julian Wiedmann) [task:207216] {CVE-2021-47143}
  - KVM: Destroy target device if coalesced MMIO unregistration fails (Sean Christopherson) [task:206929] {CVE-2021-47060}
  - KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio (Kefeng Wang) [task:206929] {CVE-2021-47060}
  - KVM: Stop looking for coalesced MMIO zones if the bus is destroyed (Sean Christopherson) [task:206929] {CVE-2021-47060}
  - ubi: Check for too small LEB size in VTBL code (Richard Weinberger) [task:212058] {CVE-2024-25739}
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation (Bastien Nocera) [task:212057] {CVE-2024-24859}
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security (Yuxuan Hu) [task:212059] {CVE-2024-22099}
  - can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (Ziqi Zhao) [task:210651] {CVE-2023-52638}
  - net: rds: use maybe_get_net() when acquiring refcount on TCP sockets (Tetsuo Handa) [task:209413]
  - tee: optee: Fix incorrect page free bug (Sumit Garg) [task:206938] {CVE-2021-47087}
  - asix: fix wrong return value in asix_check_host_enable() (Pavel Skripkin) [task:206939]
  - asix: fix uninit-value in asix_mdio_read() (Pavel Skripkin) [task:206939] {CVE-2021-47101}
  - net: asix: fix uninit value bugs (Pavel Skripkin) [task:206939]
  - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command (Michal Grzedzicki) [task:205228] {CVE-2023-52500}
  - x86/kvm: Do not try to disable kvmclock if it was not enabled (Kirill A. Shutemov) [task:207214]
  - x86/kvm: Disable kvmclock on all CPUs on shutdown (Vitaly Kuznetsov) [task:207214] {CVE-2021-47110}
  - x86/kvm: Teardown PV features on boot CPU as well (Vitaly Kuznetsov) [task:206940] {CVE-2021-47112}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Xingyuan Mo) [task:210392] {CVE-2023-7042}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Baokun Li) [task:210360] {CVE-2024-26773}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Baokun Li) [task:210642] {CVE-2024-26772}
  - ext4: fix double-free of blocks due to wrong extents moved_len (Baokun Li) [task:210641] {CVE-2024-26704}
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (Bart Van Assche) [task:210645] {CVE-2024-26744}
  - net: ip_tunnel: prevent perpetual headroom growth (Florian Westphal) [task:210646] {CVE-2024-26804}
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) (Oleksij Rempel) [task:210648] {CVE-2023-52637}
  - can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done (Oleksij Rempel) [task:210648]
  - fbdev: savage: Error out if pixclock equals zero (Fullway Wang) [task:210633] {CVE-2024-26778}
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Zach O'Keefe) [task:210632] {CVE-2024-26720}
  - wifi: mac80211: fix race condition on enabling fast-xmit (Felix Fietkau) [task:210626] {CVE-2024-26779}
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe (Kunwu Chan) [task:210482] {CVE-2024-26771}
  - btrfs: dev-replace: properly validate device names (David Sterba) [task:210624] {CVE-2024-26791}
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter (Ryosuke Yasuoka) [task:210464] {CVE-2024-26805}
  - fbdev: sis: Error out if pixclock equals zero (Fullway Wang) [task:210465] {CVE-2024-26777}
  - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [task:210432] {CVE-2024-26743}
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (Ying Hsu) [task:210462] {CVE-2024-26801}
  - ipv6: sr: fix possible use-after-free and null-ptr-deref (Vasiliy Kovalev) [task:210463] {CVE-2024-26735}
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (Alexander Ofitserov) [task:210471] {CVE-2024-26793}
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() (Vasiliy Kovalev) [task:210471]
  - ARM: ep93xx: Add terminator to gpiod_lookup_table (Nikita Shubin) [task:210473] {CVE-2024-26751}
  - dm-crypt: don't modify the data when using authenticated encryption (Mikulas Patocka) [task:210478] {CVE-2024-26763}
  - nilfs2: fix data corruption in dsync block recovery for small block sizes (Ryusuke Konishi) [task:210301] {CVE-2024-26697}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Ricardo Cañuelo) [task:205167] {CVE-2023-52477}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (Hans de Goede) [task:205219] {CVE-2023-52478}
  - NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (Trond Myklebust) [task:207226] {CVE-2021-47167}
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao) [task:205581]
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao) [task:205581]
  - xfrm: fix slab-use-after-free in decode_session6 (Zhengchao Shao) [task:205581]
  - media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run (Zheng Wang) [task:204919] {CVE-2023-52491}
  - media: platform: Add mechanism to handle jpeg hardware's locking up (Xia Jiang) [task:204919]
  - media: platform: Improve power on and power off flow (Xia Jiang) [task:204919]
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ (Alex Williamson) {CVE-2024-27437}
  - genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() (Barry Song)
  - media: vimc: stream: fix build by missing dev (Jackie Liu) [task:209415]
  - ACPI: tables: Simplify PPTT leaf node detection (Jeremy Linton) [task:207620]
  - virtio-blk: remove VIRTIO_BLK_F_SCSI support (Christoph Hellwig) [task:209004]
  - net: prevent mss overflow in skb_segment() (Eric Dumazet) [task:209255] {CVE-2023-52435}
  - media: vimc: streamer: if kthread_stop fails, ignore the error (Dafna Hirschfeld) [task:209314]
  - tracing: Ensure visibility when inserting an element into tracing_map (Petr Pavlu) [task:209253] {CVE-2024-26645}
  - efi/arm: Show SMBIOS bank/device location in CPER and GHES error logs (Marcin Benka) [bug:218049]
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (Shigeru Yoshida) [task:209216] {CVE-2024-26663}
  - sr9800: Add check for usbnet_get_endpoints (Chen Ni) [task:209210] {CVE-2024-26651}
  - inet: read sk->sk_family once in inet_recv_error() (Eric Dumazet) [task:209235] {CVE-2024-26679}
  - ppp_async: limit MRU to 64K (Eric Dumazet) [task:209233] {CVE-2024-26675}
  - netfilter: nf_tables: disallow timeout for anonymous sets (Pablo Neira Ayuso) [task:207391] {CVE-2023-52620}
  - swapfile: fix soft lockup in scan_swap_map_slots (Chen Wandun) [task:183285]
  - KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU (Sean Christopherson) [task:206928] {CVE-2021-47061}
  - KVM: use struct_size() and flex_array_size() helpers in kvm_io_bus_unregister_dev() (Rustam Kovhaev) [task:206928]
  - overflow.h: Add flex_array_size() helper (Gustavo A. R. Silva) [task:162874, task:161899]
  - jfs: fix uaf in jfs_evict_inode (Edward Adam Davis) [task:207381] {CVE-2023-52600}
  - tipc: wait and exit until all work queues are done (Xin Long) [task:207225] {CVE-2021-47163}
  - team: fix null-ptr-deref when team device type is changed (Ziyang Xuan) [task:207278] {CVE-2023-52574}
  - perf/x86/lbr: Filter vsyscall addresses (JP Kobryn) [task:205164] {CVE-2023-52476}
  - UBSAN: array-index-out-of-bounds in dtSplitRoot (Osama Muhammad) [task:207406] {CVE-2023-52603}
  - s390/ptrace: handle setting of fpc register correctly (Heiko Carstens) [task:207408] {CVE-2023-52598}
  - KVM: s390: fix setting of fpc register (Heiko Carstens) [task:207400] {CVE-2023-52597}
  - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (Daniel Stodden) [task:207403] {CVE-2023-52617}
  - switchtec: Add MRPC DMA mode support (Wesley Sheng) [task:207403]
  - can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer() (Oleksij Rempel) [task:205575]
  - ceph: fix deadlock or deadcode of misusing dget() (Xiubo Li) [task:207229] {CVE-2023-52583}
  - IB/ipoib: Fix mcast list locking (Daniel Vacek) [task:207280] {CVE-2023-52587}
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join (Jack Wang) [task:207280]
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Minsuk Kang) [task:207380] {CVE-2023-52594}
  - jfs: fix array-index-out-of-bounds in diNewExt (Edward Adam Davis) [task:207379] {CVE-2023-52599}
  - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree (Osama Muhammad) [task:207384] {CVE-2023-52604}
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Herbert Xu) [task:207385] {CVE-2023-52615}
  - powerpc/lib: Validate size for vector operations (Naveen N Rao) [task:207386] {CVE-2023-52606}
  - ocfs2: Avoid touching renamed directory if parent does not change (Jan Kara) [task:207378] {CVE-2023-52590}
  - fs: ocfs2: check status values (Artem Chernyshev) [task:207378]
  - pstore/ram: Fix crash when setting number of cpus to an odd number (Weichen Chen) [task:207388] {CVE-2023-52619}
  - SUNRPC: Fix a suspicious RCU usage warning (Anna Schumaker) [task:207390] {CVE-2023-52623}
  - jfs: fix slab-out-of-bounds Read in dtSearch (Manas Ghandat) [task:207383] {CVE-2023-52602}
  - crypto: scomp - fix req->dst buffer overflow (Chengming Zhou) [task:207387] {CVE-2023-52612}
  - crypto: scompress - initialize per-CPU variables on each CPU (Sebastian Andrzej Siewior) [task:207387]
  - crypto: scompress - Use per-CPU struct instead multiple variables (Sebastian Andrzej Siewior) [task:207387]
  - crypto: scompress - return proper error code for allocation failure (Sebastian Andrzej Siewior) [task:207387]
  - nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() (Pan Bian) [task:207228] {CVE-2023-52566}
  - nvme-loop: fix memory leak in nvme_loop_create_ctrl() (Wu Bo) [task:206937] {CVE-2021-47074}
  - nvme-loop: don't put ctrl on nvme_init_ctrl error (Chaitanya Kulkarni) [task:206937]
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Pablo Neira Ayuso) [task:206383] {CVE-2024-26642}
  - llc: make llc_ui_sendmsg() more robust against bonding changes (Eric Dumazet) [task:206384] {CVE-2024-26636}
  - security/kysec: fix k tag java hung_task_timeout_secs (mengdehui) [bug:218233]
  - ring-buffer: Have saved event hold the entire event (Steven Rostedt (Google)) [task:205154]
  - ring-buffer: Do not attempt to read past "commit" (Steven Rostedt (Google)) [task:205154] {CVE-2023-52501}
  - ring-buffer: Have rb_iter_head_event() handle concurrent writer (Steven Rostedt (VMware)) [task:205154]
  - ring-buffer: Add page_stamp to iterator for synchronization (Steven Rostedt (VMware)) [task:205154]
  - ring-buffer: Have ring_buffer_empty() not depend on tracing stopped (Steven Rostedt (VMware)) [task:205154]
  - sched/rt: Fix sysctl_sched_rr_timeslice intial value (Cyril Hrubis) [task:205110]
  - sched/rt: Disallow writing invalid values to sched_rt_period_us (Cyril Hrubis) [task:205110]
  - sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset (Cyril Hrubis) [task:205110]
  - net: rds: acquire refcount on TCP sockets (Tetsuo Handa) [task:205876]
  - net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (Eric Dumazet) [task:205232] {CVE-2023-52502}
  - nfc: constify several pointers to u8, char and sk_buff (Krzysztof Kozlowski) [task:205232]
  - drm: Don't unref the same fb many times by mistake due to deadlock handling (Ville Syrjälä) [task:205231] {CVE-2023-52486}
  - ipv6: init the accept_queue's spinlocks in inet6_create (Zhengchao Shao) [task:205163]
  - tcp: make sure init the accept_queue's spinlocks once (Zhengchao Shao) [task:205163] {CVE-2024-26614}
  - l2tp: pass correct message length to ip6_append_data (Tom Parkin) [task:205227]
  - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (David Howells) [task:205227] {CVE-2023-52527}
  - ieee802154: ca8210: Fix a potential UAF in ca8210_probe (Dinghao Liu) [task:205220] {CVE-2023-52510}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Wen Gu) [task:205222] {CVE-2024-26615}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida) [task:205218] {CVE-2023-52528}
  - tomoyo: fix UAF write bug in tomoyo_write_control() (Tetsuo Handa) [task:205063] {CVE-2024-26622}
  - net: nfc: llcp: Add lock when modifying device list (Jeremy Cline) [task:205036] {CVE-2023-52524}
  - nfc: nci: assert requested protocol is valid (Jeremy Cline) [task:205032] {CVE-2023-52507}
  - Input: powermate - fix use-after-free in powermate_config_complete (Javier Carrasco) [task:204918] {CVE-2023-52475}
  - llc: Drop support for ETH_P_TR_802_2. (Kuniyuki Iwashima) [task:204916] {CVE-2024-26635}
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (Eric Dumazet) [task:204917] {CVE-2024-26633}
  - Revert "arm64/config: CONFIG_IP_DCCP=m" (Jiangshan Yi) [task:206427]
  - ax25: Fix ax25 session cleanup problems (Duoming Zhou) [task:203789]
  - mm: fix race between MADV_FREE reclaim and blkdev direct IO read (Mauricio Faria de Oliveira) [task:162162, task:204700]
  - nfsd: fix use-after-free due to delegation race (J. Bruce Fields) [task:160493]
  - arm64/config: CONFIG_IP_DCCP=m (lingfuyi) [bug:217102]
  - tty: n_gsm: check error while registering tty devices (Hillf Danton)
  - tty: n_gsm: add helpers to convert mux-num to/from tty-base (Martin Hundebøll)
  - USB: gadget: dummy-hcd: Fix errors in port-reset handling (Alan Stern)
  - bfs: extra sanity checking and static inode bitmap (Tigran Aivazian)
  - USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug (Alan Stern)
  - i2c: cadence: fix reference leak when pm_runtime_get_sync fails (Qinglang Miao) [task:201795] {CVE-2020-36784}
  - i2c: img-scb: fix reference leak when pm_runtime_get_sync fails (Qinglang Miao) [task:201797] {CVE-2020-36783}
  - i2c: sprd: fix reference leak when pm_runtime_get_sync fails (Qinglang Miao) [task:201796] {CVE-2020-36780}
  - PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter (Zhang Qilong) [task:201796] {CVE-2020-36780}
  - security/kysec: add kysec_tcm_type boot parameter (huanfuxi) [bug:210498]
  - llc: call sock_orphan() at release time (Eric Dumazet) [task:203087] {CVE-2024-26625}
  - af_unix: fix lockdep positive in sk_diag_dump_icons() (Eric Dumazet) [task:203085] {CVE-2024-26624}
  - xen-netback: don't produce zero-size SKB frags (Jan Beulich) [task:203084] {CVE-2023-46838}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.38.v2207
changelog:
  - driver core: Let dev_of_node() accept a NULL dev (Stephen Boyd) [task:215336, bug:226512]
  - GRT: fix some warning by gcc (zhulei) [task:215796]
  - clk: Use parent node pointer during registration if necessary (Stephen Boyd) [bug:226512]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.39.v2207
changelog:
  - kvm/mmu: Add head file (zhanghao1) [task:218131]
  - bpf: Clear subreg_def for global function return values (Ilya Leoshkevich) [task:219647]
  - bpf: Fix error path under memory pressure (Alexei Starovoitov) [task:219647]
  - bpf: Introduce function-by-function verification (Alexei Starovoitov) [task:219647]
  - bpf: Fix bpf_event_output re-entry issue (Allan Zhang) [task:220155]
  - PHYTIUM: KVM: arm64: Move the clean of dcache to the map handler (zhanghao1) [task:218131]
  - net: fix kernel crash caused by ft_net_auto_affinity (Yun Lu) [bug:229383]
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [task:198456] {CVE-2024-1086}
  - nfc: nci: free rx_data_reassembly skb on NCI device cleanup (Fedor Pchelkin) [task:213955] {CVE-2024-26825}
  - NFC: nci: fix memory leak in nci_allocate_device (Dongliang Mu) [task:158827]
  - x86/xen: Add some null pointer checking to smp.c (Kunwu Chan) [task:214160] {CVE-2024-26908}
  - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Xiu Jianfeng) [task:164562]
  - xen/events: only register debug interrupt for 2-level events (Juergen Gross) [task:164562]
  - media: edia: dvbdev: fix a use-after-free (Zhipeng Lu) [task:220692] {CVE-2024-27043}
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() (Hyunwoo Kim) [task:220692] {CVE-2022-45884}
  - media: dvbdev: fix error logic at dvb_register_device() (Mauro Carvalho Chehab) [task:220692]
  - media: dvbdev: Fix memleak in dvb_register_device (Dinghao Liu) [task:220692]
  - media: media/dvb: Use kmemdup rather than duplicating its implementation (Fuqian Huang) [task:220692]
  - media: dvbdev: remove double-unlock (Mauro Carvalho Chehab) [task:220692]
  - media: dvbdev: fix refcnt bug (Lin Ma) [task:220692]
  - media: dvbdev: adopts refcnt to avoid UAF (Lin Ma) [task:220692]
  - media: dvbdev: Fix memory leak in dvb_media_device_free() (Peilin Ye) [task:220692]
  - media: dvb-core: Fix double free in dvb_register_device() (Keita Suzuki) [task:220692]
  - mm: swap: fix race between free_swap_and_cache() and swapoff() (Ryan Roberts) [task:220694] {CVE-2024-26960}
  - swap: comments get_swap_device() with usage rule (Huang Ying) [task:220694]
  - net/smc: Fix possible access to freed memory in link clear (Yacan Liu) [task:219443] {CVE-2022-48673}
  - scsi: sd: Fix sd_do_mode_sense() buffer length handling (Damien Le Moal) [task:213954] {CVE-2021-47182}
  - scsi: core: Fix scsi_mode_sense() buffer length handling (Damien Le Moal) [task:213954] {CVE-2021-47182}
  - scsi: core: Reshuffle response handling in scsi_mode_sense() (Hannes Reinecke) [task:213954] {CVE-2021-47182}
  - scsi: core: Fixup calling convention for scsi_mode_sense() (Hannes Reinecke) [task:213954] {CVE-2021-47182}
  - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [task:217548] {CVE-2024-26982}
  - clk: zynq: Prevent null pointer dereference caused by kmalloc failure (Duoming Zhou) [task:217565] {CVE-2024-27037}
  - sysv: don't call sb_bread() with pointers_lock held (Tetsuo Handa) [task:219573]
  - afs: Increase buffer size in afs_update_volume_status() (Daniil Dulov) [task:210635] {CVE-2024-26736}
  - fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion (Bart Van Assche) [task:210640]
  - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio (Bart Van Assche) [task:210640] {CVE-2024-26764}
  - Bluetooth: af_bluetooth: Fix deadlock (Luiz Augusto von Dentz) [task:214134] {CVE-2024-26886}
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Ziyang Xuan) [task:217550] {CVE-2024-27019}
  - net/mlx5e: Prevent deadlock while disabling aRFS (Carolina Jubran) [task:217553] {CVE-2024-27014}
  - security/kysec: decrease pcr hashtable size (penghuaihe) [task:219597]
  - security/kysec: move pcr hashtable init to sb_alloc_security (penghuaihe) [task:219597]
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier (ZhaoLong Wang) [task:219460] {CVE-2023-52449}
  - speakup: Avoid crash on very long word (Samuel Thibault) [task:219451] {CVE-2024-26994}
  - f2fs: fix to avoid dirent corruption (Chao Yu) [task:219461] {CVE-2023-52444}
  - apparmor: avoid crash when parsed profile name is empty (Fedor Pchelkin) [task:219459] {CVE-2023-52443}
  - powerpc/pseries/memhp: Fix access beyond end of drmem array (Nathan Lynch) [task:219457] {CVE-2023-52451}
  - powerpc/pseries/memhotplug: Quieten some DLPAR operations (Laurent Dufour) [task:219457]
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (Hyunwoo Kim) [task:219456] {CVE-2024-27395}
  - net: openvswitch: ovs_ct_exit to be done under ovs_lock (Tonghao Zhang) [task:219456]
  - cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value (Anastasia Belova) [task:219454] {CVE-2024-27051}
  - net: gtp: Fix Use-After-Free in gtp_dellink (Hyunwoo Kim) [task:219455] {CVE-2024-27396}
  - clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays (Gabor Juhos) [task:219452] {CVE-2024-26966}
  - crypto: qat - resolve race condition during AER recovery (Damian Muszynski) [task:219450] {CVE-2024-26974}
  - crypto: qat - fix double free during reset (Svyatoslav Pankratov) [task:219450]
  - txgbe: Fix handling of NAPI budget when multiple queues are enabled per vector (xiaolinkui) [task:217379]
  - ngbe: Fix handling of NAPI budget when multiple queues are enabled per vector (xiaolinkui) [task:217379]
  - printk: disable optimistic spin during panic (Stephen Brennan) [task:217379]
  - printk: Add panic_in_progress helper (Stephen Brennan) [task:217379]
  - s390/zcrypt: fix reference counting on zcrypt card objects (Harald Freudenberger) [task:219444] {CVE-2024-26957}
  - xfs: wake commit waiters on CIL abort before log item abort (Brian Foster) [task:217956]
  - clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays (Gabor Juhos) [task:219446] {CVE-2024-26969}
  - vfio/platform: Create persistent IRQ handlers (Alex Williamson) [task:210628] {CVE-2024-26813}
  - vfio/platform: Disable virqfds on cleanup (Alex Williamson) [task:210628]
  - LoongArch: Fixup extioi bounce (Jun Yi) [task:214965]
  - dm: call the resume method on internal suspend (Mikulas Patocka) [task:214159] {CVE-2024-26880}
  - quota: Fix potential NULL pointer dereference (Wang Jianjian) [task:214158] {CVE-2024-26878}
  - quota: check time limit when back out space/inode change (Chengguang Xu) [task:214158]
  - quota: code cleanup for __dquot_alloc_space() (Chengguang Xu) [task:214158]
  - jfs: fix array-index-out-of-bounds in dbAdjTree (Manas Ghandat) [task:207401] {CVE-2023-52601}
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled (Rahul Rameshbabu) [task:214161] {CVE-2023-52644}
  - b43: dma: Fix use true/false for bool type variable (Saurav Girepunje) [task:214161]
  - i40e: Fix VF MAC filter removal (Ivan Vecera) [task:214154]
  - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [task:214154] {CVE-2024-26830}
  - i40e: Add ensurance of MacVlan resources for every trusted VF (Karen Sornek) [task:214154]
  - i40e: Fix MAC address setting for a VF via Host/VM (Slawomir Laba) [task:214154]
  - drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (Hsin-Yi Wang) [task:214148] {CVE-2024-26874}
  - net: Set true network header for ECN decapsulation (Gilad Naaman) [task:214149]
  - net/bnx2x: Prevent access to a freed page in page_pool (Thinh Tran) [task:214143] {CVE-2024-26859}
  - vt: fix memory overlapping when deleting chars in the buffer (Yangxi Xiang) [task:205064] {CVE-2022-48627}
  - ext4: avoid online resizing failures due to oversized flex bg (Baokun Li) [task:207394] {CVE-2023-52622}
  - ext4: unify the type of flexbg_size to unsigned int (Baokun Li) [task:207394] {CVE-2023-52622}
  - ext4: remove unnecessary check from alloc_flex_gd() (Baokun Li) [task:207394] {CVE-2023-52622}
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Oleg Nesterov) [task:210335] {CVE-2024-26686}
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Oleg Nesterov) [task:210335]
  - fs/proc: do_task_stat: use __for_each_thread() (Oleg Nesterov) [task:210335]
  - exit: Use the correct exit_code in /proc/<pid>/stat (Eric W. Biederman) [task:210335]
  - RDMA/rxe: Return CQE error if invalid lkey was supplied (Leon Romanovsky) [task:206932] {CVE-2021-47076}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Lena Wang) [task:214040] {CVE-2024-26851}
  - IB/hfi1: Fix a memleak in init_credit_return (Zhipeng Lu) [task:214039] {CVE-2024-26839}
  - hsr: Fix uninit-value access in hsr_get_node() (Shigeru Yoshida) [task:214042] {CVE-2024-26863}
  - net: hsr: fix placement of logical operator in a multi-line statement (Murali Karicheri) [task:214042]
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow (Dave Airlie) [task:214061] {CVE-2024-26817}
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Nikita Zhandarovich) [task:214102] {CVE-2024-26901}
  - media: pvrusb2: fix uaf in pvr2_context_set_notify (Edward Adam Davis) [task:214062] {CVE-2024-26875}
  - media: pvrusb2: fix use after free on context disconnection (Ricardo B. Marliere) [task:214062]
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Armin Wolf) [task:214136] {CVE-2024-26894}
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Eric Dumazet) [task:214130] {CVE-2024-26852}
  - bpf: Fix hashtab overflow check on 32-bit arches (Toke Høiland-Jørgensen) [task:214132] {CVE-2024-26884}
  - scsi: target: core: Add TMF to tmr_list handling (Dmitry Bogdanov) [task:214137] {CVE-2024-26845}
  - arp: Prevent overflow in arp_req_get(). (Kuniyuki Iwashima) [task:210302] {CVE-2024-26733}
  - drm: bridge/panel: Cleanup connector on bridge detach (Paul Cercueil) [task:206930] {CVE-2021-47063}
  - LOONGSON: rtc-ls2x: fix a ls3a4000 rtc update trouble (zhangtianyang) [task:147526]
  - config: enable CONFIG_CGROUP_FILES. (cuitao) [task:220723]
  - OPENEULER: fs/filescontrol: add a switch to enable / disable accounting of open fds (Yu Kuai) [task:220723]
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly (xinhui pan) [task:220691] {CVE-2024-26922}
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (Chia-I Wu) [task:220691]
  - drm/amdgpu: check alignment on CPU page for bo map (Xℹ Ruoyao) [task:220691]
  - sched: disabled sysctl_sched_optimize_enabled by default (liwanwu) [task:217846]
  - net: don't let netpoll invoke NAPI if in xmit context (Jakub Kicinski) [task:217379]
  - net/mlx5e: alloc the correct size for indirection_rqt (Saeed Mahameed) [task:217500]
  - net/mlx5e: allocate 'indirection_rqt' buffer dynamically (Arnd Bergmann) [task:217500]
  - net/mlx5: Increase the max number of channels to 128 (Fan Li) [task:217500]
  - security/secureboot: vmlinuz signature support SM and RSA (penghuaihe) [task:218116]
  - security: LoongArch support kernel signature (penghuaihe) [task:181644]
  - security/kysec: secureboot add x86 arch support. (penghuaihe) [task:172384]
  - security/secureboot add signature to kernel (penghuaihe) [task:172384]
  - USB: core: Fix deadlock in usb_deauthorize_interface() (Alan Stern) [task:217563] {CVE-2024-26934}
  - irqchip: The kdump capture kernel is probably stuck In the virtual machine (duanchenghao) [bug:219683]
  - drm/hisilicon: Fix a NULL pointer access when call hibmc_unload (Shixiong Ou) [task:217158]
  - usb: roles: fix NULL pointer issue when put module's reference (Xu Yang) [task:210461] {CVE-2024-26747}
  - media: rc: bpf attach/detach requires write permission (Sean Young) [task:214138] {CVE-2023-52642}
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Alan Stern) [task:217585] {CVE-2024-26993}
  - btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve (Filipe Manana) [task:214141] {CVE-2024-26904}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Alan Stern) [task:217587] {CVE-2024-27059}
  - nilfs2: prevent kernel bug at submit_bh_wbc() (Ryusuke Konishi) [task:217584] {CVE-2024-26955}
  - nilfs2: use a more common logging style (Joe Perches) [task:217584]
  - clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays (Gabor Juhos) [task:217583] {CVE-2024-26965}
  - scsi: qla2xxx: Fix command flush on cable pull (Quinn Tran) [task:217582] {CVE-2024-26931}
  - nilfs2: fix failure to detect DAT corruption in btree and direct mappings (Ryusuke Konishi) [task:217589] {CVE-2024-26956}
  - media: go7007: fix a memleak in go7007_load_encoder (Zhipeng Lu) [task:217575] {CVE-2024-27074}
  - media: v4l2-tpg: fix some memleaks in tpg_alloc (Zhipeng Lu) [task:217576] {CVE-2024-27078}
  - SUNRPC: fix some memleaks in gssx_dec_option_array (Zhipeng Lu) [task:217578] {CVE-2024-27388}
  - drm/tegra: dsi: Add missing check for of_find_device_by_node (Chen Ni) [task:217580] {CVE-2023-52650}
  - mm/swapfile.c: __swap_entry_free() always free 1 entry (Wei Yang) [task:217590]
  - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Huang Ying) [task:217590]
  - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Huang Ying) [task:217590]
  - serial: mxs-auart: add spinlock around changing cts state (Emil Kronborg) [task:217594] {CVE-2024-27000}
  - nouveau: fix instmem race condition around ptr stores (Dave Airlie) [task:217591] {CVE-2024-26984}
  - net/rds: fix possible cp null dereference (Mahmoud Adam) [task:217596]
  - net/rds: fix WARNING in rds_conn_connect_if_down (Edward Adam Davis) [task:217596] {CVE-2024-27024}
  - spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (Fei Shao) [task:217571] {CVE-2024-27028}
  - scsi: ufs: core: Improve SCSI abort handling (Bart Van Assche) [task:212521] {CVE-2021-47188}
  - nfp: flower: handle acti_netdevs allocation failure (Duoming Zhou) [task:217573] {CVE-2024-27046}
  - nilfs2: fix OOB in nilfs_set_de_type (Jeongjun Park) [task:217541] {CVE-2024-26981}
  - fat: fix uninitialized field in nostale filehandles (Jan Kara) [task:217540] {CVE-2024-26973}
  - tun: limit printing rate when illegal packet received by tun dev (Lei Chen) [task:217543] {CVE-2024-27013}
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Ziyang Xuan) [task:217564] {CVE-2024-27020}
  - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Pablo Neira Ayuso) [task:217564]
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [task:217566] {CVE-2024-26976}
  - drm: nv04: Fix out of bounds access (Mikhail Kobuk) [task:217570] {CVE-2024-27008}
  - vfio/pci: Create persistent INTx handler (Alex Williamson) [task:210644] {CVE-2024-26812}
  - vfio: Introduce interface to flush virqfd inject workqueue (Alex Williamson) [task:210644]
  - media: dvb-frontends: avoid stack overflow warnings with clang (Arnd Bergmann) [task:217558] {CVE-2024-27075}
  - media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity (Zhipeng Lu) [task:217549] {CVE-2024-27077}
  - drm/amdgpu: Reset IH OVERFLOW_CLEAR bit (Friedrich Vock) [task:214156] {CVE-2024-26915}
  - net/mlx5: Update error handler for UCTX and UMEM (Neta Ostrovsky) [task:216632] {CVE-2021-47212}
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (Rand Deeb) [task:214041] {CVE-2024-26855}
  - nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() (Ryusuke Konishi) [task:210638] {CVE-2024-26696}
