# changelog

author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.41.v2207
changelog:
  - Revert "bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode" (yangfeng) [task:345763, task:351327]
  - ocfs2: fix unexpected zeroing of virtual disk (Chi Zhiling) [task:335993]
  - udp_tunnel: add the ability to hard-code IANA VXLAN (Jakub Kicinski) [task:334943]
  - net: fix kabi broken in struct net_device (taowei) [task:334943]
  - net: fix kabi broken in struct udp_tunnel_info (taowei) [task:334943]
  - udp_tunnel: add central NIC RX port offload infrastructure (Jakub Kicinski) [task:334943]
  - RDMA/hns: Fix UAF for cq async event (Chengchang Tang) [task:330520] {CVE-2024-38545}
  - RDMA/hns: Delete unnecessary callback functions for cq (Yixian Liu) [task:344307]
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (Alan Stern) [task:345741] {CVE-2024-41035}
  - USB: core: add endpoint-blacklist quirk (Johan Hovold) [task:345741] {CVE-2024-41035}
  - usb: core: config: using bit mask instead of individual bits (Pavel Hofman) [task:345741] {CVE-2024-41035}
  - usb: core: config: fix validation of wMaxPacketValue entries (Pavel Hofman) [task:345741] {CVE-2024-41035}
  - USB: Fix: Don't skip endpoint descriptors with maxpacket=0 (Alan Stern) [task:345741] {CVE-2024-41035}
  - ftrace: Fix possible use-after-free issue in ftrace_location() (Zheng Yejian) [task:330288] {CVE-2024-38588}
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() (Zheng Yejian) [task:330288]
  - RDMA/hns: Fix deadlock on SRQ async events. (Chengchang Tang) [task:344307] {CVE-2024-38591}
  - net/sched: fix kabi change in struct Qdisc (Zhengchao Shao) [task:217588] {CVE-2024-27010, CVE-2024-27010}
  - net/sched: Fix mirred deadlock on device recursion (Eric Dumazet) [task:217588] {CVE-2024-27010}
  - drm/vc4: hdmi: Unregister codec device on unbind (Maxime Ripard) [task:344615] {CVE-2022-48852}
  - tcp: Fix listen() regression in 4.19.270 (Kuniyuki Iwashima) [task:166857, bug:253275]
  - net: fix kabi broken in struct dst_ops (taowei) [task:200581]
  - ipv6: remove max_size check inline with ipv4 (Jon Maxwell) [task:200581] {CVE-2023-52340}
  - net/dst: use a smaller percpu_counter batch for dst entries accounting (Eric Dumazet) [task:200581] {CVE-2023-52340}
  - net: add a route cache full diagnostic message (Peter Oskolkov) [task:200581] {CVE-2023-52340}
  - net: fix kabi broken in struct netns_ipv6 (taowei) [task:200581]
  - ipv6: make ip6_rt_gc_expire an atomic_t (Eric Dumazet) [task:200581] {CVE-2023-52340}
  - net: bridge: xmit: make sure we have at least eth header len bytes (Nikolay Aleksandrov) [task:330544] {CVE-2024-38538}
  - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Ewan D. Milne) [task:167824, bug:239957]
  - bpf, sockmap: Do not ignore orig_len parameter (Eric Dumazet) [task:218786]
  - bpf, sockmap: Fix double bpf_prog_put on error case in map_link (John Fastabend) [task:218786]
  - bpf, sockmap: Attach map progs to psock early for feature probes (John Fastabend) [task:218786]
  - net, sockmap: Don't call bpf_prog_put() on NULL pointer (Alex Dewar) [task:218786]
  - bpf, sockmap: Allow skipping sk_skb parser program (John Fastabend) [task:218786]
  - bpf, sockmap: Check skb_verdict and skb_parser programs explicitly (John Fastabend) [task:218786]
  - net_sched: walk through all child classes in tc_bind_tclass() (Cong Wang) [task:218825]
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Jesse Zhang) [task:346955] {CVE-2024-42228}
  - RDMA/restrack: Fix potential invalid address access (Wenchao Hao) [task:345671] {CVE-2024-42080}
  - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (John Garry) [task:346675] {CVE-2022-48792}
  - can: j1939: prevent deadlock by moving j1939_sk_errqueue() (Oleksij Rempel) [task:341503]
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new (Oleksij Rempel) [task:341503] {CVE-2023-52887}
  - can: j1939: extend UAPI to notify about RX status (Oleksij Rempel) [task:341503]
  - can: j1939: rename J1939_ERRQUEUE_* to J1939_ERRQUEUE_TX_* (Oleksij Rempel) [task:341503]
  - ima: Fix use-after-free on a dentry's dname.name (Stefan Berger) [task:345299] {CVE-2024-39494}
  - ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (Ferry Meng) [task:345115] {CVE-2024-41016}
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry() (Ferry Meng) [task:345115] {CVE-2024-41016}
  - smb: client: fix potential UAF in cifs_stats_proc_write() (Paulo Alcantara) [task:221999] {CVE-2024-35868}
  - smb: client: fix potential UAF in smb2_is_valid_oplock_break() (Paulo Alcantara) [task:221987] {CVE-2024-35865}
  - smb: client: fix potential UAF in is_valid_oplock_break() (Paulo Alcantara) [task:327836] {CVE-2024-35863}
  - scsi: pm8001: Fix use-after-free for aborted TMF sas_task (John Garry) [task:346413] {CVE-2022-48791}
  - scsi: pm80xx: Fix TMF task completion race condition (Igor Pylypiv) [task:346413] {CVE-2022-48791}
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (Jose E. Marchesi) [task:345369] {CVE-2024-42161}
  - selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro (Andrii Nakryiko) [task:345369]
  - mmc: davinci: Don't strip remove function when driver is builtin (Uwe Kleine-König) [task:347147] {CVE-2024-39484}
  - mmc: davinci_mmc: Convert to platform remove callback returning void (Yangtao Li) [task:347147]
  - jffs2: Fix potential illegal address access in jffs2_free_inode (Wang Yong) [task:347055] {CVE-2024-42115}
  - media: dvb-frontends: tda10048: Fix integer overflow (Ricardo Ribalda) [task:347059] {CVE-2024-42223}
  - ext4: do not create EA inode under buffer lock (Jan Kara) [task:347085] {CVE-2024-40972}
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Jan Kara) [task:347085]
  - ext4: check the return value of ext4_xattr_inode_dec_ref() (Li Zhong) [task:347085]
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Ritesh Harjani) [task:166857]
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (Hagar Hemdan) [task:347093] {CVE-2024-42090}
  - usb: usbtmc: Fix bug in pipe direction for control transfers (Alan Stern) [task:347095] {CVE-2022-48834}
  - usb: usbtmc: Fix memory leak in usbtmc_ioctl_request (Guido Kiener) [task:347095]
  - usb: usbtmc: Add ioctl for generic requests on control (Guido Kiener) [task:347095]
  - xfs: add bounds checking to xlog_recover_process_data (lei lu) [task:347089] {CVE-2024-41014}
  - kdb: Fix buffer overflow during tab-complete (Daniel Thompson) [task:347091] {CVE-2024-39480}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (Kuniyuki Iwashima) [task:347115] {CVE-2024-41041}
  - scsi: qedf: Fix refcount issue when LOGO is received during TMF (Saurav Kashyap) [task:347117] {CVE-2022-48823}
  - scsi: qedf: Modify flush routine to handle all I/Os and TMF (Shyam Sundar) [task:347117]
  - ocfs2: add bounds checking to ocfs2_check_dir_entry() (lei lu) [task:347123] {CVE-2024-41015}
  - nilfs2: fix inode number range checks (Ryusuke Konishi) [task:347125] {CVE-2024-42105}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (Nikita Zhandarovich) [task:347131] {CVE-2024-41097}
  - ipv6: prevent possible NULL deref in fib6_nh_init() (Eric Dumazet) [task:347135] {CVE-2024-40961}
  - IB/core: Implement a limit on UMAD receive List (Michael Guralnik) [task:346963] {CVE-2024-42145}
  - mm: avoid overflows in dirty throttling logic (Jan Kara) [task:346909] {CVE-2024-42131}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) [task:346915] {CVE-2024-42232}
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds (Ghadi Elie Rahme) [task:344619] {CVE-2024-42148}
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (Aleksandr Mishin) [task:345121] {CVE-2024-39506}
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep (Laurent Pinchart) [task:344571] {CVE-2024-42087}
  - jfs: xattr: fix buffer overflow for invalid xattr (Greg Kroah-Hartman) [task:344449] {CVE-2024-40902}
  - orangefs: fix out-of-bounds fsid access (Mike Marshall) [task:345297] {CVE-2024-42143}
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY (Jiangfeng Xiao) [task:345307] {CVE-2024-39488}
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (Dmitry Antipov) [task:345309] {CVE-2024-41072}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (Eric Dumazet) [task:345313] {CVE-2024-40959}
  - ipv6: sr: fix memleak in seg6_hmac_init_algo (Hangbin Liu) [task:345315] {CVE-2024-39489}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (Remi Pommarel) [task:345317] {CVE-2024-40912}
  - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() (Lee Jones) [task:345415] {CVE-2024-42236}
  - hfsplus: fix uninit-value in copy_name (Edward Adam Davis) [task:345669] {CVE-2024-41059}
  - iio: chemical: bme680: Fix overflows in compensate() functions (Vasileios Amoiridis) [task:345679] {CVE-2024-42086}
  - HID: core: remove unnecessary WARN_ON() in implement() (Nikita Zhandarovich) [task:345675] {CVE-2024-39509}
  - net: hns3: fix kernel crash problem in concurrent scenario (Yonglong Liu) [task:345677] {CVE-2024-39507}
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c (Alex Deucher) [task:345695] {CVE-2024-40987}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (Sam Sun) [task:345697] {CVE-2024-39487}
  - tcp_metrics: validate source addr length (Jakub Kicinski) [task:345703] {CVE-2024-42154}
  - net: can: j1939: Initialize unused data in j1939_send_one() (Shigeru Yoshida) [task:345711] {CVE-2024-42076}
  - net/iucv: Avoid explicit cpumask var allocation on stack (Dawei Li) [task:345717] {CVE-2024-42094}
  - jfs: don't walk off the end of ealist (lei lu) [task:345721] {CVE-2024-41017}
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (Ian Ray) [task:345787] {CVE-2024-42253}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (Ma Ke) [task:346897] {CVE-2024-41095}
  - nilfs2: add missing check for inode numbers on directory entries (Ryusuke Konishi) [task:345765] {CVE-2024-42104}
  - bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode (Martin KaFai Lau) [task:345763] {CVE-2024-42063}
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes (Ma Ke) [task:345779] {CVE-2024-42101}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (Raju Rangoju) [task:345789] {CVE-2024-40984}
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [task:345799] {CVE-2024-42124}
  - scsi: qedf: Modify abort and tmf handler to handle edge condition and flush (Saurav Kashyap) [task:345799]
  - drm/radeon: fix UBSAN warning in kv_dpm.c (Alex Deucher) [task:345729] {CVE-2024-40988}
  - inet_diag: Initialize pad field in struct inet_diag_req_v2 (Shigeru Yoshida) [task:345321] {CVE-2024-42106}
  - ax25: Fix refcount imbalance on inbound connections (Lars Kellogg-Stedman) [task:346363] {CVE-2024-40910}
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Herbert Xu) [task:346361] {CVE-2024-39493}
  - ASoC: fsl-asoc-card: set priv->pdev before using it (Elinor Montmasson) [task:346375] {CVE-2024-42089}
  - ata: libata-core: Fix null pointer dereference on error (Niklas Cassel) [task:346377] {CVE-2024-41098}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (Alan Stern) [task:346373] {CVE-2024-40904}
  - ocfs2: fix races between hole punching and AIO+DIO (Su Yue) [task:345287] {CVE-2024-40943}
  - s390/pkey: Wipe sensitive data on failure (Holger Dengler) [task:346395] {CVE-2024-42157}
  - ipv6: prevent possible NULL dereference in rt6_probe() (Eric Dumazet) [task:346387] {CVE-2024-40960}
  - drm/exynos/vidi: fix memory leak in .get_modes() (Jani Nikula) [task:346391] {CVE-2024-40932}
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (Emmanuel Grumbach) [task:346417] {CVE-2024-40941}
  - netpoll: Fix race condition in netpoll_owner_active (Breno Leitao) [task:346665] {CVE-2024-41005}
  - net: make sure napi_list is safe for RCU traversal (Jakub Kicinski) [task:346665]
  - ata: libata-core: Fix double free on error (Niklas Cassel) [task:346673] {CVE-2024-41087}
  - net: ethernet: lantiq_etop: fix double free in detach (Aleksander Jan Bajkowski) [task:346393] {CVE-2024-41046}
  - net: lantiq_etop: add blank line after declaration (Aleksander Jan Bajkowski) [task:346393]
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes (Ma Ke) [task:346905] {CVE-2024-41089}
  - i2c: lpi2c: Avoid calling clk_get_rate during transfer (Alexander Stein) [task:346895] {CVE-2024-40965}
  - i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work (Carlos Song) [task:346895]
  - i2c: imx-lpi2c: use bulk clk API (Peng Fan) [task:346895]
  - tipc: fix kernel panic when enabling bearer (Tung Nguyen) [task:346901] {CVE-2022-48865}
  - tipc: fix NULL pointer dereference in tipc_disc_rcv() (Tuong Lien) [task:346901]
  - tipc: add reference counter to bearer (Tuong Lien) [task:346901]
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref() (Eric Dumazet) [task:346925] {CVE-2024-40981}
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr (Piotr Wojtaszczyk) [task:346937] {CVE-2024-42153}
  - fbdev: savage: Handle err return when savagefb_check_var failed (Cai Xinchen) [task:346943] {CVE-2024-39475}
  - drm/vc4: Fix deadlock on DSI device attach error (Padmanabha Srinivasaiah) [task:346939] {CVE-2022-48826}
  - drm/vc4: dsi: Only register our component once a DSI device is attached (Maxime Ripard) [task:346939]
  - drm/amd/display: Skip finding free audio for unknown engine_id (Alex Hung) [task:346961] {CVE-2024-42119}
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Jan Kara) [task:346949] {CVE-2024-42102}
  - net: dsa: mv88e6xxx: Correct check for empty list (Simon Horman) [task:346967] {CVE-2024-42224}
  - ocfs2: fix DIO failure due to insufficient transaction credits (Jan Kara) [task:346985] {CVE-2024-42077}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Sagi Grimberg) [task:346989] {CVE-2024-42152}
  - nvmet: update AEN list and array at one place (Daniel Wagner) [task:346989]
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects (Nicolas Escande) [task:346993] {CVE-2024-40942}
  - ftruncate: pass a signed offset (Arnd Bergmann) [task:346997] {CVE-2024-42084}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() (Hagar Gamal Halim Hemdan) [task:347011] {CVE-2024-39499}
  - ppp: reject claimed-as-LCP but actually malformed packets (Dmitry Antipov) [task:347013] {CVE-2024-41044}
  - ppp: ensure minimum packet size in ppp_write() (Eric Dumazet) [task:160493]
  - s390/sclp: Fix sclp_init() cleanup on failure (Heiko Carstens) [task:347023] {CVE-2024-41068}
  - scsi: qedi: Fix crash while reading debugfs attribute (Manish Rangankar) [task:347025] {CVE-2024-40978}
  - mISDN: Fix memory leak in dsp_pipeline_build() (Alexey Khoroshilov) [task:347035] {CVE-2022-48863}
  - mISDN: Remove obsolete PIPELINE_DEBUG debugging information (Zhen Lei) [task:347035]
  - ALSA: emux: improve patch ioctl data validation (Oswald Buddenhagen) [task:347041] {CVE-2024-42097}
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors (Ryusuke Konishi) [task:347027] {CVE-2024-39469}
  - nilfs2: return the mapped address from nilfs_get_page() (Matthew Wilcox (Oracle)) [task:347027]
  - nilfs2: Remove check for PageError (Matthew Wilcox (Oracle)) [task:347027]
  - net: relax socket state check at accept time. (Paolo Abeni) [task:341253] {CVE-2024-36484}
  - jfs: Fix array-index-out-of-bounds in diFree (Jeongjun Park)
  - nfsd: Fix races between nfsd4_cb_release() and nfsd4_shutdown_callback() (Trond Myklebust) [task:334950]
  - nfsd: minor 4.1 callback cleanup (Trond Myklebust) [task:334950]
  - Bluetooth: Fix slab-out-of-bounds Read in hci_le_ext_adv_report_evt (luoxuanqiang) [task:218812]
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Ding Hui) [task:337725] {CVE-2023-52885}
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [task:222101] {CVE-2023-52752}
  - crypto: af_alg - get rid of alg_memory_allocated (Eric Dumazet) [task:341427] {CVE-2022-48781}
  - PCI: pciehp: Reduce noisiness on hot removal (Lukas Wunner) [bug:243223]
  - fanotify: Avoid softlockups when reading many events (Jan Kara) [task:340889]
  - epoll: be better about file lifetimes (Linus Torvalds) [task:330566] {CVE-2024-38580}
  - xfs: fix inode allocation block res calculation precedence (Brian Foster) [task:334329]
  - i2c: acpi: Unbind mux adapters before delete (Hamish Martin) [task:332220] {CVE-2024-39362}
  - i2c: add fwnode APIs (Russell King (Oracle)) [task:332220]
  - btrfs: fix race between quota rescan and disable leading to NULL pointer deref (Filipe Manana) [task:330358] {CVE-2022-48734}
  - btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker (Nikolay Borisov) [task:330358] {CVE-2022-48734}
  - btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan (Filipe Manana) [task:158034]
  - btrfs: fix lockdep splat when reading qgroup config on mount (Filipe Manana) [task:158034]
  - btrfs: qgroup: fix deadlock between rescan worker and remove qgroup (Sidong Yang) [task:330358] {CVE-2022-48734}
  - macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" (Finn Thain) [task:330496] {CVE-2024-38607}
  - ALSA: Fix deadlocks with kctl removals at disconnection (Takashi Iwai) [task:330474] {CVE-2024-38600}
  - btrfs: fix deadlock between quota disable and qgroup rescan worker (Shin'ichiro Kawasaki) [task:330358] {CVE-2022-48734}
  - btrfs: fix lockdep splat when enabling and disabling qgroups (Filipe Manana) [task:330358] {CVE-2022-48734}
  - btrfs: move ulist allocation out of transaction in quota enable (David Sterba) [task:330358] {CVE-2022-48734}
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Niklas Neronin) [task:223058] {CVE-2023-52781}
  - netfilter: tproxy: bail out if IP has been disabled on the device (Florian Westphal) [task:330558] {CVE-2024-36270}
  - netfilter: use in_dev_for_each_ifa_rcu (Florian Westphal) [task:330558]
  - net: inetdevice: provide replacement iterators for in_ifaddr walk (Florian Westphal) [task:330558]
  - media: i2c: et8ek8: Don't strip remove function when driver is builtin (Uwe Kleine-König) [task:330538] {CVE-2024-38611}
  - ax25: Fix reference count leak issue of net_device (Duoming Zhou) [task:330518] {CVE-2024-38554}
  - perf report: Fix memory leaks around perf_tip() (Ian Rogers) [task:225610] {CVE-2021-47543}
  - net: fec: remove .ndo_poll_controller to avoid deadlocks (Wei Fang) [task:330300]
  - wifi: cfg80211: check A-MSDU format more carefully (Johannes Berg) [task:223115] {CVE-2024-35937}
  - vfio/pci: fix potential memory leak in vfio_intx_enable() (Ye Bin) [task:330570] {CVE-2024-38632}
  - ax25: Fix reference count leak issues of ax25_dev (Duoming Zhou) [task:330575] {CVE-2024-38602}
  - ax25: merge repeat codes in ax25_dev_device_down() (Lu Wei) [task:330575] {CVE-2024-38602}
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks (Jakub Kicinski) [task:330488] {CVE-2024-38597}
  - ptp: fix code indentation issues (Carlos Llamas) [task:222085]
  - ptp: Fix possible memory leak in ptp_clock_register() (Yang Yingliang) [task:222085] {CVE-2021-47455}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (Kuniyuki Iwashima) [task:330565] {CVE-2024-37356}
  - params: lift param_set_uint_minmax to common code (Sagi Grimberg) [task:330565]
  - ubifs: Fix races between xattr_{set|get} and listxattr operations (Zhihao Cheng) [task:223056] {CVE-2021-47351}
  - ring-buffer: Fix a race between readers and resize checks (Petr Pavlu) [task:330286] {CVE-2024-38601}
  - scsi: bfa: Ensure the copied buf is NUL terminated (Bui Quang Minh) [task:330280] {CVE-2024-38560}
  - kunit: Fix kthread reference (Mickaël Salaün) [task:330287] {CVE-2024-38561}
  - ACPI: CPPC: Fix access width used for PCC registers (Vanshidhar Konda) [task:223069]
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro (Jarred White) [task:223069]
  - ACPI: CPPC: Use access_width over bit_width for system memory accesses (Jarred White) [task:223069] {CVE-2024-35995}
  - ACPI: CPPC: Drop redundant local variable from cpc_read() (Rafael J. Wysocki) [task:223069]
  - ACPI: CPPC: fix some coding style issues (Xiaofei Tan) [task:223069]
  - ACPI: CPPC: Fix up I/O port access in cpc_read() (Rafael J. Wysocki) [task:223069]
  - ACPI: CPPC: Implement support for SystemIO registers (Steven Noonan) [task:223069]
  - ACPI: CPPC: initialise vaddr pointers to NULL (Ionela Voinescu) [task:223069]
  - drm: vc4: Fix possible null pointer dereference (Aleksandr Mishin) [task:330526] {CVE-2024-38546}
  - mmc: sdhci-msm: pervent access to suspended controller (Mantas Pucka) [task:224217] {CVE-2024-36029}
  - mmc: sdhci-msm: add Inline Crypto Engine support (Eric Biggers) [task:224217]
  - mmc: sdhci-msm: Mark sdhci_msm_cqe_disable static (Stephen Boyd) [task:224217]
  - mmc: sdhci-msm: Add CQHCI support for sdhci-msm (Ritesh Harjani) [task:224217]
  - mmc: sdhci-msm: Use OPP API to set clk/perf state (Rajendra Nayak) [task:224217]
  - mmc: sdhci-msm: Re-initialize DLL if MCLK is gated dynamically (Veerabhadrarao Badiganti) [task:224217]
  - xfs: cap longest free extent to maximum allocatable (Dave Chinner) [task:328072]
  - nilfs2: fix use-after-free of timer for log writer thread (Ryusuke Konishi) [task:330506] {CVE-2024-38583}
  - net: annotate data-race in neigh_output() (Eric Dumazet) [task:205566]
  - KVM: LAPIC: Also cancel preemption timer during SET_LAPIC (Wanpeng Li) [task:330470] {CVE-2022-48765}
  - KVM: LAPIC: Write 0 to TMICT should also cancel vmx-preemption timer (Wanpeng Li) [task:330470]
  - KVM: LAPIC: Advancing the timer expiration on guest initiated write (Wanpeng Li) [task:330470]
  - KVM: LAPIC: Also cancel preemption timer when disarm LAPIC timer (Wanpeng Li) [task:330470]
  - ecryptfs: Fix buffer size for tag 66 packet (Brian Kubisiak) [task:330504] {CVE-2024-38578}
  - netrom: fix possible dead-lock in nr_rt_ioctl() (Eric Dumazet) [task:330492] {CVE-2024-38589}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (Ilya Maximets) [task:330359] {CVE-2024-38558}
  - m68k: Fix spinlock race in kernel thread creation (Michael Schmitz) [task:330486] {CVE-2024-38613}
  - nilfs2: fix potential kernel bug due to lack of writeback flag waiting (Ryusuke Konishi) [task:332240] {CVE-2024-37078}
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc (Chengfeng Ye) [task:216643] {CVE-2021-47211}
  - OPENEULER: tcp/dccp: Add another way to allocate local ports in connect() (xiaolinkui) [task:336487]
  - nfp: flower: fix cb_ident duplicate in indirect block register (John Hurley) [task:240857]
  - flow_offload: fix block stats (John Hurley) [task:240857]
  - flow_offload: add statistics retrieval infrastructure and use it (Pablo Neira Ayuso) [bug:240857]
  - net_sched: fold tcf_block_cb_call() into tc_setup_cb_call() (Cong Wang) [bug:240857]
  - net/sched: Remove egdev mechanism (Oz Shlomo) [bug:240857]
  - nfp: flower: remove TC egdev offloads (John Hurley) [bug:240857]
  - nfp: flower: offload tunnel decap rules via indirect TC blocks (John Hurley) [bug:240857]
  - nfp: flower: increase scope of netdev checking functions (John Hurley) [bug:240857]
  - nfp: flower: allow non repr netdev offload (John Hurley) [bug:240857]
  - nfp: flower: include geneve as supported offload tunnel type (John Hurley) [bug:240857]
  - nfp: flower: use geneve and vxlan helpers (John Hurley) [bug:240857]
  - nfp: flower: use the common netdev notifier (Jakub Kicinski) [bug:240857]
  - nfp: register a notifier handler in a central location for the device (Jakub Kicinski) [bug:240857]
  - nfp: flower: use stats array instead of storing stats per flow (Pieter Jansen van Vuuren) [bug:240857]
  - nfp: flower: use rhashtable for flow caching (Pieter Jansen van Vuuren) [bug:240857]
  - Revert "kbuild: do not create orphan built-in.a or obj-y objects" (taowei) [bug:240857]
  - ipvlan: add ipvlan_route_v6_outbound() helper (Eric Dumazet) [task:223092] {CVE-2023-52796}
  - ipvlan: properly track tx_errors (Eric Dumazet) [task:223092]
  - net: add DEV_STATS_READ() helper (Eric Dumazet) [task:223092]
  - macsec: use DEV_STATS_INC() (Eric Dumazet) [task:223092]
  - macsec: Fix traffic counters/statistics (Clayton Yager) [task:223092]
  - macsec: avoid use-after-free in macsec_handle_frame() (Eric Dumazet) [task:158034]
  - net: fix kabi broken in struct net_device_stats (taowei) [task:204908]
  - net: add atomic_long_t to net_device_stats fields (Eric Dumazet) [task:204908]
  - jdb2: Don't refuse invalidation of already invalidated buffers (Jan Kara) [task:226534]
  - tipc: fix kernel warning when sending SYN message (Tung Nguyen) [task:225562] {CVE-2023-52700}
  - tipc: fix implicit-connect for SYN+ (Xin Long) [task:225562]
  - io_uring: fix Fix compilation issues caused by backport (Jackie Liu)
  - io_uring: drop any code related to SCM_RIGHTS (Jens Axboe) [task:225582] {CVE-2023-52656}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.42.v2207
changelog:
  - sched/fair: fix x86_64_defconfig build errors (liwanwu) [task:350325]
  - drm/msm: another fix for the headless Adreno GPU (Dmitry Baryshkov) [task:351463] {CVE-2023-52911}
  - drm/msm: Make .remove and .shutdown HW shutdown consistent (Javier Martinez Canillas) [task:351463]
  - drm/msm: Fix wrong size calculation (Xianting Tian) [task:160493]
  - drm/msm: fix shutdown hook in case GPU components failed to bind (Dmitry Baryshkov) [task:158827]
  - drm/msm: Call msm_init_vram before binding the gpu (Craig Tatlor) [task:158034]
  - drm/msm: add shutdown support for display platform_driver (Krishna Manikandan) [task:157172]
  - drm/msm: fix leaks if initialization fails (Pavel Machek) [task:157172]
  - drm/msm: Set dma maximum segment size for mdss (Sean Paul) [task:155707]
  - sched/core: Further clarify sched_class::set_next_task() (Peter Zijlstra) [task:101857]
  - sched: Fix pick_next_task() vs 'change' pattern race (Peter Zijlstra) [task:101857]
  - sched: Rework pick_next_task() slow-path (Peter Zijlstra) [task:101857]
  - sched: Allow put_prev_task() to drop rq->lock (Peter Zijlstra) [task:101857]
  - sched/fair: Expose newidle_balance() (Peter Zijlstra) [task:101857]
  - sched: Add task_struct pointer to sched_class::set_curr_task (Peter Zijlstra) [task:101857]
  - sched: Rework CPU hotplug task selection (Peter Zijlstra) [task:101857]
  - sched/{rt,deadline}: Fix set_next_task vs pick_next_task (Peter Zijlstra) [task:101857]
  - sched/core: Introduce set_next_task() helper for better code readability (Muchun Song) [task:101857]
  - sched/fair: Fix imbalance overflow (Vincent Guittot) [task:333737]
  - sched/fair: Cleanup newidle_balance (Vincent Guittot) [task:333737]
  - sched/fair: Remove sysctl_sched_migration_cost condition (Vincent Guittot) [task:333737]
  - sched/fair: Wait before decaying max_newidle_lb_cost (Vincent Guittot) [task:333737]
  - sched/fair: Skip update_blocked_averages if we are defering load balance (Vincent Guittot) [task:333737]
  - sched/fair: Account update_blocked_averages in newidle_balance cost (Vincent Guittot) [task:333737]
  - sched/fair: Check for idle core in wake_affine (Julia Lawall) [task:333737]
  - sched/fair: Ensure tasks spreading in LLC during LB (Vincent Guittot) [task:333737]
  - sched/fair: Fix condition of avg_load calculation (Tao Zhou) [task:333737]
  - sched/fair: Fix statistics for find_idlest_group() (Vincent Guittot) [task:333737]
  - sched/fair : Improve update_sd_pick_busiest for spare capacity case (Vincent Guittot) [task:333737]
  - sched/fair: Fix find_idlest_group() to handle CPU affinity (Vincent Guittot) [task:333737]
  - sched/fair: Fix rework of find_idlest_group() (Vincent Guittot) [task:333737]
  - sched/fair: Rework find_idlest_group() (Vincent Guittot) [task:333737]
  - sched/fair: Optimize find_idlest_group() (Vincent Guittot) [task:333737]
  - sched/fair: Use load instead of runnable load in wakeup path (Vincent Guittot) [task:333737]
  - sched/fair: Use utilization to select misfit task (Vincent Guittot) [task:333737]
  - sched/fair: Spread out tasks evenly when not overloaded (Vincent Guittot) [task:333737]
  - sched/fair: Use load instead of runnable load in load_balance() (Vincent Guittot) [task:333737]
  - sched/fair: Use rq->nr_running when balancing load (Vincent Guittot) [task:333737]
  - sched/fair: Rework load_balance() (Vincent Guittot) [task:333737]
  - sched/fair: Remove meaningless imbalance calculation (Vincent Guittot) [task:333737]
  - sched/fair: Rename sg_lb_stats::sum_nr_running to sum_h_nr_running (Vincent Guittot) [task:333737]
  - sched/fair: Clean up asym packing (Vincent Guittot) [task:333737]
  - sched/fair: Rename weighted_cpuload() to cpu_runnable_load() (Dietmar Eggemann) [task:333737]
  - sched/fair: Replace source_load() & target_load() with weighted_cpuload() (Dietmar Eggemann) [task:333737]
  - sched/fair: Remove sgs->sum_weighted_load (Dietmar Eggemann) [task:333737]
  - sched/fair: Fix rounding bug for asym packing (Vincent Guittot) [task:333737]
  - sched/fair: Add lsub_positive() and use it consistently (Patrick Bellasi) [task:333737]
  - sched/fair: Clean-up update_sg_lb_stats parameters (Quentin Perret) [task:333737]
  - sched/fair: Change 'prefer_sibling' type to bool (Valentin Schneider) [task:333737]
  - sched/fair: Wrap rq->rd->overload accesses with READ/WRITE_ONCE() (Valentin Schneider) [task:333737]
  - sched/fair: Add 'group_misfit_task' load-balance type (Morten Rasmussen) [task:101857]
  - spi: fix kabi breakage in struct spi_controller (lifangxu) [task:221921]
  - spi: Fix deadlock when adding SPI controllers on SPI buses (Mark Brown) [task:221921] {CVE-2021-47469}
  - mm/vmscan: Fix hard LOCKUP in function isolate_lru_pages (liuye) [task:334682]
  - tracing: Fix race issue between cpu buffer write and swap (Zheng Yejian)
  - fix some compilation warnings (Jiangshan Yi) [task:357223]
  - fix some dtb compile warnings (zhouyuhang) [task:328882, task:329382]
  - net: dsa: mv88e6xxx: Fix out-of-bound access (Joseph Huang) [task:358101] {CVE-2024-44988}
  - btrfs: qgroup: fix quota root leak after quota disable failure (Filipe Manana) [task:347151] {CVE-2024-41078}
  - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() (Chao Yu) [task:347103] {CVE-2024-39467}
  - drm/msm/dpu: fix compile error (Lu Yao) [task:359017]
  - memcg: protect concurrent access to mem_cgroup_idr (Shakeel Butt) [task:352017] {CVE-2024-43892}
  - mm: memcontrol: fix cannot alloc the maximum memcg ID (Muchun Song) [task:183219]
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show() (Chen Ridong) [task:352627] {CVE-2024-43853}
  - netfilter: ctnetlink: use helper function to calculate expect ID (Pablo Neira Ayuso) [task:357933] {CVE-2024-44944}
  - net: hns3: fix a deadlock problem when config TC during resetting (Jie Wang) [task:358107] {CVE-2024-44995}
  - ssb: Fix potential NULL pointer dereference in ssb_device_uevent() (Rand Deeb) [task:347161] {CVE-2024-40982}
  - fuse: Initialize beyond-EOF page contents before setting uptodate (Jann Horn) [task:358119] {CVE-2024-44947}
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation (Andi Shyti) [task:351225] {CVE-2024-42259}
  - Input: MT - limit max slots (Tetsuo Handa) [task:357851] {CVE-2024-45008}
  - kcm: Serialise kcm_sendmsg() for the same socket. (Kuniyuki Iwashima) [task:358105] {CVE-2024-44946}
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails (Dmitry Baryshkov) [task:357971] {CVE-2024-44982}
  - s390/sclp: Prevent release of buffer in I/O (Peter Oberparleiter) [task:357955] {CVE-2024-44969}
  - x86/mm: Fix pti_clone_pgtable() alignment assumption (Peter Zijlstra) [task:357895] {CVE-2024-44965}
  - ipv6: prevent UAF in ip6_send_skb() (Eric Dumazet) [task:357925] {CVE-2024-44987}
  - atm: idt77252: prevent use after free in dequeue_rx() (Dan Carpenter) [task:357805] {CVE-2024-44998}
  - wifi: mac80211: sdata can be NULL during AMPDU start (Alexander Wetzel) [task:351523] {CVE-2022-48875}
  - x86/mtrr: Check if fixed MTRRs exist before saving them (Andi Kleen) [task:357771] {CVE-2024-44948}
  - usb: gadget: core: Check for unset descriptor (Chris Wulff) [task:357799] {CVE-2024-44960}
  - media: dvb-usb-v2: af9035: fix missing unlock (Hans Verkuil) [task:357803]
  - media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer (Zhang Shurong) [task:357803] {CVE-2023-52915}
  - ibmvnic: Add tx check to prevent skb leak (Nick Child) [task:345709] {CVE-2024-41066}
  - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Li Qiang) [task:357923]
  - overflow: Add __must_check attribute to check_*() helpers (Kees Cook) [task:357223]
  - net/mlx5: Add a blank line after declarations (Wenpeng Liang) [task:357223]
  - ext4: remove the special buffer dirty handling in do_journal_get_write_access (Shida Zhang) [task:345663]
  - ext4: fix a potential assertion failure due to improperly dirtied buffer (Shida Zhang) [task:345663]
  - ext4: hoist ext4_block_write_begin and replace the __block_write_begin (Shida Zhang) [task:345663]
  - ext4: persist the new uptodate buffers in ext4_journalled_zero_new_buffers (Shida Zhang) [task:345663]
  - drm/amd/display: Add NULL check for 'afb' before dereferencing in amdgpu_dm_plane_handle_cursor_update (Srinivasan Shanmugam) [task:352661] {CVE-2024-43903}
  - drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules (Ma Jun) [task:352181] {CVE-2024-43907}
  - x86: stop playing stack games in profile_pc() (Linus Torvalds) [task:347039] {CVE-2024-42096}
  - NFSD: Fix ia_size underflow (Chuck Lever) [task:347049] {CVE-2022-48828}
  - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC (Chao Yu) [task:352651] {CVE-2024-44942}
  - null_blk: fix validation of block size (Andreas Hindborg) [task:347007] {CVE-2024-41077}
  - wifi: virt_wifi: don't use strlen() in const context (Johannes Berg) [task:352217]
  - wifi: virt_wifi: avoid reporting connection success with wrong SSID (En-Wei Wu) [task:352217] {CVE-2024-43841}
  - virt_wifi: fix error on connect (Matteo Croce) [task:352217]
  - virt_wifi: Return micros for BSS TSF values (A. Cody Schuffelen) [task:352217]
  - virt_wifi: implement ndo_get_iflink (Taehee Yoo) [task:352217]
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (Dave Jiang) [task:346975] {CVE-2024-42110}
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags (Breno Leitao) [task:347145] {CVE-2024-39508}
  - USB: serial: mos7840: fix crash on resume (Dmitry Smirnov) [task:347175] {CVE-2024-42244}
  - fpga: region: fix compilation error for commit 7dd30f1e070 (limiao) [task:354605]
  - add change boot vga device support (Shixiong Ou) [task:347429]
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Kenton Groombridge) [task:346919] {CVE-2024-41071}
  - s390/pkey: Wipe copies of clear-key structures on failure (Holger Dengler) [task:345319] {CVE-2024-42156}
  - ipv6: sr: fix missing sk_buff release in seg6_input_core (Andrea Mayer) [task:347171] {CVE-2024-39490}
  - fbdev: ls2k500sfb fix default video memory size. (Chong Qiao) [task:353249]
  - acpi: mcfg quirk: Increased multi-chip support for the 3C6000, now capable of supporting up to eight chips. (zhenghaowei) [task:353249]
  - irqchip: irq-loongson-pch-msi: Use pch_msi_priv[0] as the default value (zhangtianyang) [task:353249]
  - fbdev: ls2k500sfb update var info according to resolution. (Chong Qiao) [task:353249]
  - filelock: Remove locks reliably when fcntl/close race is detected (Jann Horn) [task:346931] {CVE-2024-41012}
  - btrfs: get rid of warning on transaction commit when using flushoncommit (Filipe Manana) [task:351471] {CVE-2022-48920}
  - f2fs: fix return value of f2fs_convert_inline_inode() (Chao Yu) [task:352015] {CVE-2024-42296}
  - f2fs: fix to consider multiple device for readonly check (Chao Yu) [task:352015]
  - PHYTIUM: drm/phytium: Add driver version information (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Add PWM backlight control for pe220x eDP (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Change the drm driver name for pe220x (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Add dc patch for BMC (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Modify driver to adapt to ARM and X86_64 compiles (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Mask the hdcp timer irq (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Mask the AUX reply error interrupt (YuDa) [task:346055]
  - PHYTIUM: drm/phytium: Adjust log printing level (WangHao) [task:346055]
  - PHYTIUM: drm/phytium: Replace default EFI fb0 with DC FB (WangHao) [task:346055]
  - PHYTIUM: drm/phytium: Fixed dp codec id (Wang Hao) [task:346055]
  - PHYTIUM: drm/phytium: Get edid audio capability (Wang Hao) [task:346055]
  - PHYTIUM: drm/phytium: Bugfix Xorg startup for ps23xx when using pe2201 bmc card (Wang Hao) [task:346055]
  - PHYTIUM: drm/phytium: Cursor hot support negative numbers (Yang Xun) [task:346055]
  - PHYTIUM: drm/phytium: Enable gamma features (Yang Xun) [task:346055]
  - PHYTIUM: drm/phytium: Add capability of tile mode (Yang Xun) [task:346055]
  - PHYTIUM: drm/phytium: Limit the TU to a maximum of 63 (Yang Xun) [task:346055]
  - PHYTIUM: drm/phytium: Sync patches from 4.19.y-dev oss branch (Wang Yinfeng) [task:346055]
  - HYGON: mm: Fix kabi breakage of pv_ops (hanliyang) [task:332685]
  - netlink: convert nlk->flags to atomic flags (Eric Dumazet) [task:345975]
  - netlink: Use copy_to_user() for optval in netlink_getsockopt(). (Kuniyuki Iwashima) [task:345975]
  - net: netlink: rename NETLINK_DUMP_STRICT_CHK -> NETLINK_GET_STRICT_CHK (Jakub Kicinski) [task:345975]
  - tools headers uapi: Update linux/netlink.h header copy (Arnaldo Carvalho de Melo) [task:345975]
  - security/kysec: Converges 3adm Control in Kysec Component (chengang) [task:168278]
  - security/kysec: open some audit log in kysec softmode (penghuaihe) [bug:177929]
  - security/kysec: adjust devctl kern log level (penghuaihe) [task:150714]
  - security/kysec: fix performance degradation bug caused by mutex (penghuaihe) [bug:163729]
  - CDC-NCM: avoid overflow in sanity checking (Oliver Neukum) [task:351493] {CVE-2022-48938}
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() (Tetsuo Handa) [task:347077] {CVE-2024-41063}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (Daniel Borkmann) [task:347029] {CVE-2024-42246}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (David Ruth) [task:344573] {CVE-2024-40995}
  - xdp: Remove WARN() from __xdp_reg_mem_model() (Daniil Dulov) [task:345323] {CVE-2024-42082}
  - scsi: qla2xxx: validate nvme_local_port correctly (Nilesh Javali) [task:354889] {CVE-2024-42286}
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Pablo Neira Ayuso) [task:346667] {CVE-2024-42070}
  - Revert "loop: Remove sector_t truncation checks" (Ben Hutchings)
  - kylin/gmjstcm: fix compilation warning (Li Jun) [task:352591]
  - PHYTIUM: drm/phytium: save vram by dma (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: skip less than 640x480 mode (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: adjust e2000 phy parameters (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: disable pixel clock before dc reset (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: support for linux-5.10.0 (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: Remove reset before close pixel clock (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: Read EDID when getting mode (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: Add E2000 Display Engine support (Yang Xun) [task:110384]
  - PHYTIUM: drm/phytium: update phytium x100 dc driver before support e2000 (oushixiong) [task:110384]
  - ASoC: hdmi-codec: Add an op to set callback function for plug event (Cheng-Yi Chiang) [task:110384]
  - security/selinux: Fixed crash caused by selinux (mengdehui) [bug:258979]
  - md/dm-raid: don't call md_reap_sync_thread() directly (Yu Kuai) [task:221813] {CVE-2024-35808}
  - md: fix kabi broken in struct mddev (zhouyuhang) [task:183151]
  - OPENEULER: md: use interruptible apis in idle/frozen_sync_thread (Yu Kuai) [task:183151]