  - binder: check offset alignment in binder_get_object() (Carlos Llamas) [task:216630] {CVE-2024-26926}
  - xen/events: close evtchn after mapping cleanup (Maximilian Heyne) [task:210357] {CVE-2024-26687}
  - wifi: mac80211: fix potential key use-after-free (Johannes Berg) [task:205233] {CVE-2023-52530}
  - xfs: check free AG space when making per-AG reservations (Darrick J. Wong) [task:215506]
  - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (Luís Henriques) [task:216634] {CVE-2022-48631}
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency (Gui-Dong Han) [task:216633] {CVE-2024-24861}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup (William Kucharski) [task:213762] {CVE-2024-26872}
  - uio: Fix use-after-free in uio_open (Guanghui Feng) [task:209257] {CVE-2023-52439}
  - config: enable CONFIG_SECURITY_YAMA for arm64 (huanfuxi) [task:214710]
  - btrfs: fix hang during unmount when stopping a space reclaim worker (Filipe Manana) [task:216635] {CVE-2022-48664}
  - Btrfs: fix crash during unmount due to race with delayed inode workers (Filipe Manana) [task:155707]
  - iavf: free q_vectors before queues in iavf_disable_vf (Nicholas Nunley) [task:212529] {CVE-2021-47201}
  - xhci: handle isoc Babble and Buffer Overrun events properly (Michal Pecio) [task:209228] {CVE-2024-26659}
  - xhci: process isoc TD properly when there was a transaction error mid TD. (Mathias Nyman) [task:209228]
  - xhci: Fix incorrect tracking of free space on transfer rings (Mathias Nyman) [task:209228]
  - xhci: store TD status in the td struct instead of passing it along (Mathias Nyman) [task:209228]
  - xhci: remove extra loop in interrupt context (Mathias Nyman) [task:209228]
  - xhci: get isochronous ring directly from endpoint structure (Mathias Nyman) [task:209228]
  - drm/amdgpu: restrict bo mapping within gpu address limits (Rajneesh Bhardwaj) [task:216641]
  - tcp: fix race condition when creating child sockets from syncookies (Ricardo Dias) [task:162162]
  - mm/swap: fix race when skipping swapcache (Kairui Song) [task:210472] {CVE-2024-26759}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.48.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.48.v2207 (Zhengyuan Liu)
  - net: core: use helper skb_ensure_writable in more places (Heiner Kallweit) [task:99622]
  - perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map (Kim Phillips) [task:153627, task:464558]
  - regulator: check that dummy regulator has been probed before using it (Christian Eggers) [task:452500] {CVE-2025-22008}
  - regulator: workaround self-referent regulators (Michał Mirosław) [task:158034]
  - regulator: avoid resolve_supply() infinite recursion (Michał Mirosław) [task:158034]
  - memcg: fix soft lockup in the OOM process (Chen Ridong) [task:440777] {CVE-2024-57977}
  - ipv6: Fix soft lockups in fib6_select_path under high next hop churn (Omid Ehtemam-Haghighi) [task:412171] {CVE-2024-56703}
  - tcp: Fix data-races around sysctl_tcp_base_mss. (Kuniyuki Iwashima) [task:440603] {CVE-2022-49597}
  - dm: interlock pending dm_io and dm_wait_for_bios_completion (Mike Snitzer) [task:162162, task:458745]
  - dm: fix mempool NULL pointer race when completing IO (Jiazi Li) [task:169357, task:458745]
  - memcg: fix soft lockup in the OOM process (Chen Ridong) [task:440777] {CVE-2024-57977}
  - scsi: qla2xxx: Fix scheduling while atomic (Quinn Tran) [task:149541]
  - drop_monitor: fix incorrect initialization order (Gavrilov Ilia) [task:444123] {CVE-2025-21862}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.49.v2207
changelog:
  - secondly update changelog for upcoming 4.19.90-52.49.v2207 (Zhengyuan Liu)
  - bpf: consider that tail calls invalidate packet pointers (Eduard Zingerman) [task:461040, task:497433] {CVE-2024-58237}
  - bpf: refactor bpf_helper_changes_pkt_data to use helper number (Eduard Zingerman) [task:461040, task:497433]
  - Revert "bpf: allow for tailcalls in BPF subprograms for x64 JIT" (Yun Lu) [task:497433]
  - Revert "bpf, x64: Add predicate for bpf2bpf with tailcalls support in JIT" (Yun Lu) [task:497433]
  - Revert "bpf: refactor bpf_helper_changes_pkt_data to use helper number" (Yun Lu) [task:497433]
  - Revert "bpf: consider that tail calls invalidate packet pointers" (Yun Lu) [task:497433]
  - update changelog for upcoming 4.19.90-52.49.v2207 (Zhengyuan Liu)
  - iommu/amd: Fix potential @entry null deref (Joao Martins) [task:457728]
  - iommu/amd: Restore IRTE.RemapEn bit after programming IRTE (Suravee Suthikulpanit) [task:457728]
  - net: fix a compilation (xiaolinkui) [task:468687]
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin) [task:461952] {CVE-2025-37830}
  - PHYTIUM: PCI: Add ACS quirk for phytium root and switch ports (leixiang) [task:477923]
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [task:486337] {CVE-2025-38086}
  - ocfs2: fix data corruption after failed write (Jan Kara via Ocfs2-devel) [task:461083] {CVE-2023-53081}
  - ext4: update s_journal_inum if it changes after journal replay (Baokun Li) [task:461218] {CVE-2023-53091}
  - jbd2: remove wrong sb->s_sequence check (Jan Kara) [task:462570] {CVE-2025-37839}
  - scsi: target: Fix WRITE_SAME No Data Buffer crash (Mike Christie) [task:463324] {CVE-2022-21546}
  - perf python: Convert tracepoint.py example to python3 (Tanu M) [task:488387, task:481449]
  - perf tools: Support Python 3.8+ in Makefile (Sam Lunt) [task:481449]
  - perf script python: Add Python3 support to tests/attr.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to export-to-sqlite.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to export-to-postgresql.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to intel-pt-events.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to event_analyzing_sample.py (Tony Jones) [task:481449]
  - perf script python: add Python3 support to check-perf-trace.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to futex-contention.py (Tony Jones) [task:481449]
  - perf script python: Remove mixed indentation (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to syscall-counts-by-pid.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to syscall-counts.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to stat-cpi.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to stackcollapse.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to sctop.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to powerpc-hcalls.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to net_dropmonitor.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to mem-phys-addr.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to failed-syscalls-by-pid.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to netdev-times.py (Tony Jones) [task:481449]
  - regulator: core: avoid regulator_resolve_supply() race condition (David Collins) [task:158034, task:491993]
  - driver core: add device probe log helper (Andrzej Hajda) [task:491993]
  - clk: Add (devm_)clk_get_optional() functions (Phil Edworthy) [task:215919, task:491993]
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [task:491897] {CVE-2025-38103}
  - HID: hyperv: Correctly access fields declared as __le16 (Michael Kelley) [task:491897]
  - xfs: split up the xfs_reflink_end_cow work into smaller transactions (Darrick J. Wong) [task:489411]
  - ngbe: FIX: fix delete redefine netdev_xmit_more in kylin os (linyuexie) [task:458496]
  - txgbe: FIX: fix delete redefine netdev_xmit_more in kylin os (linyuexie) [task:458496]
  - HYGON: alinux: tcm: add Hygon TCM2 driver (chench) [task:176679]
  - tpm: tpm_tis: Adapt spi tcm2 card ZIC0603 to x86 (wudandan) [task:220240]
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg) [task:482027] {CVE-2022-50020}
  - qede: confirm skb is allocated before using (Jamie Bainbridge) [task:162162, task:482311]
  - ext2: Add more validity checks for inode counts (Jan Kara) [task:482541] {CVE-2022-50205}
  - tcp/dccp: Add another way to allocate local ports in bind() (luoxuanqiang) [task:452905]
  - net: tun: call napi_schedule_prep() to ensure we own a napi (Eric Dumazet) [task:122626, task:460255]
  - net: tun: Fix memory leaks of napi_get_frags (Wang Yufen) [task:122626, task:460255] {CVE-2022-49871}
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (Liu Jian) [task:461321] {CVE-2023-53133}
  - xsk: Add missing overflow check in xdp_umem_reg (Kal Conley) [task:460911] {CVE-2023-53080}
  - xsk: Fix number of pinned pages/umem size discrepancy (Björn Töpel) [task:460911]
  - net/xdp: use shift instead of 64 bit division (Pavel Machek) [task:460911]
  - net: stmmac: fix notifier registration (Aaro Koskinen) [bug:370375]
  - stmmac: debugfs entry name is not be changed when udev rename device name. (Jiping Ma) [task:166857]
  - bpf: consider that tail calls invalidate packet pointers (Eduard Zingerman) [task:461040] {CVE-2024-58237}
  - bpf: refactor bpf_helper_changes_pkt_data to use helper number (Eduard Zingerman) [task:461040]
  - bpf, x64: Add predicate for bpf2bpf with tailcalls support in JIT (Tony Ambardar) [task:161887]
  - bpf: allow for tailcalls in BPF subprograms for x64 JIT (Maciej Fijalkowski) [task:161887]
  - net/9p: use a dedicated spinlock for trans_fd (Dominique Martinet) [task:460118] {CVE-2022-49765}
  - 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work (Wang Hai) [task:157172]
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet) [task:164562]
  - iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) (Alexander Lobakin) [task:482165] {CVE-2022-50093}
  - virtio-gpu: fix a missing check to avoid NULL dereference (Xiaomeng Tong) [task:481883] {CVE-2022-50181}
  - perf: Fix pmu_filter_match() (Peter Zijlstra) [task:464493]
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng) [task:459566]
  - nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng) [task:459566] {CVE-2025-22025}
  - nfsd: make nfsd4_run_cb a bool return function (Jeff Layton) [task:459566]
  - jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov) [task:459660] {CVE-2025-37925}
  - dlm: prevent NPD when writing a positive value to event_done (Thadeu Lima de Souza Cascardo) [task:459658] {CVE-2025-23131}
  - ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev) [task:459623] {CVE-2025-22079}
  - jfs: add check read-only before txBeginAnon() call (Vasiliy Kovalev) [task:459938] {CVE-2024-58095}
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [task:482067] {CVE-2025-38058}
  - scsi: iscsi: Fix HW conn removal use after free (Mike Christie) [task:482545] {CVE-2022-50031}
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [task:482265] {CVE-2025-38075}
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [task:482035] {CVE-2025-38078}
  - net: hns3: fix incorrect components info of ethtool --reset command (Jie Wang) [bug:367889]
  - net: hns3: add support for triggering reset by ethtool (Yufeng Mo) [bug:367889]
  - media: dvb-core: Fix use-after-free on race condition at dvb_frontend (Hyunwoo Kim) [task:478283] {CVE-2022-45885}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [task:466609] {CVE-2025-37970}
  - nilfs2: protect access to buffers with no active references (Ryusuke Konishi) [task:441315] {CVE-2025-21811}
  - iio: pressure: zpa2326: fix information leak in triggered buffer (Javier Carrasco) [task:426431] {CVE-2024-57912}
  - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (Javier Carrasco) [task:426437] {CVE-2024-57911}
  - iio: imu: kmx61: fix information leak in triggered buffer (Javier Carrasco) [task:426324] {CVE-2024-57908}
  - jfs: array-index-out-of-bounds fix in dtReadFirst (Ghanshyam Agrawal) [task:419633] {CVE-2024-56598}
  - udf: fix uninit-value use in udf_get_fileshortad (Gianfranco Trad) [task:387577] {CVE-2024-50143}
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces (Chao Yu) [task:375569] {CVE-2024-49859}
  - nfc: fdp: Fix potential memory leak in fdp_nci_send() (Shang XiaoJing) [task:460238] {CVE-2022-49924}
  - net/mlx5: Fix steering rules cleanup (Lama Kayal) [task:461036] {CVE-2023-53079}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Ryo Takakura) [task:460254] {CVE-2025-23161}
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [task:466236] {CVE-2025-37968}
  - mm/gup: Remove enfornced COW mechanism (Peter Xu) [task:446992]
  - net: tls: explicitly disallow disconnect (Jakub Kicinski) [task:460146] {CVE-2025-37756}
  - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła) [task:466581] {CVE-2025-37942}
  - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (Zhang Lixu) [task:461023]
  - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (Reka Norman) [task:461023] {CVE-2023-53039}
  - devm-helpers: Add resource managed version of work init (Matti Vaittinen) [task:461023]
  - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc (Matti Vaittinen) [task:461023]
  - workqueue: Add resource managed version of delayed work init (Matti Vaittinen) [task:461023]
  - net: usb: lan78xx: Limit packet length to skb->len (Szymon Heidrich) [task:461084] {CVE-2023-53068}
  - neigh: fix ARP retransmit timer guard (Hangbin Liu) [task:470107]
  - neigh: support smaller retrans_time settting (Hangbin Liu) [task:470107]
  - net: link_watch: prevent starvation when processing linkwatch wq (Yunsheng Lin) [task:470107]
  - net: ena: Fix error handling in ena_init() (Yuan Can) [task:460204] {CVE-2022-49813}
  - nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() (Shang XiaoJing) [task:460177] {CVE-2022-49923}
  - NFC: nxp-nci: remove unnecessary labels (wengjianfeng) [task:460177]
  - xfs: fix leaked dealloc blocks accounting (Shida Zhang) [task:467725]
  - btrfs: do not clean up repair bio if submit fails (Josef Bacik) [task:440526] {CVE-2022-49168}
  - nilfs2: handle errors that nilfs_prepare_chunk() may return (Ryusuke Konishi) [task:440497] {CVE-2025-21721}
  - nilfs2: eliminate staggered calls to kunmap in nilfs_rename (Ryusuke Konishi) [task:440497]
  - nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link (Ryusuke Konishi) [task:440497]
  - nilfs2: fix potential deadlock with newly created symlinks (Ryusuke Konishi) [task:387559] {CVE-2024-50229}
  - HID: ignore non-functional sensor in HP 5MP Camera (Chia-Lin Kao (AceLan)) [task:450748] {CVE-2025-21992}
  - scsi: pm8001: Fix tag leaks on error (Damien Le Moal) [task:440565] {CVE-2022-49121}
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails (Nikolay Aleksandrov) [task:461063] {CVE-2023-53103}
  - bonding: Fix memory leak when changing bond type to Ethernet (Ido Schimmel) [task:461063]
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change (Nikolay Aleksandrov) [task:461063]
  - uprobes: Reject the shared zeropage in uprobe_write_opcode() (Tong Tiangen) [task:448833] {CVE-2025-21881}
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [task:471773] {CVE-2025-37995}
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory) [task:462568] {CVE-2025-37867}
  - scsi: hisi_sas: Add cond_resched() for no forced preemption model (Yihang Li) [task:429513] {CVE-2024-56589}
  - ibmvnic: Don't reference skb after sending to VIOS (Nick Child) [task:444126] {CVE-2025-21855}
  - 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet) [task:462564] {CVE-2025-37879}
  - 9pnet: allow making incomplete read requests (Sergey Alirzaev) [task:462564]
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke) [task:462406] {CVE-2025-37836}
  - tracing: Fix wild-memory-access in register_synth_event() (Shang XiaoJing) [task:460168] {CVE-2022-49799}
  - LoongArch: Set hugetlb mmap base address aligned with pmd size (Bibo Mao) [task:450281] {CVE-2025-21949}
  - mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings (Oscar Salvador) [task:450281]
  - LoongArch: Remove shm_align_mask and use SHMLBA instead (Huacai Chen) [task:450281]
  - clk: qcom: clk-rcg2: Fix compile error for implicit declaration of macro ‘RCG_D_OFFSET’ (lihao01) [task:454819, task:467394]
  - md/raid5: fix oops during stripe resizing (Song Liu) [task:158034, task:477039]
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong) [task:460264] {CVE-2022-49840}
  - KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART (Andrew Scull) [task:157172, task:468147]
  - block: fix that util can be greater than 100% (Yu Kuai) [bug:335388]
  - blk-mq: do not update io_ticks with passthrough requests (Haisu Wang) [bug:335388]
  - blk-mq: Reuse callback in blk_mq_in_flight*() (Pavel Begunkov) [bug:335388]
  - block: update io_ticks when io hang (Zhang Wensheng) [bug:335388]
  - block: add a blk_account_io_merge_bio helper (Konstantin Khlebnikov) [bug:335388, task:381405]
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter) [task:164562]
  - btrfs: use latest_dev in btrfs_show_devname (Anand Jain) [task:330554] {CVE-2021-47599}
  - btrfs: don't traverse into the seed devices in show_devname (Anand Jain) [task:157172]
  - btrfs: convert latest_bdev type to btrfs_device and rename (Anand Jain) [task:330554] {CVE-2021-47599}
  - fs: relax assertions on failure to encode file handles (Amir Goldstein) [task:429490] {CVE-2024-57924}
  - ovl: don't use a temp buf for encoding real fh (Amir Goldstein) [task:149468]
  - ovl: make sure that real fid is 32bit aligned in memory (Amir Goldstein) [task:149468]
  - clocksource: Skip watchdog check for large watchdog intervals (Jiri Wiesner) [task:431250]
  - clocksource: Print deviation in nanoseconds when a clocksource becomes unstable (Feng Tang) [task:431250]
  - clocksource: Reduce the default clocksource_watchdog() retries to 2 (Waiman Long) [task:457161]
  - clocksource: Avoid accidental unstable marking of clocksources (Waiman Long) [task:457161]
  - clocksource: Retry clock read if long delays detected (Paul E. McKenney) [task:158827]
  - x86/fpu: Allow multiple bits in clearcpuid= parameter (Arvind Sankar) [task:158034]
  - netfilter: conntrack: revisit the gc initial rescheduling bias (Antoine Tenart) [task:441321]
  - netfilter: conntrack: fix the gc rescheduling delay (Antoine Tenart) [task:441321]
  - netfilter: conntrack: revisit gc autotuning (Florian Westphal) [task:441321] {CVE-2022-49110}
  - netfilter: conntrack: collect all entries in one cycle (Florian Westphal) [task:160493]
  - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Kuniyuki Iwashima) [task:444121]
  - geneve: Fix use-after-free in geneve_find_dev(). (Kuniyuki Iwashima) [task:444121] {CVE-2025-21858}
  - geneve: move debug check after netdev unregister (Florian Westphal) [task:155707]
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara) [task:462440] {CVE-2025-37857}
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad) [task:459937] {CVE-2025-22086}
  - RDMA/core: Fix null-ptr-deref in ib_core_cleanup() (Chen Zhongjin) [task:460250] {CVE-2022-49925}
  - IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (Niels Dossche) [task:441319] {CVE-2022-49089}
  - usbnet: gl620a: fix endpoint checking in genelink_bind() (Nikita Zhandarovich) [task:448793] {CVE-2025-21877}
  - netfilter: ipset: Hold module reference while requesting a module (Phil Sutter) [task:410153] {CVE-2024-56637}
  - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (Eric Dumazet) [task:426473] {CVE-2025-21653}
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing) [task:462587] {CVE-2025-37859}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [task:461022] {CVE-2025-37798}
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen) [task:461213] {CVE-2025-37757}
  - i40e: Fix kernel crash during reboot when adapter is in recovery mode (Ivan Vecera) [task:461215] {CVE-2023-53114}
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang) [task:461360] {CVE-2025-37797}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen) [task:461966] {CVE-2025-37824}
  - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (Jinghao Jia) [task:421045] {CVE-2024-53680}
  - f2fs: fix race in concurrent f2fs_stop_gc_thread (Long Li) [task:410149] {CVE-2024-53218}
  - f2fs: use spin_lock to avoid hang (Jaegeuk Kim) [task:440817] {CVE-2022-49169}
  - btrfs: do not double complete bio on errors during compressed reads (Josef Bacik) [task:440568] {CVE-2022-49167}
  - btrfs: fix use-after-free when attempting to join an aborted transaction (Filipe Manana) [task:440409] {CVE-2025-21753}
  - net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" (Jeremy Linton) [task:441340]
  - net: bcmgenet: Use stronger register read/writes to assure ordering (Jeremy Linton) [task:441340] {CVE-2022-49194}
  - net: systemport: fix potential memory leak in bcm_sysport_xmit() (Wang Hai) [task:387641] {CVE-2024-50171}
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (Quang Le) [task:434029] {CVE-2025-21702}
  - net_sched: sch_fifo: implement lockless __fifo_dump() (Eric Dumazet) [task:434029]
  - wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() (Marcel Hamer) [task:440550] {CVE-2025-21744}
  - netrom: check buffer length before accessing it (Ilya Shchipletsov) [task:425034] {CVE-2024-57802}
  - SUNRPC: Fix the svc_deferred_event trace class (Chuck Lever) [task:439956] {CVE-2022-49065}
  - SUNRPC: Clean up request deferral tracepoints (Chuck Lever) [task:439956]
  - SUNRPC: Simplify defining common RPC trace events (Chuck Lever) [task:439956]
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte) [task:460175] {CVE-2025-37749}
  - can: j1939: j1939_send_one(): fix missing CAN header initialization (Oliver Hartkopp) [task:460174] {CVE-2022-49845}
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal) [task:460161] {CVE-2025-37796}
  - net: vlan: don't propagate flags on open (Stanislav Fomichev) [task:460234] {CVE-2025-23163}
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro) [task:460144] {CVE-2025-23142}
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets) [task:460141] {CVE-2025-37789}
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu) [task:459581] {CVE-2025-22063}
  - atm: Fix NULL pointer dereference (Minjoong Kim) [task:459567] {CVE-2025-22018}
  - net_sched: skbprio: Remove overly strict queue assertions (Cong Wang) [task:458462] {CVE-2025-38637}
  - f2fs: fix missing free nid in f2fs_handle_failed_inode (Jaegeuk Kim) [task:440776] {CVE-2022-49255}
  - ubifs: Fix to add refcount once page is set private (Zhihao Cheng) [task:439948] {CVE-2021-47635}
  - include/linux/pagemap.h: introduce attach/detach_page_private (Guoqing Jiang) [task:439948]
  - ext4: fix access to uninitialised lock in fc replay path (Luis Henriques (SUSE)) [task:376395] {CVE-2024-50014}
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov) [task:459565] {CVE-2025-22027}
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov) [task:462409] {CVE-2025-37884}
  - bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song) [task:461956] {CVE-2025-37807}
  - net: annotate races around sk->sk_bound_dev_if (Eric Dumazet) [task:439947] {CVE-2022-49420}
  - drm/scheduler: fix fence ref counting (Christian König) [task:460223] {CVE-2022-49829}
  - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426896] {CVE-2025-21640}
  - xfs: fix freeing speculative preallocations for preallocated files (Christoph Hellwig) [task:449979]
  - xfs: update fork seq counter on data fork changes (Brian Foster) [task:449979]
  - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (Kaixin Wang) [task:387977] {CVE-2024-47747}
  - fs: add a new SB_I_NOUMASK flag (Jeff Layton) [task:438543, task:442990]
  - NFS: Further optimisations for 'ls -l' (Trond Myklebust) [task:438543, task:442990]
  - NFS: Support larger readdir buffers (Trond Myklebust) [task:438543, task:442990]
  - NFS: Remove unnecessary kmap in nfs_readdir_xdr_to_array() (Trond Myklebust) [task:438543, task:442990]
  - NFS: Clean up nfs_readdir_page_filler() (Trond Myklebust) [task:438543, task:442990]
  - NFS: Clean up directory array handling (Trond Myklebust) [task:438543, task:442990]
  - nfs: pass the correct prototype to read_cache_page (Christoph Hellwig) [task:438543, task:442990]
  - NFS: Clean up readdir struct nfs_cache_array (Trond Myklebust) [task:438543, task:442990]
  - nfs: Replace zero-length array with flexible-array member (Gustavo A. R. Silva) [task:438543, task:442990]
  - NFS: Ensure contents of struct nfs_open_dir_context are consistent (Trond Myklebust) [task:438543, task:442990]
  - NFS: Use the 64-bit server readdir cookies when possible (Trond Myklebust) [task:438543, task:442990]
  - nfs: optimise readdir cache page invalidation (Dai Ngo) [task:438543, task:442990]
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang) [task:461961] {CVE-2025-37823}
  - sctp: sysctl: rto_min/max: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426435] {CVE-2025-21639}
  - sctp: sysctl: auth_enable: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426436] {CVE-2025-21638}
  - spi: mpc52xx: Add cancel_work_sync before module remove (Pei Xiao) [task:421039] {CVE-2024-50051}
  - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier) [task:461948] {CVE-2025-37833}
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy) [task:459941] {CVE-2025-22021}
  - net/rose: prevent integer overflows in rose_setsockopt() (Nikita Zhandarovich) [task:441317] {CVE-2025-21711}
  - net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (Jakub Kicinski) [task:440770] {CVE-2025-21768}
  - udp: Deal with race between UDP socket address change and rehash (Stefano Brivio) [task:441338] {CVE-2024-57974}
  - ipv6: udp: constify 'struct net' parameter of socket lookups (Eric Dumazet) [task:441338]
  - udp: constify 'struct net' parameter of socket lookups (Eric Dumazet) [task:441338]
  - udp: Remove unused variable/function (exact_dif) (Tim Beale) [task:441338]
  - udp6: add missing rehash callback to udplite (Alexey Kodanev) [task:441338]
  - btrfs: fix use-after-free when COWing tree bock and tracing is enabled (Filipe Manana) [task:429487] {CVE-2024-56759}
  - net/sctp: Prevent autoclose integer overflow in sctp_association_init() (Nikolay Kuratov) [task:427427] {CVE-2024-57938}
  - tcp: Fix data-races around sysctl_tcp_l3mdev_accept. (Kuniyuki Iwashima) [task:440800] {CVE-2022-49599}
  - tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if() (Eric Dumazet) [task:440800]
  - usb: gadget: f_midi: fix MIDI Streaming descriptor lengths (John Keeping) [task:442582] {CVE-2025-21835}
  - igb: Fix potential invalid memory access in igb_init_module() (Yuan Can) [task:421029] {CVE-2024-52332}
  - quota: flush quota_release_work upon quota writeback (Ojaswin Mujoo) [task:420523] {CVE-2024-56780}
  - ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe (Miaoqian Lin) [task:440548] {CVE-2022-49241}
  - ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() (Yang Yingliang) [task:440548]
  - ip: Fix data-races around sysctl_ip_fwd_update_priority. (Kuniyuki Iwashima) [task:440687] {CVE-2022-49603}
  - xfs: fix log recovery when unknown rocompat bits are set (Darrick J. Wong) [task:450130]
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong) [task:450130]
  - smb: client: Add check for next_buffer in receive_encrypted_standard() (Haoxiang Li) [task:444124] {CVE-2025-21844}
  - cifs: fix potential memory leaks in session setup (Paulo Alcantara) [task:448797] {CVE-2023-53008}
  - dm array: fix releasing a faulty array block twice in dm_array_cursor_end (Ming-Hung Tsai) [task:426323] {CVE-2024-57929}
  - RDMA/core: Fix ib block iterator counter overflow (Yonatan Nachum) [task:448788] {CVE-2023-53026}
  - ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. (Kuniyuki Iwashima) [task:440707] {CVE-2022-49579}
  - tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. (Kuniyuki Iwashima) [task:440692] {CVE-2022-49585}
  - tcp: disable TFO blackhole logic by default (Wei Wang) [task:440692]
  - tcp: Fix a data-race around sysctl_tcp_ecn_fallback. (Kuniyuki Iwashima) [task:441283] {CVE-2022-49630}
  - netfilter: nf_tables: fix crash when nf_trace is enabled (Florian Westphal) [task:440633]
  - netfilter: nf_tables: avoid skb access on nf_stolen (Florian Westphal) [task:440633] {CVE-2022-49622}
  - netfilter: nf_tables: consolidate rule verdict trace call (Pablo Neira Ayuso) [task:440633]
  - fbdev: hyperv_fb: Allow graceful removal of framebuffer (Saurabh Sengar) [task:450275] {CVE-2025-21976}
  - fbdev: Introduce devm_register_framebuffer() (Thomas Weißschuh) [task:450275]
  - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (Haoxiang Li) [task:444125] {CVE-2025-21848}
  - remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (Miaoqian Lin) [task:440416] {CVE-2022-49188}
  - remoteproc: qcom_q6v5_mss: Extract mba/mpss from memory-region (Sibi Sankar) [task:440416]
  - udp: Deal with race between UDP socket address change and rehash (Stefano Brivio) [task:469817] {CVE-2024-57974}
  - udp: Remove unused parameter (exact_dif) (Tim Beale) [task:441338]
  - net: ipv6: drop unneeded likely() call around IS_ERR() (Enrico Weigelt) [task:441338]
  - net: udp6: prefer listeners bound to an address (Peter Oskolkov) [task:441338]
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [task:466598] {CVE-2025-37927}
  - iommu/amd: Fix ivrs_acpihid cmdline parsing code (Kim Phillips) [task:164562]
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [task:466603] {CVE-2025-37949}