  - md: refactor idle/frozen_sync_thread() to fix deadlock (Yu Kuai) [task:183151]
  - md: add a mutex to synchronize idle and frozen in action_store() (Yu Kuai) [task:183151]
  - md: wake up 'resync_wait' at last in md_reap_sync_thread() (Yu Kuai) [task:183151]
  - md: refactor action_store() for 'idle' and 'frozen' (Yu Kuai) [task:183151]
  - md-cluster/raid10: call update_size in md_reap_sync_thread (Guoqing Jiang) [task:128226]
  - crypto: aead,cipher - zeroize key buffer after use (Hailey Mothershead) [task:346415] {CVE-2024-42229}
  - crypto: ecdh - explicitly zeroize private_key (Joachim Vandersmissen) [task:345795] {CVE-2024-42098}
  - gpio: fix compile error (zhouyuhang) [task:347327]
  - nvme: avoid double free special payload (Chunguang Xu) [task:347137] {CVE-2024-41073}
  - ASoC: topology: Fix references to freed memory (Amadeusz Sławiński) [task:346623] {CVE-2024-41069}
  - ila: block BH in ila_output() (Eric Dumazet) [task:346669] {CVE-2024-41081}
  - serial: imx: Introduce timeout when waiting on transmitter empty (Esben Haabendal) [task:345715] {CVE-2024-40967}
  - fou: remove warn in gue_gro_receive on unsupported protocol (Willem de Bruijn) [task:352275] {CVE-2024-44940}
  - media: venus: fix use after free in vdec_close (Dikshita Agarwal) [task:352227] {CVE-2024-42313}
  - dev/parport: fix the array out-of-bounds risk (tuhaowen) [task:352211] {CVE-2024-42301}
  - driver core: Fix uevent_show() vs driver detach race (Dan Williams) [task:345303]
  - drivers: core: synchronize really_probe() and dev_uevent() (Dirk Behme) [task:345303] {CVE-2024-39501}
  - security/selinux: Fix box compile errors when stack disabled (chengang) [task:338969]
  - ipvs: properly dereference pe in ip_vs_add_service (Chen Hanxiao) [task:352245] {CVE-2024-42322}
  - nilfs2: fix kernel bug on rename operation of broken directory (Ryusuke Konishi) [task:347001] {CVE-2024-41034}
  - ceph: prevent use-after-free in encode_cap_msg() (Rishabh Dave) [task:210332] {CVE-2024-26689}
  - kvm: s390: Reject memory region operations for ucontrol VMs (Christoph Schlameuss) [task:352663] {CVE-2024-43819}
  - closures: Change BUG_ON() to WARN_ON() (Kent Overstreet) [task:345719] {CVE-2024-42252}
  - drm/nouveau: prime: fix refcount underflow (Danilo Krummrich) [task:351447] {CVE-2024-43867}
  - Bluetooth: Fix usage of __hci_cmd_sync_status (Luiz Augusto von Dentz) [task:346425]
  - Bluetooth: L2CAP: Fix deadlock (Luiz Augusto von Dentz) [task:346425]
  - Bluetooth: hci_sync: Fix Opcode prints in bt_dev_dbg/err (Marcel Ziswiler) [task:346425]
  - Bluetooth: Fix race condition in hci_cmd_sync_clear (Min Li) [task:346425]
  - Bluetooth: hci_sync: Fix not processing all entries on cmd_sync_work (Luiz Augusto von Dentz) [task:346425]
  - Bluetooth: Add helper for serialized HCI command execution (Marcel Holtmann) [task:346425]
  - Bluetooth: Add support hdev to allocate private data (Tedd Ho-Jeong An) [task:346425]
  - bluetooth/l2cap: sync sock recv cb and release (Edward Adam Davis) [task:346425] {CVE-2024-41062}
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Marc Kleine-Budde) [task:223130] {CVE-2023-52878}
  - btrfs: fix use-after-free after failure to create a snapshot (Filipe Manana) [task:330299] {CVE-2022-48733}
  - media: mediatek: vcodec: Handle invalid decoder vsi (Irui Wang) [task:352191] {CVE-2024-43831}
  - tracing: Fix overflow in get_free_elt() (Tze-nan Wu) [task:352671] {CVE-2024-43890}
  - fpga: region: add owner module and take its refcount (Marco Pagani) [task:330557] {CVE-2024-35247}
  - f2fs: fix to don't dirty inode for readonly filesystem (Chao Yu) [task:352639] {CVE-2024-42297}
  - ext4: check dot and dotdot of dx_root before making dir indexed (Baokun Li) [task:352649] {CVE-2024-42305}
  - s390/pkey: Wipe copies of protected- and secure-keys (Holger Dengler) [task:346923] {CVE-2024-42155}
  - scsi: qla2xxx: Fix for possible memory corruption (Shreyas Deodhar) [task:352643] {CVE-2024-42288}
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (Alexey Kodanev) [task:352637] {CVE-2024-43839}
  - gpio: davinci: Validate the obtained number of IRQs (Aleksandr Mishin) [task:345785] {CVE-2024-42092}
  - Revert "drm/vc4: hdmi: Unregister codec device on unbind" (李豪杰) [task:344615, task:351057]
  - ext4: make sure the first directory block is not a hole (Baokun Li) [task:352077] {CVE-2024-42304}
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (Shigeru Yoshida) [task:352297] {CVE-2024-42284}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() (Hans de Goede) [task:352209] {CVE-2024-43830}
  - dma: fix call order in dmam_free_coherent (Lance Richardson) [task:352215] {CVE-2024-43856}
  - bpf: Fix a segment issue when downgrading gso_size (Fred Li) [task:352237] {CVE-2024-42281}
  - drm/amd/display: Check for NULL pointer (Sung Joon Kim) [task:352265] {CVE-2024-42308}
  - drm/amd/display: Set flip pending for pipe split (Wesley Chalmers) [task:352265]
  - drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes (Ma Ke) [task:352277] {CVE-2024-42310}
  - serial: core: check uartclk for zero to avoid divide by zero (George Kennedy) [task:352289] {CVE-2024-43893}
  - drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes (Ma Ke) [task:352293] {CVE-2024-42309}
  - mISDN: Fix a use after free in hfcmulti_tx() (Dan Carpenter) [task:352165] {CVE-2024-42280}
  - md/raid5: avoid BUG_ON() while continue reshape after reassembling (Yu Kuai) [task:352173] {CVE-2024-43914}
  - Bluetooth: MGMT: Add error handling to pair_device() (Griffin Kroah-Hartman) [task:352185] {CVE-2024-43884}
  - net/iucv: fix use after free in iucv_sock_close() (Alexandra Winter) [task:352285] {CVE-2024-42271}
  - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (Niklas Neronin) [task:346971] {CVE-2024-42226}
  - remoteproc: imx_rproc: Skip over memory region when node value is NULL (Aleksandr Mishin) [task:352177] {CVE-2024-43860}
  - remoteproc: imx_rproc: Fix ignoring mapping vdev regions (Dong Aisheng) [task:352177]
  - remoteproc: imx_rproc: ignore mapping vdev regions (Peng Fan) [task:352177]
  - scsi: qla2xxx: During vport delete send async logout explicitly (Manish Rangankar) [task:352283] {CVE-2024-42289}
  - hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() (Chao Yu) [task:352271] {CVE-2024-42311}
  - jfs: fix null ptr deref in dtInsertEntry (Edward Adam Davis) [task:352249] {CVE-2024-44939}
  - filelock: Fix fcntl/close race recovery compat path (Jann Horn) [task:347167] {CVE-2024-41020}
  - file: Factor files_lookup_fd_locked out of fcheck_files (Eric W. Biederman) [task:347167]
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Bart Van Assche) [task:352669] {CVE-2024-42285}
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block() (Ryusuke Konishi) [task:352291] {CVE-2024-42295}
  - net: ax25: Fix a compilation error (xiaolinkui) [task:351959]
  - kobject_uevent: Fix OOB access within zap_modalias_env() (Zijun Hu) [task:352127] {CVE-2024-42292}
  - jfs: Fix shift-out-of-bounds in dbDiscardAG (Pei Li) [task:352157] {CVE-2024-44938}
  - fs/jfs: fix potential integer overflow on shift of a int (Colin Ian King) [task:158034]
  - ALSA: hda: Do not unset preset when cleaning up codec (Cezary Rojewski) [task:222115] {CVE-2023-52736}
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization (George Stark) [task:345699] {CVE-2024-42129}
  - locking/mutex: Introduce devm_mutex_init() (George Stark) [task:345699] {CVE-2024-42129}
  - exec: Fix ToCToU between perm check and set-uid/gid usage (Kees Cook) [task:351435] {CVE-2024-43882}
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (Baochen Qiang) [task:351227] {CVE-2024-43879}
  - net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister (Vladimir Oltean) [task:346697]
  - net: dsa: mv88e6xxx: don't use devres for mdiobus (Vladimir Oltean) [task:346697] {CVE-2022-48818}
  - net: ipv6: ensure we call ipv6_mc_down() at most once (j.nixdorf@avm.de) [task:351441] {CVE-2022-48910}
  - ipv6/addrconf: use a boolean to choose between UNREGISTER/DOWN (Florent Fourcot) [task:351441]
  - ipv6/addrconf: call addrconf_ifdown with consistent values (Florent Fourcot) [task:351441]
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (Breno Leitao) [task:346411] {CVE-2024-40953}
  - io_uring: add a schedule point in io_add_buffers() (Eric Dumazet) [task:351479] {CVE-2022-48937}
  - net: usb: qmi_wwan: fix memory leak for not ip packets (Daniele Palmas) [task:351501] {CVE-2024-43861}
  - drm/amd/display: Check pipe offset before setting vblank (Alex Hung) [task:345701] {CVE-2024-42120}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() (Zijun Hu) [task:351331] {CVE-2024-43871}
  - driver core: Cast to (void *) with __force for __percpu pointer (Andy Shevchenko) [task:351331]
  - usb: vhci-hcd: Do not drop references before new references are gained (Oliver Neukum) [task:351507] {CVE-2024-43883}
  - drm/radeon: check bo_va->bo is non-NULL before using it (Pierre-Eric Pelloux-Prayer) [task:346959] {CVE-2024-41060}
  - greybus: Fix use-after-free bug in gb_interface_release due to race condition. (Sicong Huang) [task:347127] {CVE-2024-39495}
  - ixgbe: fix pci device refcount leak (Yang Yingliang) [task:351021] {CVE-2022-48896}
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (Miri Korenblit) [task:346187] {CVE-2024-40929}
  - net/sched: initialize noop_qdisc owner (Johannes Berg) [task:217588]
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (Breno Leitao) [task:344437] {CVE-2024-40901}
  - scsi: mpt3sas: Gracefully handle online firmware update (Suganath Prabu) [task:344437] {CVE-2024-40901}
  - scsi: mpt3sas: Add ioc_<level> logging macros (Joe Perches) [task:344437] {CVE-2024-40901}
  - f2fs: Add inline to f2fs_build_fault_attr() stub (Nathan Chancellor) [task:346823] {CVE-2024-42160}
  - f2fs: check validation of fault attrs in f2fs_build_fault_attr() (Chao Yu) [task:346823] {CVE-2024-42160}
  - MIPS: Octeron: remove source file executable bit (Dominique Martinet) [task:347107]
  - MIPS: Octeon: Add PCIe link status check (Songyang Li) [task:347107] {CVE-2024-40968}
  - nvme-fabrics: use reserved tag for reg read/write command (Chunguang Xu) [task:345283] {CVE-2024-41082}
  - ibmvnic: don't release napi in __ibmvnic_open() (Sukadev Bhattiprolu) [task:346945] {CVE-2022-48811}
  - ibmvnic: avoid calling napi_disable() twice (Lijun Pan) [task:158827]
  - drop_monitor: replace spin_lock by raw_spin_lock (Wander Lairson Costa) [task:345791] {CVE-2024-40980}
  - powerpc/vnic: Extend "failover pending" window (Sukadev Bhattiprolu) [task:346945]
  - gianfar: ethtool: Fix refcount leak in gfar_get_ts_info (Miaoqian Lin) [task:347101] {CVE-2022-48856}
  - RDMA/mlx5: Add check for srq max_sge attribute (Patrisious Haddad) [task:349733] {CVE-2024-40990}
  - KVM: x86/mmu: make apf token non-zero to fix bug (Liang Zhang) [task:351445] {CVE-2022-48943}
  - mmc: sdhci: Add sd host v4 mode (Chunyan Zhang) [task:350907]
  - mmc: sdhci: Add version V4 definition (Chunyan Zhang) [task:350907]
  - mmc: sdhci: Let a vendor driver supply and update ADMA descriptor size (Veerabhadrarao Badiganti) [task:350907]
  - mmc: sdhci: Add ADMA2 64-bit addressing support for V4 mode (Chunyan Zhang) [task:350907]
  - mmc: sdhci: add adma_table_cnt member to struct sdhci_host (Jisheng Zhang) [task:350907]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.43.v2207
changelog:
  - Revert "x86/bugs: Add AMD retbleed= boot parameter" (Enze Li) [bug:247197]
  - Revert "x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value" (Enze Li) [bug:247197]
  - Revert "x86/entry: Add kernel IBRS implementation" (Enze Li) [bug:247197]
  - Revert "x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS" (Enze Li) [bug:247197]
  - Revert "x86/bugs: Report Intel retbleed vulnerability" (Enze Li) [bug:247197]
  - Revert "Add HYGON retbleed= boot parameter" (Enze Li) [bug:247197]
  - KVM: Fix compile error (Zhang Hao) [task:370239] {CVE-2022-2153}
  - inet: frags: re-introduce skb coalescing for local delivery (Guillaume Nault) [task:364261]
  - Revert "inet: frags: re-introduce skb coalescing for local delivery" (taowei) [task:364261]
  - Revert "inet: frags: re-introduce skb coalescing for local delivery" (taowei) [task:364261]
  - HYGON: drivers/crypto/ccp: memmove is used instead of memcpy in overlapped memmory for tkm (niuyongwen) [task:362023]
  - HYGON: drivers/crypto/ccp: add ioctl API to pin TKM hugepage (xiongmengbiao) [task:362023]
  - HYGON: drivers/crypto/ccp: fix vtkm without C-bit when host SME deactivate (xiongmengbiao) [task:362023]
  - HYGON: drivers/crypto/ccp: support TKM run on CSV (xiongmengbiao) [task:362023]
  - HYGON: drivers/crypto/ccp: remove multi-level pointers processing for vpsp (xiongmengbiao) [task:362023]
  - HYGON: drivers/crypto/ccp: Eliminate dependence of the kvm module on the ccp module (xiongmengbiao) [task:362023]
  - HYGON: drivers/crypto/ccp: Allow VM without a configured vid to use TKM (xiongmengbiao) [task:362023]
  - HYGON: drivers/crypto/ccp: support tkm key isolation (xiongmengbiao) [task:362023]
  - HYGON: x86/cpu: Detect memory encryption features on Hygon CPUs (hanliyang) [task:362023]
  - HYGON: x86/cpufeatures: Add CSV3 CPU feature (hanliyang) [task:176679]
  - mm/swap: Do not abuse the seqcount_t latching API (Ahmed S. Darwish) [task:222964]
  - mm/swap.c: piggyback lru_add_drain_all() calls (Konstantin Khlebnikov) [task:222964]
  - crypto: ccp - Add SEV_INIT_EX support (David Rientjes) [task:176679]
  - crypto: ccp - Add support for SEV-ES to the PSP driver (Tom Lendacky) [task:176679]
  - x86/cpufeatures: Add SEV-ES CPU feature (Tom Lendacky) [task:176679]
  - x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained (Tom Lendacky) [task:153627]
  - serial/pmac_zilog: Remove flawed mitigation for rx irq flood (Finn Thain) [task:217562] {CVE-2024-26999}
  - tty: serial: remove set but not used variable 'error' (YueHaibing) [task:217562]
  - ring-buffer: Fix race while reader and writer are on the same page (Zheng Yejian) [task:387361]
  - ring-buffer: Fix race between reset page and reading page (Steven Rostedt (Google)) [task:387361]
  - bonding: update port speed when getting bond speed (Hangbin Liu) [task:382011]
  - Fix a redeclaration compile error (luoxuanqiang) [task:378655]
  - drm/msm/dpu: remove LOCK/CLEAR support in RM (Jeykumar Sankaran) [task:379871]
  - drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (Abhinav Kumar) [task:363787] {CVE-2024-45015}
  - drm/msm/dpu: remove RM dependency on connector state (Jeykumar Sankaran) [task:363787]
  - drm/msm/dpu: clean up destination scaler residue (Jeykumar Sankaran) [task:379871]
  - LoongArch: drivers/pci: Enables the acs ability of loongson Bridge (jianghaoran) [task:373887]
  - LoongArch: drivers/iommu: Support iommu for 3c6000 (Xianglai Li) [task:373887]
  - LoongArch: Temporary add 3C6000 & 3D6000 support (dongbiao) [task:373887]
  - SUNRPC: Fix possible autodisconnect during connect due to old last_used (Dave Wysochanski) [bug:263777]
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing) [task:378953]
  - ocfs2: fix data corruption by fallocate (Junxiao Bi) [task:158827, task:370879]
  - phonet/pep: refuse to enable an unbound pipe (Rémi Denis-Courmont) [task:160493]
  - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 (Marc Zyngier) [task:363883] {CVE-2024-46707}
  - config: enable CONFIG_BUG_ON_DATA_CORRUPTION (tanze) [task:354881]
  - sysctl: always initialize i_uid/i_gid (Thomas Weißschuh) [task:352223] {CVE-2024-42312}
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Scott Mayhew) [task:363951] {CVE-2024-46695}
  - btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (Filipe Manana) [task:364083] {CVE-2024-46751}
  - btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() (Filipe Manana) [task:364083]
  - btrfs: remove superfluous metadata check at btrfs_lookup_extent_info() (Filipe Manana) [task:364083]
  - ACPI: video: Change how we determine if brightness key-presses are handled (Hans de Goede) [task:368343]
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (Hans de Goede) [task:368343] {CVE-2024-46859}
  - platform/x86: panasonic-laptop: Use acpi_video_get_backlight_type() (Hans de Goede) [task:368343]
  - platform/x86: panasonic-laptop: filter out duplicate volume up/down/mute keypresses (Hans de Goede) [task:368343]
  - platform/x86: panasonic-laptop: don't report duplicate brightness key-presses (Hans de Goede) [task:368343]
  - platform/x86: panasonic-laptop: revert "Resolve hotkey double trigger bug" (Hans de Goede) [task:368343]
  - platform/x86: panasonic-laptop: sort includes alphabetically (Hans de Goede) [task:368343]
  - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 392 (Thomas Gleixner) [task:368343]
  - platform/x86: panasonic-laptop: de-obfuscate button codes (Stefan Seyfried) [task:368343]
  - platform/x86: panasonic-laptop: Replace snprintf in show functions with sysfs_emit (Qing Wang) [task:368343]
  - platform/x86: panasonic-laptop: remove redundant assignment of variable result (Colin Ian King) [task:368343]
  - platform/x86: panasonic-laptop: Add sysfs attributes for firmware brightness registers (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Add support for battery charging threshold (eco mode) (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Resolve hotkey double trigger bug (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Add write support to mute (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Fix sticky key init bug (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Fix naming of platform files for consistency with other modules (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Split MODULE_AUTHOR() by one author per macro call (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Replace ACPI prints with pr_*() macros (Kenneth Chan) [task:368343]
  - platform/x86: panasonic-laptop: Add support for optical driver power in Y and W series (Kenneth Chan) [task:368343]
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) (Kishon Vijay Abraham I) [task:372905] {CVE-2024-47667}
  - nfs: fix UAF in direct writes (Josef Bacik) [task:217568] {CVE-2024-26958}
  - net/mlx5: Fix bridge mode operations when there are no VFs (Benjamin Poirier) [task:368537] {CVE-2024-46857}
  - net/mlx5: E-switch, Introduce flag to indicate if fdb table is created (Chris Mi) [task:368537]
  - staging: iio: frequency: ad9834: Validate frequency parameter value (Aleksandr Mishin) [task:372895] {CVE-2024-47663}
  - staging: iio: frequency: ad9833: Load clock using clock framework (Beniamin Bia) [task:372895]
  - staging: iio: frequency: ad9833: Get frequency value statically (Beniamin Bia) [task:372895]
  - nilfs2: fix state management in error path of log writing function (Ryusuke Konishi) [task:372903] {CVE-2024-47669}
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead (Emmanuel Grumbach) [task:372897] {CVE-2024-47672}
  - scsi: pm80xx: Set phy->enable_completion only when we wait for it (Igor Pylypiv) [task:372775] {CVE-2024-47666}
  - scsi: pm80xx: Add fatal error checks (Changyuan Lyu) [task:372775]
  - scsi: pm80xx: Fix for phy enable/disable functionality (Deepak Ukey) [task:372775]
  - smack: tcp: ipv4, fix incorrect labeling (Casey Schaufler) [task:372671] {CVE-2024-47659}
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Kent Overstreet) [task:372519] {CVE-2024-47668}
  - xfs: make sure sb_fdblocks is non-negative (Wengang Wang) [task:354053]
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [task:368153] {CVE-2024-46855}
  - ASoC: meson: axg-card: fix 'use-after-free' (Arseniy Krasnov) [task:368151] {CVE-2024-46849}
  - ethtool: check device is present when getting link settings (Jamie Bainbridge) [task:364141] {CVE-2024-46679}
  - net/mlx5: Add a timeout to acquire the command queue semaphore (Akiva Goldberger) [task:350687] {CVE-2024-38556}
  - drm/amd/display: Check BIOS images before it is used (Alex Hung) [task:368525] {CVE-2024-46809}
  - drm/amdgpu: Replace one-elements array with flex-array members (Paulo Miguel Almeida) [task:368525]
  - btrfs: clean up our handling of refs == 0 in snapshot delete (Josef Bacik) [task:368305] {CVE-2024-46840}
  - drm/amd/display: Check gpio_id before used as array index (Alex Hung) [task:368129] {CVE-2024-46818}
  - drm/amd/display: Check hpd_gpio for NULL before accessing it (Harry Wentland) [task:368129]
  - drm/amd/display: add gpio lock/unlock (Chiawen Huang) [task:368129]
  - drm/amd/display: fix sporadic multiple aux transaction failure (Yogesh Mohan Marimuthu) [task:368129]
  - drm/amd/display: add query HPD interface. (Chiawen Huang) [task:368129]
  - net: dpaa: Pad packets to ETH_ZLEN (Sean Anderson) [task:368157] {CVE-2024-46854}
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling (Zack Rusin) [task:351069] {CVE-2024-43863}
  - drm/vmwgfx/vmwgfx_fence: Add, remove and demote various documentation params/headers (Lee Jones) [task:351069] {CVE-2024-43863}
  - perf/x86/intel: Limit the period on Haswell (Kan Liang) {CVE-2024-46848}
  - driver: iio: add missing checks on iio_info's callback access (Julien Stephan) [task:363791] {CVE-2024-46715}
  - sched/smt: Fix unbalance sched_smt_present dec/inc (Yang Yingliang) [task:357951] {CVE-2024-44958}
  - xfs: don't account extra agfl blocks as available (Brian Foster) [task:354053]
  - ASoC: topology: Fix route memory corruption (Amadeusz Sławiński) [task:346623] {CVE-2024-41069}
  - gtp: fix a potential NULL pointer dereference (Cong Wang) [task:363647] {CVE-2024-46677}
  - arm64/sparsemem: reduce SECTION_SIZE_BITS (Sudarshan Rajagopalan) [bug:219958]
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (Ma Jun) [task:364199] {CVE-2024-46724}
  - drm/amd/pm: fix the Out-of-bounds read warning (Jesse Zhang) [task:363753] {CVE-2024-46731}
  - memcg_write_event_control(): fix a user-triggerable oops (Al Viro) [task:363965] {CVE-2024-45021}
  - drm/amd/display: Add null checker before passing variables (Alex Hung) [task:352183] {CVE-2024-43902}
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Dragos Tatulea) [task:363773] {CVE-2024-44970}
  - ila: call nf_unregister_net_hooks() sooner (Eric Dumazet) [task:364193] {CVE-2024-46782}
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (David Fernandez Gonzalez) [task:364051] {CVE-2024-46738}
  - tcp_bpf: fix return value of tcp_bpf_sendmsg() (Cong Wang) [task:364047] {CVE-2024-46783}
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (Guenter Roeck) [task:364043] {CVE-2024-46756}
  - scsi: aacraid: Fix double-free on probe failure (Ben Hutchings) [task:363975] {CVE-2024-46673}
  - dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor (Olivier Dautricourt) [task:363973] {CVE-2024-46716}
  - dmaengine: altera-msgdma: Correctly handle descriptor callbacks (Lars-Peter Clausen) [task:363973]
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes (Guenter Roeck) [task:363963] {CVE-2024-46758}
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (Camila Alvarez) [task:364071] {CVE-2024-46747}
  - Squashfs: sanity check symbolic link size (Phillip Lougher) [task:364131] {CVE-2024-46744}
  - mmc: mmc_test: Fix NULL dereference on allocation failure (Dan Carpenter) [task:364203] {CVE-2024-45028}
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes (Guenter Roeck) [task:364195] {CVE-2024-46757}
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (Sascha Hauer) [task:363957] {CVE-2024-46755}
  - apparmor: fix possible NULL pointer dereference (Leesoo Ahn) [task:364181] {CVE-2024-46721}
  - ACPI: extlog: fix NULL pointer dereference check (Prarit Bhargava) [task:364161] {CVE-2023-52605}
  - usb: dwc3: core: Prevent USB core invalid event buffer address access (Selvarasu Ganesan) [task:364045] {CVE-2024-46675}
  - usb: dwc3: core: Skip setting event buffers for host only controllers (Krishna Kurapati) [task:364045]
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes (Guenter Roeck) [task:363803] {CVE-2024-46759}
  - drm/amdgpu: fix ucode out-of-bounds read warning (Tim Huang) [task:364077] {CVE-2024-46723}
  - bpf: Remove tst_run from lwt_seg6local_prog_ops. (Sebastian Andrzej Siewior) [task:364073] {CVE-2024-46754}
  - PCI: Add missing bridge lock to pci_bus_lock() (Dan Williams) [task:364081] {CVE-2024-46750}
  - usb: dwc3: st: fix probed platform device ref count on probe error path (Krzysztof Kozlowski) [task:364169] {CVE-2024-46674}
  - sch/netem: fix use after free in netem_dequeue (Stephen Hemminger) [task:364105] {CVE-2024-46800}
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (Krishna Kumar) [task:364063] {CVE-2024-46761}
  - nfc: pn533: Add poll mod list filling check (Aleksandr Mishin) [task:364099] {CVE-2024-46676}
  - nfc: pn533: Add autopoll capability (Lars Poeschel) [task:364099]
  - nfc: pn533: Add dev_up/dev_down hooks to phy_ops (Lars Poeschel) [task:364099]
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). (Kuniyuki Iwashima) [task:364095]
  - can: bcm: Remove proc entry when dev is unregistered. (Kuniyuki Iwashima) [task:364095] {CVE-2024-46771}
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk (Stefan Wiehler) [task:364093] {CVE-2024-46743}
  - binder: fix UAF caused by offsets overwrite (Carlos Llamas) [task:364173] {CVE-2024-46740}
  - nilfs2: protect references to superblock parameters exposed in sysfs (Ryusuke Konishi) [task:364057] {CVE-2024-46780}
  - nilfs2: replace snprintf in show functions with sysfs_emit (Qing Wang) [task:364057]
  - Revert "btrfs: qgroup: fix quota root leak after quota disable failure" (wangdicheng) [task:347151]
  - pinctrl: single: fix potential NULL dereference in pcs_get_function() (Ma Ke) [task:363769] {CVE-2024-46685}
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (Saurabh Sengar) [task:363759] {CVE-2024-46739}
  - drm/amdgpu: fix mc_data out-of-bounds read warning (Tim Huang) [task:363795] {CVE-2024-46722}
  - netem: fix return value if duplicate enqueue fails (Stephen Hemminger) [task:364103] {CVE-2024-45016}
  - net: netem: fix use after free and double free with packet corruption (Jakub Kicinski) [task:364103]
  - Input: uinput - reject requests with unreasonable number of slots (Dmitry Torokhov) [task:364055] {CVE-2024-46745}
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE (Pablo Neira Ayuso) [task:352231] {CVE-2024-42321}
  - sched/fair: Fix NULL pointer in pick_next_task_fair (Bing Huang) [task:134949, task:378163]
  - inet: frags: re-introduce skb coalescing for local delivery (Guillaume Nault) [task:364261]
  - 6lowpan: use rbtree for IP frag queue (Peter Oskolkov) [task:364261]
  - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Hans de Goede) [task:370865] {CVE-2021-47073}
  - crypto: qcom-rng - ensure buffer for generate is completely filled (Brian Masney) [task:370835]
  - net/mlx5: Fix HW spec violation configuring uplink (Eli Cohen) [task:365327]
  - net/mlx5e: Add missing capability check for uplink follow (Aya Levin) [task:365327]
  - net/mlx5: Add ts_cqe_to_dest_cqn related bits (Eran Ben Elisha) [task:365327]
  - hfsplus: prevent corruption in shrinking truncate (Jouni Roivas) [task:370845, task:158827] {CVE-2021-46989}
  - ACPI: custom_method: fix potential use-after-free issue (Mark Langsdorf) [task:370843, task:153627] {CVE-2021-46966}
  - btrfs: do not BUG_ON in link_to_fixup_dir (Josef Bacik) [task:158827, task:370885]
  - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly Kuznetsov) [task:370239] {CVE-2022-2153}
  - crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo (Pingfan Liu) [bug:281263]
  - crash_core, vmcoreinfo: Append 'MAX_PHYSMEM_BITS' to vmcoreinfo (Bhupesh Sharma) [bug:281263]
  - kdump: Document kernel data exported in the vmcoreinfo note (Lianbo Jiang) [bug:281263]
  - kabi: fix the kabi issue caused by the addition of 'reset_in_progress' in struct usb_device (shitao) [task:370243]
  - USB: core: Prevent nested device-reset calls (Alan Stern) [task:370243] {CVE-2022-4662}
  - fix CONFIG_ARCH_PHYITUM spelling mistake (jianghaoran) [task:364023]
  - ocfs2: fix a deadlock when commit trans (Joseph Qi) [task:221975]
  - ocfs2: fix race between searching chunks and release journal_head from buffer_head (Gautham Ananthakrishna) [task:221975] {CVE-2021-47493}
  - jbd2: Make state lock a spinlock (Thomas Gleixner) [task:221975]
  - jbd2: Remove jbd_trylock_bh_state() (Thomas Gleixner) [task:221975]
  - jbd2: Simplify journal_unmap_buffer() (Thomas Gleixner) [task:221975]
  - jbd2: export jbd2_journal_[grab|put]_journal_head (Joseph Qi) [task:221975]
  - bpf: Prevent tail call between progs attached to different hooks (Xu Kuohai) [task:376069] {CVE-2024-50063}
  - bpf: Fix potential race in tail call compatibility check (Toke Høiland-Jørgensen) [task:376069]
  - ext4: improve error recovery code paths in __ext4_remount() (Theodore Ts'o) [task:370801] {CVE-2024-0775}
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (Tong Zhang) [task:158827] {CVE-2021-47056}
  - nvme: ensure subsystem reset is single threaded (Keith Busch) [bug:153851] {CVE-2022-3169}
  - nvme: Wait for reset state when required (Keith Busch) [bug:150386]
  - nvme: Prevent resets during paused controller state (Keith Busch) [task:85444]
  - nvme-pci: Sync queues on reset (Keith Busch) [bug:150386]
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (Sungwoo Kim) [task:223107] {CVE-2024-36013}
  - Bluetooth: Remove BT_HS (Luiz Augusto von Dentz) [task:223107]
  - Bluetooth: remove redundant assignment to variable icid (Colin Ian King) [task:223107]
  - Bluetooth: Remove unused declaration amp_read_loc_info() (Yue Haibing) [task:353905]
  - Bluetooth: a2mp: Use struct_size() helper (Gustavo A. R. Silva) [task:353905]
  - net: caif: fix memory leak in cfusbl_device_notify (Pavel Skripkin) [task:370875] {CVE-2021-47121}
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [task:370837] {CVE-2021-46955}
  - ethernet:enic: Fix a use after free bug in enic_hard_start_xmit (Lv Yunlong) [task:370851] {CVE-2021-46998}
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Lv Yunlong) [task:370853] {CVE-2021-47013}
  - RDMA/rxe: Clear all QP fields if creation failed (Leon Romanovsky) [task:370867] {CVE-2021-47078}
  - inet: fully convert sk->sk_rx_dst to RCU rules (Eric Dumazet) [task:370873] {CVE-2021-47103}
  - net: dsa: mt7530: fix VLAN traffic leaks (DENG Qingfang) [task:370889] {CVE-2021-47160}
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (Mathias Nyman) [task:357961] {CVE-2024-45006}
  - soc: qcom: cmd-db: Map shared memory as WC, not WB (Volodymyr Babchuk) [task:364171] {CVE-2024-46689}
  - net: caif: fix memory leak in caif_device_notify (Pavel Skripkin) [task:370887] {CVE-2021-47122}
  - net: caif: add proper error handling (Pavel Skripkin) [task:370887]
  - net: caif: added cfserl_release function (Pavel Skripkin) [task:370887]
  - Add HYGON retbleed= boot parameter (George Guo) [bug:247197]
  - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra) [bug:247197]
  - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta) [bug:247197]
  - x86/entry: Add kernel IBRS implementation (Peter Zijlstra) [bug:247197]
  - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra) [bug:247197]
  - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre) [bug:247197]
  - kbuild: delete the remaining -Wdeclaration-after-statement (zhouyuhang) [task:368863]
  - bpf: Fix toctou on read-only map's constant scalar tracking (Daniel Borkmann) [task:122412, task:370785] {CVE-2021-4001}
  - vsock/virtio: free queued packets when closing socket (Stefano Garzarella) [task:169356] {CVE-2021-47024}
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Ye Bin) [task:370803] {CVE-2021-33631}
  - kernfs: fix potential NULL dereference in __kernfs_remove (Yushan Zhou) [task:352489]
  - kernfs: fix NULL dereferencing in kernfs_remove (Minchan Kim) [task:352489]
  - kernfs: remove redundant kernfs_rwsem declaration. (Imran Khan) [task:352489]
  - kernfs: prevent early freeing of root node (Minchan Kim) [task:352489]
  - kernfs: switch global kernfs_rwsem lock to per-fs lock (Minchan Kim) [task:352489]
  - kernfs: don't create a negative dentry if inactive node exists (Ian Kent) [task:210868]
  - kernfs: also call kernfs_set_rev() for positive dentry (Hou Tao) [task:210868]
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent) [task:210868]
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent) [task:210868]
  - kernfs: switch kernfs to use an rwsem (Ian Kent) [task:210868]
  - kernfs: use VFS negative dentry caching (Ian Kent) [task:210868]
  - kernfs: add a revision to identify directory node changes (Ian Kent) [task:210868]
  - kbuild: Drop -Wdeclaration-after-statement (Peter Zijlstra) [task:368863]
  - ALSA: line6: Fix racy access to midibuf (Takashi Iwai) [task:364721]
  - dma-direct: Leak pages on dma_set_decrypted() failure (Rick Edgecombe) [task:222011] {CVE-2024-35939}
  - skmsg: Skip zero length skb in sk_msg_recvmsg (Geliang Tang) [task:346383] {CVE-2024-41048}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.44.v2207
changelog:
  - net/mlx5: Fix variable not being completed when function returns (Chenguang Zhao) [task:412201]
  - block: Fix kabi caused by blk.h (Zheng Tan) [task:381405]
  - block: fix kabi broken in stat_group (Zheng Tan) [task:381405]
  - block: support to account io_ticks precisely (Yu Kuai) [task:381405]
  - block: fix the problem of io_ticks becoming smaller (Chunguang Xu) [task:381405]
  - block: account merge of two requests (Konstantin Khlebnikov) [task:381405]
  - block: don't call part_{inc,dec}_in_flight for blk-mq devices (Christoph Hellwig) [task:381405]
  - block: remove the unused q argument to part_in_flight and part_in_flight_rw (Christoph Hellwig) [task:381405]
  - block: move the blk-mq calls out of part_in_flight{,_rw} (Christoph Hellwig) [task:381405]
  - block: avoid double io accounting for flush request (Ming Lei) [task:381405]
  - block/diskstats: accumulate all per-cpu counters in one pass (Konstantin Khlebnikov) [task:381405]
  - block: mark part_in_flight and part_in_flight_rw static (Christoph Hellwig) [task:381405]
  - block: move sysfs methods shared by disks and partitions to genhd.c (Christoph Hellwig) [task:381405]
  - block: add iostat counters for flush requests (Konstantin Khlebnikov) [task:381405]
  - block/diskstats: more accurate approximation of io_ticks for slow disks (Konstantin Khlebnikov) [task:169357]
  - drm/vc4: fix compile error (Lu Yao) [task:402971, task:417959]
  - i40e: Fix freeing of uninitialized misc IRQ vector (Sylwester Dziedziuch) [task:416193]
  - Revert "blk_poll: Fix the logic missing from the previous migration patch" (liuqiqi) [task:421191]
  - io_uring: don't defer put of cancelled ltimeout (Pavel Begunkov) [task:105694, task:370255]
  - net: Fix icmp host relookup triggering ip_rt_bug (Dong Chenchen) [task:410447] {CVE-2024-56647}
  - bpf: fix OOB devmap writes when deleting elements (Maciej Fijalkowski) [task:410065]
  - xsk: fix OOB map writes when deleting elements (Maciej Fijalkowski) [task:410065] {CVE-2024-56614}
  - drivers/gmjstcm: import CVE-2011-1160 CVE-2011-1162 fixes to tcm.c (Li ZhiGang) [task:406609] {CVE-2024-24891}
  - drivers/gmjstcm: fix a dev_err() call in spi tcm device probe (Li ZhiGang) [task:406609]
  - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Sidraya Jayagond) [task:410367] {CVE-2024-53210}
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (Ryusuke Konishi) [task:410479] {CVE-2024-56619}
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection (Takashi Iwai) [task:410395] {CVE-2024-56532}
  - hfsplus: don't query the device logical block size multiple times (Thadeu Lima de Souza Cascardo) [task:410029] {CVE-2024-56548}
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() (Dan Carpenter) [task:408543] {CVE-2024-53158}
  - NFSD: Prevent a potential integer overflow (Chuck Lever) [task:408541] {CVE-2024-53146}
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter() (Dmitry Antipov) [task:408545] {CVE-2024-53155}
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware (Luo Qiu) [task:408531] {CVE-2024-53157}
  - net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (Furong Xu) [task:391021] {CVE-2024-53058}
  - kylin_extend: fix kernel NULL pointer dereference (huanfuxi) [task:391387]
  - security: fix bug while get path by inode (penghuaihe) [task:387321]
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (Al Viro) [task:406597] {CVE-2024-42265}
  - drm/amdgpu: change vm->task_info handling (Shashank Sharma) [task:347157] {CVE-2024-41008}
  - LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context (Huacai Chen) [task:387571] {CVE-2024-50111}
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (Jeongjun Park) [task:408553] {CVE-2024-53156}
  - wifi: iwlegacy: Clear stale interrupts before resuming device (Ville Syrjälä) [task:387911] {CVE-2024-50234}
  - net: do not delay dst_entries_add() in dst_release() (Eric Dumazet) [task:380195] {CVE-2024-50036}
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() (Chao Yu) [task:376109] {CVE-2024-47691}
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Benoit Sevens) [task:403255] {CVE-2024-53104}
  - drm/vc4: fix compile error (Lu Yao) [task:397559]
  - btrfs: fix the length of reserved qgroup to free (Haisu Wang) [task:364175]
  - btrfs: fix qgroup reserve leaks in cow_file_range (Boris Burkov) [task:364175] {CVE-2024-46733}
  - io_uring: disable polling pollfree files (Pavel Begunkov) [task:179288, task:370255] {CVE-2022-3176}
  - io_uring: fix race between timeout flush and removal (Jens Axboe) [task:370255] {CVE-2022-29582}
  - block: add REQ_HIPRI and inherit it from IOCB_HIPRI (Jens Axboe) [task:107661, task:370255]
  - blk_poll: Fix the logic missing from the previous migration patch (Jackie Liu) [task:107661]
  - io_uring: remove double poll entry on arm failure (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: explicitly count entries for poll reqs (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix timeout cancel return code (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't iterate io_uring_cancel_files() (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix link lookup racing with link timeout (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't forget to task-cancel drained reqs (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix overflowed cancel w/ linked ->files (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: simplify nxt propagation in io_queue_sqe (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: always clear LINK_TIMEOUT after cancel (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't adjust LINK_HEAD in cancel ltimeout (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: remove opcode check on ltimeout kill (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't reuse linked_timeout (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix racy REQ_F_LINK_TIMEOUT clearing (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: do poll's hash_node init in common code (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: inline io_poll_task_handler() (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: make cached_cq_overflow non atomic_t (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix REQ_F_COMP_LOCKED by killing it (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: dig out COMP_LOCK from deep call chain (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't unnecessarily clear F_LINK_TIMEOUT (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't set COMP_LOCKED if won't put (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't delay io_init_req() error check (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: remove timeout.list after hrtimer cancel (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: use a separate struct for timeout_remove (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: mark statx/files_update/epoll_ctl as non-SQPOLL (Jens Axboe) [task:105694, task:370255]
  - Revert "io_uring: fix ltout double free on completion race" (Jackie Liu) [task:105694, task:370255]
  - io_uring: don't bounce block based -EAGAIN retry off task_work (Jens Axboe) [task:103049, task:370255]
  - io_uring: fix break condition for __io_uring_register() waiting (Jens Axboe) [task:103049, task:370255]
  - io_uring: process task work in io_uring_register() (Jens Axboe) [task:103049, task:370255]
  - bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop (Toke Høiland-Jørgensen) [task:397467]
  - bpf: Always return target ifindex in bpf_fib_lookup (Toke Høiland-Jørgensen) [task:397467]
  - KABI: fix mini_Qdisc ABI breakage (chenyuan) [task:397467]
  - net: sched: Pass ingress block to tcf_classify_ingress (Paul Blakey) [task:397467]
  - net: sched: Introduce ingress classification function (Paul Blakey) [task:397467]
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (Chengchang Tang) [task:376269] {CVE-2024-47735}
  - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE (Luiz Augusto von Dentz) [task:396699] {CVE-2024-8805, CVE-2024-8805}
  - Input: appletouch - initialize work before device registration (Pavel Skripkin) [task:160493, task:370827] {CVE-2021-46932}
  - i2c: validate user data in compat ioctl (Pavel Skripkin) [task:160493, task:370823] {CVE-2021-46934}
  - binder: fix async_free_space accounting for empty parcels (Todd Kjos) [task:160493, task:370819] {CVE-2021-46935}
  - HID: usbhid: fix info leak in hid_submit_ctrl (Anirudh Rayabharam) [task:158827, task:370811] {CVE-2021-46906}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Yi Yang) [task:400455] {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command (Daniel Starke) [task:400455]
  - soundwire: stream: fix memory leak in stream config error path (Rander Wang) [task:158827, task:370857] {CVE-2021-47020}
  - bus: qcom: Put child node before return (Pan Bian) [task:158827, task:370863] {CVE-2021-47054}
  - ext4: fix timer use-after-free on failed mount (Xiaxi Shen) [task:376211] {CVE-2024-49960}
  - fsl/fman: Fix refcount handling of fman-related devices (Aleksandr Mishin) [task:387475] {CVE-2024-50166}
  - net: fman: Unregister ethernet device on removal (Sean Anderson) [task:164562]
  - fsl/fman: Save device references taken in mac_probe() (Aleksandr Mishin) [task:387475]
  - net: fman: Use physical address for userspace interfaces (Sean Anderson) [task:387475]
  - net: dpaa: Use mac_dev variable in dpaa_netdev_init (Sean Anderson) [task:387475]
  - net: fman: Clean up error handling (Sean Anderson) [task:387475]
  - net: fman: Map the base address once (Sean Anderson) [task:387475]
  - net: fman: memac: Uninitialized variable on error path (Dan Carpenter) [task:387475]
  - net: fman: Configure fixed link in memac_initialization (Sean Anderson) [task:387475]
  - net: fman: Move struct dev to mac_device (Sean Anderson) [task:387475]
  - fsl/fman: use resource_size (Julia Lawall) [task:387475]
  - dpaa_eth: Use random MAC address when none is given (Madalin Bucur) [task:387475]
  - net: fman: Get PCS node in per-mac init (Sean Anderson) [task:387475]
  - fsl/fman: Check for null pointer after calling devm_ioremap (Jiasheng Jiang) [task:160493]
  - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Shradha Gupta) [task:391031] {CVE-2024-26820}
  - hv_netvsc: use netif_is_bond_master() instead of open code (Juhee Kang) [task:391031]
  - hv_netvsc: Mark VF as slave before exposing it to user-mode (Long Li) [task:391031]
  - hv_netvsc: Fix race between VF offering and VF association message from host (Gaurav Kohli) [task:164562]
  - f2fs: get rid of online repaire on corrupted directory (Chao Yu) [task:375661] {CVE-2024-47690}
  - fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext (Eric Biggers) [task:158034]
  - fscrypt: only set dentry_operations on ciphertext dentries (Eric Biggers) [task:158034]
  - fscrypt: clean up and improve dentry revalidation (Eric Biggers) [task:158034]
  - HYGON: Add psp interrupt x86 register on hygon 4G platform (chench) [task:380133]
  - HYGON: crypto: ccp: Add CCP/PSP PCI interface on Hygon hardware (Xin Jiang) [task:176679]
  - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [task:330540] {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label (Bob Peterson) [task:330540]
  - gfs2: Don't call dlm after protocol is unmounted (Bob Peterson) [task:160493]
  - gfs2: Don't skip dlm unlock if glock has an lvb (Bob Peterson) [task:158034]
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow (VanGiang Nguyen) [task:376197] {CVE-2024-47739}
  - padata: unbind parallel jobs from specific CPUs (Daniel Jordan) [task:160493]
  - padata: use separate workqueues for parallel and serial work (Daniel Jordan) [task:160493]
  - padata, pcrypt: take CPU hotplug lock internally in padata_alloc_possible (Daniel Jordan) [task:160493]
  - crypto: pcrypt - remove padata cpumask notifier (Daniel Jordan) [task:160493]
  - padata: make padata_do_parallel find alternate callback CPU (Daniel Jordan) [task:160493]
  - crypto/pcrypt: Replace synchronize_rcu_bh() with synchronize_rcu() (Paul E. McKenney) [task:160493]
  - crypto: pcrypt - Fix user-after-free on module unload (Herbert Xu) [task:153627]
  - padata: allocate workqueue internally (Daniel Jordan) [task:160493]
  - mm: avoid leaving partial pfn mappings around in error case (Linus Torvalds) [task:372881] {CVE-2024-47674}
  - mm: add remap_pfn_range_notrack (Christoph Hellwig) [task:372881]
  - mm/memory.c: make remap_pfn_range() reject unaligned addr (Alex Zhang) [task:372881]
  - mm: fix ambiguous comments for better code readability (chenqiwu) [task:372881]
  - mm: clarify a confusing comment for remap_pfn_range() (WANG Wenhu) [task:372881]
  - docs/core-api/mm: fix return value descriptions in mm/ (Mike Rapoport) [task:372881]
  - page cache: Add and replace pages using the XArray (Matthew Wilcox) [task:118664]
  - virtio-mmio: don't break lifecycle of vm_dev (Wolfram Sang) [task:379857]
  - virtio-mmio: convert to devm_platform_ioremap_resource (Yangtao Li) [task:377245]
  - virtio-mmio: Use to_virtio_mmio_device() to simply code (Tang Bin) [task:379857]
  - slip: make slhc_remember() more robust against malicious packets (Eric Dumazet) [task:376251] {CVE-2024-50033}
  - net: delete "register" keyword (Alexey Dobriyan) [task:376251]
  - slip: make slhc_compress() more robust against malicious packets (Eric Dumazet) [task:155707]
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (Devyn Liu) [task:372557] {CVE-2024-47664}
  - spi: Add HiSilicon SPI Controller Driver for Kunpeng SoCs (Jay Fang) [task:182123]
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Zhu Yanjun) [task:375617] {CVE-2024-47696}
  - RDMA/iwcm: Release resources if iw_cm module initialization fails (Leon Romanovsky) [task:160493]
  - net/ncsi: Disable the ncsi work before freeing the associated structure (Eddie James) [task:376379] {CVE-2024-49945}
  - net/ncsi: Fix netlink registration (Joel Stanley) [task:158034]
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release() (Zeng Heng) [task:376343] {CVE-2022-48961}
  - net: mdio: use device_set_node() to setup both fwnode and of (Ioana Ciornei) [task:376343]
  - driver core: add a helper to setup both the of_node and fwnode of a device (Ioana Ciornei) [task:376343]
  - media: av7110: fix a spectre vulnerability (Mauro Carvalho Chehab) [task:390755] {CVE-2024-50289}
  - firmware_loader: Block path traversal (Jann Horn) [task:375665] {CVE-2024-47742}
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (Hyunwoo Kim) [task:396803] {CVE-2024-53103}
  - net: fix data-races around sk->sk_forward_alloc (Wang Liang) [task:396799] {CVE-2024-53124}
  - filemap: Fix bounds checking in filemap_read() (Trond Myklebust) [task:390893] {CVE-2024-50272}
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (Ryusuke Konishi) [task:398629] {CVE-2024-53130}
  - netlink: terminate outstanding dump on socket close (Jakub Kicinski) [task:398631] {CVE-2024-53140}
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (Ryusuke Konishi) [task:398633] {CVE-2024-53131}
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (Jeongjun Park) [task:398615] {CVE-2024-53141}
  - security/kysec: Call put_cred() before function return (chengang) [task:390393]
  - fs: Fix uninitialized value issue in from_kuid and from_kgid (Alessandro Zanni) [task:396801] {CVE-2024-53101}
  - ocfs2: uncache inode which has failed entering the group (Dmitry Antipov) [task:396817] {CVE-2024-53112}
  - f2fs: Require FMODE_WRITE for atomic write ioctls (Jann Horn) [task:376135] {CVE-2024-47740}
  - mm: split critical region in remap_file_pages() and invoke LSMs in between (Kirill A. Shutemov) [task:376325]
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() (Shu Han) [task:376325] {CVE-2024-47745}
  - mm/mmap.c: don't unlock VMAs in remap_file_pages() (Liam Howlett) [task:376325]
  - net/mlx5: fs, lock FTE when checking if active (Mark Bloch) [task:396807] {CVE-2024-53121}
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (Al Viro) [task:363785] {CVE-2024-45025}
  - s390/cio: rename bitmap_size() -> idset_bitmap_size() (Alexander Lobakin) [task:363785]
  - bitmap: introduce generic optimized bitmap_size() (Alexander Lobakin) [task:363785]
  - tools: move alignment-related macros to new <linux/align.h> (Alexander Lobakin) [task:363785]
  - tools headers UAPI: Sync linux/const.h with the kernel headers (Arnaldo Carvalho de Melo) [task:363785]
  - tools headers: Grab copy of linux/const.h, needed by linux/bits.h (Arnaldo Carvalho de Melo) [task:363785]
  - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA (Hans de Goede) [task:387555] {CVE-2024-50134}
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (Pedro Tammela) [task:392639] {CVE-2024-53057}
  - uprobes: fix kernel info leak via "[uprobes]" vma (Oleg Nesterov) [task:375973] {CVE-2024-49975}
  - ext4: update orig_path in ext4_find_extent() (Baokun Li) [task:376209] {CVE-2024-49881}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() (Baokun Li) [task:376087] {CVE-2024-49884}
  - ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path (Theodore Ts'o) [task:376087]
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (Dmitry Antipov) [task:380475] {CVE-2024-47713}
  - i40e: fix race condition by adding filter's intermediate sync state (Aleksandr Loktionov) [task:390579] {CVE-2024-53088}
  - i40e: fix i40e_count_filters() to count only active/new filters (Aleksandr Loktionov) [task:390579]
  - bcache: remove unused bch_mark_cache_readahead function def in stats.h (Lin Feng) [task:222079]
  - bcache: avoid oversized read request in cache missing code path (Coly Li) [task:222079] {CVE-2021-47275}
  - bcache: remove bcache device self-defined readahead (Coly Li) [task:222079]
  - uprobe: avoid out-of-bounds memory access of fetching args (Qiao Ma) [task:380099] {CVE-2024-50067}
  - security/keys: fix slab-out-of-bounds in key_task_permission (Chen Ridong) [task:390885] {CVE-2024-50301}
  - nfs: Fix KMSAN warning in decode_getfattr_attrs() (Roberto Sassu) [task:391029] {CVE-2024-53066}
  - usb: musb: sunxi: Fix accessing an released usb phy (Zijun Hu) [task:390745] {CVE-2024-50269}
  - media: s5p-jpeg: prevent buffer overflows (Mauro Carvalho Chehab) [task:391027] {CVE-2024-53061}
  - sctp: properly validate chunk size in sctp_sf_ootb() (Xin Long) [task:390741] {CVE-2024-50299}
  - staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() (Zicheng Qu) [task:387919] {CVE-2024-50233}
  - staging: iio: ad9832: use clock framework for clock reference (Marcelo Schmitt) [task:387919]
  - staging: iio: ad9832: organize includes (Marcelo Schmitt) [task:387919]
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (Felix Fietkau) [task:390869] {CVE-2024-50237}
  - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction (Chen Ridong) [task:390867] {CVE-2024-53054}
  - userfaultfd: fix checks for huge PMDs (Jann Horn) [task:363981] {CVE-2024-46787}
  - media: dvbdev: prevent the risk of out of memory access (Mauro Carvalho Chehab) [task:390895] {CVE-2024-53063}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (Ido Schimmel) [task:390739] {CVE-2024-50304}
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Baokun Li) [task:344489] {CVE-2024-40998}
  - HID: core: zero-initialize the report buffer (Jiri Kosina) [task:392647] {CVE-2024-50302}
  - media: cx24116: prevent overflows on SNR calculus (Mauro Carvalho Chehab) [task:392635] {CVE-2024-50290}
  - media: v4l2-tpg: prevent the risk of a division by zero (Mauro Carvalho Chehab) [task:392643] {CVE-2024-50287}
  - security/kysec: fix crash for task kill (mengdehui) [task:390393]
  - dm cache: fix potential out-of-bounds access on the first resume (Ming-Hung Tsai) [task:390571] {CVE-2024-50278}
  - dm cache: optimize dirty bit checking with find_next_bit when resizing (Ming-Hung Tsai) [task:390571]
  - net/sched: accept TCA_STAB only for root qdisc (Eric Dumazet) [task:375649] {CVE-2024-50039}
  - net: sched: refactor grafting Qdiscs with a parent (Jakub Kicinski) [task:375649]
  - nilfs2: propagate directory read errors from nilfs_find_entry() (Ryusuke Konishi) [task:387959] {CVE-2024-50202}
  - btrfs: reinitialize delayed ref list after deleting it from the list (Filipe Manana) [task:390749] {CVE-2024-50273}
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() (Andrew Kanner) [task:390611] {CVE-2024-50265}
  - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (Edward Adam Davis) [task:390609] {CVE-2024-50218}
  - USB: serial: io_edgeport: fix use after free in debug printk (Dan Carpenter) [task:390585] {CVE-2024-50267}
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Hyunwoo Kim) [task:390583] {CVE-2024-50264}
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Kuniyuki Iwashima) [task:387777] {CVE-2024-50154}
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing (Ming-Hung Tsai) [task:390581] {CVE-2024-50279}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size (Wang Liang) [task:387479] {CVE-2024-50258}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Sean Christopherson) [task:387973] {CVE-2024-50115}
  - usb: typec: altmode should keep reference to parent (Thadeu Lima de Souza Cascardo) [task:387987] {CVE-2024-50150}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout (Luiz Augusto von Dentz) [task:387967] {CVE-2024-50125}
  - Bluetooth: call sock_hold earlier in sco_conn_del (Desmond Cheong Zhi Xi) [task:387967]
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [task:387575] {CVE-2024-50142}
  - parport: Proper fix for array out-of-bounds access (Takashi Iwai) [task:380221] {CVE-2024-50074}
  - nilfs2: fix kernel bug due to missing clearing of checked flag (Ryusuke Konishi) [task:387405] {CVE-2024-50230}
  - ixgbevf: Fix resource leak in ixgbevf_init_module() (Shang XiaoJing) [task:376297] {CVE-2022-49028}
  - sched/pelt: Fix attach_entity_load_avg() corner case (kuyo chang) [task:375977]
  - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Rutland) [task:387961] {CVE-2024-50099}
  - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() (Wang Hai) [task:387913] {CVE-2024-50168}
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister (Ye Bin) [task:387981] {CVE-2024-50148}
  - RDMA/mad: Improve handling of timed out WRs of mad agent (Saravanan Vajravel) [task:387985] {CVE-2024-50095}
  - IB/mad: Issue complete whenever decrements agent refcount (Shay Drory) [task:387985]
  - netfilter: Drop fragmented ndisc packets assembled in netfilter (Georg Kohmann) [bug:277233]
  - be2net: fix potential memory leak in be_xmit() (Wang Hai) [task:387921] {CVE-2024-50167}
  - ceph: remove the incorrect Fw reference check when dirtying pages (Xiubo Li) [task:387779] {CVE-2024-50179}
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (Pablo Neira Ayuso) [task:387917] {CVE-2024-50251}
  - nilfs2: fix kernel bug due to missing clearing of buffer delay flag (Ryusuke Konishi) [task:387481] {CVE-2024-50116}
  - drm/vc4: Stop the active perfmon before being destroyed (Maíra Canal) [task:387413] {CVE-2024-50187}
  - rtmutex: Drop rt_mutex::wait_lock before scheduling (Roland Xu) [task:368141] {CVE-2024-46829}
  - x86/ioapic: Handle allocation failures gracefully (Thomas Gleixner) [task:380139] {CVE-2024-49927}
  - net/mlx5e: Fix netif state handling (Shay Drory) [task:330508] {CVE-2024-38608}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Omar Sandoval) [task:380143] {CVE-2024-50082}
  - list: add "list_del_init_careful()" to go with "list_empty_careful()" (Linus Torvalds) [task:380143]
  - gpiolib: fix memory leak in gpiochip_setup_dev() (Zeng Heng) [task:376237] {CVE-2022-48975}
  - gpiolib: check the 'ngpios' property in core gpiolib code (Bartosz Golaszewski) [task:376237]
  - gpiolib: free device name on error path to fix kmemleak (Quanyang Wang) [task:376237]
  - gpio: gpiolib: Normalize return code variable name (Linus Walleij) [task:376237]
  - tcp: avoid too many retransmit packets (Eric Dumazet) [task:347169] {CVE-2024-41007}
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Eric Dumazet) [task:347169]
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong) [task:347169]
  - tcp: refactor tcp_retransmit_timer() (Eric Dumazet) [task:347169]
  - net/sched: act_mirred: don't override retval if we already lost the skb (Jakub Kicinski) [task:210475] {CVE-2024-26739}
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache (Oliver Upton) [task:200747] {CVE-2024-26598}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect (Luiz Augusto von Dentz) [task:375621] {CVE-2024-49950}
  - nfsd: map the EBADMSG to nfserr_io to avoid warning (Li Lingfeng) [task:376263] {CVE-2024-49875}
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl) [task:376133] {CVE-2024-50017}
  - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (Konrad Dybcio) [task:380141] {CVE-2024-49901}
  - bpf: Fix a sdiv overflow issue (Yonghong Song) [task:376399] {CVE-2024-49888}
  - bpf: Rename fixup_bpf_calls and add some comments (Brendan Jackman) [task:376399]
  - dm snapshot: fix lockup in dm_exception_table_exit (Mikulas Patocka) [task:221943] {CVE-2024-35805}
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (Ard Biesheuvel) [task:376275] {CVE-2024-49858}
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (Qu Wenruo) [task:376151] {CVE-2024-49868}
  - fsnotify: clear PARENT_WATCHED flags lazily (Amir Goldstein) [task:376261] {CVE-2024-47660}
  - xfs: Reduce unnecessary searches when searching for the best extents (Chi Zhiling) [task:377527]
  - jfs: Fix sanity check in dbMount (Dave Kleikamp) [task:376131]
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc() (Jeongjun Park) [task:376131] {CVE-2024-47723}
  - net/xen-netback: prevent UAF in xenvif_flush_hash() (Jeongjun Park) [task:380461] {CVE-2024-49936}
  - net: xen-netback: hash.c: Use built-in RCU list checking (Madhuparna Bhowmik) [task:380461]
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() (Jinjie Ruan) [task:380455] {CVE-2023-52917}
  - fou: fix initialization of grc (Muhammad Usama Anjum) [task:363977]
  - fou: Fix null-ptr-deref in GRO. (Kuniyuki Iwashima) [task:363977] {CVE-2024-46763}
  - gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers (Eric Dumazet) [task:363977]
  - gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers (Eric Dumazet) [task:363977]
  - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (Mike Marciniszyn) [task:225598] {CVE-2021-47523}
  - vfs: Don't evict inode under the inode lru traversing context (Zhihao Cheng) [task:358113] {CVE-2024-45003}
  - ACPI: sysfs: validate return type of _STR method (Thomas Weißschuh) [task:380101] {CVE-2024-49860}
  - drm/amdgpu/pm: Fix the null pointer dereference for smu7 (Ma Jun) [task:352623] {CVE-2024-43909}
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (Hersen Wu) [task:368523] {CVE-2024-46816}
  - ext4: no need to continue when the number of entries is 1 (Edward Adam Davis) [task:380197] {CVE-2024-49967}
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() (Gustavo A. R. Silva) [task:380459] {CVE-2024-50008}
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (Toke Høiland-Jørgensen) [task:379923] {CVE-2024-49938}
  - net: add more sanity checks to qdisc_pkt_len_init() (Eric Dumazet) [task:380237] {CVE-2024-49948}
  - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (Eric Dumazet) [task:376177] {CVE-2024-47707}
  - btrfs: don't balance btree inode pages from buffered write path (Nikolay Borisov) [task:375983]
  - netfilter: br_netfilter: fix panic with metadata_dst skb (Andy Roulin) [task:376437] {CVE-2024-50045}
  - drm/amd/pm: ensure the fw_info is not null before using it (Tim Huang) [task:376229] {CVE-2024-49890}
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (Lizhi Xu) [task:375655] {CVE-2024-49877}
  - tipc: guard against string buffer overrun (Simon Horman) [task:376129] {CVE-2024-49995}
  - ALSA: asihpi: Fix potential OOB array access (Takashi Iwai) [task:376313] {CVE-2024-50007}
  - iavf: Fix error handling in iavf_init_module() (Yuan Can) [task:376061] {CVE-2022-49027}
  - media: pci: cx23885: check cx23885_vdev_init() return (Hans Verkuil) [task:376301] {CVE-2023-52918}
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi) [task:371789]
  - nilfs2: fix missing cleanup on rollforward recovery error (Ryusuke Konishi) [task:363971] {CVE-2024-46781}
  - btrfs: replace BUG_ON() with error handling at update_ref_for_cow() (Filipe Manana) [task:363775] {CVE-2024-46752}
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [task:376159] {CVE-2024-49935}
  - ACPI: acpi_pad: add a missed blank line after declarations (Xiaofei Tan) [task:376159]
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue (Ma Ke) [task:376335] {CVE-2024-49879}
  - Bluetooth: hci_core: Fix leaking sent_cmd skb (Luiz Augusto von Dentz) [task:344623] {CVE-2022-48844}
  - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error (Daniel Borkmann) [task:375653] {CVE-2024-47728}
  - RDMA/cxgb4: Added NULL check for lookup_atid (Mikhail Lobanov) [task:376283] {CVE-2024-47749}
  - tcp: check skb is non-NULL in tcp_rto_delta_us() (Josh Hunt) [task:375609] {CVE-2024-47684}
  - rtc: cmos: Fix wake alarm breakage (Rafael J. Wysocki) [task:375407]
  - rtc: cmos: Fix event handler registration ordering issue (Rafael J. Wysocki) [task:375407] {CVE-2022-48953}
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Eric Dumazet) [task:375619] {CVE-2024-49949}
  - net/mlx5e: Fix use-after-free when reverting termination table (Roi Dayan) [task:375625] {CVE-2022-49025}
  - block, bfq: fix possible UAF for bfqq->bic with merge chain (Yu Kuai) [task:375629] {CVE-2024-47706}
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (Xin Long) [task:375633] {CVE-2024-49944}
  - MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed (Jiaxun Yang) [task:368269] {CVE-2024-46832}
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate() (Artem Sadovnikov) [task:375967] {CVE-2024-50006}
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() (Ryusuke Konishi) [task:375969] {CVE-2024-47699}
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption (Eric Dumazet) [task:376057] {CVE-2024-49952}
  - ppp: fix ppp_async_encode() illegal access (Eric Dumazet) [task:375965] {CVE-2024-50035}
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition (Kaixin Wang) [task:375963] {CVE-2024-50059}
  - nfsd: call cache_put if xdr_reserve_space returns NULL (Guoqing Jiang) [task:376185] {CVE-2024-47737}
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks (Lizhi Xu) [task:376163] {CVE-2024-49965}
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (Junlin Li) [task:375615] {CVE-2024-47697}
  - mailbox: bcm2835: Fix timeout during suspend mode (Stefan Wahren) [task:376341] {CVE-2024-49963}
  - nilfs2: fix potential oob read in nilfs_btree_check_delete() (Ryusuke Konishi) [task:376183] {CVE-2024-47757}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() (Baokun Li) [task:376347] {CVE-2024-49883}
  - ocfs2: cancel dqi_sync_work before freeing oinfo (Joseph Qi) [task:376203] {CVE-2024-49966}
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (Jonathan Cameron) [task:368125] {CVE-2024-46822}
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header (James Morse) [task:368125]
  - drm/amd/display: added NULL check at start of dc_validate_stream (winstang) [task:375221] {CVE-2024-46802}
  - ocfs2: reserve space for inline xattr before attaching reflink tree (Gautham Ananthakrishna) [task:376165] {CVE-2024-49958}
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount (Filipe Manana) [task:376329] {CVE-2024-49867}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Eric Dumazet) [task:376333] {CVE-2024-47685}
  - ACPI: battery: Fix possible crash when unregistering a battery hook (Armin Wolf) [task:376339] {CVE-2024-49955}
  - ACPI: battery: Simplify battery hook locking (Armin Wolf) [task:376339]
  - net: ethernet: nixge: fix NULL dereference (Yuri Karpov) [task:376191] {CVE-2022-49019}
  - net: nixge: Address compiler warnings when building for i386 (Moritz Fischer) [task:376191]
  - net: nixge: Add support for 64-bit platforms (Moritz Fischer) [task:376191]
  - ext4: fix double brelse() the buffer of the extents path (Baokun Li) [task:376207] {CVE-2024-49882}
  - vfs: fix race between evice_inodes() and find_inode()&iput() (Julian Sun) [task:376219] {CVE-2024-47679}
  - jfs: check if leafidx greater than num leaves per dmap tree (Edward Adam Davis) [task:376377] {CVE-2024-49902}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (Junlin Li) [task:376239] {CVE-2024-47698}
  - net: Fix an unsafe loop on the list (Anastasia Kovaleva) [task:376085] {CVE-2024-50024}
  - xen: use correct end address of kernel for conflict checking (Juergen Gross) [task:376245] {CVE-2024-47722}
  - media: venus: fix use after free bug in venus_remove due to race condition (Zheng Wang) [task:376401] {CVE-2024-49981}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem (Thadeu Lima de Souza Cascardo) [task:376249] {CVE-2024-47701}
  - ext4: return error on ext4_find_inline_entry (Thadeu Lima de Souza Cascardo) [task:376249]
  - jfs: Fix uninit-value access of new_ea in ea_buffer (Zhao Mengmeng) [task:376257] {CVE-2024-49900}
  - drm/amd/display: Check stream before comparing them (Alex Hung) [task:376409] {CVE-2024-49896}
  - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (Xin Long) [task:376417]
  - sctp: fix memory leak in sctp_stream_outq_migrate() (Zhengchao Shao) [task:376417] {CVE-2022-49013}
  - fbdev: pxafb: Fix possible use after free in pxafb_task() (Kaixin Wang) [task:376117] {CVE-2024-49924}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation (Srinivasan Shanmugam) [task:376113] {CVE-2024-49894}
  - ocfs2: fix null-ptr-deref when journal load failed. (Julian Sun) [task:376303] {CVE-2024-49957}
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (Luiz Augusto von Dentz) [task:376309] {CVE-2024-50044}
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error (Baokun Li) [task:376143] {CVE-2024-49959}
  - jfs: Fix uaf in dbFreeBits (Edward Adam Davis) [task:376153] {CVE-2024-49903}
  - e100: Fix possible use after free in e100_xmit_prepare (Wang Hai) [task:376281] {CVE-2022-49026}
  - e100: switch from 'pci_' to 'dma_' API (Christophe JAILLET) [task:376281]
  - aoe: fix the potential use-after-free problem in more places (Chun-Yi Lee) [task:376351] {CVE-2024-49982}
  - security/kysec: permit task killed by parent (penghuaihe) [bug:272883]
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman) [bug:251189]
  - net: ethernet: lantiq_etop: fix memory disclosure (Aleksander Jan Bajkowski) [task:376181] {CVE-2024-49997}
  - tracing: Free buffers when a used dynamic event is removed (Steven Rostedt (Google)) [task:375645] {CVE-2022-49006}
  - tracing: initialize variable in create_dyn_event() (Frank Rowand) [task:375645]
  - tracing: Add unified dynamic event framework (Masami Hiramatsu) [task:375645]
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() (Pei Xiao) [task:376385] {CVE-2024-49962}
  - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. (Vincent Pelletier) [task:160493]
  - NFC: st21nfca: Fix memory leak in device probe and remove (Wei Yongjun) [task:160493]
  - Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync() (Duoming Zhou) [bug:189740] {CVE-2023-4134}
  - x86/CPU/AMD: Do not leak quotient data after a division by 0 (Borislav Petkov (AMD)) [task:179889, bug:189752] {CVE-2023-20588}
  - x86/cpu/amd: Add a Zenbleed fix (Borislav Petkov (AMD)) [bug:185043] {CVE-2023-20593}
  - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre) [task:164574]
  - Revert "x86/cpu/amd: Add a Zenbleed fix" (Yan Wang) [bug:185043]
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach (Zheng Wang) [task:223093, task:370805] {CVE-2024-35811, CVE-2023-47233}
  - turn off the GPU driver for sietium (Yan Wang) [task:386499, task:370805]
  - KVM: Add GDS_NO support to KVM (Daniel Sneddon) [task:370791, bug:189744] {CVE-2022-40982}
  - x86/speculation: Add Gather Data Sampling mitigation (Daniel Sneddon) [task:370791, bug:189744] {CVE-2022-40982}
  - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta) [task:164574, task:370791]
  - x86/common: Stamp out the stepping madness (Peter Zijlstra) [task:164574, task:370791]
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google)) [bug:189740]
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google)) [bug:189740]
  - fix the kabi error of del_timer and del_timer_sync (Yan Wang) [bug:189740]
  - cxgb4: fix use after free bugs caused by circular dependency problem (Duoming Zhou) [bug:189736] {CVE-2023-4133}
  - timers: Provide timer_shutdown[_sync]() (Thomas Gleixner) [bug:189740]
  - timers: Add shutdown mechanism to the internal functions (Thomas Gleixner) [bug:189740]
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode (Thomas Gleixner) [bug:189740]
  - timers: Rename del_timer() to timer_delete() (Thomas Gleixner) [bug:189740]
  - timers: Rename del_timer_sync() to timer_delete_sync() (Thomas Gleixner) [bug:189740]
  - timers: Use del_timer_sync() even on UP (Thomas Gleixner) [bug:189740]
  - timers: Silently ignore timers with a NULL function (Thomas Gleixner) [bug:189740]
  - timers: Update kernel-doc for various functions (Thomas Gleixner) [bug:189740]
  - timers: Replace BUG_ON()s (Thomas Gleixner) [bug:189740]
  - i2c: Fix a potential use after free (Xu Wang) [task:162162]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.45.v2207
changelog:
  - KVM: arm64: vgic-its: Fix irq reference release error (张浩) [task:427908]
  - NETSWIFT: txgbevf: FIX: fix issue in kylin4.19-kernel test (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: set version 1.3.2 (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX:fix compile error in some redhat os (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix compile error on some os (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: fix: fix slt test error log (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix bug that try to free already-free irq (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix bug that slt test failed (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: Modify compile mode (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix bug that vf pcie device not is remove when after rmmod pf driver (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: set version 1.3.2rc0 (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix bug that txgbevf 802.1ad vlan ping fail (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix VF UDP RSS cannot off (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: Revert "FIX: fix VF RSS rules not working" (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: Revert commit b283dc9be78e (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix VF RSS rules not working (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: ADD: add new file Module.supported (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix TXGBE_VXSTATUS_SPEED not right (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix qinq issue in centos: (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: fix: fix vf only supports a maximum of 2 queues (Linyue Xie) [task:226013]
  - NETSWIFT: txgbevf: Synchronous wangxun txgbevf driver source code (luoqing) [task:226013]
  - NETSWIFT: txgbevf: set version to 1.3.1 (Juxia He) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix compile warning on linx 6.0.60.4 and linxos 6.0.60 (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix compile warning on ubuntu 22.10 and 23.04 (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: fix: fix change not mtu work on some os like centos7.7 (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix bug tx/rx count error when down/up while count exceed 0x100000000 (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: Update version to 1.3.1rc0 for test (Juxia He) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix rx/tx count error when down/up (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: ADD: add the interfacce to show fw version on vf (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: FIX: FIX bug that set vlan failed but not return error (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: FIX: fix vf cannot revice packets after pcie reset (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: FIX: FIX DRV_VERSION not right (zhongxiangji) [task:226013]
  - NETSWIFT: txgbevf: Modify: modify compile command (zhongxiangji) [task:226013]
  - devlink: allow driver to update progress of flash update (Jiri Pirko) [task:162874, task:161899]
  - devlink: prepare to support region operations (Jacob Keller) [task:162874, task:161899]
  - NETSWIFT: txgbe: FIX: fix issue in kernel test (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: add msglvl for kr debug messages (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug on vxlan-gpe tunnel packet hw offload (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: ocp ncsi link is down when driver probe (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: feat: add support to desc check (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: txgbe: sp: fix 10kr autoneg to cx4/5 (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: vxlan/geneve ipv6 add/delete port bug (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: feat: force dac cable to kr mode (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: feat: reset flow (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: ipv6 offload (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: update version to 1.3.6.2 (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: tx csum by soft except tcp udp sctp (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: feat: send autoneg setting to firmware (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: set version 1.3.6 in main file (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX:fix loud xsk in some kernel may error (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: fix bug that send packet failed in certain conditions (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX:fix xsk tx may cause kernel crash (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: Fix: allow to add nedev_uc_addr over 64 (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug that slt test failed (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: fix 802.1ad rx_csum_offload_errors not increase (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: set version 1.3.6rc1 (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: vlvf value not right (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: feat: sync adaptive rx/rx usecs/tx-frames-irq setting to txgbe (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: fix the ethtool -t loopback test fails when the multi-speed sfp links to 1000M and veto on (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: delete error code (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: function 1 ethtool -i show firmware err (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: fix some bugs about vf 802.1ad vlan (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: change firmware-version format (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: ethtool support to set multi rss when sriov is enabled (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: review: fix backplane fw ethtool show error (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: fix: fix some problem in code review (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: Fix handling of NAPI budget when multiple queues are enabled per vector (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: add support for set vf mac with zero_ether_addr (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: fix get lldp flag wrong when probe (Linyue Xie) [task:226013]
  - NETSWIFT: txgbe: FIX: loopback test may fail when veto on and the rate is set to 1000M and link down (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: set version to 1.3.6rc0 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: sync new kr tarinning flow (luoqing) [task:226013]
  - NETSWIFT: txgbe: fix : remove vf mtu restriction (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug that try to handled null pointer (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: feat: Added the function of vf trust (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix to create fdir rule index 0 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: marvell phy nic which not support ocp link speed wrong (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: feat: set flow control xon to default off (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix ether type filter configuration in VT mode (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: add get lldp status by mbx (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: correct ether type in ethtool -n (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix PF RSS when multi_rss is enabled (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix fdir filter action queue info (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix to get info of ether type filter (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: support to add ether type filter by ethtool (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Revert "MODIFY: vf do not make its own receice-hash" (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: feat: support wol on fun 1 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: remove duplicate pings vf and set vf after ping (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: ethtool set rss indir table (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: ethtool can't take effect for hash key (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Revert "Fix:skip lan_rst after retriggering interrupt" (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Revert "Fix: skip lan reset condition is imperfect" (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: patch-3 vf only supports a maximum of 2 queues JIRA: http://projsw.trustnetic.com/browse/SAP-263 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX:fix compile error when define DISABLE_PACKET_SPLIT (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: fix bug that close rx-vlan-offload not work and rx-vlan-stag-filter can not close (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: update vpd when use ethtool -f to upgrade (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: patch-v2 vf only supports a maximum of 2 queues (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: ethtool show max_combined wrong when enable sriov (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: fix vf only supports a maximum of 2 queues (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: set mac_sgmii to autoneg off failed (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: fix bug that vf mtu can be larger than pf mtu (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix error print when remove geneve or vxlan (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: add firmware quirks for WHGX (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: replacing 1G sfp module to dual-speed sfp module, link speed is 1G (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: update kr trainning flow 4 (luoqing) [task:226013]