  - xenbus: req->err should be updated before req->state (Dongli Zhang) [task:155707]
  - ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (Murad Masimov) [task:440505] {CVE-2025-21792}
  - ax25: rcu protect dev->ax25_ptr (Eric Dumazet) [task:440765] {CVE-2025-21812}
  - ax25: Use kernel universal linked list to implement ax25_dev_list (Duoming Zhou) [task:440765]
  - wifi: rtlwifi: remove unused check_buddy_priv (Thadeu Lima de Souza Cascardo) [task:442589] {CVE-2024-58072}
  - rtlwifi: Start changing RT_TRACE into rtl_dbg (Larry Finger) [task:166857]
  - rtlwifi: replace usage of found with dedicated list iterator variable (Jakob Koschel) [task:442589]
  - rtlwifi: Replace RT_TRACE with rtl_dbg (Larry Finger) [task:166857]
  - rtlwifi: rtl_pci: Fix memory leak when hardware init fails (Larry Finger) [task:166857]
  - rtlwifi: Fix errors in spacing in wifi.h (Larry Finger) [task:442589]
  - rtlwifi: Fix problems with block comments in wifi.h (Larry Finger) [task:442589]
  - rtlwifi: Remove CamelCase variables from base code (Larry Finger) [task:442589]
  - xfs: don't include bnobt blocks when reserving free block pool (Darrick J. Wong) [task:464914]
  - xfs: set aside allocation btree blocks from block reservation (Brian Foster) [task:464914]
  - xfs: introduce in-core global counter of allocbt blocks (Brian Foster) [task:464914]
  - Kdump: Resolve Second Kernel Boot Failure (duanchenghao) [bug:353716, bug:353689]
  - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (Sean Christopherson) [task:442641] {CVE-2024-58083}
  - thermal: int340x: Add NULL check for adev (Chenyuan Yang) [task:459932] {CVE-2025-23136}
  - fbdev: smscufx: fix error handling code in ufx_usb_probe (Dongliang Mu) [task:448819] {CVE-2022-49741}
  - video: fbdev: don't print error message on framebuffer_alloc() failure (Bartlomiej Zolnierkiewicz) [task:448819]
  - video: fbdev: intelfb: return -ENOMEM on framebuffer_alloc() failure (Bartlomiej Zolnierkiewicz) [task:448819]
  - video: fbdev: s3c-fb: return -ENOMEM on framebuffer_alloc() failure (Bartlomiej Zolnierkiewicz) [task:448819]
  - bpf: avoid holding freeze_mutex during mmap operation (Andrii Nakryiko) [task:444118] {CVE-2025-21853}
  - bpf: Prevent mmap()'ing read-only maps as writable (Andrii Nakryiko) [task:444118]
  - bpf: Prevent re-mmap()'ing BPF map as writable for initially r/o mapping (Andrii Nakryiko) [task:444118]
  - qibfs: fix _another_ leak (Al Viro) [task:466584] {CVE-2025-37983}
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang) [task:466615] {CVE-2025-37990}
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal) [task:466597] {CVE-2025-37982}
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge) [task:460149] {CVE-2025-37765}
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov) [task:462069] {CVE-2025-37800}
  - driver core: introduce device_set_driver() helper (Dmitry Torokhov) [task:462069]
  - driver core: bus: implement bus_get/put() without the private pointer (Greg Kroah-Hartman) [task:462069]
  - driver core: add local subsys_get and subsys_put functions (Greg Kroah-Hartman) [task:462069]
  - Revert "driver core: Fix uevent_show() vs driver detach race" (Greg Kroah-Hartman) [task:462069]
  - usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback (Wesley Cheng) [task:440766] {CVE-2022-49398}
  - tty: serial: fsl_lpuart: fix race on RX DMA shutdown (Alexander Sverdlin) [task:461247] {CVE-2023-53094}
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi) [task:460201] {CVE-2025-23140}
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo) [task:460209] {CVE-2025-37781}
  - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi) [task:462560] {CVE-2025-37878}
  - scsi: hisi_sas: Free irq vectors in order for v3 HW (Qi Liu) [task:440479] {CVE-2022-49118}
  - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (Cong Wang) [task:419353]
  - net/sched: netem: account for backlog updates from child qdisc (Martin Ottens) [task:419353] {CVE-2024-56770}
  - net: netem: use a list in addition to rbtree (Peter Oskolkov) [task:419353]
  - batman-adv: Drop unmanaged ELP metric worker (Sven Eckelmann) [task:439944] {CVE-2025-21823}
  - batman-adv: Ignore neighbor throughput metrics in error case (Sven Eckelmann) [task:439944]
  - batman-adv: ELP - use wifi tx bitrate as fallback (René Treffer) [task:439944]
  - list: fix a data-race around ep->rdllist (Kuniyuki Iwashima) [task:440750] {CVE-2022-49443}
  - list: introduce list_is_head() helper and re-use it in list.h (Andy Shevchenko) [task:440750]
  - net: phy: leds: fix memory leak (Qingfang Deng) [task:466413] {CVE-2025-37989}
  - sched/core: Prevent rescheduling when interrupts are disabled (Thomas Gleixner) [task:448841] {CVE-2023-52935}
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li) [task:462569] {CVE-2025-37883}
  - f2fs: fix to do sanity check on node blkaddr in truncate_node() (Chao Yu) [task:416339] {CVE-2024-56692}
  - f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() (Chao Yu) [task:440555] {CVE-2022-49380}
  - f2fs: do not count ENOENT for error case (Jaegeuk Kim) [task:439941]
  - f2fs: avoid infinite loop to flush node pages (Jaegeuk Kim) [task:439941] {CVE-2022-49317}
  - f2fs: fix wrong condition check when failing metapage read (Jaegeuk Kim) [task:439941]
  - f2fs: avoid an infinite loop in f2fs_sync_dirty_inodes (Jaegeuk Kim) [task:439941]
  - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found (Weichao Guo) [task:439941]
  - scsi: pm8001: Fix task leak in pm8001_send_abort_all() (Damien Le Moal) [task:440632] {CVE-2022-49120}
  - scsi: pm80xx: Fix command issue sizing (peter chang) [task:440632]
  - scsi: pm80xx: Squashed logging cleanup changes (peter chang) [task:440632]
  - btrfs: always report error in run_one_delayed_ref() (Qu Wenruo) [task:448850] {CVE-2022-49761}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.50.v2207
changelog:
  - secondly update changelog for upcoming 4.19.90-52.50.v2207 (Zhengyuan Liu)
  - iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [task:457728]
  - iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE (Suravee Suthikulpanit) [task:457728]
  - update changelog for upcoming 4.19.90-52.50.v2207 (Zhengyuan Liu)
  - mm/memory.c: Make the refreshing rate of rss_stat manual (Enze Li) [task:362195]
  - xfs: push the AIL in xlog_grant_head_wake (Dave Chinner) [task:507733]
  - Revert "udp: Deal with race between UDP socket address change and rehash" (taowei) [task:511705]
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn) [task:506635]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.51.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.51.v2207 (Zhengyuan Liu)
  - Revert "virtio_net: fix memory leak inside XPD_TX with mergeable" (刘正元)
  - sched/fair: Refill bandwidth before scaling (Huaixin Chang) [task:153627]
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [task:491929] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp) [task:491929]
  - fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion) [task:491929]
  - fs: jfs: fix shift-out-of-bounds in dbDiscardAG (Hoi Pok Wu) [task:491929, task:164562]
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin) [task:162162]
  - usb: dwc2: check return value after calling platform_get_resource() (Yang Yingliang) [task:160493]
  - drm/qxl: fix UAF on handle creation (Wander Lairson Costa) [task:346813] {CVE-2023-39198}
  - genirq/affinity: Improve __irq_build_affinity_masks() (Ming Lei) [bug:341996, bug:350695]
  - genirq/affinity: Pass first vector to __irq_build_affinity_masks() (Ming Lei) [task:157536]
  - genirq/affinity: Move two stage affinity spreading into a helper function (Ming Lei) [task:157536]
  - bpf: Fix a data-race around bpf_jit_limit. (Kuniyuki Iwashima) [task:482243] {CVE-2022-49967}
  - bpf: fix potential 32-bit overflow when accessing ARRAY map element (Andrii Nakryiko) [task:482217] {CVE-2022-50167}
  - bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals (Daniel Borkmann) [task:441339] {CVE-2022-49658}
  - bpf: Fix signed bounds propagation after mov32 (Daniel Borkmann) [task:161887]
  - bpf: Verifier, do_refine_retval_range may clamp umin to 0 incorrectly (John Fastabend) [task:158425, task:441339]
  - udp: fix skb_copy_and_csum_datagram with odd segment sizes (Willem de Bruijn) [task:516751, task:520623]
  - iov_iter: reduce code duplication (Al Viro) [task:516751, task:520623]
  - iov_iter: teach csum_and_copy_to_iter() to handle pipe-backed ones (Al Viro) [task:516751, task:520623]
  - net/tls: Use RCU API to access tls_ctx->netdev (Maxim Mikityanskiy) [task:207215]
  - net/tls: Remove the context from the list in tls_device_down (Maxim Mikityanskiy) [task:207215]
  - tls: Fix context leak on tls_device_down (Maxim Mikityanskiy) [task:207215]
  - net/tls: Fix use-after-free after the TLS device goes down and up (Maxim Mikityanskiy) [task:207215] {CVE-2021-47131}
  - net/tls: Replace TLS_RX_SYNC_RUNNING with RCU (Maxim Mikityanskiy) [task:207215]
  - security/lsm: Fix missing selinux file type (mengdehui) [task:506521]
  - driver/tpm: fix NULL err when creat vtpm (mengdehui) [task:519155]
  - kysec/ppro: Fix get paths that are not real paths (mengdehui) [bug:387337]
  - fix some compilation warnings for selinux (Jiangshan Yi) [task:357223]
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Scott Mayhew) [task:363951] {CVE-2024-46695}
  - selinux: implement the kernfs_init_security hook (Ondrej Mosnacek) [bug:258835]
  - selinux: try security xattr after genfs for kernfs filesystems (Ondrej Mosnacek) [bug:258835]
  - security/selinux: Fix SELinux crash issue when disabling stack (chengang) [task:338969]
  - selinux: fix double free of cond_list on error paths (Vratislav Bendel) [task:330355] {CVE-2022-48740}
  - selinux: fix a double free in cond_read_node()/cond_read_list() (Tom Rix) [task:330355]
  - selinux: fix error return code in cond_read_list() (Wei Yongjun) [task:330355]
  - selinux: convert cond_expr to array (Ondrej Mosnacek) [task:330355]
  - selinux: convert cond_av_list to array (Ondrej Mosnacek) [task:330355]
  - selinux: convert cond_list to array (Ondrej Mosnacek) [task:330355]
  - selinux: simplify evaluate_cond_node() (Ondrej Mosnacek) [task:330355]
  - selinux: avoid dereference of garbage after mount failure (Christian Göttsche) [task:221817] {CVE-2024-35904}
  - selinux: mark some global variables __ro_after_init (Ondrej Mosnacek) [task:221817]
  - selinux: make selinuxfs_mount static (Ondrej Mosnacek) [task:221817]
  - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling (Paul Moore) [task:169360]
  - selinux: fix error initialization in inode_doinit_with_dentry() (Tianyue Ren) [task:169360]
  - selinux: Fix error return code in sel_ib_pkey_sid_slow() (Chen Zhou) [task:169360]
  - selinux: allow labeling before policy is loaded (Jonathan Lebon) [task:169360]
  - selinux: ensure we cleanup the internal AVC counters on error in avc_insert() (Paul Moore) [task:169360]
  - selinux: fall back to ref-walk if audit is required (Stephen Smalley) [task:169360]
  - security/selinux: add ngac hook function for selinux version 4.19 (wangshengye) [bug:195749]
  - security/selinux: Implementation of selinux 4.19 stacking (chengang) [task:922066]
  - security/selinux: Upgrade selinux to version 4.19 (chengang) [task:149681]
  - Revert "net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port)" (刘正元)
  - Revert "ip: Fix data-races around sysctl_ip_prot_sock." (刘正元)
  - selinux: don't use make's grouped targets feature yet (Paul Moore) [task:166857]
  - selinux: ensure av_permissions.h is built when needed (Paul Moore) [task:166857]
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek) [task:166857]
  - selinux: Add boundary check in put_entry() (Xiu Jianfeng) [task:162162]
  - selinux: use correct type for context length (Christian Göttsche) [task:162162]
  - security/selinux: use LSM stack API in setsecurity (penghuaihe) [task:151838]
  - security/selinux: fix bounded_transition failed problem (mengdehui) [bug:161836]
  - security/selinux: add ngac hook function (yangzhao) [task:124104]
  - selinux: properly handle multiple messages in selinux_netlink_send() (Paul Moore) [task:119087] {CVE-2020-10751}
  - Revert "security/selinux: add ngac hook function" (mengdehui) [task:490643]
  - Revert "security/selinux: fix bounded_transition failed problem" (mengdehui) [task:490643]
  - Revert "security/selinux: use LSM stack API in setsecurity" (mengdehui) [task:490643]
  - Revert "selinux: properly handle multiple messages in selinux_netlink_send()" (mengdehui) [task:490643]
  - Revert "selinux: make selinuxfs_mount static" (mengdehui) [task:490643]
  - Revert "selinux: mark some global variables __ro_after_init" (mengdehui) [task:490643]
  - Revert "selinux: avoid dereference of garbage after mount failure" (mengdehui) [task:490643]
  - Revert "security/selinux: Fixed crash caused by selinux" (mengdehui) [task:490643]
  - Revert "selinux,smack: don't bypass permissions check in inode_setsecctx hook" (mengdehui) [task:490643]
  - icmp: Fix data-races around sysctl. (Kuniyuki Iwashima) [task:440780] {CVE-2022-49638}
  - virtio_net: fix memory leak inside XPD_TX with mergeable (Xuan Zhuo) [task:482159] {CVE-2022-50065}
  - ice: always check VF VSI pointer values (Jacob Keller) [task:440513] {CVE-2022-49516}
  - ice: Add helper function to get the VF's VSI (Brett Creeley) [task:162874, task:161899]
  - net: fix geneve_opt length integer overflow (Lin Ma) [task:458450] {CVE-2025-22055}
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference (James Smart) [task:167824, task:499367] {CVE-2021-47183}
  - RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang) [task:452502] {CVE-2025-22010}
  - set linkdata ps3/ps3stor to m in x86, arm and loongarch (Cao Guanghui) [task:449995]
  - LINKDATA: ps3/ps3stor: update driver support for linkdata (liujie) [task:449995]
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [task:505893] {CVE-2025-38464}
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu) [task:458968] {CVE-2025-22035}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [task:495865] {CVE-2025-38250}
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [task:491981] {CVE-2025-38229}
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama) [task:491387] {CVE-2025-38099}
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama) [task:491387]
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [task:491397] {CVE-2025-38117}
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [task:491205] {CVE-2025-38126}
  - net: stmmac: Calculate CDC error only once (Kurt Kanzenbach) [task:491205]
  - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls (Holger Assmann) [task:491205]
  - net: stmmac: Fix signed/unsigned wreckage (Thomas Gleixner) [task:491205]
  - net: stmmac: add timestamp correction to rid CDC sync error (Voon Weifeng) [task:491205]
  - net: stmmac: Get correct timestamp values from XGMAC (Jose Abreu) [task:491205]
  - net: stmmac: fix ptp timestamping on Rx on gmac4 (Ilias Apalodimas) [task:491205]
  - net: stmmac: implement the SIOCGHWTSTAMP ioctl (Artem Panfilov) [task:491205]
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky) [task:505919]
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu (Google)) [task:505919] {CVE-2025-38401}
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu) [task:505919]
  - mmc: mediatek: fix SDIO IRQ detection issue (jjian zhou) [task:505919]
  - mmc: bcm2835: Drop pointer to mmc_host from bcm2835_host (Lukas Wunner) [task:505919]
  - panic: implement nmi_panic_self_stop function for KunPeng 920 (liqiang01) [task:515025]
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei) [task:507039]
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [task:507039] {CVE-2025-38477}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [task:507033] {CVE-2025-38387}
  - nbd: fix race between timeout and normal completion (Ming Lei) [task:511239] {CVE-2024-49855}
  - btrfs: fix deadlock between quota enable and other quota operations (Filipe Manana) [task:510715, task:503849, task:463272]
  - LoongArch: Define the __io_aw() hook as mmiowb() (Huacai Chen) [task:221961] {CVE-2024-35818}
  - ndisc: extend RCU protection in ndisc_send_skb() (Eric Dumazet) [task:440599] {CVE-2025-21760}
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (Eric Dumazet) [task:440498] {CVE-2025-21761}
  - ndisc: use RCU protection in ndisc_alloc_skb() (Eric Dumazet) [task:440498]
  - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() (Eric Dumazet) [task:440498]
  - KVM: async_pf: Cleanup kvm_setup_async_pf() (Vitaly Kuznetsov) [task:511433]
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [task:491927] {CVE-2025-38215}
  - cpufreq: governor: Use kobject release() method to free dbs_data (Kevin Hao) [task:440528] {CVE-2022-49513}
  - cpufreq: Move to_gov_attr_set() to cpufreq.h (Kevin Hao) [task:440528]
  - driver core: fix deadlock in __device_attach (Zhang Wensheng) [task:441300] {CVE-2022-49371}
  - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [task:425040] {CVE-2024-57884}
  - sw_64: kprobes: Use generic kretprobe trampoline handler (Feng Yang) [task:510463]
  - block: don't allow the same type rq_qos add more than once (Jinke Han) [task:482125] {CVE-2022-50086}
  - dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (Luo Meng) [task:481813] {CVE-2022-50092}
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [task:491905] {CVE-2025-38204}
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [task:466617] {CVE-2025-37909}
  - lan743x: fix endianness when accessing descriptors (Alexey Denisov) [task:466617]
  - lan743x: fix rx_napi_poll/interrupt ping-pong (Sven Van Asbroeck) [task:466617]
  - lan743x: remove redundant initialization of variable current_head_index (Colin Ian King) [task:466617]
  - lan743x: remove redundant assignment to variable rx_process_result (Colin Ian King) [task:466617]
  - wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit) [task:491311] {CVE-2025-38096}
  - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [task:466487] {CVE-2025-37961}
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [task:466415] {CVE-2025-37932}
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [task:466237] {CVE-2025-37911}
  - net: atlantic: fix aq_vec index out of range error (Chia-Lin Kao (AceLan)) [task:481741] {CVE-2022-50066}
  - scsi: zfcp: Fix double free of FSF request when qdio send fails (Benjamin Block) [task:460278] {CVE-2022-49789}
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [task:481765] {CVE-2025-38066}
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [task:481989] {CVE-2025-38061}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki) [task:492667] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li) [task:492667]
  - neighbour: use RCU protection in __neigh_notify() (Eric Dumazet) [task:440628] {CVE-2025-21763}
  - neighbour: delete redundant judgment statements (Li Zetao) [task:440628]
  - ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet) [task:440728] {CVE-2025-21759}
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [task:490963] {CVE-2025-38163}
  - Bluetooth: use memset avoid memory leaks (Minghao Chi (CGEL ZTE)) [task:439933] {CVE-2022-49116}
  - team: better TEAM_OPTION_TYPE_STRING validation (Eric Dumazet) [task:440782] {CVE-2025-21787}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [task:491933] {CVE-2025-38193}
  - ia64: kprobes: Fix to pass correct trampoline address to the handler (Masami Hiramatsu) [task:485647]
  - kprobes: Make local functions static (Masami Hiramatsu) [task:485647]
  - kprobes: Free kretprobe_instance with RCU callback (Masami Hiramatsu) [task:485647]
  - kprobes: Remove NMI context check (Masami Hiramatsu) [task:485647]
  - loongarch: kprobes: Use generic kretprobe trampoline handler (Feng Yang) [task:485647]
  - sparc: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - sh: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - s390: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - powerpc: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - mips: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - ia64: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - arc: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - arm64: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - arm: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - x86/kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - kprobes: Add generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [task:505883] {CVE-2025-38458}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [task:491917] {CVE-2025-38212}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [task:507035] {CVE-2025-38495}
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [task:507031] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [task:507045] {CVE-2025-38474}
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [task:507019] {CVE-2025-38468}
  - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (Waiman Long) [task:482073] {CVE-2022-50103}
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter) [task:460185] {CVE-2025-37792}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [task:505901] {CVE-2025-38386}
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [task:505937] {CVE-2025-38384}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [task:507013] {CVE-2025-38494}
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (RD Babiera) [task:505909] {CVE-2025-38391}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [task:505889] {CVE-2025-38424}
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [task:497747] {CVE-2025-38320}
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [task:497751] {CVE-2025-38332}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [task:497283] {CVE-2025-38346}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [task:505877] {CVE-2025-38460}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [task:482019] {CVE-2025-38024}
  - intel_th: Fix a resource leak in an error handling path (Christophe JAILLET) [task:482199] {CVE-2022-50143}
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [task:482127] {CVE-2025-38079}
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [task:482133] {CVE-2025-38034}
  - intel_th: msu: Fix vmalloced buffers (Alexander Shishkin) [task:482209] {CVE-2022-50142}
  - intel_th: msu: Get rid of the window size limit (Alexander Shishkin) [task:482209]
  - mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu) [task:461947] {CVE-2025-37834}
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [task:482039] {CVE-2025-38072}
  - nvdimm: Split label init out from the logic for getting config data (Alexander Duyck) [task:482039]
  - libnvdimm, dimm: Maximize label transfer size (Dan Williams) [task:482039]
  - block: fix resource leak in blk_register_queue() error path (Zheng Qixing) [task:466601] {CVE-2025-37980}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [task:491885] {CVE-2025-38194}
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (Fedor Pchelkin) [task:419629]
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (Ignat Korchagin) [task:419629] {CVE-2024-56605}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [task:488165] {CVE-2025-38090}
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [task:491861] {CVE-2025-38174}
  - efi: fix potential NULL deref in efi_mem_reserve_persistent (Anton Gusev) [task:448780] {CVE-2023-52976}
  - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (Evgenii Shatokhin) [task:425037] {CVE-2024-57889}
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov) [task:462582] {CVE-2025-37851}
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang) [task:462584] {CVE-2025-37881}
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu) [task:462586] {CVE-2025-37840}
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb) [task:462439] {CVE-2025-37858}
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han) [task:462443] {CVE-2025-37841}
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła) [task:462571] {CVE-2025-37862}
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li) [task:461958] {CVE-2025-37817}
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen) [task:461959] {CVE-2025-37810}
  - staging: rtl8712: fix uninit-value in usb_read8() and friends (Wang Cheng) [task:441328] {CVE-2022-49301}
  - staging: rtl8712: usb_ops.c: Remove leading p from variable names (Nishka Dasgupta) [task:441328]
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong) [task:463860] {CVE-2023-53146}
  - mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang) [task:466613] {CVE-2025-37892}
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [task:466608] {CVE-2025-37923}
  - arp: use RCU protection in arp_xmit() (Eric Dumazet) [task:440668] {CVE-2025-21762}
  - ipv6: use RCU protection in ip6_default_advmss() (Eric Dumazet) [task:441272] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Eric Dumazet) [task:441272, task:440668]
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Jiri Pirko) [task:350517]
  - net: ethernet: stmmac: fix write to sgmii_adapter_base (Dinh Nguyen) [task:441324]
  - net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link (Dinh Nguyen) [task:441324] {CVE-2022-49061}
  - dm cache: fix flushing uninitialized delayed_work on cache_ctr error (Ming-Hung Tsai) [task:390747] {CVE-2024-50280}
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf) [task:466477] {CVE-2025-37937}
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin) [task:466616] {CVE-2025-37940}
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin) [task:461963] {CVE-2025-37829}
  - ext4: ignore xattrs past end (Bhupesh) [task:460186] {CVE-2025-37738}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio) [task:458303] {CVE-2025-22022}
  - usb: xhci: move link chain bit quirk checks into one helper function. (Niklas Neronin) [task:458303]
  - xhci: Don't pass struct xhci_hcd pointer to xhci_link_seg() (Mathias Nyman) [task:458303]
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [task:505897] {CVE-2025-38459}
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (HarshaVardhana S A) [task:505907] {CVE-2025-38403}
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia) [task:460274] {CVE-2025-23158}
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia) [task:460239] {CVE-2025-23159}
  - reset: uniphier-glue: Fix possible null-ptr-deref (Hui Tang) [task:448822] {CVE-2022-49758}
  - reset: uniphier-glue: Use reset_control_bulk API (Philipp Zabel) [task:448822]
  - reset: uniphier-usb3: Rename to reset-uniphier-glue (Kunihiko Hayashi) [task:448822]
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia) [task:460123] {CVE-2025-23156}
  - media: venus: hfi: add checks to handle capabilities from firmware (Vikash Garodia) [task:460123]
  - media: venus: hfi_parser: Check for instance after hfi platform get (Stanimir Varbanov) [task:460123]
  - media: venus: hfi_parser: Don't initialize parser on v1 (Stanimir Varbanov) [task:460123]
  - media: venus: Fix uninitialized variable count being checked for zero (Colin Ian King) [task:460123]
  - media: venus: Get codecs and capabilities from hfi platform (Stanimir Varbanov) [task:460123]
  - media: venus: parser: Prepare parser for multiple invocations (Stanimir Varbanov) [task:460123]
  - bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() (Shin'ichiro Kawasaki) [task:439953] {CVE-2022-49711}
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie) [task:458998] {CVE-2025-22083}
  - RDMA/srpt: Introduce a reference count in struct srpt_device (Bart Van Assche) [task:482173]
  - RDMA/srpt: Duplicate port name members (Bart Van Assche) [task:482173]
  - RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (Jianglei Nie) [task:482015] {CVE-2022-50138}
  - RDMA/qedr: Improve error logs for rdma_alloc_tid error return (Prabhakar Kushwaha) [task:482015]
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [task:491209] {CVE-2025-38115}
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet) [task:491257]
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [task:491257] {CVE-2025-38147}
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe) [task:491663] {CVE-2025-38094}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [task:491937] {CVE-2025-38177}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel) [task:460303] {CVE-2025-37794}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [task:491963] {CVE-2025-38200}
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads (Minsuk Kang) [task:448783] {CVE-2022-49740}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [task:491903] {CVE-2025-38190}
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [task:491983] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [task:497319] {CVE-2025-38323}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [task:497313] {CVE-2025-38285}
  - jfs: add check read-only before truncation in jfs_truncate_nolock() (Vasiliy Kovalev) [task:459936] {CVE-2024-58094}
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev) [task:460140] {CVE-2025-37782}
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han) [task:460236] {CVE-2025-37742}
  - jfs: remove unnecessary oom message (Zhen Lei) [task:460236]
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis) [task:460150] {CVE-2025-37741}
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis) [task:460180] {CVE-2025-37740}
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin) [task:460300] {CVE-2025-37758}
  - isofs: Prevent the use of too small fid (Edward Adam Davis) [task:460221] {CVE-2025-37780}
  - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [task:448967] {CVE-2025-21699}
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (Dennis Lam) [task:425033] {CVE-2024-57892}
  - ocfs2: correct return value of ocfs2_local_free_info() (Joseph Qi) [task:425033]
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [task:491953] {CVE-2025-38203}
  - xfs: fix xfs leaked delalloc blocks accounting p2 (Shida Zhang) [task:494391]
  - iio: adc: at91: call input_free_device() on allocated iio_dev (Joe Hattori) [task:426329] {CVE-2024-57904}
  - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:448817] {CVE-2023-52936}
  - irqdomain: Remove debugfs_file from struct irq_domain (Greg Kroah-Hartman) [task:448817]
  - USB: gadget: f_midi: f_midi_complete to call queue_work (Jill Donahue) [task:444127] {CVE-2025-21859}
  - nilfs2: prevent use of deleted inode (Edward Adam Davis) [task:421043] {CVE-2024-53690}
  - fbdev: sisfb: Fix strbuf array overflow (Andrey Shumilin) [task:387561] {CVE-2024-50180}
  - iio: accel: mma8452: use the correct logic to get mma8452_data (Haibo Chen) [task:440788] {CVE-2022-49285}
  - drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init (Miaoqian Lin) [task:440488] {CVE-2022-49462}
  - drm/msm/a6xx: Rename a6xx_gmu_probe to a6xx_gmu_init (Sean Paul) [task:440488]
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov) [task:460184] {CVE-2025-23150}
  - btrfs: fix inode list leak during backref walking at find_parent_nodes() (Filipe Manana) [task:460298] {CVE-2022-49913}
  - Btrfs: preftree: use rb_first_cached (Liu Bo) [task:460298]
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng) [task:459707] {CVE-2023-53034}
  - f2fs: fix to do sanity check on total_data_blocks (Chao Yu) [task:440482] {CVE-2022-49360}
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [task:497273] {CVE-2025-38319}
  - bpf: Annotate bpf_long_memcpy with data_race (Daniel Borkmann) [task:494931] {CVE-2023-52521}
  - KVM: Don't null dereference ops->destroy (Alexey Kardashevskiy) [task:440631] {CVE-2022-49568}
  - smb: client: Fix use-after-free in cifs_fill_dirent (Wang Zhaolong) [task:482229] {CVE-2025-38051}
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [task:440591]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [task:440591] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [task:440591]
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi) [task:491959] {CVE-2025-38213}
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [task:495937] {CVE-2025-38245}
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [task:497753] {CVE-2025-38312}
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Wentao Liang) [task:494929] {CVE-2025-38237}
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [task:497135] {CVE-2025-38328}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [task:497287] {CVE-2025-38324}
  - fbcon: Make sure modelist not set on unregistered console (Kees Cook) [task:491975] {CVE-2025-38198}
  - fbcon: Introduce wrapper for console->fb_info lookup (Daniel Vetter) [task:491975]
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [task:491657] {CVE-2025-38157}
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() (Juergen Gross) [task:482077] {CVE-2022-49989}
  - crypto: hisilicon/sec - don't sleep when in softirq (Zhengchao Shao) [task:481943] {CVE-2022-50171}
  - net: clear the dst when changing skb protocol (Jakub Kicinski) [task:492357] {CVE-2025-38192}
  - bpf: update skb->protocol in bpf_skb_net_grow (Willem de Bruijn) [task:492357]
  - of: check previous kernel's ima-kexec-buffer against memory bounds (Vaibhav Jain) [task:482053] {CVE-2022-50159}
  - set linkdata NIC to y in x86, arm and loongarch (YANGANG) [task:449997]
  - LINKDATA: SXE: add support for linkdata sxe NIC (YANGANG) [task:449997]
  - ax25: Remove broken autobind (Murad Masimov) [task:459548] {CVE-2025-22109}
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [task:459933] {CVE-2025-22058}
  - ibmvnic: Use kernel helpers for hex dumps (Nick Child) [task:459569] {CVE-2025-22104}
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf) [task:462579] {CVE-2025-37850}
  - ext4: fix OOB read when checking dotdot dir (Acs, Jakub) [task:458578] {CVE-2025-37785}
  - Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works (Tetsuo Handa) [task:481991]
  - Bluetooth: When HCI work queue is drained, only queue chained work (Schspa Shi) [task:481991] {CVE-2022-50166}
  - Bluetooth: Add ncmd=0 recovery handling (Manish Mandlik) [task:481991]
  - bnxt: Do not read past the end of test names (Kees Cook) [task:448825] {CVE-2023-53010}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [task:492663] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [task:492195] {CVE-2025-38184}
  - ip: Fix data-races around sysctl_ip_prot_sock. (Kuniyuki Iwashima) [task:440771] {CVE-2022-49578}
  - net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) (Maciej Żenczykowski) [task:440771]
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [task:491907] {CVE-2025-38214}
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [task:495947] {CVE-2025-38249}
  - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS (Pavankumar Kondeti) [task:160493]
  - usb: fix various gadgets null ptr deref on 10gbps cabling. (Maciej Żenczykowski) [task:158827]
  - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (Marek Vasut) [task:162162]
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (Mark Brown) [task:160493]
  - ALSA: pcm: oss: Fix negative period/buffer sizes (Takashi Iwai) [task:160493]
  - ALSA: pcm: oss: Fix a few more UBSAN fixes (Takashi Iwai) [task:158034]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.52.v2207
changelog:
  - net: drop bad gso csum_start and offset in virtio_net_hdr (Willem de Bruijn) [task:534195]
  - net: missing check virtio (Denis Arefev) [task:534195]
  - fix kabi issue for "net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation" (luoqing) [task:534195]
  - net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation (Willem de Bruijn) [task:534195]
  - linux/virtio_net.h: Support USO offload in vnet header. (Andrew Melnychenko) [task:534195]
  - net: accept UFOv6 packages in virtio_net_hdr_to_skb (Willem de Bruijn) [task:534195]
  - net: check if protocol extracted by virtio_net_hdr_set_proto is correct (Balazs Nemeth) [task:534195]
  - net: Introduce parse_protocol header_ops callback (Maxim Mikityanskiy) [task:158893]
  - RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET (Jason Gunthorpe) [task:534193]
  - net: hsr: Add VLAN support (WingMan Kwok) [task:534197]
  - netfilter: nf_tables: fix nat hook table deletion (Florian Westphal) [task:534199]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.53.v2207
changelog:
  - net: tighten bad gso csum offset check in virtio_net_hdr (Willem de Bruijn) [task:541407]
  - update changelog for upcoming 4.19.90-52.53.v2207 (Zhengyuan Liu)
  - Revert "veth: Adjust hard_start offset on redirect XDP frames" (Zhengyuan Liu) [task:547295]
  - Revert "veth: Xdp using frame_sz in veth driver" (Zhengyuan Liu)
  - Revert "xdp: Introduce xdp_convert_frame_to_buff utility routine" (Zhengyuan Liu)
  - Revert "xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame" (Zhengyuan Liu) [task:547295]
  - fix the compilation error (Zhengyuan Liu) [task:547295]
  - xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame (Lorenzo Bianconi) [task:547295]
  - xdp: Introduce xdp_convert_frame_to_buff utility routine (Lorenzo Bianconi) [task:547295]
  - veth: Xdp using frame_sz in veth driver (Jesper Dangaard Brouer) [task:547295]
  - veth: Adjust hard_start offset on redirect XDP frames (Jesper Dangaard Brouer) [task:547295]
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal) [task:351433] {CVE-2022-48911}
  - wifi: ath9k: verify the expected usb_endpoints are present (Fedor Pchelkin) [task:164562, task:531813] {CVE-2022-50297}
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (Kuniyuki Iwashima) [task:371789]
  - vrf: Increment Icmp6InMsgs on the original netdev (Stephen Suryaputra) [task:371789]
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai) [task:166857]
  - igb: Do not free q_vector unless new one was allocated (Kees Cook) [task:164562]
  - wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (Dan Carpenter) [task:520535]
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [task:520535] {CVE-2025-38602}
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Leon Romanovsky) [task:214146] {CVE-2024-26907}
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ (Alexey Dobriyan) [task:214146]
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper (Kees Cook) [task:214146]
  - dm raid: fix address sanitizer warning in raid_status (Mikulas Patocka) [task:162162]
  - cifs: Fix oops due to uncleared server->smbd_conn in reconnect (David Howells) [task:164562]
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao) [task:166857]
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (Liu Jian) [task:164562]
  - btrfs: fix race between quota enable and quota rescan ioctl (Filipe Manana) [task:164562]
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip (Xin Long) [task:166857]
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [task:476203]
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [task:476203]
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [task:476203]
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [task:476203] {CVE-2025-38001}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [task:476217] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [task:476203]
  - sched: Fix detection of empty queues in child qdiscs (Toke Høiland-Jørgensen) [task:476203]
  - vxlan: Annotate FDB data races (Ido Schimmel) [task:482121] {CVE-2025-38037}
  - vxlan: reduce dirty cache line in vxlan_find_mac (Li RongQing) [task:210575]
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima) [task:505933]
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski) [task:505933]
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [task:505933] {CVE-2025-38465}
  - netlink: annotate lockless accesses to nlk->max_recvmsg_len (Eric Dumazet) [task:505933]
  - btrfs: fix BUG_ON condition in btrfs_cancel_balance (xiaoshoukui) [task:373027]
  - virtio_net: fix memory leak inside XPD_TX with mergeable (Xuan Zhuo) [task:482159] {CVE-2022-50065}
  - ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports (Takashi Iwai) [task:440634]
  - ALSA: usb-audio: Cancel pending work at closing a MIDI substream (Takashi Iwai) [task:440634] {CVE-2022-49545}
  - ALSA: usb-audio: Replace tasklet with work (Takashi Iwai) [task:440634]
  - ext4: fix BUG_ON() when directory entry has invalid rec_len (Luís Henriques) [task:460128] {CVE-2022-49879}
  - ext4: refactor initialize_dirent_tail() (Theodore Ts'o) [task:460128]
  - ext4: rename "dirent_csum" functions to use "dirblock" (Theodore Ts'o) [task:460128]
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Zhihao Cheng) [task:162162]
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [task:497317] {CVE-2025-38337}
  - ocfs2: fix a deadlock when commit trans (Joseph Qi) [task:353893]
  - ocfs2: fix race between searching chunks and release journal_head from buffer_head (Gautham Ananthakrishna) [task:353893] {CVE-2021-47493}
  - Revert "jbd2: Make state lock a spinlock" (liubaolin) [task:429083]
  - Revert "ocfs2: fix race between searching chunks and release journal_head from buffer_head" (liubaolin) [task:429083]
  - Revert "ocfs2: fix a deadlock when commit trans" (liubaolin) [task:429083]
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [task:459580] {CVE-2025-22121}
  - ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin) [task:166857]
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li) [task:162162]
  - ext4: introduce ITAIL helper (Ye Bin) [task:459580]
  - ext4: improve xattr consistency checking and error reporting (Theodore Ts'o) [task:459580]
  - EDAC/amd64: Use cached data when checking for ECC (Yazen Ghannam) [bug:412285]
  - net: bridge: use DEV_STATS_INC() (Eric Dumazet) [task:207281] {CVE-2023-52578}
  - block, bfq: don't break merge chain in bfq_split_bfqq() (Yu Kuai) [task:515911]
  - block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (Yu Kuai) [task:515911]
  - blk-cgroup: dropping parent refcount after pd_free_fn() is done (Yu Kuai) [task:515911]
  - blkcg: blkcg_activate_policy() should initialize ancestors first (Tejun Heo) [task:515911]
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() (Minsuk Kang) [task:539351] {CVE-2022-50551}
  - tcp: Add sysctl to configure ephemeral port shuffle period for connect() (luoxuanqiang) [task:522905]
  - tcp: Add sysctl to control port randomization in __inet_hash_connect() (Xuanqiang Luo) [task:522905]
  - net: hns: fix possible memory leak in hnae_ae_register() (Yang Yingliang) [task:164562]
  - nilfs2: fix sysfs interface lifetime (Ryusuke Konishi) [task:166857]
  - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing) [task:371789]
  - net: hsr: Fix potential use-after-free (YueHaibing) [task:164562]
  - icmp: change the order of rate limits (Eric Dumazet) [task:545633] {CVE-2024-47678}
  - Revert "icmp: Add counters for rate limits" (luoxuanqiang) [task:545633]
  - Revert "icmp: change the order of rate limits" (luoxuanqiang) [task:545633]
  - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (Werner Sembach) [task:442591] {CVE-2025-21831}
  - x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4 (Mario Limonciello) [task:442591]
  - x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot (Basavaraj Natikar) [task:166883]
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Jann Horn) [task:164574, task:545077]
  - txgbe: update release note to 1.3.6.5 (linglingzhang) [task:523317]
  - txgbe: fix: delay free buffer cause ptp timeout (duanqiangwen) [task:523317]
  - txgbe: FIX: fix compile error (linyuexie) [task:523317]
  - txgbe: fix: alloc rx skb failed may cause page refcount abnormal (duanqiangwen) [task:523317]
  - txgbe: FIX: fix may calltrace when XDP_TX (linyuexie) [task:523317]
  - txgbe: fix: solve problems about smmu event 0x10 and packet data being tampered with on kunpeng920 (linglingzhang) [task:523317]
  - txgbe: set version 1.3.6.4 (juxiahe) [task:523317]
  - txgbe: FIX: fix calltrace out of range after repeatly unbind and bind (Linyue Xie) [task:523317]
  - txgbe: feat: VF receive all VLAN tags in all-multicast mode (Jiawen Wu) [task:523317]
  - bpf: Fix request_sock leak in sk lookup helpers (Jon Maxwell) [task:99622]
  - net: bpf: Don't leak time wait and request sockets (Lorenz Bauer) [task:99622]
  - bpf: Check sk_fullsock() before returning from bpf_sk_lookup() (Martin KaFai Lau) [task:99622]
  - KVM: Fix compile error of macro not defined (张浩) [task:516941, task:544759]
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng) [task:164562]
  - NFSD: prevent underflow in nfssvc_decode_writeargs() (Dan Carpenter) [task:162162]
  - ext4: don't BUG if someone dirty pages without asking ext4 first (Theodore Ts'o) [task:162162]
  - ipv6: fix WARNING in ip6_route_net_exit_late() (Zhengchao Shao) [task:164562]
  - NFSv4/pnfs: Fix a use-after-free bug in open (Trond Myklebust) [task:162162]
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Trond Myklebust) [task:162162]
  - ext4: fix bug_on in ext4_writepages (Ye Bin) [task:162162]
  - ext4: fix task hung in ext4_xattr_delete_inode (Baokun Li) [task:166857]
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang) [task:166857]
  - virtio_net: fix xdp_rxq_info bug after suspend/resume (Stephan Gerhold) [task:162162]
  - ext4: fix WARNING in ext4_update_inline_data (Ye Bin) [task:166857]
  - scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (James Smart) [task:167824]
  - mm/swapfile: add cond_resched() in get_swap_pages() (Longlong Xia) [task:164562]
  - dm integrity: fix memory corruption when tag_size is less than digest size (Mikulas Patocka) [task:162162]
  - tty: vt: initialize unicode screen buffer (Tetsuo Handa) [task:162162]
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang) [task:162162]
  - net: mdio: validate parameter addr in mdiobus_get_phy() (Heiner Kallweit) [task:164562]
  - nbd: fix io hung while disconnecting device (Yu Kuai) [task:162162]
  - usb: host: ohci-ppc-of: Fix refcount leak bug (Liang He) [task:162162]
  - tracing: Make sure trace_printk() can output as soon as it can be used (Steven Rostedt (Google)) [task:164562]
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (Gavrilov Ilia) [task:164562]
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang) [task:164562]
  - geneve: make sure to pull inner header in geneve_rx() (Eric Dumazet) [task:214140] {CVE-2024-26857}
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() (Eric Dumazet) [task:214149] {CVE-2024-26882}
  - bpf, sockmap: Fix double uncharge the mem of sk_msg (Wang Yufen) [task:168910]
  - ext4: fix use-after-free in ext4_rename_dir_prepare (Ye Bin) [task:162162, task:499367] {CVE-2022-49349}
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin) [task:164562]
  - md: Replace snprintf with scnprintf (Saurabh Sengar) [task:164562]
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li) [task:164562]
  - md: fix resync softlockup when bitmap size is less than array size (Yu Kuai) [task:371789]
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (Li Nan) [task:371789]
  - md/bitmap: md_bitmap_get_counter returns wrong blocks (Zhao Heming) [task:158034]
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (Chen Zhongjin) [task:164562]
  - md: fix a crash in mempool_free (Mikulas Patocka) [task:164562]
  - watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun) [task:153627]
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (Rik van Riel) [task:164562]
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang) [task:371789]
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang) [task:371789]
  - md/raid10: prevent soft lockup while flush writes (Yu Kuai) [task:371789]
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (David Disseldorp) [task:166857]
  - skbuff: Account for tail adjustment during pull operations (Subash Abhinov Kasiviswanathan) [task:153627]
  - vhost/vsock: Use kvmalloc/kvfree for larger packets. (Junichi Uekawa) [task:164562]
  - crypto: cavium - prevent integer overflow loading firmware (Dan Carpenter) [task:164562]
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin) [task:164562]
  - cifs: fix double free race when mount fails in cifs_get_root() (Ronnie Sahlberg) [task:162162]
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo) [task:164562]
  - bpf: track changes_pkt_data property for global functions (Eduard Zingerman) [task:461065] {CVE-2024-58098}
  - bpf: add find_containing_subprog() utility function (Eduard Zingerman) [task:461065]
  - bpf: Factor out visit_func_call_insn() in check_cfg() (Yonghong Song) [task:161887]
  - bpf: Refactor check_cfg to use a structured loop. (Wedson Almeida Filho) [task:161887]
  - fix kabi issue for "df4b25fe64e4 io_uring/af_unix: disable sending io_uring over sockets" (Haofeng Li) [task:370797, task:544105]
  - Revert "dm cache: Fix UAF in destroy()" (tanzheng) [task:539013]
  - dm cache: Fix UAF in destroy() (Luo Meng) [task:164562, task:539013] {CVE-2022-50496}
  - bpf: Reject narrower access to pointer ctx fields (Feng Yang) [task:520583] {CVE-2025-38591}
  - tpm: Actually fail on TPM errors during "get random" (Kees Cook) [task:530851]
  - tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure (Tomas Winkler) [task:530851]
  - tpm: factor out tpm1_get_random into tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: move tpm_getcap to tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: move tpm1_pcr_extend to tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: factor out tpm_get_timeouts() (Tomas Winkler) [task:530851]
  - tpm: add tpm_calc_ordinal_duration() wrapper (Tomas Winkler) [task:530851]
  - tpm: factor out tpm 1.x duration calculation to tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: sort objects in the Makefile (Tomas Winkler) [task:530851]
  - tpm2: add new tpm2 commands according to TCG 1.36 (Tomas Winkler) [task:530851]
  - ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet) [task:440728] {CVE-2025-21759}
  - Revert "ipv6: mcast: extend RCU protection in igmp6_send()" (taowei) [task:440728]
  - config/x86: enable CONFIG_DRM_PHYTIUM (lihaojie) [task:522397]
  - arm64: paravirt: Use RCU read locks to guard stolen_time (Prakruthi Deepak Heragu) [task:516941]
  - arm64: paravirt: Initialize steal time when cpu is online (Andrew Jones) [task:516941]
  - arm64: Retrieve stolen time as paravirtualized guest (Steven Price) [task:516941]
  - KVM: arm64: Provide VCPU attributes for stolen time (Steven Price) [task:516941]
  - KVM: Allow kvm_device_ops to be const (Steven Price) [task:516941]
  - KVM: arm64: Support stolen time reporting via shared structure (Steven Price) [task:516941]
  - KVM: arm64: Document PV-time interface (Steven Price) [task:516941]
  - KVM: arm64: Implement PV_TIME_FEATURES call (Steven Price) [task:516941]
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue (Chao Qin) [task:164574]
  - ntfs: add sanity check on allocation size (Dongliang Mu) [task:162162, task:525023]
  - net: mdio: unexport __init-annotated mdio_bus_init() (Masahiro Yamada) [task:162162, task:525023]
  - usb: xhci: Check endpoint is valid before dereferencing it (Jimmy Hu) [task:164562, task:525023]
  - xhci: add xhci_get_virt_ep() helper (Mathias Nyman) [task:158827, task:525023]
  - xhci: Fix null pointer dereference when host dies (Mathias Nyman) [task:164562]
  - xhci: avoid race between disable slot command and host runtime suspend (Mathias Nyman) [task:160493, task:525023]
  - Revert "reset: uniphier-usb3: Rename to reset-uniphier-glue" (Qingshuang Fu) [task:511383, task:534405]
  - Revert "reset: uniphier-glue: Use reset_control_bulk API" (Qingshuang Fu) [task:511383, task:534405]
  - Revert "reset: uniphier-glue: Fix possible null-ptr-deref" (Qingshuang Fu) [task:511383, task:534405]
  - iopoll: Introduce read_poll_timeout_atomic macro (Kai-Heng Feng) [task:537643, task:534405]
  - net: macb: call pm_runtime_put_sync on failure path (Claudiu Beznea) [task:532055, task:534405]
  - net: macb: Fix runtime PM refcounting (Andy Shevchenko) [task:532055, task:534405]
  - net: macb: Disable clocks once (Neil Mandir) [task:532055, task:534405]
  - net: macb: add function to disable all macb clocks (Claudiu Beznea) [task:532055, task:534405]
  - net: macb: fix wakeup test in runtime suspend/resume routines (Nicolas Ferre) [task:532055, task:534405]
  - net: macb: ensure interface is not suspended on at91rm9200 (Alexandre Belloni) [task:532055, task:534405]
  - net: macb: Add support for suspend/resume with full power down (Harini Katakam) [task:532055, task:534405]
  - net: macb: Add pm runtime support (Harini Katakam) [task:532055, task:534405]
  - net: macb: Support clock management for tsu_clk (Harini Katakam) [task:532055, task:534405]
  - net: macb: Check MDIO state before read/write and use timeouts (Harini Katakam) [task:537643, task:534405]
  - change_mnt_propagation(): calculate propagation source only if we'll need it (Al Viro) [task:527715]
  - change_mnt_propagation(): move ->mnt_master assignment into MS_SLAVE case (Al Viro) [task:527715]
  - turn do_make_slave() into transfer_propagation() (Al Viro) [task:527715]
  - do_make_slave(): choose new master sanely (Al Viro) [task:527715]
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() (Al Viro) [task:527715]
  - change_mnt_propagation() cleanups, step 1 (Al Viro) [task:527715]
  - blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (Li Jinlin) [task:530285]
  - Revert "blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd" (cuitao) [task:530285]
  - blkcg: Fix multiple bugs in blkcg_activate_policy() (Tejun Heo) [task:530285]
  - blkcg: pass @q and @blkcg into blkcg_pol_alloc_pd_fn() (Tejun Heo) [task:530285]
  - bpf: Fix memory leaks in __check_func_call (Wang Yufen) [task:161887]
  - bpf: Refactor check_func_call() to allow callback function (Yonghong Song) [task:161887]
  - icmp: change the order of rate limits (Eric Dumazet) [task:376375] {CVE-2024-47678}
  - icmp: Add counters for rate limits (Jamie Bainbridge) [task:376375]
  - ftrace: Fix use-after-free for dynamic ftrace_ops (Li Huafei) [task:461085] {CVE-2022-49892}
  - crypto: null - Use spin lock instead of mutex (Herbert Xu) [task:461960] {CVE-2025-37808}
  - crypto: null - Remove VLA usage of skcipher (Kees Cook) [task:461960]
  - crypto: skcipher - Set tfm in SYNC_SKCIPHER_REQUEST_ON_STACK (Herbert Xu) [task:461960]
  - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Herbert Xu) [task:158034]
  - crypto: skcipher - Introduce crypto_sync_skcipher (Kees Cook) [task:461960]
  - net: tunnels: annotate lockless accesses to dev->needed_headroom (Eric Dumazet) [task:166857, task:525023]
  - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (Akash M) [task:426433] {CVE-2024-57913}
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [task:532349] {CVE-2025-39823}
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [task:532349]
  - KVM: X86: Yield to IPI target if necessary (Wanpeng Li) [task:532349]
  - KVM: X86: Implement PV sched yield hypercall (Wanpeng Li) [task:532349]
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [task:532365] {CVE-2025-39828}
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [task:532365]
  - Revert "Revert "block, bfq: honor already-setup queue merges"" (Paolo Valente) [task:162162, task:440717] {CVE-2021-47646}
  - Revert "block, bfq: honor already-setup queue merges" (Jens Axboe) [task:162162, task:440717]
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference (James Smart) [task:167824, task:499367]
  - scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (James Smart) [task:167824, task:525023]
  - scsi: lpfc: Convert abort handling to SLI-3 and SLI-4 handlers (James Smart) [task:167824, task:525023]
  - scsi: lpfc: Rework remote port ref counting and node freeing (James Smart) [task:167824, task:525023]
  - scsi: lpfc: rport port swap discovery issue. (James Smart) [task:167824, task:525023]
  - Revert "scsi: lpfc: Fix link down processing to address NULL pointer dereference" (Wang Yan) [task:499367]
  - tcp: Fix data-races around sysctl_tcp_min_snd_mss. (Kuniyuki Iwashima) [task:153981, task:525023]
  - ext4: don't block for O_DIRECT if IOCB_NOWAIT is set (Jens Axboe) [task:539423]
  - bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds (Daniel Borkmann) [task:161887, task:525023]
  - bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds. (Alexei Starovoitov) [task:161887, task:525023]
  - bpf: Verifier, refine 32bit bound in do_refine_retval_range (John Fastabend) [task:161887, task:525023]
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [task:497745] {CVE-2025-38310}
  - ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [task:520571] {CVE-2025-38587}
  - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (Wang Yufen) [task:168910]
  - ext4: fix WARNING in mb_find_extent (Ye Bin) [task:166857]
  - ext4: Fix function prototype mismatch for ext4_feat_ktype (Kees Cook) [task:164562]
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o) [task:166857]
  - scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (James Smart) [task:167824, task:441322] {CVE-2022-49535}
  - drm/amdgpu: install stub fence into potential unused fence pointers (Lang Yu) [task:531789, task:534643] {CVE-2023-53248}
  - dma-buf: add dma_fence_get_stub (Christian König) [task:531789, task:534643]
  - udf: Fix uninitialized array access for some pathnames (Jan Kara) [task:373027]
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong) [task:532227, task:534643] {CVE-2022-50327}
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (Felix Fietkau) [task:166857]
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl() (Shigeru Yoshida) [task:164562]
  - block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (Bart Van Assche) [task:440716] {CVE-2022-49720}
  - mm: fix unexpected zeroed page mapping with zram swap (Minchan Kim) [task:169355]
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov) [bug:407309]
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia) [task:460230] {CVE-2025-23157}
  - media: venus: hfi_parser: Add check to keep the number of codecs within range (Vikash Garodia) [task:460230]
  - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Tasos Sahanidis) [task:330552]
  - USB: core: Make do_proc_control() and do_proc_bulk() killable (Alan Stern) [task:330552] {CVE-2021-47582}