  - NETSWIFT: txgbe: update release note to 1.3.5.1 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: feat: add led blink support for oem (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: fix commit 57d2aa3 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: set version to 1.3.5 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: add support tunnel prot set on kernel over 5.9 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error because not define txgbe_xdp_locking_key (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: SWESMBI Software EEPROM semaphore not granted. (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix in some kernel version, when xdp_redirect tx drop may free page error (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: The xdpring count is now maintained at the cpu core count or maximum xdpring(2) (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: The xdpring count is now maintained at the cpu core count or maximum xdpring (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: ethool -s ethx autoneg on cannot link to 10G (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix when load or unload xdp program, may calltrace. and fix lro may can't set after set lro when xdp load (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug that ifconfig down but not disable laser (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: Can't change lro when xdp load and change lro to which before xdp load when unload xdp (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: when load xdp ,turn off lro(2) (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: when load xdp ,turn off lro (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: add free page in head split mode (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: update kr trainning flow (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix when load xdp_pass may oom (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: 64k pagesize memory leak (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Update kr trainning flow 3 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug that disable sriov not clear Etype filter (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: ethtool -S not support return EINVAL (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error when define DISABLE_PACKET_SPLIT_2 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: firmware version read from flash instead of shadow ram (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix not to set prbs_en in en_cl72_krtr (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: 1000Base-T sfp module and cable link update error (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug that insmod with param max_vfs (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile warning on sles 11.3 and 11.4 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix ethtool set coalesce adaptive (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: skip lan reset condition is imperfect (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Revert "Fix: skip lan reset condition is imperfect" (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: skip lan reset condition is imperfect (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix when load xdp_redirect program (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix ethtool -t loopback test failed (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error when define DISABLE PACKET_SPLIT (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: i2c fails trying to read DAC (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Tidy up codes for sonarcloud scanner (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: update kr trainning flow 3 (luoqing) [task:226013]
  - NETSWIFT: txgbe: Update version to 1.3.5rc1 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix call trace when PAGE_SIZE<8k (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Limit change mtu range when xdp loaded (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: check cpu arch or pcie upstream before bus reset (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: add macro define in configure (luoqing) [task:226013]
  - NETSWIFT: txgbe: FIX: fix bug that mailbox error (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: add support 802.1ad vlan (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: not do pcie reset when sriov enable (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: remove default fec set (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: software timestamp skbs as late as possible (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error about xdp (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: delete unused declaration (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: strtoul compile error (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: skip lan_rst after retriggering interrupt (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: Limit rss queues when the xdp program loads copper sfp (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix 1G speed autoneg on/off functions (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: set version 1.3.5rc0 for test (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: Limit rss queues (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Add: Tidy up i2c_read 1G copper sfp flow (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: insmod driver and nsci link is down when using copper sfp (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile error xdp_rxq_info_reg (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: delete useless debug message (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix compile err when kernel version less than 4.20 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: add the interfacce to show fw version on vf (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: FIX: fix can't ethtool -t call null point (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: ADD: add support xdp (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Fix: fix bug (luoqing) [task:226013]
  - NETSWIFT: txgbe: Upgrade kr trainning flow (luoqing) [task:226013]
  - NETSWIFT: txgbe: Fix: number of descriptor must be multiple of 128 (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Delete: delete phy hardware reset in reset_hw for led oem (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Add: display aer error type (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: Add: firmware use i2c to access sfp module (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fit txgbe_is_lldp return flow (duanqiangwen) [task:226013]
  - NETSWIFT: txgbe: fix: kcompat.h not define some (duanqiangwen) [task:226013]
  - NETSWIFT: ngbevf: Synchronous wangxun ngbevf driver source code (luoqing) [task:226013]
  - NETSWIFT: ngbevf: set version 1.2.1.1 (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix set vf mtu err (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix handle kernel NULL pointer when add vxlan (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: add release time and modify version to 1.2.2 (Juxia He) [task:226013]
  - NETSWIFT: ngbevf: fix: fix bug that error dmesg when add double vlan (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix bug that vf can't ifconfig up (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix compile error (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: Revert "fix : fix bug that vf get ack timeout when pf ifconfig down up" (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: set version 1.2.2rc0 for test (Juxia He) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix mailbox error when ifconfig pf down/up (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: fix: fix bug that vf can not link when phy is not internal (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: Fix: fix the bug that ip link set vf state not work (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix bug that try to free already-free irq (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: ADD: add new file Module.supported (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: fix : fix bug that vf get ack timeout when pf ifconfig down up (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: fix: fix bug that pf ping vf but vf not reset (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix bug that txvlan and rxvlan cannot close (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: feat: add the interface to show fw version on vf (luoqing) [task:226013]
  - NETSWIFT: ngbevf: FIX: fix bug that 10M link speed error (zhongxiangji) [task:226013]
  - NETSWIFT: ngbevf: fix: fix change not mtu work on some os like centos7.7 (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: FIX:fix tunnel packets unreachable when enable sriov (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: Fixed resolving ipv6 packet header errors (linyuexie) [task:226013]
  - NETSWIFT: ngbe: Optimize reset flow when driver is tx hang or timeout (Linyue Xie) [task:226013]
  - NETSWIFT: ngbe: update version to 1.2.6.3 (linyuexie) [task:226013]
  - NETSWIFT: ngbe: fix: tx csum by soft except tcp udp sctp (linyuexie) [task:226013]
  - NETSWIFT: ngbe: update version to 1.2.6.2 (linyuexie) [task:226013]
  - NETSWIFT: ngbe: add HAVE_NETDEV_XMIT_MORE for kylin os (Linyue Xie) [task:226013]
  - NETSWIFT: ngbe: update release notes and version to 1.2.6.1 (linyuexie) [task:226013]
  - NETSWIFT: ngbe: Fix: Hardware block max request size to 128 (linyuexie) [task:226013]
  - NETSWIFT: ngbe: Fix: allow to add nedev_uc_addr over 16 (linyuexie) [task:226013]
  - ETSWIFT: ngbe: Synchronous wangxun ngbe driver source code (luoqing) [task:226013]
  - NETSWIFT: ngbe: update release note and version 1.2.6 (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: Revert "FIX: When do ethtool -C, if not change any coalesce parameters supported, will return -EINVAL" (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: set version to 1.2.6rc2 (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: Add a delay between pings for slt test (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: Add a delay between pings (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: yt8531s-ca can't generate interrupt in combo mode (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: feat: add support for notifying firmware phy link (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: fix: remove vf mtu restriction (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix slt test failed (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix fail to obtain mbx lock when slt test (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: modify version to 1.2.6rc1 for test (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix mailbox error when ifconfig pf down (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix compile error (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: add get lldp status by mbx (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that vf mtu can not be larger than pf mtu (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: fix: code review (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix compile error (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: default to set gpio_0 input direction (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix compile error (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: FIX: fix compile error in kylinos (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: feat: add the interface to set the vf link state (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: modify version to 1.2.6rc0 (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: add mtu change limit and rx buffer 3k for xdp (linyuexie) [task:226013]
  - NETSWIFT: ngbe: feat: check cpu arch or pcie upstream type to determine whether to do recovery (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: ethtool can't set hash key (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: add print when port down and change lldp (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: Revert "FIX:allow set lldp when nic down" (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix bug that try to handled null pointer (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: feat: add support that set vf vlan type 802.1ad (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: FIX: compile warming because unused value (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: allow set lldp when nic down (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: fix bugs set tx frame irq to 65536 exceed u16 max value (zhenpengzheng) [task:226013]
  - NETSWIFT: ngbe: revert: revert tx timeout retrigger irq flow (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that rx multicast count not right (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that failed to receive vlan packets when promisc enable (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that vf can not link when phy is not internal (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: feat: Added the function of vf trust (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: add dynamic itr configurable; (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: yt8531sh-ca phy can't powerdown in mode 2 (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: feat: add param for yt phy unidirectional mode (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that vlan filter change but not work (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that some feature that can not change (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that cant set ip vlan when mac vlan is set (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: fix: fix bug that vf mtu can be larger than pf mtu (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: fix: rtl8211fs and jl2201 some bugs. (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: feat: add the interface to show fw version on vf (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: fix ethtool -S may out of range (linyuexie) [task:226013]
  - NETSWIFT: ngbe: feat/fix: commit message example (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: fix: yt8531h check phy id failed (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: ADD: Synchronize xdp changes off txgbe (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: Fix: fix commit 7a14ec5 (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: ADD: add support for XZP211FS phy (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: ADD: add support for new phy JL2201-N048C and rtl8211f (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: ADD: add support for yt phy unidirectional mode (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: fix bug that mailbox error (zhongxiangji) [task:226013]
  - NETSWIFT: ngbe: Fix: Inspur ncsi nic cannot wake on lan. (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: Revert "Fix:wol can't work in inspur ncsi nic" (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: Fix: wol can't work in inspur ncsi nic (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: FIX: may calltrace when run loop test because pagecnt_bias err (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: fix compile error when define DISABLE_PACKET_SPLIT (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: fix xdp page processing flow (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: ADD: add support for showing AER error type (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: ADD: add support for inspur ncsi card (duanqiangwen) [task:226013]
  - NETSWIFT: ngbe: FIX: When do ethtool -C, if not change any coalesce parameters supported, will return -EINVAL (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: fix may calltrace due to page_ref count error,and fix calltrace when unload xdp (linyuexie) [task:226013]
  - NETSWIFT: ngbe: software timestamp skbs as late as possible (Mengyuan Lou) [task:226013]
  - NETSWIFT: ngbe: FIX: fix when load xdp_redirect program (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: fix may call trace when xdp redirect load because no XDP_PACKET_HEADROOM (linyuexie) [task:226013]
  - NETSWIFT: ngbe: FIX: fix the statistics of queues 4 to 7 are lost after xdp program is loaded (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: update unresolved issues to release notes and set version (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: ADD: update vpd when use ethtool -f to upgrade (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: set version 1.2.5.2 (wenduanqiang) [task:226013]
  - NETSWIFT: ngbe: fix: ifconfig down will not powerdown external phy (wenduanqiang) [task:226013]
  - bpf: fix recursive lock when verdict program return SK_PASS (Jiayuan Chen) [task:412141] {CVE-2024-56694}
  - bpf, sockmap: Fix race between element replace and close() (Michal Luczaj) [task:410365] {CVE-2024-56664}
  - bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t (John Fastabend) [task:410365]
  - bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap (Daniel Borkmann) [task:410365]
  - bpf: sockmap, sock_map_delete needs to use xchg (John Fastabend) [task:99622, task:410365]
  - Update kernel version to 4.19.90-52.44.v2207 (Zhengyuan Liu)
  - net/mlx5: Fix variable not being completed when function returns (Chenguang Zhao) [task:412201, task:422535]
  - block: Fix kabi caused by blk.h (Zheng Tan) [task:381405]
  - block: fix kabi broken in stat_group (Zheng Tan) [task:381405]
  - block: support to account io_ticks precisely (Yu Kuai) [task:381405]
  - block: fix the problem of io_ticks becoming smaller (Chunguang Xu) [task:381405]
  - block: account merge of two requests (Konstantin Khlebnikov) [task:381405]
  - block: don't call part_{inc,dec}_in_flight for blk-mq devices (Christoph Hellwig) [task:381405]
  - block: remove the unused q argument to part_in_flight and part_in_flight_rw (Christoph Hellwig) [task:381405]
  - block: move the blk-mq calls out of part_in_flight{,_rw} (Christoph Hellwig) [task:381405]
  - block: avoid double io accounting for flush request (Ming Lei) [task:381405]
  - block/diskstats: accumulate all per-cpu counters in one pass (Konstantin Khlebnikov) [task:381405]
  - block: mark part_in_flight and part_in_flight_rw static (Christoph Hellwig) [task:381405]
  - block: move sysfs methods shared by disks and partitions to genhd.c (Christoph Hellwig) [task:381405]
  - block: add iostat counters for flush requests (Konstantin Khlebnikov) [task:381405]
  - block/diskstats: more accurate approximation of io_ticks for slow disks (Konstantin Khlebnikov) [task:169357]
  - drm/vc4: fix compile error (Lu Yao) [task:402971, task:417959]
  - i40e: Fix freeing of uninitialized misc IRQ vector (Sylwester Dziedziuch) [task:416193]
  - Revert "blk_poll: Fix the logic missing from the previous migration patch" (liuqiqi) [task:421191]
  - io_uring: don't defer put of cancelled ltimeout (Pavel Begunkov) [task:105694, task:370255]
  - net: Fix icmp host relookup triggering ip_rt_bug (Dong Chenchen) [task:410447] {CVE-2024-56647}
  - bpf: fix OOB devmap writes when deleting elements (Maciej Fijalkowski) [task:410065]
  - xsk: fix OOB map writes when deleting elements (Maciej Fijalkowski) [task:410065] {CVE-2024-56614}
  - drivers/gmjstcm: import CVE-2011-1160 CVE-2011-1162 fixes to tcm.c (Li ZhiGang) [task:406609] {CVE-2024-24891}
  - drivers/gmjstcm: fix a dev_err() call in spi tcm device probe (Li ZhiGang) [task:406609]
  - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Sidraya Jayagond) [task:410367] {CVE-2024-53210}
  - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (Ryusuke Konishi) [task:410479] {CVE-2024-56619}
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection (Takashi Iwai) [task:410395] {CVE-2024-56532}
  - hfsplus: don't query the device logical block size multiple times (Thadeu Lima de Souza Cascardo) [task:410029] {CVE-2024-56548}
  - soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() (Dan Carpenter) [task:408543] {CVE-2024-53158}
  - NFSD: Prevent a potential integer overflow (Chuck Lever) [task:408541] {CVE-2024-53146}
  - ocfs2: fix uninitialized value in ocfs2_file_read_iter() (Dmitry Antipov) [task:408545] {CVE-2024-53155}
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware (Luo Qiu) [task:408531] {CVE-2024-53157}
  - net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (Furong Xu) [task:391021] {CVE-2024-53058}
  - kylin_extend: fix kernel NULL pointer dereference (huanfuxi) [task:391387]
  - security: fix bug while get path by inode (penghuaihe) [task:387321]
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (Al Viro) [task:406597] {CVE-2024-42265}
  - drm/amdgpu: change vm->task_info handling (Shashank Sharma) [task:347157] {CVE-2024-41008}
  - LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context (Huacai Chen) [task:387571] {CVE-2024-50111}
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (Jeongjun Park) [task:408553] {CVE-2024-53156}
  - wifi: iwlegacy: Clear stale interrupts before resuming device (Ville Syrjälä) [task:387911] {CVE-2024-50234}
  - net: do not delay dst_entries_add() in dst_release() (Eric Dumazet) [task:380195] {CVE-2024-50036}
  - f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() (Chao Yu) [task:376109] {CVE-2024-47691}
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Benoit Sevens) [task:403255] {CVE-2024-53104}
  - drm/vc4: fix compile error (Lu Yao) [task:397559]
  - btrfs: fix the length of reserved qgroup to free (Haisu Wang) [task:364175]
  - btrfs: fix qgroup reserve leaks in cow_file_range (Boris Burkov) [task:364175] {CVE-2024-46733}
  - io_uring: disable polling pollfree files (Pavel Begunkov) [task:179288, task:370255] {CVE-2022-3176}
  - io_uring: fix race between timeout flush and removal (Jens Axboe) [task:370255] {CVE-2022-29582}
  - block: add REQ_HIPRI and inherit it from IOCB_HIPRI (Jens Axboe) [task:107661, task:370255]
  - blk_poll: Fix the logic missing from the previous migration patch (Jackie Liu) [task:107661]
  - io_uring: remove double poll entry on arm failure (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: explicitly count entries for poll reqs (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix timeout cancel return code (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't iterate io_uring_cancel_files() (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix link lookup racing with link timeout (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't forget to task-cancel drained reqs (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix overflowed cancel w/ linked ->files (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: simplify nxt propagation in io_queue_sqe (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: always clear LINK_TIMEOUT after cancel (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't adjust LINK_HEAD in cancel ltimeout (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: remove opcode check on ltimeout kill (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't reuse linked_timeout (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix racy REQ_F_LINK_TIMEOUT clearing (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: do poll's hash_node init in common code (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: inline io_poll_task_handler() (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: make cached_cq_overflow non atomic_t (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: fix REQ_F_COMP_LOCKED by killing it (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: dig out COMP_LOCK from deep call chain (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't unnecessarily clear F_LINK_TIMEOUT (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't set COMP_LOCKED if won't put (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: don't delay io_init_req() error check (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: remove timeout.list after hrtimer cancel (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: use a separate struct for timeout_remove (Pavel Begunkov) [task:105694, task:370255]
  - io_uring: mark statx/files_update/epoll_ctl as non-SQPOLL (Jens Axboe) [task:105694, task:370255]
  - Revert "io_uring: fix ltout double free on completion race" (Jackie Liu) [task:105694, task:370255]
  - io_uring: don't bounce block based -EAGAIN retry off task_work (Jens Axboe) [task:103049, task:370255]
  - io_uring: fix break condition for __io_uring_register() waiting (Jens Axboe) [task:103049, task:370255]
  - io_uring: process task work in io_uring_register() (Jens Axboe) [task:103049, task:370255]
  - bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop (Toke Høiland-Jørgensen) [task:397467]
  - bpf: Always return target ifindex in bpf_fib_lookup (Toke Høiland-Jørgensen) [task:397467]
  - KABI: fix mini_Qdisc ABI breakage (chenyuan) [task:397467]
  - net: sched: Pass ingress block to tcf_classify_ingress (Paul Blakey) [task:397467]
  - net: sched: Introduce ingress classification function (Paul Blakey) [task:397467]
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (Chengchang Tang) [task:376269] {CVE-2024-47735}
  - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE (Luiz Augusto von Dentz) [task:396699] {CVE-2024-8805, CVE-2024-8805}
  - Input: appletouch - initialize work before device registration (Pavel Skripkin) [task:160493, task:370827] {CVE-2021-46932}
  - i2c: validate user data in compat ioctl (Pavel Skripkin) [task:160493, task:370823] {CVE-2021-46934}
  - binder: fix async_free_space accounting for empty parcels (Todd Kjos) [task:160493, task:370819] {CVE-2021-46935}
  - HID: usbhid: fix info leak in hid_submit_ctrl (Anirudh Rayabharam) [task:158827, task:370811] {CVE-2021-46906}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Yi Yang) [task:400455] {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command (Daniel Starke) [task:400455]
  - soundwire: stream: fix memory leak in stream config error path (Rander Wang) [task:158827, task:370857] {CVE-2021-47020}
  - bus: qcom: Put child node before return (Pan Bian) [task:158827, task:370863] {CVE-2021-47054}
  - ext4: fix timer use-after-free on failed mount (Xiaxi Shen) [task:376211] {CVE-2024-49960}
  - fsl/fman: Fix refcount handling of fman-related devices (Aleksandr Mishin) [task:387475] {CVE-2024-50166}
  - net: fman: Unregister ethernet device on removal (Sean Anderson) [task:164562]
  - fsl/fman: Save device references taken in mac_probe() (Aleksandr Mishin) [task:387475]
  - net: fman: Use physical address for userspace interfaces (Sean Anderson) [task:387475]
  - net: dpaa: Use mac_dev variable in dpaa_netdev_init (Sean Anderson) [task:387475]
  - net: fman: Clean up error handling (Sean Anderson) [task:387475]
  - net: fman: Map the base address once (Sean Anderson) [task:387475]
  - net: fman: memac: Uninitialized variable on error path (Dan Carpenter) [task:387475]
  - net: fman: Configure fixed link in memac_initialization (Sean Anderson) [task:387475]
  - net: fman: Move struct dev to mac_device (Sean Anderson) [task:387475]
  - fsl/fman: use resource_size (Julia Lawall) [task:387475]
  - dpaa_eth: Use random MAC address when none is given (Madalin Bucur) [task:387475]
  - net: fman: Get PCS node in per-mac init (Sean Anderson) [task:387475]
  - fsl/fman: Check for null pointer after calling devm_ioremap (Jiasheng Jiang) [task:160493]
  - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Shradha Gupta) [task:391031] {CVE-2024-26820}
  - hv_netvsc: use netif_is_bond_master() instead of open code (Juhee Kang) [task:391031]
  - hv_netvsc: Mark VF as slave before exposing it to user-mode (Long Li) [task:391031]
  - hv_netvsc: Fix race between VF offering and VF association message from host (Gaurav Kohli) [task:164562]
  - f2fs: get rid of online repaire on corrupted directory (Chao Yu) [task:375661] {CVE-2024-47690}
  - fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext (Eric Biggers) [task:158034]
  - fscrypt: only set dentry_operations on ciphertext dentries (Eric Biggers) [task:158034]
  - fscrypt: clean up and improve dentry revalidation (Eric Biggers) [task:158034]
  - HYGON: Add psp interrupt x86 register on hygon 4G platform (chench) [task:380133]
  - HYGON: crypto: ccp: Add CCP/PSP PCI interface on Hygon hardware (Xin Jiang) [task:176679]
  - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [task:330540] {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label (Bob Peterson) [task:330540]
  - gfs2: Don't call dlm after protocol is unmounted (Bob Peterson) [task:160493]
  - gfs2: Don't skip dlm unlock if glock has an lvb (Bob Peterson) [task:158034]
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow (VanGiang Nguyen) [task:376197] {CVE-2024-47739}
  - padata: unbind parallel jobs from specific CPUs (Daniel Jordan) [task:160493]
  - padata: use separate workqueues for parallel and serial work (Daniel Jordan) [task:160493]
  - padata, pcrypt: take CPU hotplug lock internally in padata_alloc_possible (Daniel Jordan) [task:160493]
  - crypto: pcrypt - remove padata cpumask notifier (Daniel Jordan) [task:160493]
  - padata: make padata_do_parallel find alternate callback CPU (Daniel Jordan) [task:160493]
  - crypto/pcrypt: Replace synchronize_rcu_bh() with synchronize_rcu() (Paul E. McKenney) [task:160493]
  - crypto: pcrypt - Fix user-after-free on module unload (Herbert Xu) [task:153627]
  - padata: allocate workqueue internally (Daniel Jordan) [task:160493]
  - mm: avoid leaving partial pfn mappings around in error case (Linus Torvalds) [task:372881] {CVE-2024-47674}
  - mm: add remap_pfn_range_notrack (Christoph Hellwig) [task:372881]
  - mm/memory.c: make remap_pfn_range() reject unaligned addr (Alex Zhang) [task:372881]
  - mm: fix ambiguous comments for better code readability (chenqiwu) [task:372881]
  - mm: clarify a confusing comment for remap_pfn_range() (WANG Wenhu) [task:372881]
  - docs/core-api/mm: fix return value descriptions in mm/ (Mike Rapoport) [task:372881]
  - page cache: Add and replace pages using the XArray (Matthew Wilcox) [task:118664]
  - virtio-mmio: don't break lifecycle of vm_dev (Wolfram Sang) [task:379857]
  - virtio-mmio: convert to devm_platform_ioremap_resource (Yangtao Li) [task:377245]
  - virtio-mmio: Use to_virtio_mmio_device() to simply code (Tang Bin) [task:379857]
  - slip: make slhc_remember() more robust against malicious packets (Eric Dumazet) [task:376251] {CVE-2024-50033}
  - net: delete "register" keyword (Alexey Dobriyan) [task:376251]
  - slip: make slhc_compress() more robust against malicious packets (Eric Dumazet) [task:155707]
  - spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware (Devyn Liu) [task:372557] {CVE-2024-47664}
  - spi: Add HiSilicon SPI Controller Driver for Kunpeng SoCs (Jay Fang) [task:182123]
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Zhu Yanjun) [task:375617] {CVE-2024-47696}
  - RDMA/iwcm: Release resources if iw_cm module initialization fails (Leon Romanovsky) [task:160493]
  - net/ncsi: Disable the ncsi work before freeing the associated structure (Eddie James) [task:376379] {CVE-2024-49945}
  - net/ncsi: Fix netlink registration (Joel Stanley) [task:158034]
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release() (Zeng Heng) [task:376343] {CVE-2022-48961}
  - net: mdio: use device_set_node() to setup both fwnode and of (Ioana Ciornei) [task:376343]
  - driver core: add a helper to setup both the of_node and fwnode of a device (Ioana Ciornei) [task:376343]
  - media: av7110: fix a spectre vulnerability (Mauro Carvalho Chehab) [task:390755] {CVE-2024-50289}
  - firmware_loader: Block path traversal (Jann Horn) [task:375665] {CVE-2024-47742}
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (Hyunwoo Kim) [task:396803] {CVE-2024-53103}
  - net: fix data-races around sk->sk_forward_alloc (Wang Liang) [task:396799] {CVE-2024-53124}
  - filemap: Fix bounds checking in filemap_read() (Trond Myklebust) [task:390893] {CVE-2024-50272}
  - nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint (Ryusuke Konishi) [task:398629] {CVE-2024-53130}
  - netlink: terminate outstanding dump on socket close (Jakub Kicinski) [task:398631] {CVE-2024-53140}
  - nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint (Ryusuke Konishi) [task:398633] {CVE-2024-53131}
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (Jeongjun Park) [task:398615] {CVE-2024-53141}
  - security/kysec: Call put_cred() before function return (chengang) [task:390393]
  - fs: Fix uninitialized value issue in from_kuid and from_kgid (Alessandro Zanni) [task:396801] {CVE-2024-53101}
  - ocfs2: uncache inode which has failed entering the group (Dmitry Antipov) [task:396817] {CVE-2024-53112}
  - f2fs: Require FMODE_WRITE for atomic write ioctls (Jann Horn) [task:376135] {CVE-2024-47740}
  - mm: split critical region in remap_file_pages() and invoke LSMs in between (Kirill A. Shutemov) [task:376325]
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() (Shu Han) [task:376325] {CVE-2024-47745}
  - mm/mmap.c: don't unlock VMAs in remap_file_pages() (Liam Howlett) [task:376325]
  - net/mlx5: fs, lock FTE when checking if active (Mark Bloch) [task:396807] {CVE-2024-53121}
  - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (Al Viro) [task:363785] {CVE-2024-45025}
  - s390/cio: rename bitmap_size() -> idset_bitmap_size() (Alexander Lobakin) [task:363785]
  - bitmap: introduce generic optimized bitmap_size() (Alexander Lobakin) [task:363785]
  - tools: move alignment-related macros to new <linux/align.h> (Alexander Lobakin) [task:363785]
  - tools headers UAPI: Sync linux/const.h with the kernel headers (Arnaldo Carvalho de Melo) [task:363785]
  - tools headers: Grab copy of linux/const.h, needed by linux/bits.h (Arnaldo Carvalho de Melo) [task:363785]
  - drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA (Hans de Goede) [task:387555] {CVE-2024-50134}
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (Pedro Tammela) [task:392639] {CVE-2024-53057}
  - uprobes: fix kernel info leak via "[uprobes]" vma (Oleg Nesterov) [task:375973] {CVE-2024-49975}
  - ext4: update orig_path in ext4_find_extent() (Baokun Li) [task:376209] {CVE-2024-49881}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() (Baokun Li) [task:376087] {CVE-2024-49884}
  - ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path (Theodore Ts'o) [task:376087]
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (Dmitry Antipov) [task:380475] {CVE-2024-47713}
  - i40e: fix race condition by adding filter's intermediate sync state (Aleksandr Loktionov) [task:390579] {CVE-2024-53088}
  - i40e: fix i40e_count_filters() to count only active/new filters (Aleksandr Loktionov) [task:390579]
  - bcache: remove unused bch_mark_cache_readahead function def in stats.h (Lin Feng) [task:222079]
  - bcache: avoid oversized read request in cache missing code path (Coly Li) [task:222079] {CVE-2021-47275}
  - bcache: remove bcache device self-defined readahead (Coly Li) [task:222079]
  - uprobe: avoid out-of-bounds memory access of fetching args (Qiao Ma) [task:380099] {CVE-2024-50067}
  - security/keys: fix slab-out-of-bounds in key_task_permission (Chen Ridong) [task:390885] {CVE-2024-50301}
  - nfs: Fix KMSAN warning in decode_getfattr_attrs() (Roberto Sassu) [task:391029] {CVE-2024-53066}
  - usb: musb: sunxi: Fix accessing an released usb phy (Zijun Hu) [task:390745] {CVE-2024-50269}
  - media: s5p-jpeg: prevent buffer overflows (Mauro Carvalho Chehab) [task:391027] {CVE-2024-53061}
  - sctp: properly validate chunk size in sctp_sf_ootb() (Xin Long) [task:390741] {CVE-2024-50299}
  - staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() (Zicheng Qu) [task:387919] {CVE-2024-50233}
  - staging: iio: ad9832: use clock framework for clock reference (Marcelo Schmitt) [task:387919]
  - staging: iio: ad9832: organize includes (Marcelo Schmitt) [task:387919]
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (Felix Fietkau) [task:390869] {CVE-2024-50237}
  - cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction (Chen Ridong) [task:390867] {CVE-2024-53054}
  - userfaultfd: fix checks for huge PMDs (Jann Horn) [task:363981] {CVE-2024-46787}
  - media: dvbdev: prevent the risk of out of memory access (Mauro Carvalho Chehab) [task:390895] {CVE-2024-53063}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (Ido Schimmel) [task:390739] {CVE-2024-50304}
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Baokun Li) [task:344489] {CVE-2024-40998}
  - HID: core: zero-initialize the report buffer (Jiri Kosina) [task:392647] {CVE-2024-50302}
  - media: cx24116: prevent overflows on SNR calculus (Mauro Carvalho Chehab) [task:392635] {CVE-2024-50290}
  - media: v4l2-tpg: prevent the risk of a division by zero (Mauro Carvalho Chehab) [task:392643] {CVE-2024-50287}
  - security/kysec: fix crash for task kill (mengdehui) [task:390393]
  - dm cache: fix potential out-of-bounds access on the first resume (Ming-Hung Tsai) [task:390571] {CVE-2024-50278}
  - dm cache: optimize dirty bit checking with find_next_bit when resizing (Ming-Hung Tsai) [task:390571]
  - net/sched: accept TCA_STAB only for root qdisc (Eric Dumazet) [task:375649] {CVE-2024-50039}
  - net: sched: refactor grafting Qdiscs with a parent (Jakub Kicinski) [task:375649]
  - nilfs2: propagate directory read errors from nilfs_find_entry() (Ryusuke Konishi) [task:387959] {CVE-2024-50202}
  - btrfs: reinitialize delayed ref list after deleting it from the list (Filipe Manana) [task:390749] {CVE-2024-50273}
  - ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() (Andrew Kanner) [task:390611] {CVE-2024-50265}
  - ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow (Edward Adam Davis) [task:390609] {CVE-2024-50218}
  - USB: serial: io_edgeport: fix use after free in debug printk (Dan Carpenter) [task:390585] {CVE-2024-50267}
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Hyunwoo Kim) [task:390583] {CVE-2024-50264}
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Kuniyuki Iwashima) [task:387777] {CVE-2024-50154}
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing (Ming-Hung Tsai) [task:390581] {CVE-2024-50279}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size (Wang Liang) [task:387479] {CVE-2024-50258}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Sean Christopherson) [task:387973] {CVE-2024-50115}
  - usb: typec: altmode should keep reference to parent (Thadeu Lima de Souza Cascardo) [task:387987] {CVE-2024-50150}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout (Luiz Augusto von Dentz) [task:387967] {CVE-2024-50125}
  - Bluetooth: call sock_hold earlier in sco_conn_del (Desmond Cheong Zhi Xi) [task:387967]
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [task:387575] {CVE-2024-50142}