  - USB: usbfs: Don't WARN about excessively large memory allocations (Alan Stern) [task:158827]
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (Zeng Heng) [task:328464] {CVE-2024-36959}
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng) [task:164562]
  - ALSA: jack: Access input_dev under mutex (Amadeusz Sławiński) [task:162162]
  - gpio: prevent potential speculation leaks in gpio_device_get_desc() (Hagar Hemdan) [task:352677] {CVE-2024-44931}
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (Jakub Sitnicki) [task:222089] {CVE-2023-52735}
  - ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. (Kuniyuki Iwashima) [task:440400] {CVE-2022-49580}
  - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() (Ashish Kalra) [task:460284] {CVE-2022-49885}
  - ACPI / APEI: Make estatus pool allocation a static size (James Morse) [task:460284]
  - ACPI / APEI: Make hest.c manage the estatus memory pool (James Morse) [task:460284]
  - ACPI / APEI: Remove silent flag from ghes_read_estatus() (James Morse) [task:460284]
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [task:494275] {CVE-2025-38129}
  - page_pool: fix inconsistency for page_pool_ring_[un]lock() (Yunsheng Lin) [task:494275]
  - net: page_pool: use in_softirq() instead (Qingfang DENG) [task:494275]
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Pavel Tikhomirov) [task:221965] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Pavel Tikhomirov) [task:221965]
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Pavel Tikhomirov) [task:221965]
  - neighbour: annotate lockless accesses to n->nud_state (Eric Dumazet) [task:221965]
  - nvmet: always initialize cqe.result (Daniel Wagner) [task:344611] {CVE-2024-41079}
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [task:476359] {CVE-2025-38004}
  - can: bcm: check the result of can_send() in bcm_can_tx() (Ziyang Xuan) [task:164562]
  - io_uring/af_unix: disable sending io_uring over sockets (Pavel Begunkov) [task:370797] {CVE-2023-6531}
  - NFS: Fix an Oops in nfs_d_automount() (Trond Myklebust) [task:533901] {CVE-2022-50385}
  - security: smack and tomoyo not support stacking (penghuaihe) [task:535691]
  - security: support extend modules request label slot (penghuaihe) [task:535691]
  - security: do hook support checking while register (penghuaihe) [task:535691]
  - security: fix memleak in sem_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in shm_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in msg_queue_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in msg_msg_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in file_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in inode_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in sb_alloc_security (penghuaihe) [task:535691]
  - security: fix memleak in cred_alloc_blank (penghuaihe) [task:535691]
  - security: fix memleak in sk_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in key_alloc hook (penghuaihe) [task:535691]
  - security: support task_alloc stacking (penghuaihe) [task:535691]
  - security: support audit rules stacking (penghuaihe) [task:535691]
  - locking/qspinlock: use xchg with _mb in slowpath for arm64 (pengyu) [task:524633, task:526703, task:535495]
  - ext4: fix warning when submitting superblock in ext4_commit_super() (Zhang Yi) [task:539973]
  - Revert "ext4: Use rbtrees to manage PAs instead of inode i_prealloc_list" (pengyu) [task:449973]
  - Revert "ext4: mballoc: Remove useless setting of ac_criteria" (pengyu) [task:449973]
  - Revert "ext4: fix rbtree traversal bug in ext4_mb_use_preallocated" (pengyu) [task:449973]
  - scsi: libsas: Abort all in-flight requests when device is gone (Jason Yan) [bug:408215]
  - ceph: take snap_empty_lock atomically with snaprealm refcount change (Jeff Layton) [task:530217]
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [task:491659] {CVE-2025-38112}
  - net/mlx5e: Fix cleanup null-ptr deref on encap lock (Paul Blakey) [task:461217] {CVE-2023-53105}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [task:532203] {CVE-2025-39812}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [task:534347] {CVE-2025-39866}
  - writeback: Fix inode->i_io_list not be protected by inode->i_lock error (Jchao Sun) [task:534347]
  - wifi: mac80211_hwsim: drop short frames (Johannes Berg) [task:532575] {CVE-2023-53321}
  - netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (Pavel Tikhomirov) [task:531791] {CVE-2023-53200}
  - selinux: fix cred stacking bug (penghuaihe) [task:490643]
  - security: support bpf hooks stacking (penghuaihe) [task:490643]
  - drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() (Hangyu Hua) [task:440742] {CVE-2022-49644}
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags (Mohamed Khalfella) [task:532803] {CVE-2023-53354}
  - modpost: fix off by one in is_executable_section() (Dan Carpenter) [task:534137] {CVE-2023-53397}
  - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() (Yang Yingliang) [task:532165] {CVE-2022-50246}
  - RDMA/bnxt_re: wraparound mbox producer index (Kashyap Desai) [task:531719] {CVE-2023-53201}
  - drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (K Prateek Nayak) [task:532209]
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (Yong-Xuan Wang) [task:532209] {CVE-2023-53254}
  - cacheinfo: Align checks in cache_shared_cpu_map_{setup,remove} for readability (Sudeep Holla) [task:532209]
  - cacheinfo: Add helper to access any cache index for a given CPU (Sudeep Holla) [task:532209]
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [task:519689] {CVE-2025-38530}
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [task:519361] {CVE-2025-38529}
  - tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [task:534351] {CVE-2025-39865}
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima) [task:532219] {CVE-2023-53204}
  - net: sched: sfb: fix null pointer access issue when sfb_init() fails (Zhengchao Shao) [task:532833] {CVE-2022-50356}
  - KVM: SVM: Fix vgif feature not enabled (张浩) [task:532315]
  - driver: base: fix UAF when driver_attach failed (Schspa Shi) [task:440534] {CVE-2022-49385}
  - drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table (Ivan Stepchenko) [task:442357] {CVE-2024-58052}
  - drm/amdgpu: fix usage slab after free (Vitaly Prosyak) [task:429491] {CVE-2024-56551}
  - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again (shaoyunl) [task:225612] {CVE-2021-47551}
  - drm/amdkfd: don't use dqm lock during device reset/suspend/resume (Philip Yang) [task:225612]
  - drm/i915/selftests: fix subtraction overflow bug (Andrzej Hajda) [task:440726] {CVE-2022-49635}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [task:530189] {CVE-2025-39751}
  - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (Soenke Huster) [task:440402] {CVE-2022-49139}
  - ALSA: seq: oss: Send fragmented SysEx messages immediately (Takashi Iwai) [task:429534] {CVE-2024-57893}
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong) [task:532109] {CVE-2023-53220}
  - ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers) [task:527963] {CVE-2025-39702}
  - net/sched: Fix backlog accounting in qdisc_dequeue_internal (William Liu) [task:527995] {CVE-2025-39677}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [task:530193]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [task:530193] {CVE-2025-39757}
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [task:520111] {CVE-2025-38539}
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [task:527509]
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [task:527383] {CVE-2025-38729}
  - wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [task:523365] {CVE-2025-38644}
  - srcu: Tighten cleanup_srcu_struct() GP checks (Paul E. McKenney) [task:440484] {CVE-2022-49651}
  - tcp: also NULL skb->dev when copy was needed (Florian Westphal) [task:526817]
  - tcp: ensure skb->dev is NULL before leaving TCP stack (Eric Dumazet) [task:526817]
  - net: 9p: fix refcount leak in p9_read_work() error handling (Hangyu Hua) [task:482233] {CVE-2022-50114}
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [task:476201] {CVE-2025-37992}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [task:471767] {CVE-2025-37998}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [task:523421] {CVE-2025-38617}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [task:519707] {CVE-2025-38546}
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu) [task:520783] {CVE-2025-38578}
  - iavf: Fix reset error handling (Przemyslaw Patynowski) [task:482117] {CVE-2022-50053}
  - ipv4: use RCU protection in __ip_rt_update_pmtu() (Eric Dumazet) [task:515369] {CVE-2025-21766}
  - io_uring: prevent opcode speculation (Pavel Begunkov) [task:444117] {CVE-2025-21863}
  - Remove sensitive words (Haofeng Li) [task:524133]
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [task:503861] {CVE-2025-38352}
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [task:507017] {CVE-2025-38497}
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [task:523419] {CVE-2025-38618}
  - REDHAT: spec: Fix internal "File listed twice" errors (Prarit Bhargava) [task:506475]
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [task:486335] {CVE-2025-38085}
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [task:520771] {CVE-2025-38553}
  - ALSA: hda: Manage concurrent reg access more properly (Takashi Iwai) [task:221568]
  - ALSA: seq: Fix race of snd_seq_timer_open() (Takashi Iwai) [task:491893] {CVE-2021-47281}
  - pktgen: use cpus_read_lock() in pg_net_init() (Eric Dumazet) [task:363783] {CVE-2024-46681}
  - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() (Di Zhu) [task:158034, task:363783]
  - udf: Avoid excessive partition lengths (Jan Kara) [task:363799] {CVE-2024-46777}
  - udf: Define EFSCORRUPTED error code (Jan Kara) [task:166857, task:363799]
  - ELF: fix kernel.randomize_va_space double read (Alexey Dobriyan) [task:368307] {CVE-2024-46826}
  - block, bfq: switch 'bfqg->ref' to use atomic refcount apis (Yu Kuai) [task:515911]
  - block, bfq: deschedule empty bfq_queues not referred by any process (Paolo Valente) [task:515911]
  - wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [task:519717] {CVE-2025-38512}
  - RDMA/srpt: Fix a use-after-free (Bart Van Assche) [task:482173] {CVE-2022-50129}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.54.v2207
changelog:
  - Revert "blk-sysfs: Rework documention of __blk_release_queue" (liyouhong) [bug:480255]
  - Revert "block: add docs for gendisk / request_queue refcount helpers" (liyouhong) [bug:480255]
  - Revert "block: revert back to synchronous request_queue removal" (liyouhong) [bug:480255]
  - Revert "blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue" (liyouhong) [bug:480255]
  - Revert "blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()" (liyouhong) [bug:480255]
  - Revert "blk-mq: Add the check on disk->queue before calling blk_mq_cancel_work_sync()" (liyouhong) [bug:480255]
  - secondly update changelog for upcoming 4.19.90-52.54.v2207 (Zhengyuan Liu)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [task:527589] {CVE-2025-38727}
  - net: Fix kabi caused linux/sched/isolation.h (Xiangqian Zhang) [task:550259]
  - update changelog for upcoming 4.19.90-52.54.v2207 (Zhengyuan Liu)
  - dm: Fix inaccurate iostat statistics that occur when I/O requests are split (zhanggenjian) [task:560365]
  - scsi: hisi_sas: Create all dump files during debugfs initialization (Yihang Li) [task:185107, task:429527] {CVE-2024-56588}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs (Yihang Li) [task:185107, task:196398]
  - scsi: hisi_sas: Free irq vectors in order for v3 HW (Qi Liu) [task:185107, task:440479] {CVE-2022-49118}
  - scsi: hisi_sas: Directly snapshot registers when executing a reset (Jianqin Xie) [task:185107, task:429527]
  - scsi: hisi_sas: Delete some unused callbacks (Luo Jiaxing) [task:574489, task:429527]
  - scsi: hisi_sas: Move debugfs code to v3 hw driver (Luo Jiaxing) [task:574489, task:429527]
  - scsi: hisi_sas: Fix up probe error handling for v3 hw (Xiang Chen) [task:574489, task:429527]
  - Revert "scsi: hisi_sas: Switch v3 hw to MQ" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Fix up probe error handling for v3 hw" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Move debugfs code to v3 hw driver" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Delete some unused callbacks" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Directly snapshot registers when executing a reset" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Free irq vectors in order for v3 HW" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Create all dump files during debugfs initialization" (Cao Guanghui) [task:574489]
  - scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (James Smart) [task:167824]
  - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (Dan Carpenter) [task:160493]
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong) [task:166857]
  - kprobes: don't call disarm_kprobe() for disabled kprobes (Kuniyuki Iwashima) [task:162162]
  - nvme: fix a possible use-after-free in controller reset during load (Sagi Grimberg) [task:162162]
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (Maciej S. Szmigiero) [task:162162]
  - netfilter: nft_tproxy: restrict to prerouting hook (Florian Westphal) [task:164562]
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (Sudeep Holla) [task:162162]
  - ipvs: fix WARNING in __ip_vs_cleanup_batch() (Zhengchao Shao) [task:164562]
  - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (Yang Yingliang) [task:164562]
  - net: fix a memleak when uncloning an skb dst and its metadata (Antoine Tenart) [task:160493]
  - md/bitmap: don't set sb values if can't pass sanity check (Heming Zhao) [task:162162]
  - bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (Luis Gerhorst) [task:164562]
  - net: tun: unlink NAPI from device on destruction (Jakub Kicinski) [task:122626]
  - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (Eric Dumazet) [task:164562]
  - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (Kuniyuki Iwashima) [task:162162]
  - ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng) [task:166857]
  - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (Rafael J. Wysocki) [task:162162]
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (Kuniyuki Iwashima) [task:162162]
  - ip: Fix a data-race around sysctl_fwmark_reflect. (Kuniyuki Iwashima) [task:162162]
  - ip: Fix data-races around sysctl_ip_fwd_use_pmtu. (Kuniyuki Iwashima) [task:162162]
  - nbd: call genl_unregister_family() first in nbd_cleanup() (Yu Kuai) [task:162162]
  - igmp: Fix data-races around sysctl_igmp_llm_reports. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_mtu_probing. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. (Kuniyuki Iwashima) [task:162162]
  - dm raid: fix address sanitizer warning in raid_resume (Mikulas Patocka) [task:162162]
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang) [task:164562]
  - af_netlink: Fix shift out of bounds in group mask calculation (Petr Machata) [task:162162]
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana) [task:164562]
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai) [task:164562]
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko) [task:164562]
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang) [task:164562]
  - mm/gup: fix gup_pud_range() for dax (John Starks) [task:153981]
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana) [task:164562]
  - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (Miaoqian Lin) [task:162162]
  - net: phy: micrel: Allow probing without .driver_data (Fabio Estevam) [task:162162]
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong) [task:164562]
  - tcp: tcp_rtx_synack() can be called from process context (Eric Dumazet) [task:162162]
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long) [task:153627]
  - RDMA/hfi1: Fix potential integer multiplication overflow errors (Dennis Dalessandro) [task:162162]
  - NFSD: prevent integer overflow on 32 bit systems (Dan Carpenter) [task:162162]
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc) [task:153627]
  - mm/mempolicy: fix mpol_new leak in shared_policy_replace (Miaohe Lin) [task:162162]
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock (Junxiao Bi via Ocfs2-devel) [task:162162]
  - drivers/base/node.c: fix compaction sysfs file leak (Miaohe Lin) [task:162162]
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo) [task:164562]
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Alan Stern) [task:160493]
  - usb: fix various gadget panics on 10gbps cabling (Maciej Żenczykowski) [task:158827]
  - usb: typec: tipd: Remove WARN_ON in tps6598x_block_read (Sven Peter) [task:160493]
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov) [task:166857]
  - sctp: check send stream number after wait_for_sndbuf (Xin Long) [task:166857]
  - crypto: seqiv - Handle EBUSY correctly (Herbert Xu) [task:166857]
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu) [task:164562]
  - igb: Do not bring the device up after non-fatal error (Mohamed Khalfella) [task:371789]
  - igb: Fix igb_down hung on surprise removal (Ying Hsu) [task:371789]
  - cifs: Fix warning and UAF when destroy the MR list (Zhang Xiaoxu) [task:166857]
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS (Kai-Heng Feng) [task:164562]
  - sctp: handle the error returned from sctp_auth_asoc_init_active_key (Xin Long) [task:164562]
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal) [task:162162]
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() (Maciej Żenczykowski) [task:164562]
  - usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. (Lorenzo Colitti) [task:158034]
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (Thomas Gleixner) [task:164562]
  - f2fs: let's avoid panic if extent_tree is not created (Jaegeuk Kim) [task:164562]
  - efi: fix NULL-deref in init error path (Johan Hovold) [task:164562]
  - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (Miaoqian Lin) [task:162162]
  - net: usb: fix possible use-after-free in smsc75xx_bind (Dongliang Mu) [task:158827]
  - net: usb: fix memory leak in smsc75xx_bind (Pavel Skripkin) [task:158827]
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov) [task:162162]
  - btrfs: fix qgroup reserve overflow the qgroup limit (Ethan Lien) [task:162162]
  - net: ipv6: unexport __init-annotated seg6_hmac_init() (Masahiro Yamada) [task:162162]
  - scsi: core: Fix unremoved procfs host directory regression (Guilherme G. Piccoli) [task:217556] {CVE-2024-26935}
  - scsi: core: Fix a procfs host directory removal regression (Bart Van Assche) [task:172278]
  - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (Bart Van Assche) [task:166857]
  - scsi: core: Fix a source code comment (Bart Van Assche) [task:217556]
  - net-sysfs: add check for netdevice being present to speed_show (suresh kumar) [task:162162]
  - net: stmmac: fix dma queue left shift overflow issue (Junxiao Chang) [task:162162]
  - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver (Alan Stern) [task:162162]
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (Tuo Li) [task:366437] {CVE-2024-23196}
  - net: auto affinity to exclude isolated CPU cores (Xiangqian Zhang) [task:550259]
  - usb: host: ohci-tmio: check return value after calling platform_get_resource() (Yang Yingliang) [task:160493]
  - bpf: Move skb->len == 0 checks into __bpf_redirect (Stanislav Fomichev) [task:328841]
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device (Stanislav Fomichev) [task:164562]
  - net/ieee802154: don't warn zero-sized raw_sendmsg() (Tetsuo Handa) [task:164562]
  - net/af_packet: check len when min_header_len equals to 0 (Zhengchao Shao) [task:328841]
  - bpf: Don't redirect packets with invalid pkt_len (Zhengchao Shao) [task:328841]
  - net: rose: convert 'use' field to refcount_t (Takamitsu Iwai) [task:532201] {CVE-2025-39826}
  - net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai) [task:532201]
  - net/rose: fix races in rose_kill_by_device() (Eric Dumazet) [task:397891]
  - net: rose: fix netdev reference changes (Eric Dumazet) [task:162162]
  - net/rose: remove redundant assignment to variable failed (Colin Ian King) [task:532201]
  - tracing: Fix the missing smp_store_release issue (chenyuan) [task:535437]
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [task:546811] {CVE-2025-40042}
  - tun: Fix memory leak for detached NAPI queue. (Kuniyuki Iwashima) [task:539057] {CVE-2023-53685}
  - net: tun: rebuild error handling in tun_get_user (Chuang Wang) [task:539057]
  - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Xuanqiang Luo) [task:524251]
  - inet: Avoid ehash lookup race in inet_ehash_insert() (Xuanqiang Luo) [task:524251]
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Xuanqiang Luo) [task:524251]
  - net: tcp: un-pin the tw_timer (Florian Westphal) [task:524251]
  - net: tcp/dccp: prepare for tw_timer un-pinning (Valentin Schneider) [task:524251]
  - kprobes: Fix the KABI issue (Feng Yang) [task:485647]
  - add a NULL check for ring/ring->desc in NIC rnp (Gang Yan) [task:562563]
  - scsi: hisi_sas: Create all dump files during debugfs initialization (Yihang Li) [task:429527] {CVE-2024-56588}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs (Yihang Li) [task:196398]
  - scsi: hisi_sas: Free irq vectors in order for v3 HW (Qi Liu) [task:440479] {CVE-2022-49118}
  - scsi: hisi_sas: Directly snapshot registers when executing a reset (Jianqin Xie) [task:185107]
  - scsi: hisi_sas: Delete some unused callbacks (Luo Jiaxing) [task:185107]
  - scsi: hisi_sas: Move debugfs code to v3 hw driver (Luo Jiaxing) [task:185107]
  - scsi: hisi_sas: Fix up probe error handling for v3 hw (Xiang Chen) [task:185107]
  - scsi: hisi_sas: Switch v3 hw to MQ (John Garry) [task:429527]
  - Revert "scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs" (Cao Guanghui) [task:429527]
  - Revert "scsi: hisi_sas: Free irq vectors in order for v3 HW" (Cao Guanghui) [task:429527]
  - scsi: qla2xxx: Fix crash during module load unload test (Arun Easi) [task:149541, task:441336]
  - ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet) [task:440728] {CVE-2025-21759}
  - Revert "ipv6: mcast: extend RCU protection in igmp6_send()" (taowei) [task:440728]
  - net: phy: Fix "link partner" information disappear issue (Yonglong Liu) [task:502961]
  - net: phy: fix race in genphy_update_link (Heiner Kallweit) [task:502961]
  - net: phy: fix setting autoneg_complete in genphy_update_link (Heiner Kallweit) [task:502961]
  - net: phy: don't double-read link status register if link is up (Heiner Kallweit) [task:502961]
  - net: phy: fix autoneg mismatch case in genphy_read_status (Heiner Kallweit) [task:502961]
  - net: phy: avoid unneeded MDIO reads in genphy_read_status (Heiner Kallweit) [task:502961]
  - xfs: dump log about filesystem when allocation failed (Chi Zhiling) [task:540343]
  - xfs: use XFS_ALLOCTYPE_START_BNO in xfs_bmap_extents_to_btree (Chi Zhiling) [task:540343]
  - CONFIG_GPIO_PHYTIUM_PCI=m (Wang Yan) [bug:417541]
  - Revert "gpio: add support for gpio on ft-2000+ based on ACPI" (zhouyuhang) [bug:417541]
  - PHYTIUM: gpio: phytium: Add Phytium GPIO driver (zhouyuhang) [bug:417541]
  - gpio/phytium: solve can't detect the gpio rising edge interrupt (songxiebing) [task:159076]
  - PHYTIUM: gpio: Support for Phytium GPIO controller behind PCI (Riwen Lu) [task:159076]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [task:542879] {CVE-2025-39993}
  - media: imon: reorganize serialization (Tetsuo Handa) [task:542879]
  - PHYTIUM: drm/phytium: Avoid NULL PTR issue when setting gamma (YuDa) [task:562451]
  - PHYTIUM: drm: Phytium: Add DC driver module_device_table (Liu Tianyu) [task:562451]
  - PHYTIUM: drm/phytium: Bugfix lane count parameter can't be set problem (WangHao) [task:562451]
  - PHYTIUM: drm/phytium: read EDID in bmc mode (WangHao) [task:562451]
  - PHITIUM: drm/phytium: Enable dither function (YuDa) [task:562451]
  - PHYTIUM: drm/phytium: Fix gpio resource release logic (YuDa) [task:562451]
  - PHYTIUM: drm/phytium: Change the maximum resolution supported by pe220x (YuDa) [task:550747]
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter) [task:488955]
  - net: loopback: Avoid sending IP packets without an Ethernet header (Ido Schimmel) [task:488955]
  - ipv4: give an IPv4 dev to blackhole_netdev (Xin Long) [task:488955]
  - loopback: fix lockdep splat (Mahesh Bandewar) [task:488955]
  - ipv6: blackhole_netdev needs snmp6 counters (Ido Schimmel) [task:488955]
  - ipv6: give an IPv6 dev to blackhole_netdev (Eric Dumazet) [task:488955]
  - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Mahesh Bandewar) [task:488955]
  - loopback: create blackhole net device similar to loopack. (Mahesh Bandewar) [task:488955]
  - Revert "LoongArch: Remove shm_align_mask and use SHMLBA instead" (Wang Yan) [task:541467]
  - Revert "mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings" (Wang Yan) [task:541467]
  - Revert "LoongArch: Set hugetlb mmap base address aligned with pmd size" (Wang Yan) [task:541467]
  - Revert "ipv6: Fix soft lockups in fib6_select_path under high next hop churn" (Wang Yan) [task:520985]
  - OPENEULER: notifiers: Add oops check in blocking_notifier_call_chain() (Yi Yang) [task:551737]
  - OPENEULER: PCI/sysfs: Prohibit unaligned access to I/O port on non-x86 (Yongqiang Liu) [task:551727]
  - Revert "kernel version changelog generation and normalization script" (Qingshuang Fu) [task:556805]
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [task:554289] {CVE-2025-40154}
  - kernel version changelog generation and normalization script (Qingshuang Fu) [task:543713]
  - xfs: punch out data fork delalloc blocks on COW writeback failure (Brian Foster) [task:536187]
  - x86/kernel: fix occasional hang-up during 'reboot -f' on HG4 platform (luoliang) [task:545109]
  - fs: quota: create dedicated workqueue for quota_release_work (Shashank A P) [task:547337]
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [task:539015] {CVE-2025-39949}
  - wifi: mt7601u: fix an integer underflow (Jisoo Jang) [task:539337] {CVE-2023-53679}
  - mt7601u: do not use WARN_ON in the datapath (Lorenzo Bianconi) [task:539337]
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu) [task:460243] {CVE-2025-37739}
  - f2fs: lost matching-pair of trace in f2fs_truncate_inode_blocks (Yubo Feng) [task:460243]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.55.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.55.v2207 (Zhengyuan Liu)
  - net: ipv4: fix one memleak in __inet_del_ifa() (Liu Jian) [task:576891] {CVE-2023-53995}
  - net: ipv4: fix rcu lockdep splat due to wrong annotation (Florian Westphal) [task:358305]
  - net: ipv4: remove erroneous advancement of list pointer (Florian Westphal) [task:358305]
  - net: ipv4: fix infinite loop on secondary addr promotion (Florian Westphal) [task:358305]
  - plip: avoid rcu debug splat (Florian Westphal) [task:358305]
  - net: ipv4: provide __rcu annotation for ifa_list (Florian Westphal) [task:358305]
  - drivers: use in_dev_for_each_ifa_rtnl/rcu (Florian Westphal) [task:358305]
  - net: use new in_dev_ifa iterators (Florian Westphal) [task:358305]
  - devinet: use in_dev_for_each_ifa_rcu in more places (Florian Westphal) [task:358305]
  - block: blkcg: avoid extending blkcg_gq to preserve kABI (chengkaitao) [task:575765]
  - block: avoid calling blkg_free() in atomic context (Ming Lei) [task:575765]
  - net: tcp: add tcp no delay ack function (Chenguang Zhao) [task:546453]
  - OPENEULER: net: Add Huawei Intelligent Network Card Driver (zhoubin) [task:544303]
  - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() (Minsuk Kang) [task:577645] {CVE-2022-50881}
  - ath9k: Fix typo in function name (Pavel Machek) [task:577645]
  - ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx (Qiujun Huang) [task:157172]
  - cifs: return errors during session setup during reconnects (Shyam Prasad N) [task:162162, task:562209]
  - cifs: fail i/o on soft mounts if sessionsetup errors out (Ronnie Sahlberg) [task:153627, task:562209]
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [task:532169] {CVE-2025-39824}
  - HID: multitouch: Add NULL check in mt_input_configured (Charles Han) [task:540621]
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu) [task:540621] {CVE-2023-53454}
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [task:534327] {CVE-2025-39853}
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [task:534337] {CVE-2025-39860}
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Lu Wei) [task:578201] {CVE-2022-50865}
  - tcp: minor optimization in tcp_add_backlog() (Eric Dumazet) [task:578201]
  - tcp: do not mess with cloned skbs in tcp_add_backlog() (Eric Dumazet) [task:578201]
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [task:520585] {CVE-2025-38565}
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [task:507041] {CVE-2025-38483}
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [task:527973] {CVE-2025-39691}