  - parport: Proper fix for array out-of-bounds access (Takashi Iwai) [task:380221] {CVE-2024-50074}
  - nilfs2: fix kernel bug due to missing clearing of checked flag (Ryusuke Konishi) [task:387405] {CVE-2024-50230}
  - ixgbevf: Fix resource leak in ixgbevf_init_module() (Shang XiaoJing) [task:376297] {CVE-2022-49028}
  - sched/pelt: Fix attach_entity_load_avg() corner case (kuyo chang) [task:375977]
  - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Rutland) [task:387961] {CVE-2024-50099}
  - net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() (Wang Hai) [task:387913] {CVE-2024-50168}
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister (Ye Bin) [task:387981] {CVE-2024-50148}
  - RDMA/mad: Improve handling of timed out WRs of mad agent (Saravanan Vajravel) [task:387985] {CVE-2024-50095}
  - IB/mad: Issue complete whenever decrements agent refcount (Shay Drory) [task:387985]
  - netfilter: Drop fragmented ndisc packets assembled in netfilter (Georg Kohmann) [bug:277233]
  - be2net: fix potential memory leak in be_xmit() (Wang Hai) [task:387921] {CVE-2024-50167}
  - ceph: remove the incorrect Fw reference check when dirtying pages (Xiubo Li) [task:387779] {CVE-2024-50179}
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (Pablo Neira Ayuso) [task:387917] {CVE-2024-50251}
  - nilfs2: fix kernel bug due to missing clearing of buffer delay flag (Ryusuke Konishi) [task:387481] {CVE-2024-50116}
  - drm/vc4: Stop the active perfmon before being destroyed (Maíra Canal) [task:387413] {CVE-2024-50187}
  - rtmutex: Drop rt_mutex::wait_lock before scheduling (Roland Xu) [task:368141] {CVE-2024-46829}
  - x86/ioapic: Handle allocation failures gracefully (Thomas Gleixner) [task:380139] {CVE-2024-49927}
  - net/mlx5e: Fix netif state handling (Shay Drory) [task:330508] {CVE-2024-38608}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Omar Sandoval) [task:380143] {CVE-2024-50082}
  - list: add "list_del_init_careful()" to go with "list_empty_careful()" (Linus Torvalds) [task:380143]
  - gpiolib: fix memory leak in gpiochip_setup_dev() (Zeng Heng) [task:376237] {CVE-2022-48975}
  - gpiolib: check the 'ngpios' property in core gpiolib code (Bartosz Golaszewski) [task:376237]
  - gpiolib: free device name on error path to fix kmemleak (Quanyang Wang) [task:376237]
  - gpio: gpiolib: Normalize return code variable name (Linus Walleij) [task:376237]
  - tcp: avoid too many retransmit packets (Eric Dumazet) [task:347169] {CVE-2024-41007}
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Eric Dumazet) [task:347169]
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Menglong Dong) [task:347169]
  - tcp: refactor tcp_retransmit_timer() (Eric Dumazet) [task:347169]
  - net/sched: act_mirred: don't override retval if we already lost the skb (Jakub Kicinski) [task:210475] {CVE-2024-26739}
  - KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache (Oliver Upton) [task:200747] {CVE-2024-26598}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect (Luiz Augusto von Dentz) [task:375621] {CVE-2024-49950}
  - nfsd: map the EBADMSG to nfserr_io to avoid warning (Li Lingfeng) [task:376263] {CVE-2024-49875}
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl) [task:376133] {CVE-2024-50017}
  - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (Konrad Dybcio) [task:380141] {CVE-2024-49901}
  - bpf: Fix a sdiv overflow issue (Yonghong Song) [task:376399] {CVE-2024-49888}
  - bpf: Rename fixup_bpf_calls and add some comments (Brendan Jackman) [task:376399]
  - dm snapshot: fix lockup in dm_exception_table_exit (Mikulas Patocka) [task:221943] {CVE-2024-35805}
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (Ard Biesheuvel) [task:376275] {CVE-2024-49858}
  - btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (Qu Wenruo) [task:376151] {CVE-2024-49868}
  - fsnotify: clear PARENT_WATCHED flags lazily (Amir Goldstein) [task:376261] {CVE-2024-47660}
  - xfs: Reduce unnecessary searches when searching for the best extents (Chi Zhiling) [task:377527]
  - jfs: Fix sanity check in dbMount (Dave Kleikamp) [task:376131]
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc() (Jeongjun Park) [task:376131] {CVE-2024-47723}
  - net/xen-netback: prevent UAF in xenvif_flush_hash() (Jeongjun Park) [task:380461] {CVE-2024-49936}
  - net: xen-netback: hash.c: Use built-in RCU list checking (Madhuparna Bhowmik) [task:380461]
  - ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() (Jinjie Ruan) [task:380455] {CVE-2023-52917}
  - fou: fix initialization of grc (Muhammad Usama Anjum) [task:363977]
  - fou: Fix null-ptr-deref in GRO. (Kuniyuki Iwashima) [task:363977] {CVE-2024-46763}
  - gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers (Eric Dumazet) [task:363977]
  - gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers (Eric Dumazet) [task:363977]
  - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (Mike Marciniszyn) [task:225598] {CVE-2021-47523}
  - vfs: Don't evict inode under the inode lru traversing context (Zhihao Cheng) [task:358113] {CVE-2024-45003}
  - ACPI: sysfs: validate return type of _STR method (Thomas Weißschuh) [task:380101] {CVE-2024-49860}
  - drm/amdgpu/pm: Fix the null pointer dereference for smu7 (Ma Jun) [task:352623] {CVE-2024-43909}
  - drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links (Hersen Wu) [task:368523] {CVE-2024-46816}
  - ext4: no need to continue when the number of entries is 1 (Edward Adam Davis) [task:380197] {CVE-2024-49967}
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() (Gustavo A. R. Silva) [task:380459] {CVE-2024-50008}
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (Toke Høiland-Jørgensen) [task:379923] {CVE-2024-49938}
  - net: add more sanity checks to qdisc_pkt_len_init() (Eric Dumazet) [task:380237] {CVE-2024-49948}
  - ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (Eric Dumazet) [task:376177] {CVE-2024-47707}
  - btrfs: don't balance btree inode pages from buffered write path (Nikolay Borisov) [task:375983]
  - netfilter: br_netfilter: fix panic with metadata_dst skb (Andy Roulin) [task:376437] {CVE-2024-50045}
  - drm/amd/pm: ensure the fw_info is not null before using it (Tim Huang) [task:376229] {CVE-2024-49890}
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (Lizhi Xu) [task:375655] {CVE-2024-49877}
  - tipc: guard against string buffer overrun (Simon Horman) [task:376129] {CVE-2024-49995}
  - ALSA: asihpi: Fix potential OOB array access (Takashi Iwai) [task:376313] {CVE-2024-50007}
  - iavf: Fix error handling in iavf_init_module() (Yuan Can) [task:376061] {CVE-2022-49027}
  - media: pci: cx23885: check cx23885_vdev_init() return (Hans Verkuil) [task:376301] {CVE-2023-52918}
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi) [task:371789]
  - nilfs2: fix missing cleanup on rollforward recovery error (Ryusuke Konishi) [task:363971] {CVE-2024-46781}
  - btrfs: replace BUG_ON() with error handling at update_ref_for_cow() (Filipe Manana) [task:363775] {CVE-2024-46752}
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [task:376159] {CVE-2024-49935}
  - ACPI: acpi_pad: add a missed blank line after declarations (Xiaofei Tan) [task:376159]
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue (Ma Ke) [task:376335] {CVE-2024-49879}
  - Bluetooth: hci_core: Fix leaking sent_cmd skb (Luiz Augusto von Dentz) [task:344623] {CVE-2022-48844}
  - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error (Daniel Borkmann) [task:375653] {CVE-2024-47728}
  - RDMA/cxgb4: Added NULL check for lookup_atid (Mikhail Lobanov) [task:376283] {CVE-2024-47749}
  - tcp: check skb is non-NULL in tcp_rto_delta_us() (Josh Hunt) [task:375609] {CVE-2024-47684}
  - rtc: cmos: Fix wake alarm breakage (Rafael J. Wysocki) [task:375407]
  - rtc: cmos: Fix event handler registration ordering issue (Rafael J. Wysocki) [task:375407] {CVE-2022-48953}
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Eric Dumazet) [task:375619] {CVE-2024-49949}
  - net/mlx5e: Fix use-after-free when reverting termination table (Roi Dayan) [task:375625] {CVE-2022-49025}
  - block, bfq: fix possible UAF for bfqq->bic with merge chain (Yu Kuai) [task:375629] {CVE-2024-47706}
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (Xin Long) [task:375633] {CVE-2024-49944}
  - MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed (Jiaxun Yang) [task:368269] {CVE-2024-46832}
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate() (Artem Sadovnikov) [task:375967] {CVE-2024-50006}
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() (Ryusuke Konishi) [task:375969] {CVE-2024-47699}
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption (Eric Dumazet) [task:376057] {CVE-2024-49952}
  - ppp: fix ppp_async_encode() illegal access (Eric Dumazet) [task:375965] {CVE-2024-50035}
  - ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition (Kaixin Wang) [task:375963] {CVE-2024-50059}
  - nfsd: call cache_put if xdr_reserve_space returns NULL (Guoqing Jiang) [task:376185] {CVE-2024-47737}
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks (Lizhi Xu) [task:376163] {CVE-2024-49965}
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (Junlin Li) [task:375615] {CVE-2024-47697}
  - mailbox: bcm2835: Fix timeout during suspend mode (Stefan Wahren) [task:376341] {CVE-2024-49963}
  - nilfs2: fix potential oob read in nilfs_btree_check_delete() (Ryusuke Konishi) [task:376183] {CVE-2024-47757}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() (Baokun Li) [task:376347] {CVE-2024-49883}
  - ocfs2: cancel dqi_sync_work before freeing oinfo (Joseph Qi) [task:376203] {CVE-2024-49966}
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (Jonathan Cameron) [task:368125] {CVE-2024-46822}
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header (James Morse) [task:368125]
  - drm/amd/display: added NULL check at start of dc_validate_stream (winstang) [task:375221] {CVE-2024-46802}
  - ocfs2: reserve space for inline xattr before attaching reflink tree (Gautham Ananthakrishna) [task:376165] {CVE-2024-49958}
  - btrfs: wait for fixup workers before stopping cleaner kthread during umount (Filipe Manana) [task:376329] {CVE-2024-49867}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Eric Dumazet) [task:376333] {CVE-2024-47685}
  - ACPI: battery: Fix possible crash when unregistering a battery hook (Armin Wolf) [task:376339] {CVE-2024-49955}
  - ACPI: battery: Simplify battery hook locking (Armin Wolf) [task:376339]
  - net: ethernet: nixge: fix NULL dereference (Yuri Karpov) [task:376191] {CVE-2022-49019}
  - net: nixge: Address compiler warnings when building for i386 (Moritz Fischer) [task:376191]
  - net: nixge: Add support for 64-bit platforms (Moritz Fischer) [task:376191]
  - ext4: fix double brelse() the buffer of the extents path (Baokun Li) [task:376207] {CVE-2024-49882}
  - vfs: fix race between evice_inodes() and find_inode()&iput() (Julian Sun) [task:376219] {CVE-2024-47679}
  - jfs: check if leafidx greater than num leaves per dmap tree (Edward Adam Davis) [task:376377] {CVE-2024-49902}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (Junlin Li) [task:376239] {CVE-2024-47698}
  - net: Fix an unsafe loop on the list (Anastasia Kovaleva) [task:376085] {CVE-2024-50024}
  - xen: use correct end address of kernel for conflict checking (Juergen Gross) [task:376245] {CVE-2024-47722}
  - media: venus: fix use after free bug in venus_remove due to race condition (Zheng Wang) [task:376401] {CVE-2024-49981}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem (Thadeu Lima de Souza Cascardo) [task:376249] {CVE-2024-47701}
  - ext4: return error on ext4_find_inline_entry (Thadeu Lima de Souza Cascardo) [task:376249]
  - jfs: Fix uninit-value access of new_ea in ea_buffer (Zhao Mengmeng) [task:376257] {CVE-2024-49900}
  - drm/amd/display: Check stream before comparing them (Alex Hung) [task:376409] {CVE-2024-49896}
  - sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (Xin Long) [task:376417]
  - sctp: fix memory leak in sctp_stream_outq_migrate() (Zhengchao Shao) [task:376417] {CVE-2022-49013}
  - fbdev: pxafb: Fix possible use after free in pxafb_task() (Kaixin Wang) [task:376117] {CVE-2024-49924}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation (Srinivasan Shanmugam) [task:376113] {CVE-2024-49894}
  - ocfs2: fix null-ptr-deref when journal load failed. (Julian Sun) [task:376303] {CVE-2024-49957}
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (Luiz Augusto von Dentz) [task:376309] {CVE-2024-50044}
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error (Baokun Li) [task:376143] {CVE-2024-49959}
  - jfs: Fix uaf in dbFreeBits (Edward Adam Davis) [task:376153] {CVE-2024-49903}
  - e100: Fix possible use after free in e100_xmit_prepare (Wang Hai) [task:376281] {CVE-2022-49026}
  - e100: switch from 'pci_' to 'dma_' API (Christophe JAILLET) [task:376281]
  - aoe: fix the potential use-after-free problem in more places (Chun-Yi Lee) [task:376351] {CVE-2024-49982}
  - security/kysec: permit task killed by parent (penghuaihe) [bug:272883]
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman) [bug:251189]
  - net: ethernet: lantiq_etop: fix memory disclosure (Aleksander Jan Bajkowski) [task:376181] {CVE-2024-49997}
  - tracing: Free buffers when a used dynamic event is removed (Steven Rostedt (Google)) [task:375645] {CVE-2022-49006}
  - tracing: initialize variable in create_dyn_event() (Frank Rowand) [task:375645]
  - tracing: Add unified dynamic event framework (Masami Hiramatsu) [task:375645]
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() (Pei Xiao) [task:376385] {CVE-2024-49962}
  - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. (Vincent Pelletier) [task:160493]
  - NFC: st21nfca: Fix memory leak in device probe and remove (Wei Yongjun) [task:160493]
  - Input: cyttsp4_core - change del_timer_sync() to timer_shutdown_sync() (Duoming Zhou) [bug:189740] {CVE-2023-4134}
  - x86/CPU/AMD: Do not leak quotient data after a division by 0 (Borislav Petkov (AMD)) [task:179889, bug:189752] {CVE-2023-20588}
  - x86/cpu/amd: Add a Zenbleed fix (Borislav Petkov (AMD)) [bug:185043] {CVE-2023-20593}
  - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre) [task:164574]
  - Revert "x86/cpu/amd: Add a Zenbleed fix" (Yan Wang) [bug:185043]
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach (Zheng Wang) [task:223093, task:370805] {CVE-2024-35811, CVE-2023-47233}
  - turn off the GPU driver for sietium (Yan Wang) [task:386499, task:370805]
  - KVM: Add GDS_NO support to KVM (Daniel Sneddon) [task:370791, bug:189744] {CVE-2022-40982}
  - x86/speculation: Add Gather Data Sampling mitigation (Daniel Sneddon) [task:370791, bug:189744] {CVE-2022-40982}
  - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta) [task:164574, task:370791]
  - x86/common: Stamp out the stepping madness (Peter Zijlstra) [task:164574, task:370791]
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google)) [bug:189740]
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google)) [bug:189740]
  - fix the kabi error of del_timer and del_timer_sync (Yan Wang) [bug:189740]
  - cxgb4: fix use after free bugs caused by circular dependency problem (Duoming Zhou) [bug:189736] {CVE-2023-4133}
  - timers: Provide timer_shutdown[_sync]() (Thomas Gleixner) [bug:189740]
  - timers: Add shutdown mechanism to the internal functions (Thomas Gleixner) [bug:189740]
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode (Thomas Gleixner) [bug:189740]
  - timers: Rename del_timer() to timer_delete() (Thomas Gleixner) [bug:189740]
  - timers: Rename del_timer_sync() to timer_delete_sync() (Thomas Gleixner) [bug:189740]
  - timers: Use del_timer_sync() even on UP (Thomas Gleixner) [bug:189740]
  - timers: Silently ignore timers with a NULL function (Thomas Gleixner) [bug:189740]
  - timers: Update kernel-doc for various functions (Thomas Gleixner) [bug:189740]
  - timers: Replace BUG_ON()s (Thomas Gleixner) [bug:189740]
  - i2c: Fix a potential use after free (Xu Wang) [task:162162]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.46.v2207
changelog:
  - Bluetooth: hci_qca: Fix the teardown problem for real (Thomas Gleixner) [task:440775]
  - Bluetooth: hci_qca: Use del_timer_sync() before freeing (Steven Rostedt) [task:440775] {CVE-2022-49555}
  - ext4: fix bug_on in __es_tree_search (Baokun Li) [task:440679] {CVE-2022-49409}
  - nilfs2: fix possible int overflows in nilfs_fiemap() (Nikita Zhandarovich) [task:441380] {CVE-2025-21736}
  - ftrace: Clean up hash direct_functions on register failures (Song Liu) [task:440761] {CVE-2022-49402}
  - ipmr: do not call mr_mfc_uses_dev() for unres entries (Eric Dumazet) [task:440524] {CVE-2025-21719}
  - nbd: don't allow reconnect after disconnect (Yu Kuai) [task:441294] {CVE-2025-21731}
  - nbd: Aovid double completion of a request (Xie Yongji) [task:441294]
  - binfmt_flat: Fix integer overflow bug on 32 bit systems (Dan Carpenter) [task:440786] {CVE-2024-58010}
  - staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances (Stefan Wahren) [task:440751] {CVE-2022-49106}
  - ata: libata: Fix memory leak for error path in ata_host_alloc() (Zheng Qixing) [bug:335381]
  - dlm: fix possible lkb_resource null dereference (Alexander Aring) [task:429489] {CVE-2024-47809}
  - hrtimers: Handle CPU state correctly on hotplug (Koichiro Den) [task:431132] {CVE-2024-57951}
  - io_uring: check for overflows in io_sqe_buffer_register (Pavel Begunkov) [task:419631] {CVE-2024-53187}
  - kcsan: Turn report_filterlist_lock into a raw_spinlock (Marco Elver) [task:429532] {CVE-2024-56610}
  - nvme-pci: fix freeing of the HMB descriptor table (Christoph Hellwig) [task:412165] {CVE-2024-56756}
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference (Miri Korenblit) [task:376287] {CVE-2024-49929}
  - netfilter: xtables: fix typo causing some targets not to load on IPv6 (Pablo Neira Ayuso) [task:376295]
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed (Florian Westphal) [task:376295] {CVE-2024-50038}
  - netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value (Juhee Kang) [task:376295]
  - netfilter: xtables: Bring SPDX identifier back (Thomas Gleixner) [task:376295]
  - netfilter: xtables: Add snapshot of hardidletimer target (Manoj Basapathi) [task:376295]
  - tracing: Prevent bad count for tracing_cpumask_write (Lizhi Xu) [task:417443] {CVE-2024-56763}
  - kernel: Initialize cpumask before parsing (Tetsuo Handa) [task:183179]
  - md/md-bitmap: Add missing destroy_work_on_stack() (Yuan Can) [task:393427]
  - md/raid1-10: fix casting from randomized structure in raid1_submit_write() (Yu Kuai) [task:393427]
  - md/raid1: avoid soft lockup under high load (Hannes Reinecke) [task:393427]
  - md/raid1-10: limit the number of plugged bio (Yu Kuai) [task:393427]
  - md/raid1-10: don't handle pluged bio by daemon thread (Yu Kuai) [task:393427]
  - md/md-bitmap: add a new helper to unplug bitmap asynchrously (Yu Kuai) [task:393427]
  - md/raid1-10: submit write io directly if bitmap is not enabled (Yu Kuai) [task:393427]
  - md/raid1-10: factor out a helper to submit normal write (Yu Kuai) [task:393427]
  - md/raid1-10: factor out a helper to add bio to plug (Yu Kuai) [task:393427]
  - md: raid1/raid10: drop pending_cnt (Mariusz Tkaczyk) [task:393427]
  - md: drop queue limitation for RAID1 and RAID10 (Mariusz Tkaczyk) [task:393427]
  - drivers: md: Unify common definitions of raid1 and raid10 (Marcos Paulo de Souza) [task:128226]
  - sched/deadline: Fix task_struct reference leak (Wander Lairson Costa) [task:347043] {CVE-2024-41023}
  - sched/deadline: Unthrottle PI boosted threads while enqueuing (Daniel Bristot de Oliveira) [task:162162]
  - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [task:429535] {CVE-2024-57807}
  - scsi: megaraid_sas: Early detection of VD deletion through RaidMap update (Kashyap Desai) [task:156664]
  - xdp: fix invalid wait context of page_pool_destroy() (Taehee Yoo) [task:352233] {CVE-2024-43834}
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [task:410041] {CVE-2024-53237}
  - driver core: Introduce device_find_any_child() helper (Andy Shevchenko) [task:410041]
  - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (Easwar Hariharan) [task:431135] {CVE-2025-21690}
  - ceph: fix potential use-after-free in ceph_mdsc_build_path (Jeff Layton) [task:429522]
  - PCI: Add ACS quirk for Wangxun FF5xxx NICs (Mengyuan Lou) [task:441941]
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX (Pablo Neira Ayuso) [task:426326] {CVE-2025-21648}
  - netfilter: Use kvcalloc (Joe Perches) [task:426326]
  - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection (Takashi Iwai) [task:410151] {CVE-2024-56533}
  - nfsd: restore callback functionality for NFSv4.0 (NeilBrown) [task:410431]
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (Chuck Lever) [task:410431] {CVE-2024-53217}
  - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (David Hildenbrand) [task:410435] {CVE-2024-56611}
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Takashi Iwai) [task:408539] {CVE-2024-53150}
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (Radu Rendec) [task:439937] {CVE-2025-21785}
  - gro_cells: reduce number of synchronize_net() calls (Eric Dumazet) [task:432553]
  - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (Antonio Quartulli) [task:393407] {CVE-2024-53060}
  - net: b44: set pause params only when interface is up (Peter Münster) [task:434220]
  - stackdepot: respect __GFP_NOLOCKDEP allocation flag (Andrey Ryabinin) [task:434220]
  - mtd: diskonchip: work around ubsan link failure (Arnd Bergmann) [task:434220]
  - Bluetooth: hci_core: Fix possible buffer overflow (Luiz Augusto von Dentz) [task:434220]
  - xfrm: Avoid clang fortify warning in copy_to_user_tmpl() (Nathan Chancellor) [task:434220]
  - comedi: comedi_test: Prevent timers rescheduling during deletion (Ian Abbott) [task:434220]
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (Qu Wenruo) [task:434220]
  - net: stmmac: fix TSO DMA API usage causing oops (Russell King (Oracle)) [task:412193] {CVE-2024-56719}
  - net: stmmac: Fix TSO descriptor with Enhanced Addressing (Jose Abreu) [task:412193]
  - net: stmmac: Fix the problem of tso_xmit (yuqi jin) [task:412193]
  - net: stmmac: Enable support for > 32 Bits addressing in XGMAC (Jose Abreu) [task:412193]
  - security/kysec: read SM3_256 bank use tpm_pcr_read_for_sm3 function (huanfuxi) [task:431169]
  - tpm: add tpm_pcr_read_for_sm3 function for read SM3_256 bank (huanfuxi) [task:431169]
  - eth: bnxt: always recalculate features after XDP clearing, fix null-deref (Jakub Kicinski) [task:428486] {CVE-2025-21682}
  - netfilter: IDLETIMER: Fix for possible ABBA deadlock (Phil Sutter) [task:421021] {CVE-2024-54683}
  - SUNRPC: no need get cache ref when protected by rcu (Yang Erkun) [task:429509]
  - sunrpc: cache : Replace seq_printf with seq_puts (Xu Wang) [task:429509]
  - nfsd: no need get cache ref when protected by rcu (Yang Erkun) [task:429509]
  - SUNRPC: introduce cache_check_rcu to help check in rcu context (Yang Erkun) [task:429509]
  - SUNRPC: make sure cache entry active before cache_show (Yang Erkun) [task:429509] {CVE-2024-53174}
  - SUNRPC: Allow cache lookups to use RCU protection rather than the r/w spinlock (Trond Myklebust) [task:429509]
  - SUNRPC: Refactor sunrpc_cache_lookup (Trond Myklebust) [task:429509]
  - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (Luiz Augusto von Dentz) [task:429498] {CVE-2024-56590}
  - skbuff: introduce skb_pull_data (Luiz Augusto von Dentz) [task:429498]
  - drm/dp_mst: Fix MST sideband message body length check (Imre Deak) [task:429526] {CVE-2024-56616}
  - drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check (Ma Ke) [task:420525] {CVE-2024-56778}
  - drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check (Ma Ke) [task:420269] {CVE-2024-56777}
  - ovl: Filter invalid inodes with missing lookup function (Vasiliy Kovalev) [task:416333] {CVE-2024-56570}
  - rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (Yongliang Gao) [task:412179] {CVE-2024-56739}
  - fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() (Zhen Lei) [task:412169] {CVE-2024-56746}
  - fbdev/sh7760fb: Alloc DMA memory from hardware device (Thomas Zimmermann) [task:412169]
  - 9p/xen: fix release of IRQ (Alex Zenla) [task:412037] {CVE-2024-56704}
  - crypto: bcm - add error check in the ahash_hmac_init function (Chen Ridong) [task:412173] {CVE-2024-56681}
  - ALSA: usb-audio: Fix a DMA to stack memory bug (Dan Carpenter) [task:410485]
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Benoît Sevens) [task:410485] {CVE-2024-53197}
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() (Alper Nebi Yasak) [task:410399] {CVE-2024-56539}
  - vfio/pci: Properly hide first-in-list PCIe extended capability (Avihai Horon) [task:410377] {CVE-2024-53214}
  - fs/io_uring: fix missing NOWAIT check for O_DIRECT start write (Jens Axboe) [task:391015] {CVE-2024-53052}
  - mm/swapfile: skip HugeTLB pages for unuse_vma (Liu Shixin) [task:419359] {CVE-2024-50199}
  - posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() (Jinjie Ruan) [task:419337]
  - posix-clock: Fix missing timespec64 check in pc_clock_settime() (Jinjie Ruan) [task:419337] {CVE-2024-50195}
  - drm/amd: Guard against bad data for ATIF ACPI method (Mario Limonciello) [task:387573] {CVE-2024-50117}
  - xfs: attach dquots to inode before reading data/cow fork mappings (Darrick J. Wong) [task:426909]
  - ila: serialize calls to nf_register_net_hooks() (Eric Dumazet) [task:425032] {CVE-2024-57900}
  - bpf, sockmap: Several fixes to bpf_msg_pop_data (Zijian Zhang) [task:412183] {CVE-2024-56720}
  - bpf, sockmap: msg_pop_data can incorrecty set an sge length (John Fastabend) [task:412183]
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open() (Trond Myklebust) [task:410439] {CVE-2024-53173}
  - NFSv4.0: Fix the wake up of the next waiter in nfs_release_seqid() (Trond Myklebust) [task:410439] {CVE-2024-53173}
  - initramfs: avoid filename buffer overrun (David Disseldorp) [task:398621] {CVE-2024-53142}
  - bpf: Fix out-of-bounds write in trie_get_next_key() (Byeonguk Jeong) [task:387905] {CVE-2024-50262}
  - ext4: avoid use-after-free in ext4_ext_show_leaf() (Baokun Li) [task:376359] {CVE-2024-49889}
  - tipc: fix NULL deref in cleanup_bearer() (Eric Dumazet) [task:410449]
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (Kuniyuki Iwashima) [task:410449] {CVE-2024-56642}
  - scsi: sg: Fix slab-use-after-free read in sg_release() (Suraj Sonawane) [task:410451] {CVE-2024-56631}
  - sh: intc: Fix use-after-free bug in register_intc_controller() (Dan Carpenter) [task:410463] {CVE-2024-53165}
  - ALSA: caiaq: Use snd_card_free_when_closed() at disconnection (Takashi Iwai) [task:410393] {CVE-2024-56531}
  - ALSA: 6fire: Release resources at card release (Takashi Iwai) [task:410473] {CVE-2024-53239}
  - net/smc: initialize close_work early to avoid warning (Wen Gu) [task:410481] {CVE-2024-56641}
  - RDMA/uverbs: Prevent integer overflow issue (Dan Carpenter) [task:425748] {CVE-2024-57890}
  - mac802154: check local interfaces before deleting sdata list (Lizhi Xu) [task:429350] {CVE-2024-57948}
  - jfs: fix shift-out-of-bounds in dbSplit (Ghanshyam Agrawal) [task:429537] {CVE-2024-56597}
  - af_packet: avoid erroring out after sock_init_data() in packet_create() (Ignat Korchagin) [task:429525] {CVE-2024-56606}
  - jfs: fix array-index-out-of-bounds in jfs_readdir (Ghanshyam Agrawal) [task:429545] {CVE-2024-56596}
  - jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (Nihar Chaithanya) [task:429494] {CVE-2024-56595}
  - nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (Yang Erkun) [task:429530] {CVE-2024-56779}
  - jffs2: Fix rtime decompressor (Richard Weinberger) [task:429542]
  - jffs2: Prevent rtime decompress memory corruption (Kinsey Moore) [task:429542] {CVE-2024-57850}
  - drm/amd/display: Add check for granularity in dml ceil/floor helpers (Roman Li) [task:429533] {CVE-2024-57922}
  - leds: class: Protect brightness_show() with led_cdev->led_access mutex (Mukesh Ojha) [task:429495] {CVE-2024-56587}
  - iommu/arm-smmu: Defer probe of clients after smmu device bound (Pratyush Brahma) [task:410455] {CVE-2024-56568}
  - dma-debug: fix a possible deadlock on radix_lock (Levi Yun) [task:429502] {CVE-2024-47143}
  - dma-debug: clean up put_hash_bucket() (Dan Carpenter) [task:429502]
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (Zhen Lei) [task:412177] {CVE-2024-56747}
  - net: sched: fix ordering of qlen adjustment (Lion Ackermann) [task:429507] {CVE-2024-53164}
  - PCI: Fix use-after-free of slot->bus on hot remove (Lukas Wunner) [task:429480] {CVE-2024-53194}
  - wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (Norbert van Bolhuis) [task:429493] {CVE-2024-56593}
  - scsi: qla2xxx: Fix use after free on unload (Quinn Tran) [task:429485] {CVE-2024-56623}
  - net: af_can: do not leave a dangling sk pointer in can_create() (Ignat Korchagin) [task:429514] {CVE-2024-56603}
  - wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (Issam Hamdi) [task:429536] {CVE-2024-57899}
  - wifi: mac80211: fix mesh id corruption on 32 bit systems (Felix Fietkau) [task:429536]
  - net: inet6: do not leave a dangling sk pointer in inet6_create() (Ignat Korchagin) [task:429511] {CVE-2024-56600}
  - sched/deadline: Fix warning in migrate_enable for boosted tasks (Wander Lairson Costa) [task:410385] {CVE-2024-56583}
  - selinux: ignore unknown extended permissions (Thiébaud Weksteen) [task:427277] {CVE-2024-57931}
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (Liu Jian) [task:412151] {CVE-2024-56688}
  - dm thin: make get_first_thin use rcu-safe list first function (Krister Johansen) [task:427323] {CVE-2025-21664}
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (Suraj Sonawane) [task:410053] {CVE-2024-56662}
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices (Andy Shevchenko) [task:412161] {CVE-2024-56723}
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device (Andy Shevchenko) [task:412167] {CVE-2024-56724}
  - mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device (Andy Shevchenko) [task:412167]
  - REDHAT: rpmspec: amend removal of depmod created files to include modules.builtin.alias.bin (Jiangshan Yi) [task:413827]
  - rpmbuild: avoid providing duplicate dtb directory (Jiangshan Yi) [task:413827]
  - HYGON: KVM: x86/svm: Add set_guest_pat_wb parameter for non-passthrough application scenarios (Liao Xuan) [task:419887, task:435723]
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too (Jiri Slaby (SUSE)) [task:376267] {CVE-2024-50058}
  - LSM: lsm_hooks.h - fix missing colon in docstring (Ondrej Mosnacek) [bug:258835, task:442977]
  - kernfs: initialize security of newly created nodes (Ondrej Mosnacek) [bug:258835, task:442977]
  - LSM: add new hook for kernfs node initialization (Ondrej Mosnacek) [bug:258835, task:442977]
  - kernfs: use simple_xattrs for security attributes (Ondrej Mosnacek) [bug:258835, task:442977]
  - kernfs: do not alloc iattrs in kernfs_xattr_get (Ondrej Mosnacek) [bug:258835, task:442977]
  - kernfs: clean up struct kernfs_iattrs (Ondrej Mosnacek) [bug:258835, task:442977]
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Eric Dumazet) [task:387901] {CVE-2024-50256}
  - hrtimers: Push pending hrtimers away from outgoing CPU earlier (Thomas Gleixner) [task:397891, task:429297]
  - dm: switch to precise io accounting (zhanggenjian) [task:430223]
  - block: add precise io accouting apis (Li Nan) [task:430223]
  - OPENEULER: iomap: add support to track dirty state of sub pages (Shida Zhang) [task:192649, task:407439]
  - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount (Filipe Manana) [task:429500] {CVE-2024-57896}
  - xhci: make sure TRB is fully written before giving it to the controller (Mathias Nyman) [task:158034]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.47.v2207
changelog:
  - Revert "drop_monitor: fix incorrect initialization order" (Zhengyuan Liu)
  - drop_monitor: fix incorrect initialization order (Gavrilov Ilia) [task:444123] {CVE-2025-21862}
  - update changelog for upcoming 4.19.90-52.47.v2207 (Zhengyuan Liu)
  - ext4: fix race condition between ext4_write and ext4_convert_inline_data (Baokun Li) [task:439963] {CVE-2022-49414}
  - ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow (Baokun Li) [task:449973]
  - ext4: avoid potential data overflow in next_linear_group (Kemeng Shi) [task:449973]
  - ext4: use locality group preallocation for small closed files (Jan Kara) [task:449973]
  - ext4: avoid unnecessary spreading of allocations among groups (Jan Kara) [task:449973]
  - ext4: discard preallocations before releasing group lock (Jan Kara) [task:449973]
  - ext4: fix dead loop in ext4_mb_new_blocks (Ye Bin) [task:449973]
  - ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS (Baokun Li) [task:449973]
  - ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow (Baokun Li) [task:449973]
  - ext4: add two helper functions extent_logical_end() and pa_logical_end() (Baokun Li) [task:449973]
  - ext4: fix rbtree traversal bug in ext4_mb_use_preallocated (Ojaswin Mujoo) [task:449973]
  - ext4: mballoc: Remove useless setting of ac_criteria (Ritesh Harjani) [task:449973]
  - ext4: add EXT4_MB_HINT_GOAL_ONLY test in ext4_mb_use_preallocated (Kemeng Shi) [task:449973]
  - ext4: Stop searching if PA doesn't satisfy non-extent file (Ojaswin Mujoo) [task:449973]
  - ext4: Use rbtrees to manage PAs instead of inode i_prealloc_list (Ojaswin Mujoo) [task:449973]
  - ext4: Refactor code related to freeing PAs (Ojaswin Mujoo) [task:449973]
  - ext4: Convert pa->pa_inode_list and pa->pa_obj_lock into a union (Ojaswin Mujoo) [task:449973]
  - ext4: limit the length of per-inode prealloc list (brookxu) [task:449973]
  - OPENEULER: ext4: Stop trying writing pages if no free blocks generated (Zhihao Cheng) [task:184981]
  - ext4: reorganize if statement of ext4_mb_release_context() (brookxu) [task:449973]
  - ext4: add mb_debug logging when there are lost chunks (brookxu) [task:449973]
  - ext4: mballoc: add blocks to PA list under same spinlock after allocating blocks (Ritesh Harjani) [task:449973]
  - ext4: use built-in RCU list checking in mballoc (Madhuparna Bhowmik) [task:449973]
  - ext4: Abstract out overlap fix/check logic in ext4_mb_normalize_request() (Ojaswin Mujoo) [task:449973]
  - ext4: Move overlap assert logic into a separate function (Ojaswin Mujoo) [task:449973]
  - ext4: Refactor code in ext4_mb_normalize_request() and ext4_mb_use_preallocated() (Ojaswin Mujoo) [task:449973]
  - ext4: avoid unnecessary pointer dereference in ext4_mb_normalize_request (Kemeng Shi) [task:449973]
  - ext4: Add allocation criteria 1.5 (CR1_5) (Ojaswin Mujoo) [task:449973]
  - ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() (Ojaswin Mujoo) [task:166857]
  - ext4: Add per CR extent scanned counter (Ojaswin Mujoo) [task:449973]
  - ext4: Abstract out logic to search average fragment list (Ojaswin Mujoo) [task:449973]
  - ext4: fixup possible uninitialized variable access in ext4_mb_choose_next_group_cr1() (Jan Kara) [task:449973]
  - ext4: use is_power_of_2 helper in ext4_mb_regular_allocator (Kemeng Shi) [task:449973]
  - ext4: Avoid scanning smaller extents in BG during CR1 (Ojaswin Mujoo) [task:449973]
  - ext4: Add counter to track successful allocation of goal length (Ojaswin Mujoo) [task:449973]
  - ext4: Convert mballoc cr (criteria) to enum (Ojaswin Mujoo) [task:449973]
  - ext4: use buckets for cr 1 block scan instead of rbtree (Jan Kara) [task:449973]
  - ext4: fix sparse warnings (Theodore Ts'o) [task:449973]
  - ext4: add proc files to monitor new structures (Harshad Shirwadkar) [task:449973]
  - ext4: make mballoc try target group first even with mb_optimize_scan (Jan Kara) [task:449973]
  - ext4: mballoc: add more mb_debug() msgs (Ritesh Harjani) [task:449973]
  - ext4: mballoc: refactor ext4_mb_show_ac() (Ritesh Harjani) [task:449973]
  - ext4: improve cr 0 / cr 1 group scanning (Harshad Shirwadkar) [task:449973]
  - ext4: add ability to return parsed options from parse_options (Harshad Shirwadkar) [task:449973]
  - ext4: add MB_NUM_ORDERS macro (Harshad Shirwadkar) [task:449973]
  - ext4: optimize the implementation of ext4_mb_good_group() (brookxu) [task:449973]
  - ext4: add prefetch_block_bitmaps mount option (Theodore Ts'o) [task:449973, addresses-google-bug:159488342]
  - ext4: add prefetching for block allocation bitmaps (Alex Zhuravlev) [task:449973]
  - ext4: add mballoc stats proc file (Harshad Shirwadkar) [task:449973]
  - ext4: drop s_mb_bal_lock and convert protected fields to atomic (Harshad Shirwadkar) [task:449973]
  - ext4: skip non-loaded groups at cr=0/1 when scanning for good groups (Alex Zhuravlev) [task:449973]
  - ext4: mballoc: use lock for checking free blocks while retrying (Ritesh Harjani) [task:449973]
  - ext4: mballoc: introduce pcpu seqcnt for freeing PA to improve ENOSPC handling (Ritesh Harjani) [task:449973]
  - ext4: mballoc: refactor ext4_mb_discard_preallocations() (Ritesh Harjani) [task:449973]
  - ext4: mballoc: refactor ext4_mb_good_group() (Ritesh Harjani) [task:449973]
  - xfs: fix chown leaking delalloc quota blocks when fssetxattr fails (Darrick J. Wong) [task:450133]
  - xfs: always return -ENOSPC on project quota reservation failure (Eric Sandeen) [task:450133]
  - HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition (Kaixin Wang) [task:458685] {CVE-2025-37838}
  - mmc: core: use sysfs_emit() instead of sprintf() (Sergey Shtylyov) [task:440609] {CVE-2022-49267}
  - RDMA/mlx5: Move events notifier registration to be after device registration (Patrisious Haddad) [task:410141] {CVE-2024-53224}
  - net: asix: add proper error handling of usb read errors (Pavel Skripkin) [task:440657] {CVE-2022-49226}
  - drm/amd/display: Assign normalized_pix_clk when color depth = 14 (Alex Hung) [task:450278] {CVE-2025-21956}
  - drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params (Ma Ke) [task:450263] {CVE-2025-21941}
  - drm/amd/display: Check for invalid input params when building scaling params (Michael Strauss) [task:450263]
  - drivers: staging: rtl8723bs: Fix locking in rtw_scan_timeout_handler() (Hans de Goede) [task:440567]
  - drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() (Duoming Zhou) [task:440567] {CVE-2022-49309}
  - staging: rtl8723bs: replace _cancel_timer with del_timer_sync (Ross Schmidt) [task:440567]
  - staging: rtl8723bs: replace __inline by inline (Rasmus Villemoes) [task:440567]
  - i2c: designware: use casting of u64 in clock multiplication to avoid overflow (Lareine Khawaly) [task:448836] {CVE-2022-49749}
  - i2c: designware: Use DIV_ROUND_CLOSEST() macro (Andy Shevchenko) [task:448836]
  - math64: New DIV_S64_ROUND_CLOSEST helper (Chunyan Zhang) [task:448836]
  - units: Add SI metric prefix definitions (Andy Shevchenko) [task:448836]
  - include/linux/units.h: add helpers for kelvin to/from Celsius conversion (Akinobu Mita) [task:448836]
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (Ma Wupeng) [task:450240] {CVE-2025-21931}
  - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). (Kuniyuki Iwashima) [task:447169] {CVE-2025-21865}
  - usb: xhci: Fix NULL pointer dereference on certain command aborts (Michal Pecio) [task:440504] {CVE-2024-57981}
  - blk-mq: Add the check on disk->queue before calling blk_mq_cancel_work_sync() (yangxiuwei) [task:225592]
  - blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release() (Ming Lei) [task:225592] {CVE-2021-47552}
  - blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue (Yang Yang) [task:225592]
  - block: revert back to synchronous request_queue removal (Luis Chamberlain) [task:225592]
  - block: add docs for gendisk / request_queue refcount helpers (Luis Chamberlain) [task:225592]
  - blk-sysfs: Rework documention of __blk_release_queue (Marcos Paulo de Souza) [task:225592]
  - EULER: sched: Introduce priority load balance for CFS (zhangsong) [task:101857]
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() (Sergey Shtylyov) [task:162162]
  - blkcg: Add during the process to ensure data synchronization between CPUs. (cuitao) [task:404161, task:455283]
  - blkcg: handle dying request_queue when associating a blkg (Dennis Zhou) [task:404161, task:455283]
  - OPENEULER: sched/fair: Introduce multiple qos level (liwanwu) [task:447047, task:457033]
  - EULER: sched/fair: Introduce QOS_SMT_EXPELL priority reversion mechanism (Guan Jing) [task:151886]
  - fix the kabi issue caused by the addition of a union in the struct cfs_rq (Wang Yan) [task:457033]
  - EULER: sched/fair: Start tracking qos_offline tasks count in cfs_rq (Guan Jing) [task:151886]
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (Zijian Zhang) [task:410445] {CVE-2024-56633}
  - bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues (Wang Yufen) [task:168910]
  - bpf, sockmap: Fix more uncharged while msg has more_data (Wang Yufen) [task:168910]
  - tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function (Liu Jian) [task:168910]
  - nvme-fc: fix racing controller reset and create association (James Smart) [task:395841]
  - nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context (James Smart) [task:395841]
  - nvme-fc: do not wait in vain when unloading module (Daniel Wagner) [task:395841] {CVE-2024-26846}
  - nvme-fc: remove nvme_fc_terminate_io() (James Smart) [task:395841]
  - nvme-fc: eliminate terminate_io use by nvme_fc_error_recovery (James Smart) [task:395841]
  - nvme-fc: track error_recovery while connecting (James Smart) [task:395841]
  - nvme-fc: fix io timeout to abort I/O (James Smart) [task:395841]
  - nvme: wait until all completed request's complete fn is called (Ming Lei) [task:85444]
  - nvme-fc: convert assoc_active flag to bit op (James Smart) [task:395841]
  - nvme-fc: remove err_work work item (James Smart) [task:395841]
  - nvme_fc: add 'nvme_discovery' sysfs attribute to fc transport device (James Smart) [task:395841]
  - usb-storage: apply IGNORE_UAS for Realtek RTL9210 (dengjie03) [bug:332982]
  - usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 (Juhyung Park) [task:164562]
  - btrfs: ref-verify: fix use-after-free after invalid ref action (Filipe Manana) [task:410453] {CVE-2024-56581}
  - btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod (Dinghao Liu) [task:158034]
  - scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" (Lee Duncan) [task:427978]
  - atm: idt77252: fix a memleak in open_card_ubr0 (Zhipeng Lu) [task:427978]
  - net: ipv4: fix a memleak in ip_setup_cork (Zhipeng Lu) [task:427978]
  - fjes: fix memleaks in fjes_hw_setup (Zhipeng Lu) [task:427978]
  - btrfs: don't warn if discard range is not aligned to sector (David Sterba) [task:427978]
  - net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe (Kunwu Chan) [task:427978]
  - usb: mon: Fix atomicity violation in mon_bin_vma_fault (Gui-Dong Han) [task:427978]
  - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (Edward Adam Davis) [task:427978]
  - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (Benjamin Berg) [task:427978]
  - crypto: stm32/crc32 - fix parsing list of devices (Thomas Bourgoin) [task:427978]
  - crypto: stm32/crc32 - fix multi-instance (Nicolas Toromanoff) [task:157172]
  - crypto: stm32/crc32 - fix ext4 chksum BUG_ON() (Nicolas Toromanoff) [task:157172]
  - gpu/drm/radeon: fix two memleaks in radeon_vm_init (Zhipeng Lu) [task:427978]
  - clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() (Kuan-Wei Chiu) [task:427978]
  - clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() (Kuan-Wei Chiu) [task:427978]
  - drm/crtc: fix uninitialized variable use (Jani Nikula) [task:427978]
  - libsubcmd: Fix memory leak in uniq() (Ian Rogers) [task:427978]
  - drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table (Zhipeng Lu) [task:427978]
  - drm/radeon/dpm: fix a memleak in sumo_parse_power_table (Zhipeng Lu) [task:427978]
  - media: cx231xx: fix a memleak in cx231xx_init_isoc (Zhipeng Lu) [task:427978]
  - net/tg3: fix race condition in tg3_reset_task() (Thinh Tran) [task:427978]
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH (David Christensen) [task:164562]
  - PNP: ACPI: fix fortify warning (Dmitry Antipov) [task:427978]
  - crypto: ccp - fix memleak in ccp_init_dm_workarea (Dinghao Liu) [task:427978]
  - kdb: Fix a potential buffer overflow in kdb_local() (Christophe JAILLET) [task:427978]
  - media: dvbdev: drop refcount on error path in dvb_device_open() (Dan Carpenter) [task:427978]
  - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (Chengfeng Ye) [task:427978]
  - ext4: replace the traditional ternary conditional operator with with max()/min() (Kemeng Shi) [task:427978]
  - drm/crtc: Fix uninit-value bug in drm_mode_setcrtc (Ziqi Zhao) [task:427978]
  - ext4: mark group as trimmed only if it was fully scanned (Dmitry Monakhov) [task:427978]
  - ext4: change s_last_trim_minblks type to unsigned long (Lukas Czerner) [task:427978]
  - ext4: add new helper interface ext4_try_to_trim_range() (Wang Jianchao) [task:427978]
  - ext4: remove the 'group' parameter of ext4_trim_extent (Wang Jianchao) [task:427978]
  - kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ (Daniel Thompson) [task:427978]
  - gtp: Destroy device along with udp socket's netns dismantle. (Kuniyuki Iwashima) [task:428512] {CVE-2025-21678}
  - gtp: use exit_batch_rtnl() method (Eric Dumazet) [task:428512]
  - netfilter: use get_random_u32 instead of prandom (Florian Westphal) [task:440743] {CVE-2022-49698}
  - netfilter: nft_meta: place prandom handling in a helper (Florian Westphal) [task:440743]
  - media: uvcvideo: Remove dangling pointers (Ricardo Ribalda) [task:440495] {CVE-2024-58002}
  - media: uvcvideo: Provide sync and async uvc_ctrl_status_event (Ricardo Ribalda) [task:166857]
  - media: uvcvideo: Only save async fh if success (Ricardo Ribalda) [task:440495]
  - media: davinci: vpif: fix use-after-free on driver unbind (Johan Hovold) [task:440590] {CVE-2021-47653}
  - media: davinci: vpif: fix unbalanced runtime PM get (Johan Hovold) [task:162162]
  - media: davinci: vpif: fix unbalanced runtime PM enable (Johan Hovold) [task:440590]
  - media: platform: davinci: Use DEFINE_SPINLOCK() for spinlock (Zheng Yongjun) [task:440590]
  - media: vpif: Fix runtime PM imbalance in vpif_probe (Dinghao Liu) [task:440590]
  - rxrpc: Fix call timer start racing with call destruction (David Howells) [task:441367] {CVE-2022-49149}
  - rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect (David Howells) [task:153627]
  - ipv4: prevent potential spectre v1 gadget in fib_metrics_match() (Eric Dumazet) [task:448792] {CVE-2023-52996}
  - netfilter: allow exp not to be removed in nf_ct_find_expectation (Xin Long) [task:444898] {CVE-2023-52927}
  - mlxsw: spectrum: Guard against invalid local ports (Amit Cohen) [task:440543] {CVE-2022-49134}
  - mlxsw: spectrum: Protect driver from buggy firmware (Amit Cohen) [task:440543]
  - mlxsw: Verify the accessed index doesn't exceed the array length (Danielle Ratson) [task:440543]
  - sysctl: Fix data races in proc_douintvec(). (Kuniyuki Iwashima) [task:440762] {CVE-2022-49641}
  - ALSA: pcm: Add sanity NULL check for the default mmap fault handler (Takashi Iwai) [task:429543] {CVE-2024-53180}
  - net: gso: fix ownership in __udp_gso_segment (Antoine Tenart) [task:450256] {CVE-2025-21926}
  - udp: rehash on disconnect (Willem de Bruijn) [task:450256]
  - net: ipv4: drop unneeded likely() call around IS_ERR() (Enrico Weigelt) [task:450256]
  - udp: add missing rehash callback to udplite (Alexey Kodanev) [task:450256]
  - net: udp: prefer listeners bound to an address (Peter Oskolkov) [task:450256]
  - clk: qcom: clk-rcg2: Update logic to calculate D value for RCG (Taniya Das) [task:440546] {CVE-2022-49189}
  - ftrace: Avoid potential division by zero in function_stat_show() (Nikolay Kuratov) [task:450271] {CVE-2025-21898}
  - caif_virtio: fix wrong pointer check in cfv_probe() (Vitaliy Shevtsov) [task:450247] {CVE-2025-21904}
  - gpio: rcar: Use raw_spinlock to protect register access (Niklas Söderlund) [task:450255] {CVE-2025-21912}
  - gpio: rcar: Optimize GPIO pin state read on R-Car Gen3 (Geert Uytterhoeven) [task:450255]
  - gpio: rcar: Implement gpio_chip.get_multiple() (Geert Uytterhoeven) [task:450255]
  - gpio: rcar: Rework hardware features handling (Geert Uytterhoeven) [task:450255]
  - gpio: rcar: Cache gpiochip_get_data() return value (Geert Uytterhoeven) [task:450255]
  - gpio: rcar: select General Output Register to set output states (Vladimir Zapolskiy) [task:450255]
  - gpio: rcar: reference device instead of platform device (Vladimir Zapolskiy) [task:450255]
  - slimbus: messaging: Free transaction ID in delayed interrupt scenario (Visweswara Tanuku) [task:450260] {CVE-2025-21914}
  - net_sched: Prevent creation of classes with TC_H_ROOT (Cong Wang) [task:450261] {CVE-2025-21971}
  - wifi: cfg80211: regulatory: improve invalid hints checking (Nikita Zhandarovich) [task:450244] {CVE-2025-21910}
  - HID: appleir: Fix potential NULL dereference at raw event handle (Daniil Dulov) [task:450218] {CVE-2025-21948}
  - Mucse: rnp: never use err_handler avoid os crash when aer error recover (Dong Yibo) [task:447054]
  - usb: renesas_usbhs: Flush the notify_hotplug_work (Claudiu Beznea) [task:450259] {CVE-2025-21917}
  - vlan: enforce underlying device type (Oscar Maes) [task:450262] {CVE-2025-21920}
  - scsi: qla1280: Fix kernel oops when debug level > 2 (Magnus Lindholm) [task:450276] {CVE-2025-21957}
  - scsi: qla1280: use lower_32_bits and upper_32_bits instead of reinventing them (Christoph Hellwig) [task:450276]
  - wifi: nl80211: reject cooked mode if it is set along with other flags (Vitaliy Shevtsov) [task:450266] {CVE-2025-21909}
  - rapidio: fix an API misues when rio_add_net() fails (Haoxiang Li) [task:450268] {CVE-2025-21934}
  - llc: do not use skb_get() before dev_queue_xmit() (Eric Dumazet) [task:450248] {CVE-2025-21925}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (Zhang Lixu) [task:450254] {CVE-2025-21928}
  - rapidio: add check for rio_add_net() in rio_scan_alloc_net() (Haoxiang Li) [task:450246] {CVE-2025-21935}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (Chengen Du) [task:450787] {CVE-2025-21993}
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (Nikita Zhandarovich) [task:451120] {CVE-2025-21996}
  - Bluetooth: Fix error code in chan_alloc_skb_cb() (Dan Carpenter) [task:451118] {CVE-2025-22007}
  - ppp: Fix KMSAN uninit-value warning with bpf (Jiayuan Chen) [task:450270] {CVE-2025-21922}
  - net: atm: fix use after free in lec_send() (Dan Carpenter) [task:451119] {CVE-2025-22004}
  - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() (Kohei Enju) [task:450269] {CVE-2025-21959}
  - netfilter: nf_conncount: fix wrong variable type (Yunjian Wang) [task:450269]
  - arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall (Alexandru Elisei) [task:440489] {CVE-2022-49520}
  - hwrng: nomadik - keep clock enabled while hwrng is registered (Martin Kaiser) [task:440480]
  - hwrng: st - keep clock enabled while hwrng is registered (Martin Kaiser) [task:440408]
  - hwrng: nomadik - Change clk_disable to clk_disable_unprepare (Miaoqian Lin) [task:440408]
  - hwrng: cavium - fix NULL but dereferenced coccicheck error (Wan Jiabing) [task:440408] {CVE-2022-49177}
  - hwrng: cavium - Check health status while reading random data (Sunil Goutham) [task:440408]
  - hwrng: st - Fix W=1 unused variable warning (Herbert Xu) [task:440408]
  - hwrng: n2-drv - fix typo (Stephen Rothwell) [task:440408]
  - hwrng: drivers - Use device-managed registration API (Chuhong Yuan) [task:440408]
  - icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. (Kuniyuki Iwashima) [task:440570] {CVE-2022-49632}
  - kernel/resource: fix kfree() of bootmem memory again (Miaohe Lin) [task:440655] {CVE-2022-49190}
  - macsec: fix UAF bug for real_dev (Ziyang Xuan) [task:439954] {CVE-2022-49390}
  - tee: optee: Fix supplicant wait loop (Sumit Garg) [task:448794] {CVE-2025-21871}
  - bpf: Skip task with pid=1 in send_signal_common() (Hao Sun) [task:448840] {CVE-2023-52992}
  - netlink: prevent potential spectre v1 gadgets (Eric Dumazet) [task:448831] {CVE-2023-53000}
  - xfs: don't walk off the end of a directory data block (lei lu) [task:347099] {CVE-2024-41013}
  - netfilter: nf_tables: prefer nft_chain_validate (Florian Westphal) [task:346389] {CVE-2024-41042}
  - netfilter: nf_tables: allow loop termination for pending fatal signal (Florian Westphal) [task:346389]
  - netfilter: nftables: add loop check helper function (Pablo Neira Ayuso) [task:346389]
  - bcache: call force_wake_up_gc() if necessary in check_should_bypass() (Coly Li) [task:445847]
  - block: fix integer overflow in BLKSECDISCARD (Alexey Dobriyan) [task:376277] {CVE-2024-49994}
  - ocfs2: free inode when ocfs2_get_init_inode() fails (Tetsuo Handa) [task:410407] {CVE-2024-56630}
  - net: lapb: increase LAPB_HEADER_LEN (Eric Dumazet) [task:410469] {CVE-2024-56659}
  - netfilter: x_tables: fix LED ID check in led_tg_check() (Dmitry Antipov) [task:410373] {CVE-2024-56650}
  - media: i2c: tc358743: Fix crash in the probe error path when using polling (Alexander Shiyan) [task:410369] {CVE-2024-56576}
  - scsi: bfa: Fix use-after-free in bfad_im_module_exit() (Ye Bin) [task:410391] {CVE-2024-53227}
  - media: ts2020: fix null-ptr-deref in ts2020_probe() (Li Zetao) [task:410423] {CVE-2024-56574}
  - ubi: fastmap: Fix duplicate slab cache names while attaching (Zhihao Cheng) [task:410387] {CVE-2024-53172}
  - dccp: Fix memory leak in dccp_feat_change_recv (Ivan Solodovnikov) [task:410471] {CVE-2024-56643}
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (Zhen Lei) [task:412149] {CVE-2024-56748}
  - scsi: qedf: Print message during bailout conditions (Saurav Kashyap) [task:412149]
  - scsi: qedf: Cleanup rrq_work after QEDF_CMD_OUTSTANDING is cleared (Shyam Sundar) [task:412149]
  - scsi: qedf: Check for link state before processing LL2 packets and send fipvlan retries (Saurav Kashyap) [task:412149]
  - media: wl128x: Fix atomicity violation in fmc_send_cmd() (Qiu-ji Chen) [task:412191] {CVE-2024-56700}
  - can: j1939: j1939_session_new(): fix skb reference counting (Dmitry Antipov) [task:410389] {CVE-2024-56645}
  - gpio: grgpio: Add NULL check in grgpio_probe (Charles Han) [task:410441] {CVE-2024-56634}
  - gpio: grgpio: use a helper variable to store the address of ofdev->dev (Bartosz Golaszewski) [task:410441]
  - HID: wacom: fix when get product name maybe null pointer (WangYuli) [task:410433] {CVE-2024-56629}
  - usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer (Lianqin Hu) [task:410125] {CVE-2024-56670}
  - net: inet: do not leave a dangling sk pointer in inet_create() (Ignat Korchagin) [task:416337] {CVE-2024-56601}
  - arm64: probes: Fix uprobes for big-endian kernels (Mark Rutland) [task:416531] {CVE-2024-50194}
  - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (junhua huang) [task:416531]
  - arm64:uprobe fix the uprobe SWBP_INSN in big-endian (junhua huang) [task:416531]
  - dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (Chen Ridong) [task:417437] {CVE-2024-56767}
  - media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (Nikita Zhandarovich) [task:417435] {CVE-2024-56769}
  - mmc: jz4740: Apply DMA engine limits to maximum segment size (Aidan MacDonald) [task:441291] {CVE-2022-49522}
  - media: i2c: dw9714: add optional regulator support (Angus Ainslie) [task:440678] {CVE-2022-49528}
  - sysctl: Fix data races in proc_douintvec_minmax(). (Kuniyuki Iwashima) [task:440639] {CVE-2022-49640}
  - kernel/sysctl.c: define minmax conv functions in terms of non-minmax versions (Zev Weiss) [task:440639]
  - USB: core: Add routines for endpoint checks in old drivers (Alan Stern) [task:166857]
  - usb: atm: cxacru: fix a flaw in existing endpoint checks (Nikita Zhandarovich) [task:446878]
  - fs/proc: fix softlockup in __read_vmcore (part 2) (Rik van Riel) [task:446878]
  - i2c: pnx: Fix timeout in wait functions (Vladimir Riabchun) [task:446878]
  - drm/amdgpu/atomfirmware: silence UBSAN warning (Alex Deucher) [task:446878]
  - mm: optimize the redundant loop of mm_update_owner_next() (Jinliang Zheng) [task:446878]
  - net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings (Oliver Neukum) [task:446878]
  - perf/core: Fix missing wakeup when waiting for context reference (Haifeng Xu) [task:446878]
  - fs/proc: fix softlockup in __read_vmcore (Rik van Riel) [task:446878]
  - media: dw2102: fix a potential buffer overflow (Mauro Carvalho Chehab) [task:446878]
  - media: mc: mark the media devnode as registered from the, start (Hans Verkuil) [task:446878]
  - media: dw2102: Don't translate i2c read into write (Michael Bunk) [task:446878]
  - openvswitch: fix lockup on tx to unregistering netdev with carrier (Ilya Maximets) [task:428511] {CVE-2025-21681}
  - virtio-blk: don't keep queue frozen during system suspend (Ming Lei) [task:429497] {CVE-2024-57946}
  - virtio-blk: Ensure no requests in virtqueues before deleting vqs. (Yi Sun) [task:429497]
  - net: hns3: don't auto enable misc vector (Jian Shen) [task:426325] {CVE-2025-21651}
  - netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (Pablo Neira Ayuso) [task:434662]
  - netfilter: nftables: add helper function to set the base sequence number (Pablo Neira Ayuso) [task:434662]
  - macintosh/via-macii: Remove BUG_ON assertions (Finn Thain) [task:434662]
  - lan78xx: Fix race conditions in suspend/resume handling (John Efstathiades) [task:433676]
  - lan78xx: Fix partial packet errors on suspend/resume (John Efstathiades) [task:433676]
  - lan78xx: Add missing return code checks (John Efstathiades) [task:433676]
  - lan78xx: Fix white space and style issues (John Efstathiades) [task:433676]
  - net: usb: lan78xx: Remove lots of set but unused 'ret' variables (Lee Jones) [task:433676]
  - nilfs2: replace WARN_ONs for invalid DAT metadata block requests (Ryusuke Konishi) [task:433676]
  - btrfs: ref-verify: free ref cache before clearing mount opt (Fedor Pchelkin) [task:433676]
  - cachefiles: fix memory leak in cachefiles_add_cache() (Baokun Li) [task:433676]
  - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [task:433676]
  - net: sched: Disallow replacing of child qdisc from one parent to another (Jamal Hadi Salim) [task:431730] {CVE-2025-21700}
  - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (Qasim Ijaz) [task:430210] {CVE-2025-21689}
  - vfio/platform: check the bounds of read/write syscalls (Alex Williamson) [task:430197] {CVE-2025-21687}
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Ignat Korchagin) [task:431136] {CVE-2024-56602}
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (Guilherme G. Piccoli) [task:431123] {CVE-2024-53190}
  - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (Ville Syrjälä) [task:429505] {CVE-2024-56369}
  - drm/modes: Switch to 64bit maths to avoid integer overflow (Ville Syrjälä) [task:429505]
  - rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426327] {CVE-2025-21635}
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (Ignat Korchagin) [task:429518] {CVE-2024-56604}
  - usb: cdc-acm: Check control transfer buffer size before access (Jann Horn) [task:441929] {CVE-2025-21704}
  - drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem (Lucas Stach) [task:440801] {CVE-2022-49336}
  - wifi: rtlwifi: fix memory leaks and invalid access at probe error path (Thadeu Lima de Souza Cascardo) [task:442585] {CVE-2024-58063}
  - net: remove two BUG() from skb_checksum_help() (Eric Dumazet) [task:441332] {CVE-2022-49497}
  - net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register (Miaoqian Lin) [task:441333] {CVE-2022-49342}
  - net: bgmac: support MDIO described in DT (Rafał Miłecki) [task:441333]
  - dmaengine: qcom: bam_dma: fix runtime PM underflow (Caleb Connolly) [task:440724] {CVE-2022-49650}
  - dmaengine: qcom: bam_dma: Manage clocks when controlled_remotely is set (Thara Gopinath) [task:440724]
  - ceph: give up on paths longer than PATH_MAX (Max Kellermann) [task:429522] {CVE-2024-53685}
  - ceph: tone down loglevel on ceph_mdsc_build_path warning (Jeff Layton) [task:429522]
  - ipv6: Fix signed integer overflow in __ip6_append_data (Wang Yufen) [task:440725] {CVE-2022-49728}
  - udp6: pass flow in ip6_make_skb together with cork (Pavel Begunkov) [task:440725]
  - ipv6: pass full cork into __ip6_append_data() (Pavel Begunkov) [task:440725]
  - raw: Fix a data-race around sysctl_raw_l3mdev_accept. (Kuniyuki Iwashima) [task:440643] {CVE-2022-49631}
  - ubifs: skip dumping tnc tree when zroot is null (pangliyuan) [task:442592] {CVE-2024-58058}
  - media: uvcvideo: Fix double free in error path (Laurent Pinchart) [task:440566] {CVE-2024-57980}
  - vrf: use RCU protection in l3mdev_l3_out() (Eric Dumazet) [task:440813] {CVE-2025-21791}
  - drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (Miaoqian Lin) [task:443712] {CVE-2022-49693}
  - drm: msm: Use DRM_DEV_* instead of dev_* (Mamta Shukla) [task:443712]
  - drm: Convert to using %pOFn instead of device_node.name (Rob Herring) [task:443712]
  - drm/msm/a6xx: Poll for HFI responses (Jordan Crouse) [task:443712]
  - drm/msm: dsi: Return errors whan dt parsing fails (Sean Paul) [task:443712]
  - wifi: ath10k: avoid NULL pointer error during sdio remove (Kang Yang) [task:429496] {CVE-2024-56599}
  - comedi: Flush partial mappings in error case (Jann Horn) [task:408549] {CVE-2024-53148}
  - staging: comedi: use dma_mmap_coherent for DMA-able buffer mmap (Ian Abbott) [task:408549]
  - net/ipv6: release expired exception dst cached in socket (Jiri Wiesner) [task:410459] {CVE-2024-56644}
  - crypto: qat - add param check for DH (Giovanni Cabiddu) [task:443713] {CVE-2022-49564}
  - usb: gadget: f_tcm: Don't free command immediately (Thinh Nguyen) [task:443717] {CVE-2024-58055}
  - ext4: avoid remount errors with 'abort' mount option (Jan Kara) [task:387437]
  - ext4: don't set SB_RDONLY after filesystem errors (Jan Kara) [task:387437] {CVE-2024-50191}
  - ext4: fix warning in ext4_handle_inode_extension (Ye Bin) [task:441296] {CVE-2022-49352}
  - ath10k: skip ath10k_halt during suspend for driver state RESTARTING (Abhishek Kumar) [task:441263] {CVE-2022-49519}
  - ath10k: add support for hardware rfkill (Wen Gong) [task:441263]
  - acct: perform last write from workqueue (Christian Brauner) [task:444128] {CVE-2025-21846}
  - kernel/acct.c: use dedicated helper to access rlimit values (Yang Yang) [task:444128]
  - kernel/acct.c: use #elif instead of #end and #elif (Hui Su) [task:444128]
  - iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (Yang Yingliang) [task:440729] {CVE-2022-49323}
  - driver core: platform: Reimplement devm_platform_ioremap_resource (Dejin Zheng) [task:440729]
  - drivers: provide devm_platform_get_and_ioremap_resource() (Dejin Zheng) [task:440729]
  - iommu/arm-smmu-v3: check return value after calling platform_get_resource() (Yang Yingliang) [task:440798] {CVE-2022-49319}
  - iommu/arm-smmu-v3: Fix resource_size check (Masahiro Yamada) [task:440798]
  - ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe (Miaoqian Lin) [task:440819] {CVE-2022-49486}
  - team: prevent adding a device which is already a team device lower (Octavian Purdila) [task:444119] {CVE-2024-58071}
  - f2fs: remove WARN_ON in f2fs_is_valid_blkaddr (Dongliang Mu) [task:441366] {CVE-2022-49318}
  - ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero (Piotr Skajewski) [task:440499] {CVE-2022-49584}
  - bfq: Update cgroup information before merging bio (Jan Kara) [task:440630] {CVE-2022-49413}
  - ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (Xiubo Li) [task:440576] {CVE-2022-49107}
  - crypto: qat - add param check for RSA (Giovanni Cabiddu) [task:440656] {CVE-2022-49563}
  - ocfs2: handle a symlink read error correctly (Matthew Wilcox (Oracle)) [task:440661] {CVE-2024-58001}
  - watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe (Miaoqian Lin) [task:440542] {CVE-2022-49373}
  - watchdog: ts4800_wdt: Convert to use device managed functions and other improvements (Guenter Roeck) [task:440542]
  - net: rose: lock the socket in rose_bind() (Eric Dumazet) [task:440441] {CVE-2025-21749}
  - net: rose: add missing dev_put() on error in rose_bind (YueHaibing) [task:440441]
  - batman-adv: fix panic during interface removal (Andy Strohman) [task:440627] {CVE-2025-21781}
  - NFC: nci: Add bounds checking in nci_hci_create_pipe() (Dan Carpenter) [task:441347] {CVE-2025-21735}
  - orangefs: fix a oob in orangefs_debug_write (Mike Marshall) [task:441261] {CVE-2025-21782}
  - mips: ralink: fix a refcount leak in ill_acc_of_setup() (Hangyu Hua) [task:440744] {CVE-2022-49117}
  - MIPS: Convert to using %pOFn instead of device_node.name (Rob Herring) [task:440744]
  - crypto: qat - fix memory leak in RSA (Giovanni Cabiddu) [task:440585] {CVE-2022-49566}
  - media: rga: fix possible memory leak in rga_probe (Hangyu Hua) [task:440605] {CVE-2022-49502}
  - media: rockchip/rga: do proper error checking in probe (Kyle Copperfield) [task:440605]
  - media: rockchip/rga: fix error handling in probe (Dan Carpenter) [task:440605]
  - media: rockchip/rga: use pm_runtime_resume_and_get() (Mauro Carvalho Chehab) [task:440605]
  - net: hns3: set port base vlan tbl_sta to false before removing old vlan (Guangbin Huang) [task:440448]
  - net: hns3: add vlan list lock to protect vlan list (Jian Shen) [task:440448] {CVE-2022-49182}
  - net: hns3: fix port base vlan add fail when concurrent with reset (Jian Shen) [task:440448]
  - net: hns3: split function hclge_update_port_base_vlan_cfg() (Jian Shen) [task:440448]
  - net: hns3: fix duplicate node in VLAN list (Guojia Liao) [task:440448]
  - RDMA/mlx5: Fix memory leak in error flow for subscribe event routine (Yongzhi Liu) [task:441916] {CVE-2022-49206}
  - linux/dim: Fix divide by 0 in RDMA DIM (Tao Liu) [task:441301] {CVE-2022-49670}
  - mpam: Fix several section mismatch warnings (Enze Li) [task:441567]
  - wifi: mac80211: fix qos on mesh interfaces (Felix Fietkau) [task:441302]
  - wifi: mac80211: fix queue selection for mesh/OCB interfaces (Felix Fietkau) [task:441302] {CVE-2022-49646}
  - mac80211: when using iTXQ, select the queue in ieee80211_subif_start_xmit (Felix Fietkau) [task:441302]
  - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (Dmitry Antipov) [task:440617] {CVE-2024-58014}
  - PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (Miaoqian Lin) [task:440704] {CVE-2022-49668}
  - PM / devfreq: exynos-events: change matching code during probe (Lukasz Luba) [task:440704]
  - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX (Kuan-Wei Chiu) [task:440747] {CVE-2024-58017}
  - udp: Fix a data-race around sysctl_udp_l3mdev_accept. (Kuniyuki Iwashima) [task:440506] {CVE-2022-49577}
  - net: rose: fix timer races against user threads (Eric Dumazet) [task:440589] {CVE-2025-21718}
  - dm mirror log: clear log bits up to BITS_PER_LONG boundary (Mikulas Patocka) [task:441371]
  - dm mirror log: round up region bitmap size to BITS_PER_LONG (Mikulas Patocka) [task:441371] {CVE-2022-49710}
  - USB: hub: Ignore non-compliant devices with too many configs or interfaces (Alan Stern) [task:441287] {CVE-2025-21776}
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (Liu Jian) [task:410467] {CVE-2024-53168}
  - net: make sock_inuse_add() available (Eric Dumazet) [task:410467]
  - partitions: mac: fix handling of bogus partition table (Jann Horn) [task:440508] {CVE-2025-21772}
  - media: i2c: dw9714: Disable the regulator when the driver fails to probe (Zheyu Ma) [task:440678] {CVE-2022-49528}
  - thermal/core: Fix memory leak in __thermal_cooling_device_register() (Yang Yingliang) [task:440493] {CVE-2022-49468}
  - net: restrict SO_REUSEPORT to inet sockets (Eric Dumazet) [task:425031] {CVE-2024-57903}
  - HYGON: fix incorrect display of CPU topology structure (wangxuewen) [task:447053]
  - HYGON: perf/x86/uncore: Add L3 PMU support for Hygon family 18h model 6h (Pu Wen) [task:447053]
  - HYGON: ALSA: hda: Fix single byte write failure issue for Hygon (Pu Wen) [task:447053]
  - HYGON: ALSA: hda: Add Hygon HD-Audio support (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Adjust UMC channel for Hygon family 18h model 6h (Pu Wen) [task:447053]
  - HYGON: x86/amd_nb: Get DF ID from F5 device for Hygon family 18h model 6h (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Fix intlv_num_chan for Hygon family 18h model 4h (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Revert hi_addr_offset for Hygon family 18h model 4h (Pu Wen) [task:447053]
  - x86/microcode/AMD: Clean up per-family patch size checks (Borislav Petkov) [task:447053]
  - HYGON: i2c-piix4: Remove the IMC detecting for Hygon SMBus (Pu Wen) [task:447053]
  - HYGON: hwmon: (k10temp) Add support for Hygon family 18h model 4h~6h (Pu Wen) [task:447053]
  - HYGON: EDAC/mce_amd: Use struct cpuinfo_x86.logical_die_id for AMD NodeId (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Determine DDR type for Hygon family 18h model 4h~6h (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Add support for Hygon family 18h model 5h and 6h (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Add support for Hygon family 18h model 4h (Pu Wen) [task:447053]
  - HYGON: EDAC/amd64: Get UMC channel from the strict 6th nibble (Pu Wen) [task:447053]
  - HYGON: mce/amd: Optimize bank_map implementation to support >= 32 MCE banks (Pu Wen) [task:447053]
  - HYGON: iommu/hygon: Add support for Hygon family 18h model 4h IOAPIC (Pu Wen) [task:447053]
  - HYGON: x86/amd_nb: Add support for Hygon family 18h model 5h and 6h (George Guo) [task:447053]
  - HYGON: x86/amd_nb: Add northbridge support for Hygon family 18h model 4h (Pu Wen) [task:447053]
  - HYGON: x86/microcode: Add microcode loading support for Hygon processors (Pu Wen) [task:447053]
  - HYGON: x86/cpu/hygon: Add Hygon model 5h and 6h processors (Pu Wen) [task:447053]
  - HYGON: x86/cpu/hygon: Modify the CPU topology deriving method for Hygon (Pu Wen) [task:447053]
  - EDAC: Add RDDR5 and LRDDR5 memory types (Yazen Ghannam) [task:447053]
  - EDAC: Add DDR5 new memory type (Qiuxu Zhuo) [task:447053]
  - x86/topology: Set cpu_die_id only if DIE_TYPE found (Yazen Ghannam) [task:447053]
  - EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId (Yazen Ghannam) [task:447053]
  - x86/CPU/AMD: Remove amd_get_nb_id() (Yazen Ghannam) [task:447053]
  - x86/CPU/AMD: Save AMD NodeId as cpu_die_id (Yazen Ghannam) [task:447053]
  - x86/mce: Increase maximum number of banks to 64 (Akshay Gupta) [task:447053]
  - x86/umip: Make the UMIP activated message generic (Lendacky, Thomas) [task:447053]
  - x86/umip: Print UMIP line only once (Borislav Petkov) [task:447053]
  - perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag (Kim Phillips) [task:447053]
  - bpf: Verifier, do explicit ALU32 bounds tracking (John Fastabend) [task:448553]
  - bpf: add include guard to tnum.h (Masahiro Yamada) [task:448553]
  - bpf: Simplify reg_set_min_max_inv handling (Jann Horn) [task:448553]
  - bpf: Fix tnum constraints for 32-bit comparisons (Jann Horn) [task:448553]
  - bpf: Verifer, refactor adjust_scalar_min_max_vals (John Fastabend) [task:448553]
  - bpf: Fix incorrect verifier simulation of ARSH under ALU32 (Daniel Borkmann) [task:448553]
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (Imre Deak) [task:429517] {CVE-2024-57798}
  - drm/dp_mst: Introduce new refcounting scheme for mstbs and ports (Lyude Paul) [task:429517]
  - drm/dp_mst: Rename drm_dp_mst_get_validated_(port|mstb)_ref and friends (Lyude Paul) [task:429517]
  - drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi (Xin Xiong) [task:158034]
  - drm/dp_mst: Correct the bug in drm_dp_update_payload_part1() (Wayne Lin) [task:429517]
  - drm/dp_mst: Refactor drm_dp_update_payload_part1() (Lyude Paul) [task:429517]
  - drm/dp_mst: Remove bogus conditional in drm_dp_update_payload_part1() (Lyude Paul) [task:429517]
  - drm/dp_mst: Fix some formatting in drm_dp_payload_send_msg() (Lyude Paul) [task:429517]
  - drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (Vinod Polimera) [task:440773] {CVE-2022-49489}
  - drbd: Fix five use after free bugs in get_initial_state (Lv Yunlong) [task:439957] {CVE-2022-49085}
  - iio: trigger: sysfs: fix use-after-free on remove (Vincent Whitchurch) [task:440569] {CVE-2022-49685}
  - scsi: libfc: Fix use after free in fc_exch_abts_resp() (Jianglei Nie) [task:439959] {CVE-2022-49114}
  - nfsd: clear acl_access/acl_default after releasing them (Li Lingfeng) [task:440481] {CVE-2025-21796}
  - ubi: fastmap: Return error code if memory allocation fails in add_aeb() (Zhihao Cheng) [task:162162]
  - ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() (Zhihao Cheng) [task:162162]
  - ubifs: setflags: Make dirtied_ino_d 8 bytes aligned (Zhihao Cheng) [task:162162]
  - ubifs: Rectify space amount budget for mkdir/tmpfile operations (Zhihao Cheng) [task:162162]
  - ubifs: Add missing iput if do_tmpfile() failed in rename whiteout (Zhihao Cheng) [task:162162]
  - ubifs: Fix deadlock in concurrent rename whiteout and inode writeback (Zhihao Cheng) [task:162162]
  - ubifs: rename_whiteout: Fix double free for whiteout_ui->data (Zhihao Cheng) [task:162162]
  - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (Baokun Li) [task:162162]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.48.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.48.v2207 (Zhengyuan Liu)
  - net: core: use helper skb_ensure_writable in more places (Heiner Kallweit) [task:99622]
  - perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map (Kim Phillips) [task:153627, task:464558]
  - regulator: check that dummy regulator has been probed before using it (Christian Eggers) [task:452500] {CVE-2025-22008}
  - regulator: workaround self-referent regulators (Michał Mirosław) [task:158034]
  - regulator: avoid resolve_supply() infinite recursion (Michał Mirosław) [task:158034]
  - memcg: fix soft lockup in the OOM process (Chen Ridong) [task:440777] {CVE-2024-57977}
  - ipv6: Fix soft lockups in fib6_select_path under high next hop churn (Omid Ehtemam-Haghighi) [task:412171] {CVE-2024-56703}
  - tcp: Fix data-races around sysctl_tcp_base_mss. (Kuniyuki Iwashima) [task:440603] {CVE-2022-49597}
  - dm: interlock pending dm_io and dm_wait_for_bios_completion (Mike Snitzer) [task:162162, task:458745]
  - dm: fix mempool NULL pointer race when completing IO (Jiazi Li) [task:169357, task:458745]
  - memcg: fix soft lockup in the OOM process (Chen Ridong) [task:440777] {CVE-2024-57977}
  - scsi: qla2xxx: Fix scheduling while atomic (Quinn Tran) [task:149541]
  - drop_monitor: fix incorrect initialization order (Gavrilov Ilia) [task:444123] {CVE-2025-21862}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.49.v2207
changelog:
  - secondly update changelog for upcoming 4.19.90-52.49.v2207 (Zhengyuan Liu)
  - bpf: consider that tail calls invalidate packet pointers (Eduard Zingerman) [task:461040, task:497433] {CVE-2024-58237}
  - bpf: refactor bpf_helper_changes_pkt_data to use helper number (Eduard Zingerman) [task:461040, task:497433]
  - Revert "bpf: allow for tailcalls in BPF subprograms for x64 JIT" (Yun Lu) [task:497433]
  - Revert "bpf, x64: Add predicate for bpf2bpf with tailcalls support in JIT" (Yun Lu) [task:497433]
  - Revert "bpf: refactor bpf_helper_changes_pkt_data to use helper number" (Yun Lu) [task:497433]
  - Revert "bpf: consider that tail calls invalidate packet pointers" (Yun Lu) [task:497433]
  - update changelog for upcoming 4.19.90-52.49.v2207 (Zhengyuan Liu)
  - iommu/amd: Fix potential @entry null deref (Joao Martins) [task:457728]
  - iommu/amd: Restore IRTE.RemapEn bit after programming IRTE (Suravee Suthikulpanit) [task:457728]
  - net: fix a compilation (xiaolinkui) [task:468687]
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (Henry Martin) [task:461952] {CVE-2025-37830}
  - PHYTIUM: PCI: Add ACS quirk for phytium root and switch ports (leixiang) [task:477923]
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [task:486337] {CVE-2025-38086}
  - ocfs2: fix data corruption after failed write (Jan Kara via Ocfs2-devel) [task:461083] {CVE-2023-53081}
  - ext4: update s_journal_inum if it changes after journal replay (Baokun Li) [task:461218] {CVE-2023-53091}
  - jbd2: remove wrong sb->s_sequence check (Jan Kara) [task:462570] {CVE-2025-37839}
  - scsi: target: Fix WRITE_SAME No Data Buffer crash (Mike Christie) [task:463324] {CVE-2022-21546}
  - perf python: Convert tracepoint.py example to python3 (Tanu M) [task:488387, task:481449]
  - perf tools: Support Python 3.8+ in Makefile (Sam Lunt) [task:481449]
  - perf script python: Add Python3 support to tests/attr.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to export-to-sqlite.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to export-to-postgresql.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to intel-pt-events.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to event_analyzing_sample.py (Tony Jones) [task:481449]
  - perf script python: add Python3 support to check-perf-trace.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to futex-contention.py (Tony Jones) [task:481449]
  - perf script python: Remove mixed indentation (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to syscall-counts-by-pid.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to syscall-counts.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to stat-cpi.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to stackcollapse.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to sctop.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to powerpc-hcalls.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to net_dropmonitor.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to mem-phys-addr.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to failed-syscalls-by-pid.py (Tony Jones) [task:481449]
  - perf script python: Add Python3 support to netdev-times.py (Tony Jones) [task:481449]
  - regulator: core: avoid regulator_resolve_supply() race condition (David Collins) [task:158034, task:491993]
  - driver core: add device probe log helper (Andrzej Hajda) [task:491993]
  - clk: Add (devm_)clk_get_optional() functions (Phil Edworthy) [task:215919, task:491993]
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [task:491897] {CVE-2025-38103}
  - HID: hyperv: Correctly access fields declared as __le16 (Michael Kelley) [task:491897]
  - xfs: split up the xfs_reflink_end_cow work into smaller transactions (Darrick J. Wong) [task:489411]
  - ngbe: FIX: fix delete redefine netdev_xmit_more in kylin os (linyuexie) [task:458496]
  - txgbe: FIX: fix delete redefine netdev_xmit_more in kylin os (linyuexie) [task:458496]
  - HYGON: alinux: tcm: add Hygon TCM2 driver (chench) [task:176679]
  - tpm: tpm_tis: Adapt spi tcm2 card ZIC0603 to x86 (wudandan) [task:220240]
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg) [task:482027] {CVE-2022-50020}
  - qede: confirm skb is allocated before using (Jamie Bainbridge) [task:162162, task:482311]
  - ext2: Add more validity checks for inode counts (Jan Kara) [task:482541] {CVE-2022-50205}
  - tcp/dccp: Add another way to allocate local ports in bind() (luoxuanqiang) [task:452905]
  - net: tun: call napi_schedule_prep() to ensure we own a napi (Eric Dumazet) [task:122626, task:460255]
  - net: tun: Fix memory leaks of napi_get_frags (Wang Yufen) [task:122626, task:460255] {CVE-2022-49871}