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu) [task:530221] {CVE-2025-39743}
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [task:528081] {CVE-2025-39689}
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [task:527673] {CVE-2025-38680}
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko) [task:527591] {CVE-2025-38714}
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu) [task:523433] {CVE-2025-38652}
  - pptp: fix pptp_xmit() error path (Eric Dumazet) [task:520779]
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [task:520779] {CVE-2025-38574}
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Tao Xue) [task:520579] {CVE-2025-38555}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [task:530219] {CVE-2025-39760}
  - USB: core: Change configuration warnings to notices (Alan Stern) [task:530219]
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma) [task:491653] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy) [task:491653]
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [task:540449] {CVE-2025-39913}
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [task:527585] {CVE-2025-38685}
  - lwt: Fix return values of BPF xmit ops (Yan Zhai) [task:532829] {CVE-2023-53338}
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar) [task:533643] {CVE-2023-53395}
  - bonding: avoid send_ns_work UAF when toggling ns_probe_active (pengyu) [task:558047, task:582151]
  - bonding: add broadcast NS and NA packets to all slaves for 802.3ad mode (Yun Lu) [task:422173, task:582151]
  - bonding: add sending arp and NS packets on each bonding slave interface (Yun Lu) [task:107642, task:582151]
  - Bonding: split bond_handle_vlan from bond_arp_send (Hangbin Liu) [task:107642, task:582151]
  - ipv6: separate ndisc_ns_create() from ndisc_send_ns() (Hangbin Liu) [task:122630]
  - crypto: hisilicon/hpre - fix resource leak in remove process (Zhiqi Song) [task:540073]
  - OPENEULER: xfs: fix sb write verify for lazysbcount (Shida Zhang) [task:583267]
  - xfs: update superblock counters correctly for !lazysbcount (Dave Chinner) [task:583267]
  - xfs: reduce free inode accounting overhead (Dave Chinner) [task:583267]
  - xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() (Dave Chinner) [task:583267]
  - iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [task:583485]
  - REDHAT: kernel.spec: avoid keeping two copies of vmlinux (Ondrej Mosnacek) [task:556803]
  - REDHAT: spec: speed up "cp -r" when it overwrites existing files. (Denys Vlasenko) [task:556803]
  - REDHAT: kernel.spec: Force remove tmp file (Prarit Bhargava) [task:556803]
  - REDHAT: kernel.spec: remove some temporary files early (Ondrej Mosnacek) [task:556803]
  - REDHAT: kernel.spec: Remove unnecessary output from pathfix.py (Prarit Bhargava) [task:556803]
  - SUNRPC: prevent port reuse on transports which don't request it. (NeilBrown) [task:566683]
  - md/raid0, raid10: Don't set discard sectors for request queue (Xiao Ni) [task:569813] {CVE-2022-50583}
  - sit: replace 68 with micro IPV4_MIN_MTU (zhang kai) [task:576945]
  - sit: use dst_cache in ipip6_tunnel_xmit (Haishuang Yan) [task:576945]
  - scsi: qla2xxx: Fix buffer overrun (Quinn Tran) [task:577017] {CVE-2023-54054}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [task:576577] {CVE-2025-68349}
  - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [task:577049] {CVE-2025-68367}
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (Shay Drory) [task:576227] {CVE-2023-54015}
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [task:573827] {CVE-2025-68305}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [task:567355] {CVE-2025-40277}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [task:570205] {CVE-2025-40322}
  - xprtrdma: Ensure MRs are DMA-unmapped when posting LOCAL_INV fails (Chuck Lever) [task:570023]
  - xprtrdma: Explicitly resetting MRs is no longer necessary (Chuck Lever) [task:570023]
  - fs: use do_splice_direct() for nfsd/ksmbd server-side-copy (Amir Goldstein) [task:540123]
  - mm/memory.c: skip spurious TLB flush for retried page fault (Yang Shi) [task:572449]
  - i40e: remove read access to debugfs files (Jacob Keller) [task:552823] {CVE-2025-39901}
  - sched: Fix race between yield_to() and try_to_wake_up() (Tianchen Ding) [task:564633]
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [task:570029] {CVE-2025-40304}
  - USB: usbtmc: Fix direction for 0-length ioctl control messages (Alan Stern) [task:569979] {CVE-2023-53761}
  - OPENEULER: proc: fix use-after-free in proc_get_inode() (Ye Bin) [task:451122] {CVE-2025-21999}
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [task:519691] {CVE-2025-38527}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [task:520773] {CVE-2025-38572}
  - scsi: qla2xxx: Wait for io return on terminate rport (Quinn Tran) [task:532105] {CVE-2023-53322}
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa) [task:569317] {CVE-2025-40312}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [task:569293] {CVE-2025-40309}
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [task:539845] {CVE-2025-39898}
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [task:540117] {CVE-2025-39955}
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() (Duoming Zhou) [task:540515] {CVE-2022-50422}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [task:542893] {CVE-2025-39998}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [task:566401] {CVE-2025-40259}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [task:567267] {CVE-2025-40275}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [task:534335] {CVE-2025-39841}
  - pstore/ram: Check start of empty przs during init (Enlin Mu) [task:532113] {CVE-2023-53331}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [task:532215] {CVE-2025-39817}
  - sched/fair: Don't balance task to its current running CPU (Yicong Yang) [task:531901] {CVE-2023-53215}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [task:527961] {CVE-2025-39730}
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [task:527687] {CVE-2025-38718}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [task:505915] {CVE-2025-38445}
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [task:566441] {CVE-2025-40240}
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen) [task:455283]
  - icmp: guard against too small mtu (Eric Dumazet) [task:455283]
  - net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc (Victor Nogueira) [task:573535]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [task:505935] {CVE-2025-38457}
  - net: sched: simplify the qdisc_leaf code (Tonghao Zhang) [task:505935]
  - team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [task:575753] {CVE-2025-68340}
  - net: team: Unsync device addresses on ndo_stop (Benjamin Poirier) [task:162162]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.56.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.56.v2207 (Zhengyuan Liu)
  - scsi: megaraid_sas: Fix resource leak in case of probe failure (Chandrakanth Patil) [task:156664]
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue (Anirudh Venkataramanan) [task:162874, task:161899]
  - net: hns3: do not allow call hns3_nic_net_open repeatedly (Jian Shen) [task:185104]
  - tty: fix deadlock caused by calling printk() under tty_port->lock (Qi Zheng) [task:162162]
  - seg6: fix the iif in the IPv6 socket control block (Andrea Mayer) [task:153627]
  - igc: Fix use-after-free error during reset (Vinicius Costa Gomes) [task:163480]
  - trace/fgraph: Fix error handling (Guenter Roeck) [task:532591]
  - trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [task:532591] {CVE-2025-39829}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [task:573257] {CVE-2025-68241}
  - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (Pengcheng Yang) [task:168910]
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [task:592321] {CVE-2026-23021}
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang) [task:482145] {CVE-2025-38074}
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [task:590073] {CVE-2025-71082}
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima) [task:198156]
  - RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task" (Zhu Yanjun) [task:576721] {CVE-2023-54028}
  - net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel) [task:569745] {CVE-2025-40337}
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kashyap Desai) [task:576569] {CVE-2023-54048}
  - nbd: fix incomplete validation of ioctl arg (Zhong Jinghua) [task:183259]
  - nbd: validate the block size in nbd_set_size (Christoph Hellwig) [task:183259]
  - nbd: refactor size updates (Christoph Hellwig) [task:183259]
  - nbd: move the task_recv check into nbd_size_update (Christoph Hellwig) [task:183259]
  - nbd: remove the call to set_blocksize (Christoph Hellwig) [task:183259]
  - ipmi: fix use after free in _ipmi_destroy_user() (Dan Carpenter) [task:153627]
  - net/mlx5e: Check for NOT_READY flag state after locking (Vlad Buslov) [task:540111] {CVE-2023-53581}
  - scsi: target: Fix multiple LUN_RESET handling (Mike Christie) [task:540457] {CVE-2023-53586}
  - s390/ism: fix concurrency management in ism_cmd() (Halil Pasic) [task:528075] {CVE-2025-39726}
  - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() (Zhang Changzhong) [task:577789] {CVE-2022-50832}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [task:328474] {CVE-2024-36903}
  - dm flakey: don't corrupt the zero page (Mikulas Patocka) [task:153627]
  - ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo) [task:576613] {CVE-2025-68344}
  - bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log (Andrii Nakryiko) [task:576899] {CVE-2023-54145}
  - comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott) [task:576313] {CVE-2025-68332}
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter) [task:573037] {CVE-2025-68303}
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() (Shuchang Li) [task:167824]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [task:546815] {CVE-2025-40026}
  - Drivers: hv: vmbus: Don't dereference ACPI root object handle (Maciej S. Szmigiero) [task:539901] {CVE-2023-53647}
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() (Wenchao Hao) [task:540399]
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() (Yang Yingliang) [task:540399] {CVE-2022-50532}
  - scsi: mpt3sas: Fix a memory leak (Tomas Henzl) [task:539867] {CVE-2023-53512}
  - drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [task:530225] {CVE-2025-39772}
  - mm: /proc/pid/smaps_rollup: fix no vma's null-deref (Seth Jenkins) [task:164562]
  - kprobes: Fix check for probe enabled in kill_kprobe() (Li Huafei) [task:531833] {CVE-2022-50266}
  - net/mlx5: Check device memory pointer before usage (Stav Aviram) [task:522997] {CVE-2025-38645}
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [task:522907] {CVE-2025-38665}
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park) [task:491385]
  - ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [task:491385] {CVE-2025-38105}
  - ALSA: usb-audio: Fix race against the error recovery URB submission (Takashi Iwai) [task:157172]
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [task:466415] {CVE-2025-37953}
  - bpf: Fix signed_{sub,add32}_overflows type handling (Daniel Borkmann) {CVE-2021-20268}
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() (Christophe Leroy) [task:346935] {CVE-2024-42068}
  - sctp: clear out_curr if all frag chunks of current msg are pruned (Xin Long) [task:460129] {CVE-2022-49838}
  - net: usb: rtl8150: enable basic endpoint checking (Nikita Zhandarovich) [task:440694] {CVE-2025-21708}
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() (Christophe Leroy) [task:345285] {CVE-2024-42067}
  - net: hsr: avoid possible NULL deref in skb_clone() (Eric Dumazet) [task:218810]
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [task:542895] {CVE-2025-39994}
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow (Justin Tee) [task:167824]
  - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [task:520575] {CVE-2025-38556}
  - tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [task:527975] {CVE-2025-39683}
  - tracing: Remove unneeded goto out logic (Steven Rostedt) [task:527975]
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (Philip Yang) [task:376149] {CVE-2024-49991}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [task:520549] {CVE-2025-38563}
  - media: xc2028: avoid use-after-free in load_firmware_cb() (Chi Zhiling) [task:219526]
  - bpf: Fix scalar32_min_max_or bounds tracking (Daniel Borkmann) [task:161887]
  - x86/unwind/orc: Fall back to using frame pointers for generated code (Josh Poimboeuf) [task:605427]
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [task:554287] {CVE-2025-40190}
  - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia PukNgae) [task:589059] {CVE-2025-71118}
  - ACPICA: Avoid walking the ACPI Namespace if it is not there (Rafael J. Wysocki) [task:589059]
  - ACPI: CPPC: Assume no transition latency if no PCCT (Pierre Gondois) [bug:474457, bug:498271]
  - HYGON: crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong) [task:556059]
  - ring-buffer: Fix deadloop issue on reading trace_pipe (Zheng Yejian) [task:539297, task:604597] {CVE-2023-53668}
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li) [task:540557, task:604597] {CVE-2023-53622}
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin) [task:540563, task:604597] {CVE-2023-53676}
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [task:539197, task:604597] {CVE-2025-39945}
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion) [task:539047, task:604597] {CVE-2023-53616}
  - iavf: Fix use-after-free in free_netdev (Ding Hui) [task:539329, task:604597] {CVE-2023-53556}
  - wifi: mwifiex: Initialize the chan_stats array to zero (Qianfeng Rong) [task:539911, task:604597] {CVE-2025-39891}
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang) [task:532589, task:604597] {CVE-2023-53305}
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [task:527683, task:604597] {CVE-2025-38708}
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte) [task:527301, task:604597] {CVE-2025-38697}
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko) [task:527343, task:604597] {CVE-2025-38713}
  - fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [task:527563, task:604597] {CVE-2025-38702}
  - regulator: core: Fix resolve supply lookup issue (ChiYuan Huang) [task:569843]
  - regulator: core: Use different devices for resource allocation and DT lookup (ChiYuan Huang) [task:569843] {CVE-2022-50616}
  - regulator: gpio: Convert to devm_regulator_register (Axel Lin) [task:569843]
  - regulator: dummy: Use devm_regulator_register() (Zenghui Yu) [task:569843]
  - regulator: Avoid a double 'of_node_get' in 'regulator_of_get_init_node()' (Christophe JAILLET) [task:569843]
  - regulator: of: Add of_node_put() before return in function (Nishka Dasgupta) [task:569843]
  - regulator: Factor out location of init data OF node (Charles Keepax) [task:569843]
  - ip: Fix data-races around sysctl_ip_prot_sock. (Kuniyuki Iwashima) [task:440771] {CVE-2022-49578}
  - net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) (Maciej Żenczykowski) [task:440771]
  - mm/khugepaged: fix ->anon_vma race (Jann Horn) [task:448841] {CVE-2023-52935}
  - scsi/ps3: Fix compile error for high version gcc (Bing Huang) [task:588907]
  - net: add a judgment to decide whether to enable network auto affinity (xiaolinkui) [task:195287]
  - net: add a sysctl interface for network affinity setting (xiaolinkui) [task:195287]
  - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none (Ming Lei) [task:532123] {CVE-2023-53292}
  - blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (Ming Lei) [task:532123]
  - bpf: Fix alu32 const subreg bound tracking on bitwise operations (Daniel Borkmann) [task:161887]
  - bpf: Fix a verifier failure with xor (Yonghong Song) [task:161887]
  - mmc: via-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla) [task:573679] {CVE-2025-68204}
  - firmware: arm_scmi: Add SCMI PM driver remove routine (Cristian Marussi) [task:164562]
  - firmware: arm_scmi: pm: Propagate return value to caller (Peng Fan) [task:160493]
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (Dongxiang Ke) [task:162162]
  - mac80211: validate extended element ID is present (Johannes Berg) [task:160493]
  - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (Eric Dumazet) [task:160493]
  - net: systemport: Add global locking for descriptor lifecycle (Florian Fainelli) [task:160493]
  - kvm: avoid speculation-based attacks from out-of-range memslot accesses (Paolo Bonzini) [task:158827]
  - samples/bpf: Fix buffer overflow in tcp_basertt (Pengcheng Yang) [task:371789]
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin) [task:166857]
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (Deren Wu) [task:164562]
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara) [task:164562]
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir) [task:373027]
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey) [task:548711] {CVE-2025-40106}
  - bpf: Address KCSAN report on bpf_lru_list (Martin KaFai Lau) [task:371789]
  - drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback (Nathan Chancellor) [task:578035] {CVE-2022-50844}
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle) [task:166857]
  - scsi: ipr: Fix WARNING in ipr_init() (Shang XiaoJing) [task:164562]
  - xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() (Harshit Mogalapalli) [task:164562]
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo) [task:164562]
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima) [task:166857]
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (Miaoqian Lin) [task:164562]
  - USB: sisusbvga: Add endpoint checks (Alan Stern) [task:166857]
  - dm thin: Fix UAF in run_timer_softirq() (Luo Meng) [task:164562]
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error (Zhu Yanjun) [task:164562]
  - ASoC: pxa: fix null-pointer dereference in filter() (Zeng Heng) [task:164562]
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf) [task:166857]
  - ipv6: ensure sane device mtu in tunnels (Eric Dumazet) [task:164562]
  - md/raid10: fix null-ptr-deref in raid10_sync_request (Li Nan) [task:166857]
  - net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (Tetsuo Handa) [task:164562]
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet) [task:166857]
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka) [task:166857]
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir) [task:373027]
  - cifs: Fix lost destroy smbd connection when MR allocate failed (Zhang Xiaoxu) [task:166857]
  - smbd: Make upper layer decide when to destroy the transport (Long Li) [task:164562]
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Rongwei Wang) [task:166857]
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang) [task:166857]
  - af_unix: Fix data races around sk->sk_shutdown. (Kuniyuki Iwashima) [task:166857]
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [task:527993] {CVE-2025-39713}
  - mmc: core: Fix kernel panic when remove non-standard SDIO card (Matthew Ma) [task:164562]
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter) [task:166857]
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer (Javier Martinez Canillas) [task:164562]
  - ext4: refuse to create ea block when umounted (Jun Nie) [task:166857]
  - mmc: toshsd: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - net: macb: fix a memory corruption in extended buffer descriptor mode (Roman Gushchin) [task:166857]
  - usb: typec: altmodes/displayport: fix pin_assignment_show (Badhri Jagan Sridharan) [task:166857]
  - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya) [task:371789]
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path (Ye Bin) [task:164562]
  - acct: fix potential integer overflow in encode_comp_t() (Zheng Yejian) [task:164562]
  - hwrng: amd - Fix PCI device refcount leak (Xiongfeng Wang) [task:164562]
  - binder: fix memory leak in binder_init() (Qi Zheng) [task:371789]
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() (Ziyang Xuan) [task:166857]
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (Zhang Xiaoxu) [task:164562]
  - RDMA/rxe: Fix the error caused by qp->sk (Zhu Yanjun) [task:164562]
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o) [task:166857]
  - ext4: optimize ea_inode block expansion (Jun Nie) [task:166857]
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin) [task:164562]
  - hfs: Fix OOB Write in hfs_asc2mac (ZhangPeng) [task:164562]
  - apparmor: fix a memleak in multi_transaction_new() (Gaosheng Cui) [task:164562]
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red) [task:166857]
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi) [task:166857]
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (Kuniyuki Iwashima) [task:166857]
  - ALSA: line6: fix stack overflow in line6_midi_transmit (Artem Egorkine) [task:164562]
  - f2fs: fix to drop all dirty pages during umount() if cp_error is set (Chao Yu) [task:166857]
  - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (Xiongfeng Wang) [task:164562]
  - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (Zhang Xiaoxu) [task:164562]
  - ubifs: fix possible dereference after free (Konstantin Meskhidze) [task:371789]
  - ubifs: Fix memleak when insert_old_idx() failed (Zhihao Cheng) [task:166857]
  - Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" (Zhihao Cheng) [task:166857]
  - ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng) [task:166857]
  - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (Tetsuo Handa) [task:164562]
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode (Baokun Li) [task:164562]
  - quota: Factor out setup of quota inode (Jan Kara) [task:164562]
  - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (Gaosheng Cui) [task:164562]
  - ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang) [task:166857]
  - mrp: introduce active flags to prevent UAF when applicant uninit (Schspa Shi) [task:164562]
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe) [task:371789]
  - vmci_host: fix a race condition in vmci_host_poll() causing GPF (Dae R. Jeong) [task:166857]
  - hwrng: virtio - Fix race on data_avail and actual data (Herbert Xu) [task:371789]
  - hwrng: virtio - always add a pending request (Laurent Vivier) [task:371789]
  - hwrng: virtio - don't waste entropy (Laurent Vivier) [task:371789]
  - hwrng: virtio - don't wait on cleanup (Laurent Vivier) [task:371789]
  - hwrng: virtio - add an internal buffer (Laurent Vivier) [task:371789]
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed (Jiang Li) [task:164562]
  - usb: idmouse: fix an uninit-value in idmouse_open (Dongliang Mu) [task:164562]
  - md/raid10: fix memleak for 'conf->bio_split' (Yu Kuai) [task:166857]
  - udf: Avoid double brelse() in udf_rename() (Shigeru Yoshida) [task:164562]
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf) [task:373027]
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet) [task:373027]
  - net: fix UaF in netns ops registration error path (Paolo Abeni) [task:164562]
  - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (Zhengchao Shao) [task:164562]
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng) [task:166857]
  - x86/xen: Fix memory leak in xen_init_lock_cpu() (Xiu Jianfeng) [task:164562]
  - x86/xen: don't unbind uninitialized lock_kicker_irq (Brian Masney) [task:158034]
  - drm/amd/display: Check NULL before accessing (Alex Hung) [task:573219] {CVE-2025-68286}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern) [task:371789]
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede) [task:166857]
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede) [task:166857]
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin) [task:166857]
  - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe (Miaoqian Lin) [task:164562]
  - f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers) [task:166857]
  - ppp: associate skb with a device at tx (Stanislav Fomichev) [task:164562]
  - media: dvb-frontends: fix leak of memory fw (Yan Lei) [task:164562]
  - wifi: brcmfmac: fix invalid address access when enabling SCAN log level (Wright Feng) [task:164562]
  - ubi: Fix use-after-free when volume resizing failed (Li Zetao) [task:166857]
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi) [task:166857]
  - wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao) [task:166857]
  - scsi: hpsa: Fix possible memory leak in hpsa_init_one() (Yuan Can) [task:164562]
  - scsi: hpsa: use local workqueues instead of system workqueues (Don Brace) [task:164562]
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi) [task:166857]
  - netlink: do not hard code device address lenth in fdb dumps (Eric Dumazet) [task:371789]
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() (Mazin Al Haddad) [task:164562]
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init (Pavel Skripkin) [task:158827]
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy) [task:166857]
  - vc_screen: rewrite vcs_size to accept vc, not inode (Jiri Slaby) [task:166857]
  - class: fix possible memory leak in __class_register() (Yang Yingliang) [task:164562]
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe` (Ke Zhang) [task:166857]
  - xfrm: Update ipcomp_scratches with NULL when freed (Khalid Masum) [task:164562]
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (Xiongfeng Wang) [task:164562]
  - mtd: Fix device name leak when register device failed in add_mtd_device() (Zhang Xiaoxu) [task:164562]
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() (Jianglei Nie) [task:164562]
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng) [task:164562]
  - netlink: Add __sock_i_ino() for __netlink_diag_dump(). (Kuniyuki Iwashima) [task:371789]
  - netlink: fix potential deadlock in netlink_set_err() (Eric Dumazet) [task:371789]
  - media: radio-shark: Add endpoint checks (Alan Stern) [task:166857]
  - drm/amd/display: Fix potential null-deref in dm_resume (Roman Li) [task:166857]
  - drm/amd/display: Fix allocate_mst_payload assert on resume (Roman Li) [task:162162]
  - tipc: fix a null-ptr-deref in tipc_topsrv_accept (Xin Long) [task:164562]
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa) [task:166857]
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling (Linus Torvalds) [task:164562]
  - hfs: fix OOB Read in __hfs_brec_find (ZhangPeng) [task:164562]
  - hfs/hfsplus: use WARN_ON for sanity check (Arnd Bergmann) [task:164562]
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure (Ryusuke Konishi) [task:164562]
  - tipc: fix an information leak in tipc_topsrv_kern_subscr (Alexander Potapenko) [task:164562]
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() (Yu Liao) [task:164562]
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern) [task:371789]
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar) [task:164562]
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() (Yang Yingliang) [task:164562]
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical) [task:373027]
  - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (Zheng Wang) [task:371789]
  - bcache: remove 'int n' from parameter list of bch_bucket_alloc_set() (Coly Li) [task:371789]
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav) [task:166857]
  - drm/mipi-dsi: Detach devices when removing the host (Maxime Ripard) [task:164562]
  - thermal: intel_powerclamp: Use first online CPU as control_cpu (Rafael J. Wysocki) [task:164562]
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash (Srinivas Pandruvada) [task:164562]
  - ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel) [task:166857]
  - ALSA: usb-audio: Fix potential memory leaks (Takashi Iwai) [task:164562]
  - spi: qup: Don't skip cleanup in remove's error path (Uwe Kleine-König) [task:166857]
  - spi: qup: fix PM reference leak in spi_qup_remove() (Wang Li) [task:166857]
  - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds (Jisoo Jang) [task:166857]
  - drm/radeon: free iio for atombios when driver shutdown (Liwei Song) [task:166857]
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong) [task:373027]
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Bikash Hazarika) [task:371789]
  - blk-mq: fix possible memleak when register 'hctx' failed (Ye Bin) [task:164562]
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (Yang Yingliang) [task:164562]
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o) [task:166857]
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima) [task:166857]
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng) [task:166857]
  - wifi: iwl3945: Add missing check for create_singlethread_workqueue (Jiasheng Jiang) [task:166857]
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley) [task:371789]
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [task:490967] {CVE-2025-38145}
  - Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz) [task:166857]
  - dax: make sure inodes are flushed before destroy cache (Tong Zhang) [task:440563] {CVE-2022-49220}
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang) [task:166857]
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register (Jiamei Xie) [task:164562]
  - Bluetooth: Fix race condition in hidp_session_thread (Min Li) [task:166857]
  - PCI: Fix pci_device_is_present() for VFs by checking PF (Michael S. Tsirkin) [task:164562]
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (Fedor Pchelkin) [task:371789]
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (Kuninori Morimoto) [task:166857]
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (Stephen Boyd) [task:164562]
  - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (Wen Gong) [task:164562]
  - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (Dan Carpenter) [task:166857]
  - usb: rndis_host: Secure rndis_query check against int overflow (Szymon Heidrich) [task:164562]
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags (Liu Shixin) [task:164562]
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede) [task:166857]
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Baokun Li) [task:164562]
  - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (Ryusuke Konishi) [task:164562]
  - Bluetooth: Fix l2cap_disconnect_req deadlock (Ying Hsu) [task:166857]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Luiz Augusto von Dentz) [task:166857]
  - Bluetooth: prefetch channel before killing sock (Hillf Danton) [task:122624]
  - Bluetooth: Fix refcount use-after-free issue (Manish Mandlik) [task:122624]
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer) [task:166857]
  - ubifs: Free memory for tmpfile name (Mårten Lindahl) [task:166857]
  - fs: prevent out-of-bounds array speculation when closing a file descriptor (Theodore Ts'o) [task:166857]
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang) [task:164562]
  - vt_ioctl: fix array_index_nospec in vt_setactivate (Jakob Koschel) [task:160493]
  - igmp: Fix data-races around sysctl_igmp_qrv. (Kuniyuki Iwashima) [task:162162]
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka) [task:164562]
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 (Chen Zhongjin) [task:166857]
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (Jann Horn) [task:164562]
  - drm/amd/pm: fix double free in si_parse_power_table() (Keita Suzuki) [task:162162]
  - scsi: sg: Allow waiting for commands to complete on removed device (Tony Battersby) [task:162162]
  - ASoC: ops: Correct bounds check for second channel on SX controls (Charles Keepax) [task:164562]
  - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() (Mark Brown) [task:164562]
  - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (Yi Yang) [task:412137] {CVE-2024-56690}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin) [task:182757]
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia) [task:166857]
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (Florent Revest) [task:371789]
  - xhci: Remove device endpoints from bandwidth list when freeing the device (Mathias Nyman) [task:164562]
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (Ryusuke Konishi) [task:166857]
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh) [task:373027]
  - kernfs: fix use-after-free in __kernfs_remove (Christian A. Ehrhardt) [task:164562]
  - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails (Chuck Lever) [task:164562]
  - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (Martijn de Gouw) [task:153627]
  - SUNRPC: Fix svcauth_gss_proxy_init() (Chuck Lever) [task:153627]
  - udf: Do not bother merging very long extents (Jan Kara) [task:166857]
  - ext4: fix use-after-free in ext4_orphan_cleanup (Baokun Li) [task:164562]
  - ext4: lost matching-pair of trace in ext4_truncate (zhengliang) [task:164562]
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() (Li Zetao) [task:166857]
  - rtlwifi: fix -Wpointer-sign warning (Arnd Bergmann) [task:166857]
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao) [task:164562]
  - tracing/histograms: Return an error if we fail to add histogram to hist_vars list (Mohamed Khalfella) [task:371789]
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables (Mohamed Khalfella) [task:371789]
  - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() (Ben Hutchings) [task:166857]
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen) [task:166857]
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong) [task:166857]
  - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (Li Zhong) [task:164562]
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren) [task:166857]
  - ocfs2: fix memory leak in ocfs2_stack_glue_init() (Shang XiaoJing) [task:164562]
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou) [task:166857]
  - wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao) [task:166857]
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai) [task:166857]
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Ivan Orlov) [task:166857]
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi) [task:166857]
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - wifi: iwl4965: Add missing check for create_singlethread_workqueue() (Jiasheng Jiang) [task:166857]
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (ruanjinjie) [task:164562]
  - rapidio: fix possible name leaks when rio_add_device() fails (Yang Yingliang) [task:164562]
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng) [task:166857]
  - caif: fix memory leak in cfctrl_linkup_request() (Zhengchao Shao) [task:164562]
  - drivers: serial: jsm: fix some leaks in probe (Dan Carpenter) [task:164562]
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein) [task:166857]
  - rapidio: fix possible UAF when kfifo_alloc() fails (Wang Weiyang) [task:164562]
  - mmc: vub300: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - chardev: fix error handling in cdev_device_add() (Yang Yingliang) [task:164562]
  - PNP: fix name memory leak in pnp_alloc_dev() (Yang Yingliang) [task:164562]
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo) [task:164562]
  - pnode: terminate at peers of source (Christian Brauner) [task:164562]
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (Luiz Augusto von Dentz) [task:164562]
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (Alexander Coffin) [task:164562]
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma) [task:164562]
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Rafael J. Wysocki) [task:164562]
  - Bluetooth: L2CAP: Fix user-after-free (Luiz Augusto von Dentz) [task:164562]
  - media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda) [task:166857]
  - media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (Zheyu Ma) [task:164562]
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing) [task:182920]
  - udf: Do not update file length for failed writes to inline files (Jan Kara) [task:166857]
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (Fedor Pchelkin) [task:166857]
  - wifi: ath9k: use proper statements in conditionals (Arnd Bergmann) [task:166857]
  - ath9k: htc: clean up statistics macros (Pavel Skripkin) [task:166857]
  - ath9k: hif_usb: simplify if-if to if-else (Wan Jiabing) [task:166857]
  - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (Zekun Shen) [task:160493]
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li) [task:166857]
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (Zhihao Cheng) [task:166857]
  - ubi: ensure that VID header offset + VID header size <= alloc, size (George Kennedy) [task:166857]
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang) [task:166857]
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Pin-yen Lin) [task:374297]
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi) [task:374297]
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (Fedor Pchelkin) [task:371789]
  - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg (Qiujun Huang) [task:157172]
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" (Hector Martin) [task:166857]
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel) [task:166857]
  - wifi: libertas: Fix possible refcount leak in if_usb_probe() (Hangyu Hua) [task:162162]
  - thermal: int340x: fix memory leak in int3400_notify() (Chuansheng Liu) [task:162162]
  - PM: core: keep irq flags in device_pm_check_callbacks() (Dmitry Baryshkov) [task:162162]
  - apparmor: Fix memleak in aa_simple_write_to_buffer() (Xiu Jianfeng) [task:162162]
  - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region (Takashi Sakamoto) [task:164562]
  - nilfs2: fix general protection fault in nilfs_btree_insert() (Ryusuke Konishi) [task:164562]
  - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start (Liang He) [task:162162]
  - media: pvrusb2: fix memory leak in pvr_probe (Dongliang Mu) [task:162162]
  - MIPS: smp: fill in sibling and core maps earlier (Alexander Lobakin) [task:162162]
  - sfc: fix kernel panic when creating VF (Íñigo Huguet) [task:162162]
  - ALSA: oss: Fix PCM OSS buffer allocation overflow (Takashi Iwai) [task:162162]
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe (Miaoqian Lin) [task:162162]
  - drm/amdkfd: Fix an illegal memory access (Qu Huang) [task:166857]
  - drm/amdkfd: Check for potential null return of kmalloc_array() (QintaoShen) [task:162162]
  - tcp: tcp_make_synack() can be called from process context (Breno Leitao) [task:166857]
  - ath9k_htc: fix uninit value bugs (Pavel Skripkin) [task:162162]
  - f2fs: fix dereference of stale list iterator after loop body (Jakob Koschel) [task:162162]
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Yu Kuai) [task:166857]
  - drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (Zhou Qingyang) [task:162162]
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. (Dave Airlie) [task:162162]
  - nvmet: avoid potential UAF in nvmet_req_complete() (Damien Le Moal) [task:166857]
  - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (Paolo Bonzini) [task:162162]
  - jffs2: fix memory leak in jffs2_scan_medium (Baokun Li) [task:162162]
  - drm/virtio: Fix GEM handle creation UAF (Rob Clark) [task:164562]
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka) [task:166857]
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (Daniil Tatianin) [task:166857]
  - zsmalloc: fix races between asynchronous zspage free and page migration (Sultan Alsawaf) [task:162162]
  - drm/plane: Move range check for format_count earlier (Steven Price) [task:162162]
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen) [task:162162]
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (Ryusuke Konishi) [task:166857]
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov) [task:162162]
  - bpf, arm64: Clear prog->jited_len along prog->jited (Eric Dumazet) [task:162162]
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang) [task:164562]
  - ipv6: fix panic when forwarding a pkt with no in6 dev (Nicolas Dichtel) [task:162162]
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (Zheyu Ma) [task:162162]
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (Eric Dumazet) [task:162162]
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (Smith, Kyle Miller (Nimble Kernel)) [task:162162]
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi) [task:164562]
  - RDMA/hfi1: Prevent use of lock before it is initialized (Douglas Miller) [task:162162]
  - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (Xin Xiong) [task:162162]
  - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe (Miaoqian Lin) [task:162162]
  - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (Takashi Sakamoto) [task:162162]
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld) [task:164562]
  - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (Miaoqian Lin) [task:162162]
  - jffs2: fix memory leak in jffs2_do_mount_fs (Baokun Li) [task:162162]
  - Bluetooth: Fix not cleanup led when bt_init fails (Chen Zhongjin) [task:164562]
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook) [task:164562]
  - apparmor: fix reference count leak in aa_pivotroot() (Xin Xiong) [task:162162]
  - be2net: Fix buffer overflow in be_get_module_eeprom (Hristo Venev) [task:162162]
  - tracing: Fix sleeping function called from invalid context on RT kernel (Jun Miao) [task:162162]
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() (Wang Cheng) [task:162162]
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (Jianglei Nie) [task:162162]
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi) [task:164562]
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun) [task:164562]
  - veth: Ensure eth header is in skb's linear part (Guillaume Nault) [task:162162]
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (Miaoqian Lin) [task:162162]
  - drbd: use after free in drbd_create_device() (Dan Carpenter) [task:164562]
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (Miaoqian Lin) [task:162162]
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu) [task:164562]
  - mtd: maps: Fix refcount leak in ap_flash_init (Miaoqian Lin) [task:162162]
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei) [task:164562]
  - mtd: maps: Fix refcount leak in of_flash_probe_versatile (Miaoqian Lin) [task:162162]
  - ipw2x00: Fix potential NULL dereference in libipw_xmit() (Haowen Bai) [task:162162]
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang) [task:164562]
  - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe (Miaoqian Lin) [task:162162]
  - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (Vincent Mailhol) [task:158034]
  - HID: hidraw: fix memory leak in hidraw_release() (Karthik Alapati) [task:162162]
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng) [task:164562]
  - gfs2: Always check inode size of inline inodes (Andreas Gruenbacher) [task:166857]
  - erspan: do not use skb_mac_header() in ndo_start_xmit() (Eric Dumazet) [task:166857]
  - erspan: do not assume transport header is always set (Eric Dumazet) [task:162162]
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL (Kinglong Mee) [task:162162]
  - udf: Fix preallocation discarding at indirect extent boundary (Jan Kara) [task:164562]
  - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. (Kuniyuki Iwashima) [task:162162]
  - video: fbdev: amba-clcd: Fix refcount leak bugs (Liang He) [task:162162]
  - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions (David Collins) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_early_retrans. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_fastopen. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_probe_interval. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_recovery. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_max_reordering. (Kuniyuki Iwashima) [task:162162]
  - cipso: Fix data-races around sysctl. (Kuniyuki Iwashima) [task:162162]
  - HID: betop: check shape of output reports (Pietro Borrello) [task:164562]
  - HID: betop: fix slab-out-of-bounds Write in betop_probe (F.A.Sulaiman) [task:160493]
  - igb: Initialize mailbox message for VF reset (Tony Nguyen) [task:164562]
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init() (Masahiro Yamada) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold. (Kuniyuki Iwashima) [task:162162]
  - Input: aiptek - properly check endpoint type (Pavel Skripkin) [task:162162]
  - Input: aiptek - fix endpoint sanity check (Johan Hovold) [task:153627]
  - tipc: check attribute length for bearer name (Hoang Le) [task:162162]
  - tipc: add extack messages for bearer/media failure (Hoang Le) [task:158827]
  - jffs2: fix memory leak in jffs2_do_fill_super (Baokun Li) [task:162162]
  - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem (Baokun Li) [task:162162]
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin) [task:164562]
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin) [task:164562]
  - net: tun: Fix use-after-free in tun_detach() (Shigeru Yoshida) [task:164562]
  - igc: Reinstate IGC_REMOVED logic and implement it properly (Lennert Buytenhek) [task:163480]
  - igc: remove IGC_REMOVED function (Vitaly Lifshits) [task:163480]
  - trace_events_hist: add check for return value of 'create_hist_field' (Natalia Petrova) [task:164562]
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui) [task:164562]
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (Dan Carpenter) [task:162162]
  - um: Fix out-of-bounds read in LDT setup (Vincent Whitchurch) [task:162162]
  - vsock: remove vsock from connected table when connect is interrupted by a signal (Seth Forshee) [task:162162]
  - wifi: cfg80211: fix memory leak in query_regdb_file() (Arend van Spriel) [task:164562]
  - virtio_console: eliminate anonymous module_init & module_exit (Randy Dunlap) [task:162162]
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang) [task:164562]
  - tracing/histograms: Fix memory leak problem (Zheng Yejian) [task:162162]
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet) [task:164562]
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (Yang Jihong) [task:162162]
  - scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (James Smart) [task:167824]
  - scsi: lpfc: Remove use of kmalloc() in trace event logging (James Smart) [task:167824]
  - scsi: lpfc: Enhancements to LOG_TRACE_EVENT for better readability (James Smart) [task:167824]
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (Liu Zixian) [task:162162]
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (Alexey Kodanev) [task:162162]
  - PM: hibernate: defer device probing when resuming from hibernation (Tetsuo Handa) [task:162162]
  - HID: cp2112: prevent a buffer overflow in cp2112_xfer() (Harshit Mogalapalli) [task:162162]
  - md: call __md_stop_writes in md_stop (Guoqing Jiang) [task:162162]
  - vt: Clear selection before changing the font (Helge Deller) [task:162162]
  - net: usb: smsc95xx: Limit packet length to skb->len (Szymon Heidrich) [task:166857]
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka) [task:162162]
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add() (Yang Yingliang) [task:164562]
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin) [task:164562]
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng) [task:164562]
  - HID: core: detect and skip invalid inputs to snto32() (Randy Dunlap) [task:158034]
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu) [task:164562]
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai) [task:164562]
  - RDMA/rxe: Fix error unwind in rxe_create_qp() (Zhu Yanjun) [task:162162]
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa) [task:164562]
  - net/9p: validate fds in p9_fd_open (Christoph Hellwig) [task:157172]
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui) [task:164562]
  - ipvs: fix WARNING in ip_vs_app_net_cleanup() (Zhengchao Shao) [task:164562]
  - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (Saurabh Sengar) [task:162162]
  - net: fix refcount bug in sk_psock_get (2) (Hawkins Jiawei) [task:218801]
  - net, sk_msg: Don't use RCU_INIT_POINTER on sk_user_data (Jakub Sitnicki) [task:218801]
  - net, sk_msg: Clear sk_user_data pointer on clone if tagged (Jakub Sitnicki) [task:218801]
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (Artemii Karasev) [task:164562]
  - xen/netfront: fix crash when removing device (Juergen Gross) [task:408535] {CVE-2024-53240}
  - xen-netfront: Fix NULL sring after live migration (Lin Liu) [task:164562]
  - xen/netfront: destroy queues before real_num_tx_queues is zeroed (Marek Marczykowski-Górecki) [task:162162]
  - tracing: Fix potential double free in create_var_ref() (Keita Suzuki) [task:162162]
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (Pavel Skripkin) [task:162162]
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui) [task:164562]
  - can: peak_usb: fix use after free bugs (Vincent Mailhol) [task:158034]
  - drivers:md:fix a potential use-after-free bug (Wentao_Liang) [task:162162]
  - gadgetfs: ep_io - wait until IRQ finishes (Jozef Martiniak) [task:162162]
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx() (Siddh Raman Pant) [task:162162]
  - HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (Lee Jones) [task:162162]
  - f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() (Chao Yu) [task:162162]
  - drm/amd/display: clear optc underflow before turn off odm clock (Fudong Wang) [task:162162]
  - extcon: Modify extcon device to be created after driver data is set (bumwoo lee) [task:162162]
  - extcon: Fix error handling in extcon_dev_register (Dinghao Liu) [task:158827]
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing (Zheyu Ma) [task:162162]
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected (Siddh Raman Pant) [task:162162]
  - RDMA/hfi1: Prevent panic when SDMA is disabled (Douglas Miller) [task:162162]
  - IB/hfi1: Close window for pq and request coliding (Mike Marciniszyn) [task:153627]
  - Squashfs: fix handling and sanity checking of xattr_ids count (Phillip Lougher) [task:164562]
  - Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (Miaoqian Lin) [task:162162]
  - Drivers: hv: vmbus: Expose monitor data only when monitor pages are used (Kimberly Brown) [task:162162]
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price) [task:164562]
  - gfs2: add validation checks for size of superblock (Anant Thazhemadam) [task:158034]
  - ceph: avoid putting the realm twice when decoding snaps fails (Xiubo Li) [task:164562]
  - ceph: do not update snapshot context when there is no new snapshot (Xiubo Li) [task:164562]
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo) [task:164562]
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang) [task:164562]
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko) [task:164562]
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng) [task:164562]
  - dlm: fix plock invalid read (Alexander Aring) [task:162162]
  - dm ioctl: prevent potential spectre v1 gadget (Jordy Zomer) [task:162162]
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich) [task:166857]
  - net: usb: smsc75xx: Limit packet length to skb->len (Szymon Heidrich) [task:166857]
  - dmaengine: Fix double increment of client_count in dma_chan_get() (Koba Ko) [task:164562]
  - netfilter: fix use-after-free in __nf_register_net_hook() (Eric Dumazet) [task:162162]
  - wifi: mac80211: fix use-after-free in chanctx code (Johannes Berg) [task:162162]
  - usb: f_fs: Fix use-after-free for epfile (Udipto Goswami) [task:160493]
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind (Uttkarsh Aggarwal) [task:166857]
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait (Udipto Goswami) [task:164562]
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait (Udipto Goswami) [task:164562]
  - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind (Wesley Cheng) [task:158827]
  - nvme-rdma: fix possible use-after-free in transport error_recovery work (Sagi Grimberg) [task:162162]
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov) [task:162162]
  - ASoC: rt5645: Fix errorenous cleanup order (Lin Ma) [task:162162]
  - cifs: potential buffer overflow in handling symlinks (Harshit Mogalapalli) [task:162162]
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei) [task:164562]
  - usb: gadget: uvc: Prevent buffer overflow in setup handler (Szymon Heidrich) [task:164562]
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed (Zhihao Cheng) [task:162162]
  - media: pci: cx23885: Fix the error handling in cx23885_initdev() (Zheyu Ma) [task:162162]
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet) [task:164562]
  - sfc: fix use after free when disabling sriov (Íñigo Huguet) [task:162162]
  - sfc: error code if SRIOV cannot be disabled (Íñigo Huguet) [task:158827]
  - can: dev: can_restart: fix use after free bug (Vincent Mailhol) [task:158034]
  - can: dev: can_restart(): post buffer from the right context (Alejandro Concepcion Rodriguez) [task:158034]
  - HID: elan: Fix potential double free in elan_input_configured (Miaoqian Lin) [task:162162]
  - HID: elan: Fix memleak in elan_input_configured (Dinghao Liu) [task:157172]
  - nfp: Fix memory leak in nfp_cpp_area_cache_add() (Jianglei Nie) [task:160493]
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Miko Larsson) [task:164562]
  - usbnet: sanity check for maxpacket (Oliver Neukum) [task:160493]
  - RDMA/cma: Fix rdma_resolve_route() memory leak (Gerd Rausch) [task:158827]
  - perf hist: Fix memory leak of a perf_hpp_fmt (Ian Rogers) [task:160493]
  - media: mxl111sf: change mutex_init() location (Pavel Skripkin) [task:160493]
  - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (John Meneghini) [task:160493]
  - net: encx24j600: check error in devm_regmap_init_encx24j600 (Nanyong Sun) [task:160493]
  - isdn: mISDN: Fix sleeping function called from invalid context (Zheyu Ma) [task:160493]
  - drm/nouveau/debugfs: fix file release memory leak (Yang Yingliang) [task:160493]
  - net: USB: Fix wrong-direction WARNING in plusb.c (Alan Stern) [task:164562]
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Stephen Boyd) [task:160493]
  - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() (Gustavo A. R. Silva) [task:158827]
  - igbvf: fix double free in `igbvf_probe` (Letu Ren) [task:160493]
  - scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy) [task:160493]
  - mmc: sdio: fix possible resource leaks in some error paths (Yang Yingliang) [task:164562]
  - IB/hfi1: Restore allocated resources on failed copyout (Dean Luick) [task:164562]
  - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (Lukas Wunner) [task:162162]
  - net: cdc_eem: fix tx fixup skb leak (Linyu Yuan) [task:158827]
  - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (Mark Brown) [task:160493]
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (Tasos Sahanidis) [task:162162]
  - drm: Fix use-after-free read in drm_getunique() (Desmond Cheong Zhi Xi) [task:158827]
  - HID: usbhid: free raw_report buffers in usbhid_stop (Anirudh Rayabharam) [task:160493]
  - drm/radeon: fix a possible null pointer dereference (Gong Yuanjun) [task:162162]
  - udf: Fix NULL pointer dereference in udf_symlink function (Arturo Giusti) [task:158827]
  - nilfs2: fix underflow in second superblock position calculations (Ryusuke Konishi) [task:164562]
  - drm/radeon: add a force flush to delay work when radeon (Zhenneng Li) [task:162162]
  - aio: fix mremap after fork null-deref (Seth Jenkins) [task:164562]
  - ip_gre: test csum_start instead of transport header (Willem de Bruijn) [task:162162]
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen) [task:162162]
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup (Stefan Haberland) [task:162162]
  - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (Sean Christopherson) [task:160493]
  - ALSA: gus: fix null pointer dereference on pointer block (Chengfeng Ye) [task:160493]
  - mac80211-hwsim: fix late beacon hrtimer handling (Johannes Berg) [task:122623]
  - isofs: Fix out of bound access for corrupted isofs image (Jan Kara) [task:160493]
  - gfs2: Fix use-after-free in gfs2_glock_shrink_scan (Hillf Danton) [task:158827]
  - btrfs: fix memory ordering between normal and ordered work functions (Nikolay Borisov) [task:160493]
  - net: ieee802154: fix null deref in parse dev addr (Dan Robertson) [task:158827]
  - ocfs2: mount fails with buffer overflow in strlen (Valentin Vidic) [task:160493]
  - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (Nguyen Dinh Phi) [task:160493]
  - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (James Smart) [task:160493]
  - net: fix uninit-value in caif_seqpkt_sendmsg (Ziyang Xuan) [task:158827]
  - i40e: Fix NULL ptr dereference on VSI filter sync (Michal Maloszewski) [task:160493]
  - mac80211: track only QoS data frames for admission control (Johannes Berg) [task:160493]
  - can: peak_pci: peak_pci_remove(): fix UAF (Zheyu Ma) [task:160493]
  - isdn: mISDN: netjet: Fix crash in nj_probe: (Zheyu Ma) [task:158827]
  - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb (Xin Long) [task:160493]
  - ASoC: max9759: fix underflow in speaker_gain_control_put() (Dan Carpenter) [task:160493]
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Sudeep Holla) [task:160493]
  - i2c: acpi: fix resource leak in reconfiguration device addition (Jamie Iles) [task:160493]
  - i2c: i801: Don't generate an interrupt on bus reset (Jean Delvare) [task:158827]
  - drm/amdgpu: Fix a use-after-free (xinhui pan) [task:158827]
  - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (John Meneghini) [task:160493]
  - net: amd-xgbe: Fix skb data length underflow (Shyam Sundar S K) [task:160493]
  - mISDN: fix possible use-after-free in HFC_cleanup() (Zou Wei) [task:158827]
  - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap (Lorenzo Bianconi) [task:160493]
  - watchdog: Fix possible use-after-free by calling del_timer_sync() (Zou Wei) [task:158827]
  - igb: Fix use-after-free error during reset (Vinicius Costa Gomes) [task:158827]
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Teng Qi) [task:160493]
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header (Lu Wei) [task:162162]
  - phylib: fix potential use-after-free (Marek Behún) [task:160493]
  - drm/nouveau: fix off by one in BIOS boundary checking (Nick Lopez) [task:160493]
  - ocfs2: fix data corruption after conversion from inline format (Jan Kara) [task:160493]
  - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (Zhou Qingyang) [task:160493]
  - mac80211: fix use-after-free in CCMP/GCMP RX (Johannes Berg) [task:160493]
  - regmap: Fix possible double-free in regcache_rbtree_exit() (Yang Yingliang) [task:160493]
  - net: qcom/emac: fix UAF in emac_remove (Pavel Skripkin) [task:158827]
  - IB/mlx5: Fix initializing CQ fragments buffer (Alaa Hleihel) [task:158827]
  - mm/slub: fix to return errno if kmalloc() fails (Chao Yu) [task:162162]
  - xen/balloon: fix cancelled balloon action (Juergen Gross) [task:160493]
  - xen/balloon: fix balloon kthread freezing (Juergen Gross) [task:160493]
  - xen/balloon: use a kernel thread instead a workqueue (Juergen Gross) [task:160493]
  - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [task:224218] {CVE-2024-36954}
  - xhci: Fix commad ring abort, write all 64 bits to CRCR register. (Mathias Nyman) [task:160493]
  - xhci: Fix command ring pointer corruption while aborting a command (Pavankumar Kondeti) [task:160493]
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown) [task:164562]
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (Mark Brown) [task:160493]
  - ALSA: pcm: oss: Limit the period size to 16MB (Takashi Iwai) [task:160493]
  - ALSA: pcm: oss: Fix potential out-of-bounds shift (Takashi Iwai) [task:158034]
  - tipc: skb_linearize the head skb when reassembling msgs (Xin Long) [task:158827]
  - i40e: Fix queues reservation for XDP (Sylwester Dziedziuch) [task:160493]
  - i40e: Fix issue when maximum queues is exceeded (Jedrzej Jagielski) [task:160493]
  - usb: misc: fix improper handling of refcount in uss720_probe() (Hangyu Hua) [task:162162]
  - misc/uss720: fix memory leak in uss720_probe (Dongliang Mu) [task:158827]
  - ipv6: Add lwtunnel encap size of all siblings in nexthop  calculation (Lu Wei) [task:540241] {CVE-2023-53477}
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [task:481987] {CVE-2022-50073}
  - wifi: mt76: do not run mt76u_status_worker if the device is not running (Lorenzo Bianconi) [task:576303] {CVE-2022-50735}
  - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [task:593641] {CVE-2026-23086}
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [task:593641]
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov) [task:593641]
  - bpf: Fix invalid prog->stats access when update_effective_progs fails (Pu Lehui) [task:577043] {CVE-2025-68742}
  - PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson) [task:522801] {CVE-2025-38624}
  - media: imon: make send_packet() more robust (Tetsuo Handa) [task:573221] {CVE-2025-68194}
  - media: imon: fix a race condition in send_packet() (Gautam Menghani) [task:573221]
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [task:542887] {CVE-2025-39970}
  - i40e: Fix filter input checks to prevent config with invalid values (Sudheer Mogilappagari) [task:542887]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [task:593597] {CVE-2026-23054}
  - hv_netvsc: Allocate rx indirection table size dynamically (Shradha Gupta) [task:593597]
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [task:567289] {CVE-2025-40280}
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [task:554173] {CVE-2025-40173}
  - KVM: arm64: Prevent access to vCPU events before init (Oliver Upton) [task:547765] {CVE-2025-40102}
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure (Tetsuo Handa) [task:533075] {CVE-2022-50374}
  - Bluetooth: hci_serdev: call init_rwsem() before p->open() (Pavel Skripkin) [task:533075]
  - net/mlx5: Prevent high-rate FW commands from populating all slots (Tariq Toukan) [task:583189]
  - xfs: make inode reclaim almost non-blocking (Dave Chinner) [task:603105]
  - debugfs: add debugfs_lookup_and_remove() (Greg Kroah-Hartman) [task:162162]
  - net: Fix data-races around sysctl_[rw]mem(_offset)?. (Kuniyuki Iwashima) [task:581109]
  - mm/hugetlb: add mempolicy check in the reservation routine (Muchun Song) [task:595137]
  - xfs: Retry allocating space in xfs_bmap_extents_to_btree (Chi Zhiling) [task:566335, task:587243, task:589957, task:593187, task:594873, task:595621]
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [task:590075] {CVE-2025-71111}
  - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [task:590365] {CVE-2025-68771}
  - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [task:590171] {CVE-2026-22991}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [task:590125] {CVE-2026-22990}
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [task:592301] {CVE-2026-23038}
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [task:593557] {CVE-2026-23089}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [task:593631] {CVE-2026-23060}
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [task:593799] {CVE-2026-23105}
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [task:593593] {CVE-2026-23074}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [task:593615] {CVE-2026-23108}
  - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [task:593625] {CVE-2026-23073}
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [task:593621] {CVE-2026-23061}
  - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [task:593595] {CVE-2026-23071}
  - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [task:593803] {CVE-2026-23101}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [task:593611] {CVE-2026-23084}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [task:593635] {CVE-2026-23058}
  - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [task:593633] {CVE-2025-71194}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [task:593607] {CVE-2026-23076}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [task:590149] {CVE-2025-71096}
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [task:590147] {CVE-2026-22977}
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (fuqiang wang) [task:590143] {CVE-2025-71104}
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [task:590135] {CVE-2025-68820}
  - mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel) [task:590137] {CVE-2025-68801}
  - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory CLEMENT) [task:589963] {CVE-2025-71109}
  - caif: fix integer underflow in cffrml_receive() (Junrui Luo) [task:590063] {CVE-2025-68799}
  - arp: do not assume dev_hard_header() does not change skb->head (Eric Dumazet) [task:589975]
  - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [task:589975] {CVE-2025-71098}
  - e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [task:590055] {CVE-2025-71093}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [task:589971] {CVE-2025-71087}
  - tracing: Do not register unsupported perf events (Steven Rostedt) [task:589945] {CVE-2025-71125}
  - wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [task:589519] {CVE-2026-22978}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (Herbert Xu) [task:589525] {CVE-2025-71131}
  - crypto: seqiv - Use kmemdup in seqiv_aead_encrypt() (YueHaibing) [task:589525]
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [task:589521] {CVE-2025-71154}
  - ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [task:589547] {CVE-2026-23011}
  - hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [task:589061] {CVE-2025-68789}
  - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [task:589027] {CVE-2025-71108}
  - net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen) [task:589009] {CVE-2025-71064}
  - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [task:588997] {CVE-2025-71114}
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [task:589007] {CVE-2025-68819}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [task:589013] {CVE-2025-71085}
  - net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [task:588975] {CVE-2026-22999}
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [task:567353] {CVE-2025-40283}
  - Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (Luiz Augusto von Dentz) [task:515351] {CVE-2022-50233}
  - PCI/AER: Fix NULL pointer access by aer_info (Vernon Yang) [task:573049] {CVE-2025-68309}
  - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (Zhu Yanjun) [task:576735] {CVE-2025-68379}
  - wifi: ath10k: Delay the unmapping of the buffer (Youghandhar Chintala) [task:576839] {CVE-2022-50700}
  - sfc: complete the next packet when we receive a timestamp (Tom Zhao) [task:582061]
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [task:590965] {CVE-2025-68783}
  - OPENEULER: livepatch: support for super-long symbol repositioning (caixiaomeng 00662745) [task:479611]
  - net: hns3: add VLAN id validation before using (Jian Shen) [task:589439] {CVE-2025-71112}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [task:566417] {CVE-2025-40252}
  - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [task:593547] {CVE-2026-23095}
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [task:593627] {CVE-2026-23083}
  - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [task:593735] {CVE-2026-23103}
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [task:583035]
  - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi) [task:589039] {CVE-2025-68774}
  - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [task:589523] {CVE-2025-68813}
  - btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer (Tetsuo Handa) [task:576527] {CVE-2022-50766}
  - btrfs: fix race when deleting free space root from the dirty cow roots list (Filipe Manana) [task:576625] {CVE-2023-54067}
  - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [task:553671] {CVE-2025-40164}
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [task:569685] {CVE-2025-40321}
  - brcmfmac: Add P2P Action Frame retry delay to fix GAS Comeback Response failure issue (Justin Li) [task:569685]
  - brcmfmac: Fix P2P Group Formation failure via Go-neg method (Joseph Chuang) [task:569685]
  - brcmfmac: p2p cert 6.1.9-support GOUT handling p2p presence request (Madhan Mohan R) [task:569685]
  - net: fix stack overflow when LRO is disabled for virtual interfaces (Taehee Yoo) [task:576549] {CVE-2023-54012}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [task:573593] {CVE-2025-68285}
  - net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set (Mike Manning) [task:583459]
  - ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() (Eric Dumazet) [task:583459]
  - inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() (Eric Dumazet) [task:583459]
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [task:540405] {CVE-2025-39931}
  - apparmor: Fix memleak in alloc_ns() (Xiu Jianfeng) [task:578001] {CVE-2022-50860}
  - net/net_failover: fix txq exceeding warning (Faicker Mo) [task:577763] {CVE-2023-54236}
  - objtool: Fix SEGFAULT (Christophe Leroy) [task:577749] {CVE-2022-50879}
  - dm cache: free background tracker's queued work in btracker_destroy (Joe Thornber) [task:567625] {CVE-2023-53765}
  - ext4: fix deadlock when converting an inline directory in nojournal mode (Theodore Ts'o) [task:578181] {CVE-2023-54311}
  - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [task:572651] {CVE-2025-68264}
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong) [task:577843] {CVE-2023-54314}
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana) [task:577835] {CVE-2023-54224}
  - scsi: target: iscsit: Free cmds before session free (Dmitry Bogdanov) [task:577935] {CVE-2023-54184}
  - scsi: iscsi: target: fix spelling mistake "entires" -> "entries" (Colin Ian King) [task:577935]
  - drm/i915/gvt: fix gvt debugfs destroy (Zhenyu Wang) [task:576469] {CVE-2023-54098}
  - iavf: use internal state to free traffic IRQs (Ahmed Zaki) [task:570137] {CVE-2023-53850}
  - drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (Min Li) [task:578229] {CVE-2023-54202}
  - f2fs: fix potential corruption when moving a directory (Jaegeuk Kim) [task:578145] {CVE-2023-54187}
  - f2fs: report ENOENT correctly in f2fs_rename (Jaegeuk Kim) [task:578145]
  - amba: bus: fix refcount leak (Peng Fan) [task:578027] {CVE-2023-54230}
  - bpf: Prevent decl_tag from being referenced in func_proto arg (Stanislav Fomichev) [task:578175] {CVE-2022-50883}
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil) [task:577985] {CVE-2023-54282}
  - scsi: qedf: Fix NULL dereference in error handling (Jinhong Zhu) [task:577959] {CVE-2023-54289}
  - scsi: qedf: Fix error codes in qedf_alloc_global_queues() (Dan Carpenter) [task:577959]
  - crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr (Ye Weihua) [task:577881] {CVE-2022-50814}
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer (Saravanan Vajravel) [task:577875] {CVE-2023-54274}
  - RDMA/srpt: Fix disabling device management (Kamal Heib) [task:577875]
  - nilfs2: fix shift-out-of-bounds due to too large exponent of block size (Ryusuke Konishi) [task:577823] {CVE-2022-50864}
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu) [task:578221]
  - tracing: Fix warning in trace_buffered_event_disable() (Zheng Yejian) [task:578221] {CVE-2023-54211}
  - scsi: qla2xxx: Array index may go out of bound (Nilesh Javali) [task:578169] {CVE-2023-54179}
  - bpf: Fix issue in verifying allow_ptr_leaks (Yafang Shao) [task:577649] {CVE-2023-54181}
  - ipv6/sit: use DEV_STATS_INC() to avoid data-races (Eric Dumazet) [task:576945] {CVE-2022-50764}
  - configfs: fix possible memory leak in configfs_create_dir() (Chen Zhongjin) [task:576961] {CVE-2022-50751}
  - configfs: factor dirent removal into helpers (Christoph Hellwig) [task:576961]
  - ext4: silence the warning when evicting inode with dioread_nolock (Zhang Yi) [task:577027] {CVE-2022-50730}
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui) [task:576981] {CVE-2023-54045}
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin) [task:576959] {CVE-2023-54134}
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali) [task:576931] {CVE-2023-54014}
  - btrfs: fix race when deleting quota root from the dirty cow roots list (Filipe Manana) [task:576951] {CVE-2023-54032}
  - nbd: defer config put in recv_work (Zheng Qixing) [task:576921] {CVE-2025-68372}
  - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [task:576883] {CVE-2025-68366}
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong) [task:576879] {CVE-2023-54093}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [task:576567] {CVE-2025-68724}
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [task:576581] {CVE-2025-68734}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng) [task:576543] {CVE-2025-68750}
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner) [task:576553] {CVE-2023-54127}
  - RDMA/core: Fix GID entry ref leak when create_ah fails (Saravanan Vajravel) [task:576593] {CVE-2023-54003}
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi) [task:576337] {CVE-2023-54140}
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [task:576289] {CVE-2025-68364}
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han) [task:575751] {CVE-2025-68339}
  - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [task:573201] {CVE-2025-68261}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [task:573401] {CVE-2025-68288}
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [task:573277] {CVE-2025-68191}
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [task:573259] {CVE-2025-68308}
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [task:573675] {CVE-2025-68229}
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko) [task:573523] {CVE-2025-40351}
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [task:573519] {CVE-2025-68185}
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi) [task:573411] {CVE-2025-40349}
  - hfsplus: fix to avoid false alarm of circular locking (Chao Yu) [task:573411]
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [task:573407] {CVE-2025-68192}
  - bfs: Reconstruct file type when loading from disk (Tetsuo Handa) [task:573225] {CVE-2025-68266}
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane) [task:573105] {CVE-2025-68168}
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [task:576229] {CVE-2025-68346}
  - drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou) [task:569749] {CVE-2025-40339}
  - drm/amdgpu: update mappings not managed by KFD (Felix Kuehling) [task:569749]
  - drm/amdkfd: keep BOs in system memory if restore failed (Philip Yang) [task:569749]
  - drm/amdgpu: KFD Restore process: Optimize waiting (Harish Kasiviswanathan) [task:569749]
  - drm/amdgpu: Remove explicit wait after VM validate (Harish Kasiviswanathan) [task:569749]
  - usbnet: Prevents free active kevent (Lizhi Xu) [task:573207] {CVE-2025-68312}
  - timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [task:573247] {CVE-2025-68214}
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [task:573099] {CVE-2025-68321}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [task:466416] {CVE-2025-37958}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [task:571709] {CVE-2025-40345}
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [task:554169] {CVE-2025-40204}
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [task:569903] {CVE-2025-40308}
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [task:570215] {CVE-2025-40331}
  - usb: early: xhci-dbc: Fix a potential out-of-bound memory access (Christophe JAILLET) [task:569807] {CVE-2023-53840}
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet) [task:569859] {CVE-2023-53831}
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan) [task:570033] {CVE-2023-53817}
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov) [task:570061] {CVE-2023-53808}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke) [task:534325] {CVE-2025-39846}
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [task:534321] {CVE-2025-39847}
  - driver core: fix resource leak in device_add() (Zhengchao Shao) [task:539843] {CVE-2023-53594}
  - trace/blktrace: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:533251] {CVE-2023-53408}
  - blktrace: fix use after free for struct blk_trace (Yu Kuai) [task:533251]
  - drivers: base: dd: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:533259] {CVE-2023-53390}
  - driver core: dd: remove deferred_devices variable (Greg Kroah-Hartman) [task:533259]
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [task:535625] {CVE-2025-39885}
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede) [task:539117] {CVE-2025-39937}
  - net: rfkill: gpio: add DT support (Philipp Zabel) [task:539117]
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo) [task:539195] {CVE-2023-53672}
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma) [task:539903] {CVE-2023-53456}
  - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (Dan Carpenter) [task:539905] {CVE-2023-53476}
  - scsi: qla2xxx: Fix deletion race condition (Quinn Tran) [task:540555] {CVE-2023-53615}
  - iommu: Fix error unwind in iommu_group_alloc() (Jason Gunthorpe) [task:540195] {CVE-2023-53482}
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Wentao Liang) [task:540201] {CVE-2025-39920}
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei) [task:540453] {CVE-2023-53480}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [task:542885] {CVE-2025-39972}
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [task:542889] {CVE-2025-39968}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [task:542891] {CVE-2025-39996}
  - drm/omap: dss: Fix refcount leak bugs (Liang He) [task:544551] {CVE-2022-50574}
  - drm/omap: dss: Cleanup DSS ports on initialisation failure (Laurent Pinchart) [task:544551]
  - drm/omap: dss: Handle DPI and SDI port initialization failures (Laurent Pinchart) [task:544551]
  - soc: qcom: qmi_encdec: Restrict string length in decode (Chris Lew) [task:544625] {CVE-2023-53729}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [task:546067] {CVE-2025-40018}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [task:546583] {CVE-2025-40049}
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [task:546611] {CVE-2025-40044}
  - nfsd: remove non-existent struct in flexfiles (liuyunchen) [task:569939]
  - net: dlink: handle copy_thresh allocation failure (Yeounsu Moon) [task:546803] {CVE-2025-40053}
  - net: dl2k: switch from 'pci_' to 'dma_' API (Christophe JAILLET) [task:546803]
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [task:546813] {CVE-2025-40055}
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [task:546825] {CVE-2025-40030}
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [task:546827] {CVE-2025-40081}
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [task:546995] {CVE-2025-40027}
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [task:546823] {CVE-2025-40078}
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [task:547733] {CVE-2025-40087}
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko) [task:547751] {CVE-2025-40088}
  - usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai) [task:547759] {CVE-2025-40093}
  - usb: gadget: remove max support speed info in bind operation (Linyu Yuan) [task:547759]
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [task:547763] {CVE-2025-40094}
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon) [task:544627]
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong) [task:544627] {CVE-2023-53722}
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [task:547995] {CVE-2025-40083}
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [task:554197] {CVE-2025-40140}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [task:554269] {CVE-2025-40187}
  - pid: Add a judgment for ns null in pid_nr_ns (gaoxiang17) [task:554209] {CVE-2025-40178}
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [task:554213] {CVE-2025-40125}
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [task:554257] {CVE-2025-40115}
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [task:554271] {CVE-2025-40153}
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [task:554313] {CVE-2025-40183}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [task:555251] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher) [task:555251]
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [task:559713] {CVE-2025-40211}
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [task:566411] {CVE-2025-40233}
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko) [task:566403] {CVE-2025-40243}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [task:508235] {CVE-2025-38498}
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [task:527679] {CVE-2025-38695}
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [task:527979] {CVE-2025-39676}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov [NVIDIA]) [task:530267] {CVE-2025-39742}
  - scsi: qla2xxx: Pointer may be dereferenced (Shreyas Deodhar) [task:531899] {CVE-2023-53150}
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN (Lin Ma) [task:533859] {CVE-2023-53369}
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov) [task:533893] {CVE-2023-53384}
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (Li Nan) [task:533857] {CVE-2023-53380}
  - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (Nikita Zhandarovich) [task:532845] {CVE-2023-53335}
  - USB: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:532729] {CVE-2023-53359}
  - USB: core: no need to save usb_devices_root (Greg Kroah-Hartman) [task:532729]
  - USB: move usb debugfs directory creation to the usb common core (Greg Kroah-Hartman) [task:532729]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [task:532225] {CVE-2025-39808}
  - USB: uhci: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:531787] {CVE-2023-53197}
  - USB: host: uhci: remove dentry pointer for debugfs (Greg Kroah-Hartman) [task:531787]
  - md/raid10: fix wrong setting of max_corr_read_errors (Li Nan) [task:532129] {CVE-2023-53313}
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [task:532363] {CVE-2025-39813}
  - ext4: fix i_disksize exceeding i_size problem in paritally written case (Zhihao Cheng) [task:532121] {CVE-2023-53270}
  - mISDN: hfcpci: Fix warning when deleting uninitialized timer (Vladimir Riabchun) [task:532231] {CVE-2025-39833}
  - ipv6/addrconf: fix a potential refcount underflow for idev (Ziyang Xuan) [task:531859] {CVE-2023-53189}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [task:530329] {CVE-2025-39756}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'o) [task:527339] {CVE-2025-38701}
  - net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann) [task:527571] {CVE-2025-38717}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh) [task:527669] {CVE-2025-38696}
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [task:527579] {CVE-2025-38691}
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [task:527691] {CVE-2025-38700}
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa) [task:527561] {CVE-2025-38712}
  - jfs: Regular file corruption check (Edward Adam Davis) [task:527667] {CVE-2025-38698}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [task:527379] {CVE-2025-38694}
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [task:527341] {CVE-2025-38693}
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [task:522999] {CVE-2025-38671}
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi) [task:522913] {CVE-2025-38663}
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li) [task:523427] {CVE-2025-38650}
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [task:523363] {CVE-2025-38639}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [task:520109] {CVE-2025-38515}
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao (AceLan)) [task:519339] {CVE-2025-38540}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown) [task:506037] {CVE-2025-38430}
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko) [task:566437] {CVE-2025-40244}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [task:566439] {CVE-2025-40264}
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen) [task:567195] {CVE-2025-40282}
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (Manish Rangankar) [task:532367] {CVE-2023-53280}
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [task:554253] {CVE-2025-40134}
  - null_blk: Always check queue mode setting from configfs (Chaitanya Kulkarni) [task:540445] {CVE-2023-53576}
  - xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk) [task:553675] {CVE-2025-40160}
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk) [task:553675]
  - xen: Use evtchn_type_t as a type for event channels (Yan Yankovskyi) [task:553675]
  - IB/mad: Don't call to function that might sleep while in atomic context (Leonid Ravich) [task:539101] {CVE-2022-50472}
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [task:554195] {CVE-2025-40121}
  - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [task:553045] {CVE-2025-40110}
  - netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed (Zhengchao Shao) [task:540047] {CVE-2022-50500}
  - can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean) [task:546085] {CVE-2025-40020}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [task:546817] {CVE-2025-40035}
  - scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list (Xingui Yang) [task:540093] {CVE-2023-53627}
  - usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai) [task:547767] {CVE-2025-40095}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [task:543789] {CVE-2025-40011}
  - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (Shang XiaoJing) [task:544705] {CVE-2022-50556}
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [task:539857] {CVE-2025-39902}
  - bnxt: avoid overflow in bnxt_get_nvram_directory() (Maxim Korotkov) [task:539303] {CVE-2023-53661}
  - dm-stripe: fix a possible integer overflow (Mikulas Patocka) [task:538939] {CVE-2025-39940}
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui) [task:540131]
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (Su Hui) [task:540131] {CVE-2023-53648}
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller) [task:540451] {CVE-2023-53488}
  - jbd2: check 'jh->b_transaction' before removing it from checkpoint (Zhihao Cheng) [task:539839] {CVE-2023-53526}
  - lib/fonts: fix undefined behavior in bit shift for get_default_font (Gaosheng Cui) [task:539359] {CVE-2022-50511}
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [task:528079] {CVE-2025-39724}
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors (Yazen Ghannam) [task:533313] {CVE-2023-53438}
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002) [task:532389] {CVE-2023-53309}
  - wifi: iwlwifi: mvm: don't trust firmware n_channels (Johannes Berg) [task:540147] {CVE-2023-53589}
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (Baokun Li) [task:539011] {CVE-2022-50485}
  - ext4: avoid deadlock in fs reclaim with page writeback (Jan Kara) [task:532081] {CVE-2023-53149}
  - RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (Shay Drory) [task:533401] {CVE-2023-53393}
  - cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [task:534323] {CVE-2025-39838}