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (Liu Jian) [task:461321] {CVE-2023-53133}
  - xsk: Add missing overflow check in xdp_umem_reg (Kal Conley) [task:460911] {CVE-2023-53080}
  - xsk: Fix number of pinned pages/umem size discrepancy (Björn Töpel) [task:460911]
  - net/xdp: use shift instead of 64 bit division (Pavel Machek) [task:460911]
  - net: stmmac: fix notifier registration (Aaro Koskinen) [bug:370375]
  - stmmac: debugfs entry name is not be changed when udev rename device name. (Jiping Ma) [task:166857]
  - bpf: consider that tail calls invalidate packet pointers (Eduard Zingerman) [task:461040] {CVE-2024-58237}
  - bpf: refactor bpf_helper_changes_pkt_data to use helper number (Eduard Zingerman) [task:461040]
  - bpf, x64: Add predicate for bpf2bpf with tailcalls support in JIT (Tony Ambardar) [task:161887]
  - bpf: allow for tailcalls in BPF subprograms for x64 JIT (Maciej Fijalkowski) [task:161887]
  - net/9p: use a dedicated spinlock for trans_fd (Dominique Martinet) [task:460118] {CVE-2022-49765}
  - 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work (Wang Hai) [task:157172]
  - 9p: trans_fd/p9_conn_cancel: drop client lock earlier (Dominique Martinet) [task:164562]
  - iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) (Alexander Lobakin) [task:482165] {CVE-2022-50093}
  - virtio-gpu: fix a missing check to avoid NULL dereference (Xiaomeng Tong) [task:481883] {CVE-2022-50181}
  - perf: Fix pmu_filter_match() (Peter Zijlstra) [task:464493]
  - nfsd: decrease sc_count directly if fail to queue dl_recall (Li Lingfeng) [task:459566]
  - nfsd: put dl_stid if fail to queue dl_recall (Li Lingfeng) [task:459566] {CVE-2025-22025}
  - nfsd: make nfsd4_run_cb a bool return function (Jeff Layton) [task:459566]
  - jfs: reject on-disk inodes of an unsupported type (Dmitry Antipov) [task:459660] {CVE-2025-37925}
  - dlm: prevent NPD when writing a positive value to event_done (Thadeu Lima de Souza Cascardo) [task:459658] {CVE-2025-23131}
  - ocfs2: validate l_tree_depth to avoid out-of-bounds access (Vasiliy Kovalev) [task:459623] {CVE-2025-22079}
  - jfs: add check read-only before txBeginAnon() call (Vasiliy Kovalev) [task:459938] {CVE-2024-58095}
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [task:482067] {CVE-2025-38058}
  - scsi: iscsi: Fix HW conn removal use after free (Mike Christie) [task:482545] {CVE-2022-50031}
  - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [task:482265] {CVE-2025-38075}
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [task:482035] {CVE-2025-38078}
  - net: hns3: fix incorrect components info of ethtool --reset command (Jie Wang) [bug:367889]
  - net: hns3: add support for triggering reset by ethtool (Yufeng Mo) [bug:367889]
  - media: dvb-core: Fix use-after-free on race condition at dvb_frontend (Hyunwoo Kim) [task:478283] {CVE-2022-45885}
  - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [task:466609] {CVE-2025-37970}
  - nilfs2: protect access to buffers with no active references (Ryusuke Konishi) [task:441315] {CVE-2025-21811}
  - iio: pressure: zpa2326: fix information leak in triggered buffer (Javier Carrasco) [task:426431] {CVE-2024-57912}
  - iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer (Javier Carrasco) [task:426437] {CVE-2024-57911}
  - iio: imu: kmx61: fix information leak in triggered buffer (Javier Carrasco) [task:426324] {CVE-2024-57908}
  - jfs: array-index-out-of-bounds fix in dtReadFirst (Ghanshyam Agrawal) [task:419633] {CVE-2024-56598}
  - udf: fix uninit-value use in udf_get_fileshortad (Gianfranco Trad) [task:387577] {CVE-2024-50143}
  - f2fs: fix to check atomic_file in f2fs ioctl interfaces (Chao Yu) [task:375569] {CVE-2024-49859}
  - nfc: fdp: Fix potential memory leak in fdp_nci_send() (Shang XiaoJing) [task:460238] {CVE-2022-49924}
  - net/mlx5: Fix steering rules cleanup (Lama Kayal) [task:461036] {CVE-2023-53079}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Ryo Takakura) [task:460254] {CVE-2025-23161}
  - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [task:466236] {CVE-2025-37968}
  - mm/gup: Remove enfornced COW mechanism (Peter Xu) [task:446992]
  - net: tls: explicitly disallow disconnect (Jakub Kicinski) [task:460146] {CVE-2025-37756}
  - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX (Tomasz Pakuła) [task:466581] {CVE-2025-37942}
  - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (Zhang Lixu) [task:461023]
  - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (Reka Norman) [task:461023] {CVE-2023-53039}
  - devm-helpers: Add resource managed version of work init (Matti Vaittinen) [task:461023]
  - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc (Matti Vaittinen) [task:461023]
  - workqueue: Add resource managed version of delayed work init (Matti Vaittinen) [task:461023]
  - net: usb: lan78xx: Limit packet length to skb->len (Szymon Heidrich) [task:461084] {CVE-2023-53068}
  - neigh: fix ARP retransmit timer guard (Hangbin Liu) [task:470107]
  - neigh: support smaller retrans_time settting (Hangbin Liu) [task:470107]
  - net: link_watch: prevent starvation when processing linkwatch wq (Yunsheng Lin) [task:470107]
  - net: ena: Fix error handling in ena_init() (Yuan Can) [task:460204] {CVE-2022-49813}
  - nfc: nxp-nci: Fix potential memory leak in nxp_nci_send() (Shang XiaoJing) [task:460177] {CVE-2022-49923}
  - NFC: nxp-nci: remove unnecessary labels (wengjianfeng) [task:460177]
  - xfs: fix leaked dealloc blocks accounting (Shida Zhang) [task:467725]
  - btrfs: do not clean up repair bio if submit fails (Josef Bacik) [task:440526] {CVE-2022-49168}
  - nilfs2: handle errors that nilfs_prepare_chunk() may return (Ryusuke Konishi) [task:440497] {CVE-2025-21721}
  - nilfs2: eliminate staggered calls to kunmap in nilfs_rename (Ryusuke Konishi) [task:440497]
  - nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link (Ryusuke Konishi) [task:440497]
  - nilfs2: fix potential deadlock with newly created symlinks (Ryusuke Konishi) [task:387559] {CVE-2024-50229}
  - HID: ignore non-functional sensor in HP 5MP Camera (Chia-Lin Kao (AceLan)) [task:450748] {CVE-2025-21992}
  - scsi: pm8001: Fix tag leaks on error (Damien Le Moal) [task:440565] {CVE-2022-49121}
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails (Nikolay Aleksandrov) [task:461063] {CVE-2023-53103}
  - bonding: Fix memory leak when changing bond type to Ethernet (Ido Schimmel) [task:461063]
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change (Nikolay Aleksandrov) [task:461063]
  - uprobes: Reject the shared zeropage in uprobe_write_opcode() (Tong Tiangen) [task:448833] {CVE-2025-21881}
  - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [task:471773] {CVE-2025-37995}
  - RDMA/core: Silence oversized kvmalloc() warning (Shay Drory) [task:462568] {CVE-2025-37867}
  - scsi: hisi_sas: Add cond_resched() for no forced preemption model (Yihang Li) [task:429513] {CVE-2024-56589}
  - ibmvnic: Don't reference skb after sending to VIOS (Nick Child) [task:444126] {CVE-2025-21855}
  - 9p/net: fix improper handling of bogus negative read/write replies (Dominique Martinet) [task:462564] {CVE-2025-37879}
  - 9pnet: allow making incomplete read requests (Sergey Alirzaev) [task:462564]
  - PCI: Fix reference leak in pci_register_host_bridge() (Ma Ke) [task:462406] {CVE-2025-37836}
  - tracing: Fix wild-memory-access in register_synth_event() (Shang XiaoJing) [task:460168] {CVE-2022-49799}
  - LoongArch: Set hugetlb mmap base address aligned with pmd size (Bibo Mao) [task:450281] {CVE-2025-21949}
  - mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings (Oscar Salvador) [task:450281]
  - LoongArch: Remove shm_align_mask and use SHMLBA instead (Huacai Chen) [task:450281]
  - clk: qcom: clk-rcg2: Fix compile error for implicit declaration of macro ‘RCG_D_OFFSET’ (lihao01) [task:454819, task:467394]
  - md/raid5: fix oops during stripe resizing (Song Liu) [task:158034, task:477039]
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() (Baisong Zhong) [task:460264] {CVE-2022-49840}
  - KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART (Andrew Scull) [task:157172, task:468147]
  - block: fix that util can be greater than 100% (Yu Kuai) [bug:335388]
  - blk-mq: do not update io_ticks with passthrough requests (Haisu Wang) [bug:335388]
  - blk-mq: Reuse callback in blk_mq_in_flight*() (Pavel Begunkov) [bug:335388]
  - block: update io_ticks when io hang (Zhang Wensheng) [bug:335388]
  - block: add a blk_account_io_merge_bio helper (Konstantin Khlebnikov) [bug:335388, task:381405]
  - net: sched: Fix use after free in red_enqueue() (Dan Carpenter) [task:164562]
  - btrfs: use latest_dev in btrfs_show_devname (Anand Jain) [task:330554] {CVE-2021-47599}
  - btrfs: don't traverse into the seed devices in show_devname (Anand Jain) [task:157172]
  - btrfs: convert latest_bdev type to btrfs_device and rename (Anand Jain) [task:330554] {CVE-2021-47599}
  - fs: relax assertions on failure to encode file handles (Amir Goldstein) [task:429490] {CVE-2024-57924}
  - ovl: don't use a temp buf for encoding real fh (Amir Goldstein) [task:149468]
  - ovl: make sure that real fid is 32bit aligned in memory (Amir Goldstein) [task:149468]
  - clocksource: Skip watchdog check for large watchdog intervals (Jiri Wiesner) [task:431250]
  - clocksource: Print deviation in nanoseconds when a clocksource becomes unstable (Feng Tang) [task:431250]
  - clocksource: Reduce the default clocksource_watchdog() retries to 2 (Waiman Long) [task:457161]
  - clocksource: Avoid accidental unstable marking of clocksources (Waiman Long) [task:457161]
  - clocksource: Retry clock read if long delays detected (Paul E. McKenney) [task:158827]
  - x86/fpu: Allow multiple bits in clearcpuid= parameter (Arvind Sankar) [task:158034]
  - netfilter: conntrack: revisit the gc initial rescheduling bias (Antoine Tenart) [task:441321]
  - netfilter: conntrack: fix the gc rescheduling delay (Antoine Tenart) [task:441321]
  - netfilter: conntrack: revisit gc autotuning (Florian Westphal) [task:441321] {CVE-2022-49110}
  - netfilter: conntrack: collect all entries in one cycle (Florian Westphal) [task:160493]
  - geneve: Suppress list corruption splat in geneve_destroy_tunnels(). (Kuniyuki Iwashima) [task:444121]
  - geneve: Fix use-after-free in geneve_find_dev(). (Kuniyuki Iwashima) [task:444121] {CVE-2025-21858}
  - geneve: move debug check after netdev unregister (Florian Westphal) [task:155707]
  - scsi: st: Fix array overflow in st_setup() (Kai Mäkisara) [task:462440] {CVE-2025-37857}
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow (Patrisious Haddad) [task:459937] {CVE-2025-22086}
  - RDMA/core: Fix null-ptr-deref in ib_core_cleanup() (Chen Zhongjin) [task:460250] {CVE-2022-49925}
  - IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (Niels Dossche) [task:441319] {CVE-2022-49089}
  - usbnet: gl620a: fix endpoint checking in genelink_bind() (Nikita Zhandarovich) [task:448793] {CVE-2025-21877}
  - netfilter: ipset: Hold module reference while requesting a module (Phil Sutter) [task:410153] {CVE-2024-56637}
  - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (Eric Dumazet) [task:426473] {CVE-2025-21653}
  - page_pool: avoid infinite loop to schedule delayed worker (Jason Xing) [task:462587] {CVE-2025-37859}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [task:461022] {CVE-2025-37798}
  - tipc: fix memory leak in tipc_link_xmit (Tung Nguyen) [task:461213] {CVE-2025-37757}
  - i40e: Fix kernel crash during reboot when adapter is in recovery mode (Ivan Vecera) [task:461215] {CVE-2023-53114}
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Cong Wang) [task:461360] {CVE-2025-37797}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (Tung Nguyen) [task:461966] {CVE-2025-37824}
  - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (Jinghao Jia) [task:421045] {CVE-2024-53680}
  - f2fs: fix race in concurrent f2fs_stop_gc_thread (Long Li) [task:410149] {CVE-2024-53218}
  - f2fs: use spin_lock to avoid hang (Jaegeuk Kim) [task:440817] {CVE-2022-49169}
  - btrfs: do not double complete bio on errors during compressed reads (Josef Bacik) [task:440568] {CVE-2022-49167}
  - btrfs: fix use-after-free when attempting to join an aborted transaction (Filipe Manana) [task:440409] {CVE-2025-21753}
  - net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" (Jeremy Linton) [task:441340]
  - net: bcmgenet: Use stronger register read/writes to assure ordering (Jeremy Linton) [task:441340] {CVE-2022-49194}
  - net: systemport: fix potential memory leak in bcm_sysport_xmit() (Wang Hai) [task:387641] {CVE-2024-50171}
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (Quang Le) [task:434029] {CVE-2025-21702}
  - net_sched: sch_fifo: implement lockless __fifo_dump() (Eric Dumazet) [task:434029]
  - wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() (Marcel Hamer) [task:440550] {CVE-2025-21744}
  - netrom: check buffer length before accessing it (Ilya Shchipletsov) [task:425034] {CVE-2024-57802}
  - SUNRPC: Fix the svc_deferred_event trace class (Chuck Lever) [task:439956] {CVE-2022-49065}
  - SUNRPC: Clean up request deferral tracepoints (Chuck Lever) [task:439956]
  - SUNRPC: Simplify defining common RPC trace events (Chuck Lever) [task:439956]
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Arnaud Lecomte) [task:460175] {CVE-2025-37749}
  - can: j1939: j1939_send_one(): fix missing CAN header initialization (Oliver Hartkopp) [task:460174] {CVE-2022-49845}
  - wifi: at76c50x: fix use after free access in at76_disconnect (Abdun Nihaal) [task:460161] {CVE-2025-37796}
  - net: vlan: don't propagate flags on open (Stanislav Fomichev) [task:460234] {CVE-2025-23163}
  - sctp: detect and prevent references to a freed transport in sendmsg (Ricardo Cañuelo Navarro) [task:460144] {CVE-2025-23142}
  - net: openvswitch: fix nested key length validation in the set() action (Ilya Maximets) [task:460141] {CVE-2025-37789}
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (Debin Zhu) [task:459581] {CVE-2025-22063}
  - atm: Fix NULL pointer dereference (Minjoong Kim) [task:459567] {CVE-2025-22018}
  - net_sched: skbprio: Remove overly strict queue assertions (Cong Wang) [task:458462] {CVE-2025-38637}
  - f2fs: fix missing free nid in f2fs_handle_failed_inode (Jaegeuk Kim) [task:440776] {CVE-2022-49255}
  - ubifs: Fix to add refcount once page is set private (Zhihao Cheng) [task:439948] {CVE-2021-47635}
  - include/linux/pagemap.h: introduce attach/detach_page_private (Guoqing Jiang) [task:439948]
  - ext4: fix access to uninitialised lock in fc replay path (Luis Henriques (SUSE)) [task:376395] {CVE-2024-50014}
  - media: streamzap: fix race between device disconnection and urb callback (Murad Masimov) [task:459565] {CVE-2025-22027}
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (Alexei Starovoitov) [task:462409] {CVE-2025-37884}
  - bpf: Fix kmemleak warning for percpu hashmap (Yonghong Song) [task:461956] {CVE-2025-37807}
  - net: annotate races around sk->sk_bound_dev_if (Eric Dumazet) [task:439947] {CVE-2022-49420}
  - drm/scheduler: fix fence ref counting (Christian König) [task:460223] {CVE-2022-49829}
  - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426896] {CVE-2025-21640}
  - xfs: fix freeing speculative preallocations for preallocated files (Christoph Hellwig) [task:449979]
  - xfs: update fork seq counter on data fork changes (Brian Foster) [task:449979]
  - net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (Kaixin Wang) [task:387977] {CVE-2024-47747}
  - fs: add a new SB_I_NOUMASK flag (Jeff Layton) [task:438543, task:442990]
  - NFS: Further optimisations for 'ls -l' (Trond Myklebust) [task:438543, task:442990]
  - NFS: Support larger readdir buffers (Trond Myklebust) [task:438543, task:442990]
  - NFS: Remove unnecessary kmap in nfs_readdir_xdr_to_array() (Trond Myklebust) [task:438543, task:442990]
  - NFS: Clean up nfs_readdir_page_filler() (Trond Myklebust) [task:438543, task:442990]
  - NFS: Clean up directory array handling (Trond Myklebust) [task:438543, task:442990]
  - nfs: pass the correct prototype to read_cache_page (Christoph Hellwig) [task:438543, task:442990]
  - NFS: Clean up readdir struct nfs_cache_array (Trond Myklebust) [task:438543, task:442990]
  - nfs: Replace zero-length array with flexible-array member (Gustavo A. R. Silva) [task:438543, task:442990]
  - NFS: Ensure contents of struct nfs_open_dir_context are consistent (Trond Myklebust) [task:438543, task:442990]
  - NFS: Use the 64-bit server readdir cookies when possible (Trond Myklebust) [task:438543, task:442990]
  - nfs: optimise readdir cache page invalidation (Dai Ngo) [task:438543, task:442990]
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (Cong Wang) [task:461961] {CVE-2025-37823}
  - sctp: sysctl: rto_min/max: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426435] {CVE-2025-21639}
  - sctp: sysctl: auth_enable: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [task:426436] {CVE-2025-21638}
  - spi: mpc52xx: Add cancel_work_sync before module remove (Pei Xiao) [task:421039] {CVE-2024-50051}
  - net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (Jonathan Currier) [task:461948] {CVE-2025-37833}
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT (Maxim Mikityanskiy) [task:459941] {CVE-2025-22021}
  - net/rose: prevent integer overflows in rose_setsockopt() (Nikita Zhandarovich) [task:441317] {CVE-2025-21711}
  - net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (Jakub Kicinski) [task:440770] {CVE-2025-21768}
  - udp: Deal with race between UDP socket address change and rehash (Stefano Brivio) [task:441338] {CVE-2024-57974}
  - ipv6: udp: constify 'struct net' parameter of socket lookups (Eric Dumazet) [task:441338]
  - udp: constify 'struct net' parameter of socket lookups (Eric Dumazet) [task:441338]
  - udp: Remove unused variable/function (exact_dif) (Tim Beale) [task:441338]
  - udp6: add missing rehash callback to udplite (Alexey Kodanev) [task:441338]
  - btrfs: fix use-after-free when COWing tree bock and tracing is enabled (Filipe Manana) [task:429487] {CVE-2024-56759}
  - net/sctp: Prevent autoclose integer overflow in sctp_association_init() (Nikolay Kuratov) [task:427427] {CVE-2024-57938}
  - tcp: Fix data-races around sysctl_tcp_l3mdev_accept. (Kuniyuki Iwashima) [task:440800] {CVE-2022-49599}
  - tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if() (Eric Dumazet) [task:440800]
  - usb: gadget: f_midi: fix MIDI Streaming descriptor lengths (John Keeping) [task:442582] {CVE-2025-21835}
  - igb: Fix potential invalid memory access in igb_init_module() (Yuan Can) [task:421029] {CVE-2024-52332}
  - quota: flush quota_release_work upon quota writeback (Ojaswin Mujoo) [task:420523] {CVE-2024-56780}
  - ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe (Miaoqian Lin) [task:440548] {CVE-2022-49241}
  - ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() (Yang Yingliang) [task:440548]
  - ip: Fix data-races around sysctl_ip_fwd_update_priority. (Kuniyuki Iwashima) [task:440687] {CVE-2022-49603}
  - xfs: fix log recovery when unknown rocompat bits are set (Darrick J. Wong) [task:450130]
  - xfs: allow inode inactivation during a ro mount log recovery (Darrick J. Wong) [task:450130]
  - smb: client: Add check for next_buffer in receive_encrypted_standard() (Haoxiang Li) [task:444124] {CVE-2025-21844}
  - cifs: fix potential memory leaks in session setup (Paulo Alcantara) [task:448797] {CVE-2023-53008}
  - dm array: fix releasing a faulty array block twice in dm_array_cursor_end (Ming-Hung Tsai) [task:426323] {CVE-2024-57929}
  - RDMA/core: Fix ib block iterator counter overflow (Yonatan Nachum) [task:448788] {CVE-2023-53026}
  - ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. (Kuniyuki Iwashima) [task:440707] {CVE-2022-49579}
  - tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. (Kuniyuki Iwashima) [task:440692] {CVE-2022-49585}
  - tcp: disable TFO blackhole logic by default (Wei Wang) [task:440692]
  - tcp: Fix a data-race around sysctl_tcp_ecn_fallback. (Kuniyuki Iwashima) [task:441283] {CVE-2022-49630}
  - netfilter: nf_tables: fix crash when nf_trace is enabled (Florian Westphal) [task:440633]
  - netfilter: nf_tables: avoid skb access on nf_stolen (Florian Westphal) [task:440633] {CVE-2022-49622}
  - netfilter: nf_tables: consolidate rule verdict trace call (Pablo Neira Ayuso) [task:440633]
  - fbdev: hyperv_fb: Allow graceful removal of framebuffer (Saurabh Sengar) [task:450275] {CVE-2025-21976}
  - fbdev: Introduce devm_register_framebuffer() (Thomas Weißschuh) [task:450275]
  - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (Haoxiang Li) [task:444125] {CVE-2025-21848}
  - remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (Miaoqian Lin) [task:440416] {CVE-2022-49188}
  - remoteproc: qcom_q6v5_mss: Extract mba/mpss from memory-region (Sibi Sankar) [task:440416]
  - udp: Deal with race between UDP socket address change and rehash (Stefano Brivio) [task:469817] {CVE-2024-57974}
  - udp: Remove unused parameter (exact_dif) (Tim Beale) [task:441338]
  - net: ipv6: drop unneeded likely() call around IS_ERR() (Enrico Weigelt) [task:441338]
  - net: udp6: prefer listeners bound to an address (Peter Oskolkov) [task:441338]
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (Pavel Paklov) [task:466598] {CVE-2025-37927}
  - iommu/amd: Fix ivrs_acpihid cmdline parsing code (Kim Phillips) [task:164562]
  - xenbus: Use kref to track req lifetime (Jason Andryuk) [task:466603] {CVE-2025-37949}
  - xenbus: req->err should be updated before req->state (Dongli Zhang) [task:155707]
  - ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (Murad Masimov) [task:440505] {CVE-2025-21792}
  - ax25: rcu protect dev->ax25_ptr (Eric Dumazet) [task:440765] {CVE-2025-21812}
  - ax25: Use kernel universal linked list to implement ax25_dev_list (Duoming Zhou) [task:440765]
  - wifi: rtlwifi: remove unused check_buddy_priv (Thadeu Lima de Souza Cascardo) [task:442589] {CVE-2024-58072}
  - rtlwifi: Start changing RT_TRACE into rtl_dbg (Larry Finger) [task:166857]
  - rtlwifi: replace usage of found with dedicated list iterator variable (Jakob Koschel) [task:442589]
  - rtlwifi: Replace RT_TRACE with rtl_dbg (Larry Finger) [task:166857]
  - rtlwifi: rtl_pci: Fix memory leak when hardware init fails (Larry Finger) [task:166857]
  - rtlwifi: Fix errors in spacing in wifi.h (Larry Finger) [task:442589]
  - rtlwifi: Fix problems with block comments in wifi.h (Larry Finger) [task:442589]
  - rtlwifi: Remove CamelCase variables from base code (Larry Finger) [task:442589]
  - xfs: don't include bnobt blocks when reserving free block pool (Darrick J. Wong) [task:464914]
  - xfs: set aside allocation btree blocks from block reservation (Brian Foster) [task:464914]
  - xfs: introduce in-core global counter of allocbt blocks (Brian Foster) [task:464914]
  - Kdump: Resolve Second Kernel Boot Failure (duanchenghao) [bug:353716, bug:353689]
  - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (Sean Christopherson) [task:442641] {CVE-2024-58083}
  - thermal: int340x: Add NULL check for adev (Chenyuan Yang) [task:459932] {CVE-2025-23136}
  - fbdev: smscufx: fix error handling code in ufx_usb_probe (Dongliang Mu) [task:448819] {CVE-2022-49741}
  - video: fbdev: don't print error message on framebuffer_alloc() failure (Bartlomiej Zolnierkiewicz) [task:448819]
  - video: fbdev: intelfb: return -ENOMEM on framebuffer_alloc() failure (Bartlomiej Zolnierkiewicz) [task:448819]
  - video: fbdev: s3c-fb: return -ENOMEM on framebuffer_alloc() failure (Bartlomiej Zolnierkiewicz) [task:448819]
  - bpf: avoid holding freeze_mutex during mmap operation (Andrii Nakryiko) [task:444118] {CVE-2025-21853}
  - bpf: Prevent mmap()'ing read-only maps as writable (Andrii Nakryiko) [task:444118]
  - bpf: Prevent re-mmap()'ing BPF map as writable for initially r/o mapping (Andrii Nakryiko) [task:444118]
  - qibfs: fix _another_ leak (Al Viro) [task:466584] {CVE-2025-37983}
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() (Wentao Liang) [task:466615] {CVE-2025-37990}
  - wifi: wl1251: fix memory leak in wl1251_tx_work (Abdun Nihaal) [task:466597] {CVE-2025-37982}
  - drm/nouveau: prime: fix ttm_bo_delayed_delete oops (Chris Bainbridge) [task:460149] {CVE-2025-37765}
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Dmitry Torokhov) [task:462069] {CVE-2025-37800}
  - driver core: introduce device_set_driver() helper (Dmitry Torokhov) [task:462069]
  - driver core: bus: implement bus_get/put() without the private pointer (Greg Kroah-Hartman) [task:462069]
  - driver core: add local subsys_get and subsys_put functions (Greg Kroah-Hartman) [task:462069]
  - Revert "driver core: Fix uevent_show() vs driver detach race" (Greg Kroah-Hartman) [task:462069]
  - usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback (Wesley Cheng) [task:440766] {CVE-2022-49398}
  - tty: serial: fsl_lpuart: fix race on RX DMA shutdown (Alexander Sverdlin) [task:461247] {CVE-2023-53094}
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (Kunihiko Hayashi) [task:460201] {CVE-2025-23140}
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present (Thadeu Lima de Souza Cascardo) [task:460209] {CVE-2025-37781}
  - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (Gabriel Shahrouzi) [task:462560] {CVE-2025-37878}
  - scsi: hisi_sas: Free irq vectors in order for v3 HW (Qi Liu) [task:440479] {CVE-2022-49118}
  - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (Cong Wang) [task:419353]
  - net/sched: netem: account for backlog updates from child qdisc (Martin Ottens) [task:419353] {CVE-2024-56770}
  - net: netem: use a list in addition to rbtree (Peter Oskolkov) [task:419353]
  - batman-adv: Drop unmanaged ELP metric worker (Sven Eckelmann) [task:439944] {CVE-2025-21823}
  - batman-adv: Ignore neighbor throughput metrics in error case (Sven Eckelmann) [task:439944]
  - batman-adv: ELP - use wifi tx bitrate as fallback (René Treffer) [task:439944]
  - list: fix a data-race around ep->rdllist (Kuniyuki Iwashima) [task:440750] {CVE-2022-49443}
  - list: introduce list_is_head() helper and re-use it in list.h (Andy Shevchenko) [task:440750]
  - net: phy: leds: fix memory leak (Qingfang Deng) [task:466413] {CVE-2025-37989}
  - sched/core: Prevent rescheduling when interrupts are disabled (Thomas Gleixner) [task:448841] {CVE-2023-52935}
  - s390/sclp: Add check for get_zeroed_page() (Haoxiang Li) [task:462569] {CVE-2025-37883}
  - f2fs: fix to do sanity check on node blkaddr in truncate_node() (Chao Yu) [task:416339] {CVE-2024-56692}
  - f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() (Chao Yu) [task:440555] {CVE-2022-49380}
  - f2fs: do not count ENOENT for error case (Jaegeuk Kim) [task:439941]
  - f2fs: avoid infinite loop to flush node pages (Jaegeuk Kim) [task:439941] {CVE-2022-49317}
  - f2fs: fix wrong condition check when failing metapage read (Jaegeuk Kim) [task:439941]
  - f2fs: avoid an infinite loop in f2fs_sync_dirty_inodes (Jaegeuk Kim) [task:439941]
  - f2fs: set SBI_NEED_FSCK flag when inconsistent node block found (Weichao Guo) [task:439941]
  - scsi: pm8001: Fix task leak in pm8001_send_abort_all() (Damien Le Moal) [task:440632] {CVE-2022-49120}
  - scsi: pm80xx: Fix command issue sizing (peter chang) [task:440632]
  - scsi: pm80xx: Squashed logging cleanup changes (peter chang) [task:440632]
  - btrfs: always report error in run_one_delayed_ref() (Qu Wenruo) [task:448850] {CVE-2022-49761}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.50.v2207
changelog:
  - secondly update changelog for upcoming 4.19.90-52.50.v2207 (Zhengyuan Liu)
  - iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported (Suravee Suthikulpanit) [task:457728]
  - iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE (Suravee Suthikulpanit) [task:457728]
  - update changelog for upcoming 4.19.90-52.50.v2207 (Zhengyuan Liu)
  - mm/memory.c: Make the refreshing rate of rss_stat manual (Enze Li) [task:362195]
  - xfs: push the AIL in xlog_grant_head_wake (Dave Chinner) [task:507733]
  - Revert "udp: Deal with race between UDP socket address change and rehash" (taowei) [task:511705]
  - mm/slub: add missing TID updates on slab deactivation (Jann Horn) [task:506635]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.51.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.51.v2207 (Zhengyuan Liu)
  - Revert "virtio_net: fix memory leak inside XPD_TX with mergeable" (刘正元)
  - sched/fair: Refill bandwidth before scaling (Huaixin Chang) [task:153627]
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [task:491929] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp) [task:491929]
  - fs/jfs: fix shift exponent db_agl2size negative (Liu Shixin via Jfs-discussion) [task:491929]
  - fs: jfs: fix shift-out-of-bounds in dbDiscardAG (Hoi Pok Wu) [task:491929, task:164562]
  - usb: dwc2: Fix memory leak in dwc2_hcd_init (Miaoqian Lin) [task:162162]
  - usb: dwc2: check return value after calling platform_get_resource() (Yang Yingliang) [task:160493]
  - drm/qxl: fix UAF on handle creation (Wander Lairson Costa) [task:346813] {CVE-2023-39198}
  - genirq/affinity: Improve __irq_build_affinity_masks() (Ming Lei) [bug:341996, bug:350695]
  - genirq/affinity: Pass first vector to __irq_build_affinity_masks() (Ming Lei) [task:157536]
  - genirq/affinity: Move two stage affinity spreading into a helper function (Ming Lei) [task:157536]
  - bpf: Fix a data-race around bpf_jit_limit. (Kuniyuki Iwashima) [task:482243] {CVE-2022-49967}
  - bpf: fix potential 32-bit overflow when accessing ARRAY map element (Andrii Nakryiko) [task:482217] {CVE-2022-50167}
  - bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals (Daniel Borkmann) [task:441339] {CVE-2022-49658}
  - bpf: Fix signed bounds propagation after mov32 (Daniel Borkmann) [task:161887]
  - bpf: Verifier, do_refine_retval_range may clamp umin to 0 incorrectly (John Fastabend) [task:158425, task:441339]
  - udp: fix skb_copy_and_csum_datagram with odd segment sizes (Willem de Bruijn) [task:516751, task:520623]
  - iov_iter: reduce code duplication (Al Viro) [task:516751, task:520623]
  - iov_iter: teach csum_and_copy_to_iter() to handle pipe-backed ones (Al Viro) [task:516751, task:520623]
  - net/tls: Use RCU API to access tls_ctx->netdev (Maxim Mikityanskiy) [task:207215]
  - net/tls: Remove the context from the list in tls_device_down (Maxim Mikityanskiy) [task:207215]
  - tls: Fix context leak on tls_device_down (Maxim Mikityanskiy) [task:207215]
  - net/tls: Fix use-after-free after the TLS device goes down and up (Maxim Mikityanskiy) [task:207215] {CVE-2021-47131}
  - net/tls: Replace TLS_RX_SYNC_RUNNING with RCU (Maxim Mikityanskiy) [task:207215]
  - security/lsm: Fix missing selinux file type (mengdehui) [task:506521]
  - driver/tpm: fix NULL err when creat vtpm (mengdehui) [task:519155]
  - kysec/ppro: Fix get paths that are not real paths (mengdehui) [bug:387337]
  - fix some compilation warnings for selinux (Jiangshan Yi) [task:357223]
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Scott Mayhew) [task:363951] {CVE-2024-46695}
  - selinux: implement the kernfs_init_security hook (Ondrej Mosnacek) [bug:258835]
  - selinux: try security xattr after genfs for kernfs filesystems (Ondrej Mosnacek) [bug:258835]
  - security/selinux: Fix SELinux crash issue when disabling stack (chengang) [task:338969]
  - selinux: fix double free of cond_list on error paths (Vratislav Bendel) [task:330355] {CVE-2022-48740}
  - selinux: fix a double free in cond_read_node()/cond_read_list() (Tom Rix) [task:330355]
  - selinux: fix error return code in cond_read_list() (Wei Yongjun) [task:330355]
  - selinux: convert cond_expr to array (Ondrej Mosnacek) [task:330355]
  - selinux: convert cond_av_list to array (Ondrej Mosnacek) [task:330355]
  - selinux: convert cond_list to array (Ondrej Mosnacek) [task:330355]
  - selinux: simplify evaluate_cond_node() (Ondrej Mosnacek) [task:330355]
  - selinux: avoid dereference of garbage after mount failure (Christian Göttsche) [task:221817] {CVE-2024-35904}
  - selinux: mark some global variables __ro_after_init (Ondrej Mosnacek) [task:221817]
  - selinux: make selinuxfs_mount static (Ondrej Mosnacek) [task:221817]
  - selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling (Paul Moore) [task:169360]
  - selinux: fix error initialization in inode_doinit_with_dentry() (Tianyue Ren) [task:169360]
  - selinux: Fix error return code in sel_ib_pkey_sid_slow() (Chen Zhou) [task:169360]
  - selinux: allow labeling before policy is loaded (Jonathan Lebon) [task:169360]
  - selinux: ensure we cleanup the internal AVC counters on error in avc_insert() (Paul Moore) [task:169360]
  - selinux: fall back to ref-walk if audit is required (Stephen Smalley) [task:169360]
  - security/selinux: add ngac hook function for selinux version 4.19 (wangshengye) [bug:195749]
  - security/selinux: Implementation of selinux 4.19 stacking (chengang) [task:922066]
  - security/selinux: Upgrade selinux to version 4.19 (chengang) [task:149681]
  - Revert "net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port)" (刘正元)
  - Revert "ip: Fix data-races around sysctl_ip_prot_sock." (刘正元)
  - selinux: don't use make's grouped targets feature yet (Paul Moore) [task:166857]
  - selinux: ensure av_permissions.h is built when needed (Paul Moore) [task:166857]
  - selinux: fix Makefile dependencies of flask.h (Ondrej Mosnacek) [task:166857]
  - selinux: Add boundary check in put_entry() (Xiu Jianfeng) [task:162162]
  - selinux: use correct type for context length (Christian Göttsche) [task:162162]
  - security/selinux: use LSM stack API in setsecurity (penghuaihe) [task:151838]
  - security/selinux: fix bounded_transition failed problem (mengdehui) [bug:161836]
  - security/selinux: add ngac hook function (yangzhao) [task:124104]
  - selinux: properly handle multiple messages in selinux_netlink_send() (Paul Moore) [task:119087] {CVE-2020-10751}
  - Revert "security/selinux: add ngac hook function" (mengdehui) [task:490643]
  - Revert "security/selinux: fix bounded_transition failed problem" (mengdehui) [task:490643]
  - Revert "security/selinux: use LSM stack API in setsecurity" (mengdehui) [task:490643]
  - Revert "selinux: properly handle multiple messages in selinux_netlink_send()" (mengdehui) [task:490643]
  - Revert "selinux: make selinuxfs_mount static" (mengdehui) [task:490643]
  - Revert "selinux: mark some global variables __ro_after_init" (mengdehui) [task:490643]
  - Revert "selinux: avoid dereference of garbage after mount failure" (mengdehui) [task:490643]
  - Revert "security/selinux: Fixed crash caused by selinux" (mengdehui) [task:490643]
  - Revert "selinux,smack: don't bypass permissions check in inode_setsecctx hook" (mengdehui) [task:490643]
  - icmp: Fix data-races around sysctl. (Kuniyuki Iwashima) [task:440780] {CVE-2022-49638}
  - virtio_net: fix memory leak inside XPD_TX with mergeable (Xuan Zhuo) [task:482159] {CVE-2022-50065}
  - ice: always check VF VSI pointer values (Jacob Keller) [task:440513] {CVE-2022-49516}
  - ice: Add helper function to get the VF's VSI (Brett Creeley) [task:162874, task:161899]
  - net: fix geneve_opt length integer overflow (Lin Ma) [task:458450] {CVE-2025-22055}
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference (James Smart) [task:167824, task:499367] {CVE-2021-47183}
  - RDMA/hns: Fix soft lockup during bt pages loop (Junxian Huang) [task:452502] {CVE-2025-22010}
  - set linkdata ps3/ps3stor to m in x86, arm and loongarch (Cao Guanghui) [task:449995]
  - LINKDATA: ps3/ps3stor: update driver support for linkdata (liujie) [task:449995]
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [task:505893] {CVE-2025-38464}
  - tracing: Fix use-after-free in print_graph_function_flags during tracer switching (Tengda Wu) [task:458968] {CVE-2025-22035}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (Kuniyuki Iwashima) [task:495865] {CVE-2025-38250}
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [task:491981] {CVE-2025-38229}
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama) [task:491387] {CVE-2025-38099}
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING (Pedro Nishiyama) [task:491387]
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (Luiz Augusto von Dentz) [task:491397] {CVE-2025-38117}
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (Alexis Lothoré) [task:491205] {CVE-2025-38126}
  - net: stmmac: Calculate CDC error only once (Kurt Kanzenbach) [task:491205]
  - net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls (Holger Assmann) [task:491205]
  - net: stmmac: Fix signed/unsigned wreckage (Thomas Gleixner) [task:491205]
  - net: stmmac: add timestamp correction to rid CDC sync error (Voon Weifeng) [task:491205]
  - net: stmmac: Get correct timestamp values from XGMAC (Jose Abreu) [task:491205]
  - net: stmmac: fix ptp timestamping on Rx on gmac4 (Ilias Apalodimas) [task:491205]
  - net: stmmac: implement the SIOCGHWTSTAMP ioctl (Artem Panfilov) [task:491205]
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky) [task:505919]
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu (Google)) [task:505919] {CVE-2025-38401}
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu) [task:505919]
  - mmc: mediatek: fix SDIO IRQ detection issue (jjian zhou) [task:505919]
  - mmc: bcm2835: Drop pointer to mmc_host from bcm2835_host (Lukas Wunner) [task:505919]
  - panic: implement nmi_panic_self_stop function for KunPeng 920 (liqiang01) [task:515025]
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei) [task:507039]
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [task:507039] {CVE-2025-38477}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [task:507033] {CVE-2025-38387}
  - nbd: fix race between timeout and normal completion (Ming Lei) [task:511239] {CVE-2024-49855}
  - btrfs: fix deadlock between quota enable and other quota operations (Filipe Manana) [task:510715, task:503849, task:463272]
  - LoongArch: Define the __io_aw() hook as mmiowb() (Huacai Chen) [task:221961] {CVE-2024-35818}
  - ndisc: extend RCU protection in ndisc_send_skb() (Eric Dumazet) [task:440599] {CVE-2025-21760}
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (Eric Dumazet) [task:440498] {CVE-2025-21761}
  - ndisc: use RCU protection in ndisc_alloc_skb() (Eric Dumazet) [task:440498]
  - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() (Eric Dumazet) [task:440498]
  - KVM: async_pf: Cleanup kvm_setup_async_pf() (Vitaly Kuznetsov) [task:511433]
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [task:491927] {CVE-2025-38215}
  - cpufreq: governor: Use kobject release() method to free dbs_data (Kevin Hao) [task:440528] {CVE-2022-49513}
  - cpufreq: Move to_gov_attr_set() to cpufreq.h (Kevin Hao) [task:440528]
  - driver core: fix deadlock in __device_attach (Zhang Wensheng) [task:441300] {CVE-2022-49371}
  - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [task:425040] {CVE-2024-57884}
  - sw_64: kprobes: Use generic kretprobe trampoline handler (Feng Yang) [task:510463]
  - block: don't allow the same type rq_qos add more than once (Jinke Han) [task:482125] {CVE-2022-50086}
  - dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (Luo Meng) [task:481813] {CVE-2022-50092}
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [task:491905] {CVE-2025-38204}
  - net: lan743x: Fix memleak issue when GSO enabled (Thangaraj Samynathan) [task:466617] {CVE-2025-37909}
  - lan743x: fix endianness when accessing descriptors (Alexey Denisov) [task:466617]
  - lan743x: fix rx_napi_poll/interrupt ping-pong (Sven Van Asbroeck) [task:466617]
  - lan743x: remove redundant initialization of variable current_head_index (Colin Ian King) [task:466617]
  - lan743x: remove redundant assignment to variable rx_process_result (Colin Ian King) [task:466617]
  - wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit) [task:491311] {CVE-2025-38096}
  - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [task:466487] {CVE-2025-37961}
  - sch_htb: make htb_qlen_notify() idempotent (Cong Wang) [task:466415] {CVE-2025-37932}
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w (Shruti Parab) [task:466237] {CVE-2025-37911}
  - net: atlantic: fix aq_vec index out of range error (Chia-Lin Kao (AceLan)) [task:481741] {CVE-2022-50066}
  - scsi: zfcp: Fix double free of FSF request when qdio send fails (Benjamin Block) [task:460278] {CVE-2022-49789}
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [task:481765] {CVE-2025-38066}
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [task:481989] {CVE-2025-38061}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'ichiro Kawasaki) [task:492667] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li) [task:492667]
  - neighbour: use RCU protection in __neigh_notify() (Eric Dumazet) [task:440628] {CVE-2025-21763}
  - neighbour: delete redundant judgment statements (Li Zetao) [task:440628]
  - ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet) [task:440728] {CVE-2025-21759}
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [task:490963] {CVE-2025-38163}
  - Bluetooth: use memset avoid memory leaks (Minghao Chi (CGEL ZTE)) [task:439933] {CVE-2022-49116}
  - team: better TEAM_OPTION_TYPE_STRING validation (Eric Dumazet) [task:440782] {CVE-2025-21787}
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [task:491933] {CVE-2025-38193}
  - ia64: kprobes: Fix to pass correct trampoline address to the handler (Masami Hiramatsu) [task:485647]
  - kprobes: Make local functions static (Masami Hiramatsu) [task:485647]
  - kprobes: Free kretprobe_instance with RCU callback (Masami Hiramatsu) [task:485647]
  - kprobes: Remove NMI context check (Masami Hiramatsu) [task:485647]
  - loongarch: kprobes: Use generic kretprobe trampoline handler (Feng Yang) [task:485647]
  - sparc: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - sh: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - s390: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - powerpc: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - mips: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - ia64: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - arc: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - arm64: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - arm: kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - x86/kprobes: Use generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - kprobes: Add generic kretprobe trampoline handler (Masami Hiramatsu) [task:485647]
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [task:505883] {CVE-2025-38458}
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [task:491917] {CVE-2025-38212}
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [task:507035] {CVE-2025-38495}
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [task:507031] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [task:507045] {CVE-2025-38474}
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [task:507019] {CVE-2025-38468}
  - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (Waiman Long) [task:482073] {CVE-2022-50103}
  - Bluetooth: btrtl: Prevent potential NULL dereference (Dan Carpenter) [task:460185] {CVE-2025-37792}
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [task:505901] {CVE-2025-38386}
  - mtd: spinand: fix memory leak of ECC engine conf (Pablo Martin-Gomez) [task:505937] {CVE-2025-38384}
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [task:507013] {CVE-2025-38494}
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (RD Babiera) [task:505909] {CVE-2025-38391}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [task:505889] {CVE-2025-38424}
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [task:497747] {CVE-2025-38320}
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [task:497751] {CVE-2025-38332}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [task:497283] {CVE-2025-38346}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [task:505877] {CVE-2025-38460}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [task:482019] {CVE-2025-38024}
  - intel_th: Fix a resource leak in an error handling path (Christophe JAILLET) [task:482199] {CVE-2022-50143}
  - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [task:482127] {CVE-2025-38079}
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [task:482133] {CVE-2025-38034}
  - intel_th: msu: Fix vmalloced buffers (Alexander Shishkin) [task:482209] {CVE-2022-50142}
  - intel_th: msu: Get rid of the window size limit (Alexander Shishkin) [task:482209]
  - mm/vmscan: don't try to reclaim hwpoison folio (Jinjiang Tu) [task:461947] {CVE-2025-37834}
  - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [task:482039] {CVE-2025-38072}
  - nvdimm: Split label init out from the logic for getting config data (Alexander Duyck) [task:482039]
  - libnvdimm, dimm: Maximize label transfer size (Dan Williams) [task:482039]
  - block: fix resource leak in blk_register_queue() error path (Zheng Qixing) [task:466601] {CVE-2025-37980}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [task:491885] {CVE-2025-38194}
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc (Fedor Pchelkin) [task:419629]
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (Ignat Korchagin) [task:419629] {CVE-2024-56605}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [task:488165] {CVE-2025-38090}
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [task:491861] {CVE-2025-38174}
  - efi: fix potential NULL deref in efi_mem_reserve_persistent (Anton Gusev) [task:448780] {CVE-2023-52976}
  - pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking (Evgenii Shatokhin) [task:425037] {CVE-2024-57889}
  - fbdev: omapfb: Add 'plane' value check (Leonid Arapov) [task:462582] {CVE-2025-37851}
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() (Chenyuan Yang) [task:462584] {CVE-2025-37881}
  - mtd: rawnand: brcmnand: fix PM resume warning (Kamal Dasu) [task:462586] {CVE-2025-37840}
  - fs/jfs: Prevent integer overflow in AG size calculation (Rand Deeb) [task:462439] {CVE-2025-37858}
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure (Zhongqiu Han) [task:462443] {CVE-2025-37841}
  - HID: pidff: Fix null pointer dereference in pidff_find_fields (Tomasz Pakuła) [task:462571] {CVE-2025-37862}
  - mcb: fix a double free bug in chameleon_parse_gdd() (Haoxiang Li) [task:461958] {CVE-2025-37817}
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (Frode Isaksen) [task:461959] {CVE-2025-37810}
  - staging: rtl8712: fix uninit-value in usb_read8() and friends (Wang Cheng) [task:441328] {CVE-2022-49301}
  - staging: rtl8712: usb_ops.c: Remove leading p from variable names (Nishka Dasgupta) [task:441328]
  - media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (Zhang Shurong) [task:463860] {CVE-2023-53146}
  - mtd: inftlcore: Add error check for inftl_read_oob() (Wentao Liang) [task:466613] {CVE-2025-37892}
  - tracing: Fix oob write in trace_seq_to_buffer() (Jeongjun Park) [task:466608] {CVE-2025-37923}
  - arp: use RCU protection in arp_xmit() (Eric Dumazet) [task:440668] {CVE-2025-21762}
  - ipv6: use RCU protection in ip6_default_advmss() (Eric Dumazet) [task:441272] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Eric Dumazet) [task:441272, task:440668]
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Jiri Pirko) [task:350517]
  - net: ethernet: stmmac: fix write to sgmii_adapter_base (Dinh Nguyen) [task:441324]
  - net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link (Dinh Nguyen) [task:441324] {CVE-2022-49061}
  - dm cache: fix flushing uninitialized delayed_work on cache_ctr error (Ming-Hung Tsai) [task:390747] {CVE-2024-50280}
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() (Josh Poimboeuf) [task:466477] {CVE-2025-37937}
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() (zhoumin) [task:466616] {CVE-2025-37940}
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (Henry Martin) [task:461963] {CVE-2025-37829}
  - ext4: ignore xattrs past end (Bhupesh) [task:460186] {CVE-2025-37738}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints (Michal Pecio) [task:458303] {CVE-2025-22022}
  - usb: xhci: move link chain bit quirk checks into one helper function. (Niklas Neronin) [task:458303]
  - xhci: Don't pass struct xhci_hcd pointer to xhci_link_seg() (Mathias Nyman) [task:458303]
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [task:505897] {CVE-2025-38459}
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (HarshaVardhana S A) [task:505907] {CVE-2025-38403}
  - media: venus: hfi: add check to handle incorrect queue size (Vikash Garodia) [task:460274] {CVE-2025-23158}
  - media: venus: hfi: add a check to handle OOB in sfr region (Vikash Garodia) [task:460239] {CVE-2025-23159}
  - reset: uniphier-glue: Fix possible null-ptr-deref (Hui Tang) [task:448822] {CVE-2022-49758}
  - reset: uniphier-glue: Use reset_control_bulk API (Philipp Zabel) [task:448822]
  - reset: uniphier-usb3: Rename to reset-uniphier-glue (Kunihiko Hayashi) [task:448822]
  - media: venus: hfi_parser: refactor hfi packet parsing logic (Vikash Garodia) [task:460123] {CVE-2025-23156}
  - media: venus: hfi: add checks to handle capabilities from firmware (Vikash Garodia) [task:460123]
  - media: venus: hfi_parser: Check for instance after hfi platform get (Stanimir Varbanov) [task:460123]
  - media: venus: hfi_parser: Don't initialize parser on v1 (Stanimir Varbanov) [task:460123]
  - media: venus: Fix uninitialized variable count being checked for zero (Colin Ian King) [task:460123]
  - media: venus: Get codecs and capabilities from hfi platform (Stanimir Varbanov) [task:460123]
  - media: venus: parser: Prepare parser for multiple invocations (Stanimir Varbanov) [task:460123]
  - bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() (Shin'ichiro Kawasaki) [task:439953] {CVE-2022-49711}
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (Mike Christie) [task:458998] {CVE-2025-22083}
  - RDMA/srpt: Introduce a reference count in struct srpt_device (Bart Van Assche) [task:482173]
  - RDMA/srpt: Duplicate port name members (Bart Van Assche) [task:482173]
  - RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (Jianglei Nie) [task:482015] {CVE-2022-50138}
  - RDMA/qedr: Improve error logs for rdma_alloc_tid error return (Prabhakar Kushwaha) [task:482015]
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [task:491209] {CVE-2025-38115}
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet) [task:491257]
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [task:491257] {CVE-2025-38147}
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe) [task:491663] {CVE-2025-38094}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [task:491937] {CVE-2025-38177}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() (Remi Pommarel) [task:460303] {CVE-2025-37794}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [task:491963] {CVE-2025-38200}
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads (Minsuk Kang) [task:448783] {CVE-2022-49740}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [task:491903] {CVE-2025-38190}
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [task:491983] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [task:497319] {CVE-2025-38323}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [task:497313] {CVE-2025-38285}
  - jfs: add check read-only before truncation in jfs_truncate_nolock() (Vasiliy Kovalev) [task:459936] {CVE-2024-58094}
  - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key (Vasiliy Kovalev) [task:460140] {CVE-2025-37782}
  - jfs: Fix uninit-value access of imap allocated in the diMount() function (Zhongqiu Han) [task:460236] {CVE-2025-37742}
  - jfs: remove unnecessary oom message (Zhen Lei) [task:460236]
  - jfs: Prevent copying of nlink with value 0 from disk inode (Edward Adam Davis) [task:460150] {CVE-2025-37741}
  - jfs: add sanity check for agwidth in dbMount (Edward Adam Davis) [task:460180] {CVE-2025-37740}
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() (Henry Martin) [task:460300] {CVE-2025-37758}
  - isofs: Prevent the use of too small fid (Edward Adam Davis) [task:460221] {CVE-2025-37780}
  - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (Andreas Gruenbacher) [task:448967] {CVE-2025-21699}
  - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv (Dennis Lam) [task:425033] {CVE-2024-57892}
  - ocfs2: correct return value of ocfs2_local_free_info() (Joseph Qi) [task:425033]
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [task:491953] {CVE-2025-38203}
  - xfs: fix xfs leaked delalloc blocks accounting p2 (Shida Zhang) [task:494391]
  - iio: adc: at91: call input_free_device() on allocated iio_dev (Joe Hattori) [task:426329] {CVE-2024-57904}
  - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:448817] {CVE-2023-52936}
  - irqdomain: Remove debugfs_file from struct irq_domain (Greg Kroah-Hartman) [task:448817]
  - USB: gadget: f_midi: f_midi_complete to call queue_work (Jill Donahue) [task:444127] {CVE-2025-21859}
  - nilfs2: prevent use of deleted inode (Edward Adam Davis) [task:421043] {CVE-2024-53690}
  - fbdev: sisfb: Fix strbuf array overflow (Andrey Shumilin) [task:387561] {CVE-2024-50180}
  - iio: accel: mma8452: use the correct logic to get mma8452_data (Haibo Chen) [task:440788] {CVE-2022-49285}
  - drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init (Miaoqian Lin) [task:440488] {CVE-2022-49462}
  - drm/msm/a6xx: Rename a6xx_gmu_probe to a6xx_gmu_init (Sean Paul) [task:440488]
  - ext4: fix off-by-one error in do_split (Artem Sadovnikov) [task:460184] {CVE-2025-23150}
  - btrfs: fix inode list leak during backref walking at find_parent_nodes() (Filipe Manana) [task:460298] {CVE-2022-49913}
  - Btrfs: preftree: use rb_first_cached (Liu Bo) [task:460298]
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Yajun Deng) [task:459707] {CVE-2023-53034}
  - f2fs: fix to do sanity check on total_data_blocks (Chao Yu) [task:440482] {CVE-2022-49360}
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table (Charles Han) [task:497273] {CVE-2025-38319}
  - bpf: Annotate bpf_long_memcpy with data_race (Daniel Borkmann) [task:494931] {CVE-2023-52521}
  - KVM: Don't null dereference ops->destroy (Alexey Kardashevskiy) [task:440631] {CVE-2022-49568}
  - smb: client: Fix use-after-free in cifs_fill_dirent (Wang Zhaolong) [task:482229] {CVE-2025-38051}
  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [task:440591]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [task:440591] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [task:440591]
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (GONG Ruiqi) [task:491959] {CVE-2025-38213}
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [task:495937] {CVE-2025-38245}
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [task:497753] {CVE-2025-38312}
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Wentao Liang) [task:494929] {CVE-2025-38237}
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [task:497135] {CVE-2025-38328}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [task:497287] {CVE-2025-38324}
  - fbcon: Make sure modelist not set on unregistered console (Kees Cook) [task:491975] {CVE-2025-38198}
  - fbcon: Introduce wrapper for console->fb_info lookup (Daniel Vetter) [task:491975]
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [task:491657] {CVE-2025-38157}
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() (Juergen Gross) [task:482077] {CVE-2022-49989}
  - crypto: hisilicon/sec - don't sleep when in softirq (Zhengchao Shao) [task:481943] {CVE-2022-50171}
  - net: clear the dst when changing skb protocol (Jakub Kicinski) [task:492357] {CVE-2025-38192}
  - bpf: update skb->protocol in bpf_skb_net_grow (Willem de Bruijn) [task:492357]
  - of: check previous kernel's ima-kexec-buffer against memory bounds (Vaibhav Jain) [task:482053] {CVE-2022-50159}
  - set linkdata NIC to y in x86, arm and loongarch (YANGANG) [task:449997]
  - LINKDATA: SXE: add support for linkdata sxe NIC (YANGANG) [task:449997]
  - ax25: Remove broken autobind (Murad Masimov) [task:459548] {CVE-2025-22109}
  - udp: Fix memory accounting leak. (Kuniyuki Iwashima) [task:459933] {CVE-2025-22058}
  - ibmvnic: Use kernel helpers for hex dumps (Nick Child) [task:459569] {CVE-2025-22104}
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() (Josh Poimboeuf) [task:462579] {CVE-2025-37850}
  - ext4: fix OOB read when checking dotdot dir (Acs, Jakub) [task:458578] {CVE-2025-37785}
  - Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works (Tetsuo Handa) [task:481991]
  - Bluetooth: When HCI work queue is drained, only queue chained work (Schspa Shi) [task:481991] {CVE-2022-50166}
  - Bluetooth: Add ncmd=0 recovery handling (Manish Mandlik) [task:481991]
  - bnxt: Do not read past the end of test names (Kees Cook) [task:448825] {CVE-2023-53010}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [task:492663] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [task:492195] {CVE-2025-38184}
  - ip: Fix data-races around sysctl_ip_prot_sock. (Kuniyuki Iwashima) [task:440771] {CVE-2022-49578}
  - net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) (Maciej Żenczykowski) [task:440771]
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [task:491907] {CVE-2025-38214}
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [task:495947] {CVE-2025-38249}
  - usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS (Pavankumar Kondeti) [task:160493]
  - usb: fix various gadgets null ptr deref on 10gbps cabling. (Maciej Żenczykowski) [task:158827]
  - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (Marek Vasut) [task:162162]
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (Mark Brown) [task:160493]
  - ALSA: pcm: oss: Fix negative period/buffer sizes (Takashi Iwai) [task:160493]
  - ALSA: pcm: oss: Fix a few more UBSAN fixes (Takashi Iwai) [task:158034]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.52.v2207
changelog:
  - net: drop bad gso csum_start and offset in virtio_net_hdr (Willem de Bruijn) [task:534195]
  - net: missing check virtio (Denis Arefev) [task:534195]
  - fix kabi issue for "net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation" (luoqing) [task:534195]
  - net: more strict VIRTIO_NET_HDR_GSO_UDP_L4 validation (Willem de Bruijn) [task:534195]
  - linux/virtio_net.h: Support USO offload in vnet header. (Andrew Melnychenko) [task:534195]
  - net: accept UFOv6 packages in virtio_net_hdr_to_skb (Willem de Bruijn) [task:534195]
  - net: check if protocol extracted by virtio_net_hdr_set_proto is correct (Balazs Nemeth) [task:534195]
  - net: Introduce parse_protocol header_ops callback (Maxim Mikityanskiy) [task:158893]
  - RDMA/nl: Do not permit empty devices names during RDMA_NLDEV_CMD_NEWLINK/SET (Jason Gunthorpe) [task:534193]
  - net: hsr: Add VLAN support (WingMan Kwok) [task:534197]
  - netfilter: nf_tables: fix nat hook table deletion (Florian Westphal) [task:534199]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.53.v2207
changelog:
  - net: tighten bad gso csum offset check in virtio_net_hdr (Willem de Bruijn) [task:541407]
  - update changelog for upcoming 4.19.90-52.53.v2207 (Zhengyuan Liu)
  - Revert "veth: Adjust hard_start offset on redirect XDP frames" (Zhengyuan Liu) [task:547295]
  - Revert "veth: Xdp using frame_sz in veth driver" (Zhengyuan Liu)
  - Revert "xdp: Introduce xdp_convert_frame_to_buff utility routine" (Zhengyuan Liu)
  - Revert "xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame" (Zhengyuan Liu) [task:547295]
  - fix the compilation error (Zhengyuan Liu) [task:547295]
  - xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame (Lorenzo Bianconi) [task:547295]
  - xdp: Introduce xdp_convert_frame_to_buff utility routine (Lorenzo Bianconi) [task:547295]
  - veth: Xdp using frame_sz in veth driver (Jesper Dangaard Brouer) [task:547295]
  - veth: Adjust hard_start offset on redirect XDP frames (Jesper Dangaard Brouer) [task:547295]
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal) [task:351433] {CVE-2022-48911}
  - wifi: ath9k: verify the expected usb_endpoints are present (Fedor Pchelkin) [task:164562, task:531813] {CVE-2022-50297}
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (Kuniyuki Iwashima) [task:371789]
  - vrf: Increment Icmp6InMsgs on the original netdev (Stephen Suryaputra) [task:371789]
  - md/raid10: fix leak of 'r10bio->remaining' for recovery (Yu Kuai) [task:166857]
  - igb: Do not free q_vector unless new one was allocated (Kees Cook) [task:164562]
  - wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() (Dan Carpenter) [task:520535]
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [task:520535] {CVE-2025-38602}
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Leon Romanovsky) [task:214146] {CVE-2024-26907}
  - uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ (Alexey Dobriyan) [task:214146]
  - stddef: Introduce DECLARE_FLEX_ARRAY() helper (Kees Cook) [task:214146]
  - dm raid: fix address sanitizer warning in raid_status (Mikulas Patocka) [task:162162]
  - cifs: Fix oops due to uncleared server->smbd_conn in reconnect (David Howells) [task:164562]
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (Li Zetao) [task:166857]
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory (Liu Jian) [task:164562]
  - btrfs: fix race between quota enable and quota rescan ioctl (Filipe Manana) [task:164562]
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip (Xin Long) [task:166857]
  - net_sched: qfq: Fix double list add in class with netem as child qdisc (Victor Nogueira) [task:476203]
  - net_sched: drr: Fix double list add in class with netem as child qdisc (Victor Nogueira) [task:476203]
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [task:476203]
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [task:476203] {CVE-2025-38001}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [task:476217] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Victor Nogueira) [task:476203]
  - sched: Fix detection of empty queues in child qdiscs (Toke Høiland-Jørgensen) [task:476203]
  - vxlan: Annotate FDB data races (Ido Schimmel) [task:482121] {CVE-2025-38037}
  - vxlan: reduce dirty cache line in vxlan_find_mac (Li RongQing) [task:210575]
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima) [task:505933]
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski) [task:505933]
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [task:505933] {CVE-2025-38465}
  - netlink: annotate lockless accesses to nlk->max_recvmsg_len (Eric Dumazet) [task:505933]
  - btrfs: fix BUG_ON condition in btrfs_cancel_balance (xiaoshoukui) [task:373027]
  - virtio_net: fix memory leak inside XPD_TX with mergeable (Xuan Zhuo) [task:482159] {CVE-2022-50065}
  - ALSA: usb-audio: Avoid dropping MIDI events at closing multiple ports (Takashi Iwai) [task:440634]
  - ALSA: usb-audio: Cancel pending work at closing a MIDI substream (Takashi Iwai) [task:440634] {CVE-2022-49545}
  - ALSA: usb-audio: Replace tasklet with work (Takashi Iwai) [task:440634]
  - ext4: fix BUG_ON() when directory entry has invalid rec_len (Luís Henriques) [task:460128] {CVE-2022-49879}
  - ext4: refactor initialize_dirent_tail() (Theodore Ts'o) [task:460128]
  - ext4: rename "dirent_csum" functions to use "dirblock" (Theodore Ts'o) [task:460128]
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Zhihao Cheng) [task:162162]
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [task:497317] {CVE-2025-38337}
  - ocfs2: fix a deadlock when commit trans (Joseph Qi) [task:353893]
  - ocfs2: fix race between searching chunks and release journal_head from buffer_head (Gautham Ananthakrishna) [task:353893] {CVE-2021-47493}
  - Revert "jbd2: Make state lock a spinlock" (liubaolin) [task:429083]
  - Revert "ocfs2: fix race between searching chunks and release journal_head from buffer_head" (liubaolin) [task:429083]
  - Revert "ocfs2: fix a deadlock when commit trans" (liubaolin) [task:429083]
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (Ye Bin) [task:459580] {CVE-2025-22121}
  - ext4: move where set the MAY_INLINE_DATA flag is set (Ye Bin) [task:166857]
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li) [task:162162]
  - ext4: introduce ITAIL helper (Ye Bin) [task:459580]
  - ext4: improve xattr consistency checking and error reporting (Theodore Ts'o) [task:459580]
  - EDAC/amd64: Use cached data when checking for ECC (Yazen Ghannam) [bug:412285]
  - net: bridge: use DEV_STATS_INC() (Eric Dumazet) [task:207281] {CVE-2023-52578}
  - block, bfq: don't break merge chain in bfq_split_bfqq() (Yu Kuai) [task:515911]
  - block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() (Yu Kuai) [task:515911]
  - blk-cgroup: dropping parent refcount after pd_free_fn() is done (Yu Kuai) [task:515911]
  - blkcg: blkcg_activate_policy() should initialize ancestors first (Tejun Heo) [task:515911]
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() (Minsuk Kang) [task:539351] {CVE-2022-50551}
  - tcp: Add sysctl to configure ephemeral port shuffle period for connect() (luoxuanqiang) [task:522905]
  - tcp: Add sysctl to control port randomization in __inet_hash_connect() (Xuanqiang Luo) [task:522905]
  - net: hns: fix possible memory leak in hnae_ae_register() (Yang Yingliang) [task:164562]
  - nilfs2: fix sysfs interface lifetime (Ryusuke Konishi) [task:166857]
  - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing) [task:371789]
  - net: hsr: Fix potential use-after-free (YueHaibing) [task:164562]
  - icmp: change the order of rate limits (Eric Dumazet) [task:545633] {CVE-2024-47678}
  - Revert "icmp: Add counters for rate limits" (luoxuanqiang) [task:545633]
  - Revert "icmp: change the order of rate limits" (luoxuanqiang) [task:545633]
  - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (Werner Sembach) [task:442591] {CVE-2025-21831}
  - x86/PCI: Avoid PME from D3hot/D3cold for AMD Rembrandt and Phoenix USB4 (Mario Limonciello) [task:442591]
  - x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot (Basavaraj Natikar) [task:166883]
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Jann Horn) [task:164574, task:545077]
  - txgbe: update release note to 1.3.6.5 (linglingzhang) [task:523317]
  - txgbe: fix: delay free buffer cause ptp timeout (duanqiangwen) [task:523317]
  - txgbe: FIX: fix compile error (linyuexie) [task:523317]
  - txgbe: fix: alloc rx skb failed may cause page refcount abnormal (duanqiangwen) [task:523317]
  - txgbe: FIX: fix may calltrace when XDP_TX (linyuexie) [task:523317]
  - txgbe: fix: solve problems about smmu event 0x10 and packet data being tampered with on kunpeng920 (linglingzhang) [task:523317]
  - txgbe: set version 1.3.6.4 (juxiahe) [task:523317]
  - txgbe: FIX: fix calltrace out of range after repeatly unbind and bind (Linyue Xie) [task:523317]
  - txgbe: feat: VF receive all VLAN tags in all-multicast mode (Jiawen Wu) [task:523317]
  - bpf: Fix request_sock leak in sk lookup helpers (Jon Maxwell) [task:99622]
  - net: bpf: Don't leak time wait and request sockets (Lorenz Bauer) [task:99622]
  - bpf: Check sk_fullsock() before returning from bpf_sk_lookup() (Martin KaFai Lau) [task:99622]
  - KVM: Fix compile error of macro not defined (张浩) [task:516941, task:544759]
  - ftrace: Fix null pointer dereference in ftrace_add_mod() (Xiu Jianfeng) [task:164562]
  - NFSD: prevent underflow in nfssvc_decode_writeargs() (Dan Carpenter) [task:162162]
  - ext4: don't BUG if someone dirty pages without asking ext4 first (Theodore Ts'o) [task:162162]
  - ipv6: fix WARNING in ip6_route_net_exit_late() (Zhengchao Shao) [task:164562]
  - NFSv4/pnfs: Fix a use-after-free bug in open (Trond Myklebust) [task:162162]
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Trond Myklebust) [task:162162]
  - ext4: fix bug_on in ext4_writepages (Ye Bin) [task:162162]
  - ext4: fix task hung in ext4_xattr_delete_inode (Baokun Li) [task:166857]
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang) [task:166857]
  - virtio_net: fix xdp_rxq_info bug after suspend/resume (Stephan Gerhold) [task:162162]
  - ext4: fix WARNING in ext4_update_inline_data (Ye Bin) [task:166857]
  - scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (James Smart) [task:167824]
  - mm/swapfile: add cond_resched() in get_swap_pages() (Longlong Xia) [task:164562]
  - dm integrity: fix memory corruption when tag_size is less than digest size (Mikulas Patocka) [task:162162]
  - tty: vt: initialize unicode screen buffer (Tetsuo Handa) [task:162162]
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() (Yicong Yang) [task:162162]
  - net: mdio: validate parameter addr in mdiobus_get_phy() (Heiner Kallweit) [task:164562]
  - nbd: fix io hung while disconnecting device (Yu Kuai) [task:162162]
  - usb: host: ohci-ppc-of: Fix refcount leak bug (Liang He) [task:162162]
  - tracing: Make sure trace_printk() can output as soon as it can be used (Steven Rostedt (Google)) [task:164562]
  - netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. (Gavrilov Ilia) [task:164562]
  - HID: hyperv: fix possible memory leak in mousevsc_probe() (Yang Yingliang) [task:164562]
  - geneve: make sure to pull inner header in geneve_rx() (Eric Dumazet) [task:214140] {CVE-2024-26857}
  - net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() (Eric Dumazet) [task:214149] {CVE-2024-26882}
  - bpf, sockmap: Fix double uncharge the mem of sk_msg (Wang Yufen) [task:168910]
  - ext4: fix use-after-free in ext4_rename_dir_prepare (Ye Bin) [task:162162, task:499367] {CVE-2022-49349}
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin) [task:164562]
  - md: Replace snprintf with scnprintf (Saurabh Sengar) [task:164562]
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li) [task:164562]
  - md: fix resync softlockup when bitmap size is less than array size (Yu Kuai) [task:371789]
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (Li Nan) [task:371789]
  - md/bitmap: md_bitmap_get_counter returns wrong blocks (Zhao Heming) [task:158034]
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails (Chen Zhongjin) [task:164562]
  - md: fix a crash in mempool_free (Mikulas Patocka) [task:164562]
  - watchdog: Fix kmemleak in watchdog_cdev_register (Chen Jun) [task:153627]
  - mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages (Rik van Riel) [task:164562]
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang) [task:371789]
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang) [task:371789]
  - md/raid10: prevent soft lockup while flush writes (Yu Kuai) [task:371789]
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL (David Disseldorp) [task:166857]
  - skbuff: Account for tail adjustment during pull operations (Subash Abhinov Kasiviswanathan) [task:153627]
  - vhost/vsock: Use kvmalloc/kvfree for larger packets. (Junichi Uekawa) [task:164562]
  - crypto: cavium - prevent integer overflow loading firmware (Dan Carpenter) [task:164562]
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin) [task:164562]
  - cifs: fix double free race when mount fails in cifs_get_root() (Ronnie Sahlberg) [task:162162]
  - memcg: fix possible use-after-free in memcg_write_event_control() (Tejun Heo) [task:164562]
  - bpf: track changes_pkt_data property for global functions (Eduard Zingerman) [task:461065] {CVE-2024-58098}
  - bpf: add find_containing_subprog() utility function (Eduard Zingerman) [task:461065]
  - bpf: Factor out visit_func_call_insn() in check_cfg() (Yonghong Song) [task:161887]
  - bpf: Refactor check_cfg to use a structured loop. (Wedson Almeida Filho) [task:161887]
  - fix kabi issue for "df4b25fe64e4 io_uring/af_unix: disable sending io_uring over sockets" (Haofeng Li) [task:370797, task:544105]
  - Revert "dm cache: Fix UAF in destroy()" (tanzheng) [task:539013]
  - dm cache: Fix UAF in destroy() (Luo Meng) [task:164562, task:539013] {CVE-2022-50496}
  - bpf: Reject narrower access to pointer ctx fields (Feng Yang) [task:520583] {CVE-2025-38591}
  - tpm: Actually fail on TPM errors during "get random" (Kees Cook) [task:530851]
  - tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure (Tomas Winkler) [task:530851]
  - tpm: factor out tpm1_get_random into tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: move tpm_getcap to tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: move tpm1_pcr_extend to tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: factor out tpm_get_timeouts() (Tomas Winkler) [task:530851]
  - tpm: add tpm_calc_ordinal_duration() wrapper (Tomas Winkler) [task:530851]
  - tpm: factor out tpm 1.x duration calculation to tpm1-cmd.c (Tomas Winkler) [task:530851]
  - tpm: sort objects in the Makefile (Tomas Winkler) [task:530851]
  - tpm2: add new tpm2 commands according to TCG 1.36 (Tomas Winkler) [task:530851]
  - ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet) [task:440728] {CVE-2025-21759}
  - Revert "ipv6: mcast: extend RCU protection in igmp6_send()" (taowei) [task:440728]
  - config/x86: enable CONFIG_DRM_PHYTIUM (lihaojie) [task:522397]
  - arm64: paravirt: Use RCU read locks to guard stolen_time (Prakruthi Deepak Heragu) [task:516941]
  - arm64: paravirt: Initialize steal time when cpu is online (Andrew Jones) [task:516941]
  - arm64: Retrieve stolen time as paravirtualized guest (Steven Price) [task:516941]
  - KVM: arm64: Provide VCPU attributes for stolen time (Steven Price) [task:516941]
  - KVM: Allow kvm_device_ops to be const (Steven Price) [task:516941]
  - KVM: arm64: Support stolen time reporting via shared structure (Steven Price) [task:516941]
  - KVM: arm64: Document PV-time interface (Steven Price) [task:516941]
  - KVM: arm64: Implement PV_TIME_FEATURES call (Steven Price) [task:516941]
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue (Chao Qin) [task:164574]
  - ntfs: add sanity check on allocation size (Dongliang Mu) [task:162162, task:525023]
  - net: mdio: unexport __init-annotated mdio_bus_init() (Masahiro Yamada) [task:162162, task:525023]
  - usb: xhci: Check endpoint is valid before dereferencing it (Jimmy Hu) [task:164562, task:525023]
  - xhci: add xhci_get_virt_ep() helper (Mathias Nyman) [task:158827, task:525023]
  - xhci: Fix null pointer dereference when host dies (Mathias Nyman) [task:164562]
  - xhci: avoid race between disable slot command and host runtime suspend (Mathias Nyman) [task:160493, task:525023]
  - Revert "reset: uniphier-usb3: Rename to reset-uniphier-glue" (Qingshuang Fu) [task:511383, task:534405]
  - Revert "reset: uniphier-glue: Use reset_control_bulk API" (Qingshuang Fu) [task:511383, task:534405]
  - Revert "reset: uniphier-glue: Fix possible null-ptr-deref" (Qingshuang Fu) [task:511383, task:534405]
  - iopoll: Introduce read_poll_timeout_atomic macro (Kai-Heng Feng) [task:537643, task:534405]
  - net: macb: call pm_runtime_put_sync on failure path (Claudiu Beznea) [task:532055, task:534405]
  - net: macb: Fix runtime PM refcounting (Andy Shevchenko) [task:532055, task:534405]
  - net: macb: Disable clocks once (Neil Mandir) [task:532055, task:534405]
  - net: macb: add function to disable all macb clocks (Claudiu Beznea) [task:532055, task:534405]
  - net: macb: fix wakeup test in runtime suspend/resume routines (Nicolas Ferre) [task:532055, task:534405]
  - net: macb: ensure interface is not suspended on at91rm9200 (Alexandre Belloni) [task:532055, task:534405]
  - net: macb: Add support for suspend/resume with full power down (Harini Katakam) [task:532055, task:534405]
  - net: macb: Add pm runtime support (Harini Katakam) [task:532055, task:534405]
  - net: macb: Support clock management for tsu_clk (Harini Katakam) [task:532055, task:534405]
  - net: macb: Check MDIO state before read/write and use timeouts (Harini Katakam) [task:537643, task:534405]
  - change_mnt_propagation(): calculate propagation source only if we'll need it (Al Viro) [task:527715]
  - change_mnt_propagation(): move ->mnt_master assignment into MS_SLAVE case (Al Viro) [task:527715]
  - turn do_make_slave() into transfer_propagation() (Al Viro) [task:527715]
  - do_make_slave(): choose new master sanely (Al Viro) [task:527715]
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() (Al Viro) [task:527715]
  - change_mnt_propagation() cleanups, step 1 (Al Viro) [task:527715]
  - blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (Li Jinlin) [task:530285]
  - Revert "blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd" (cuitao) [task:530285]
  - blkcg: Fix multiple bugs in blkcg_activate_policy() (Tejun Heo) [task:530285]
  - blkcg: pass @q and @blkcg into blkcg_pol_alloc_pd_fn() (Tejun Heo) [task:530285]
  - bpf: Fix memory leaks in __check_func_call (Wang Yufen) [task:161887]
  - bpf: Refactor check_func_call() to allow callback function (Yonghong Song) [task:161887]
  - icmp: change the order of rate limits (Eric Dumazet) [task:376375] {CVE-2024-47678}
  - icmp: Add counters for rate limits (Jamie Bainbridge) [task:376375]
  - ftrace: Fix use-after-free for dynamic ftrace_ops (Li Huafei) [task:461085] {CVE-2022-49892}
  - crypto: null - Use spin lock instead of mutex (Herbert Xu) [task:461960] {CVE-2025-37808}
  - crypto: null - Remove VLA usage of skcipher (Kees Cook) [task:461960]
  - crypto: skcipher - Set tfm in SYNC_SKCIPHER_REQUEST_ON_STACK (Herbert Xu) [task:461960]
  - crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Herbert Xu) [task:158034]
  - crypto: skcipher - Introduce crypto_sync_skcipher (Kees Cook) [task:461960]
  - net: tunnels: annotate lockless accesses to dev->needed_headroom (Eric Dumazet) [task:166857, task:525023]
  - usb: gadget: f_fs: Remove WARN_ON in functionfs_bind (Akash M) [task:426433] {CVE-2024-57913}
  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [task:532349] {CVE-2025-39823}
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [task:532349]
  - KVM: X86: Yield to IPI target if necessary (Wanpeng Li) [task:532349]
  - KVM: X86: Implement PV sched yield hypercall (Wanpeng Li) [task:532349]
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [task:532365] {CVE-2025-39828}
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [task:532365]
  - Revert "Revert "block, bfq: honor already-setup queue merges"" (Paolo Valente) [task:162162, task:440717] {CVE-2021-47646}
  - Revert "block, bfq: honor already-setup queue merges" (Jens Axboe) [task:162162, task:440717]
  - scsi: lpfc: Fix link down processing to address NULL pointer dereference (James Smart) [task:167824, task:499367]
  - scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (James Smart) [task:167824, task:525023]
  - scsi: lpfc: Convert abort handling to SLI-3 and SLI-4 handlers (James Smart) [task:167824, task:525023]
  - scsi: lpfc: Rework remote port ref counting and node freeing (James Smart) [task:167824, task:525023]
  - scsi: lpfc: rport port swap discovery issue. (James Smart) [task:167824, task:525023]
  - Revert "scsi: lpfc: Fix link down processing to address NULL pointer dereference" (Wang Yan) [task:499367]
  - tcp: Fix data-races around sysctl_tcp_min_snd_mss. (Kuniyuki Iwashima) [task:153981, task:525023]
  - ext4: don't block for O_DIRECT if IOCB_NOWAIT is set (Jens Axboe) [task:539423]
  - bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds (Daniel Borkmann) [task:161887, task:525023]
  - bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds. (Alexei Starovoitov) [task:161887, task:525023]
  - bpf: Verifier, refine 32bit bound in do_refine_retval_range (John Fastabend) [task:161887, task:525023]
  - seg6: Fix validation of nexthop addresses (Ido Schimmel) [task:497745] {CVE-2025-38310}
  - ipv6: fix possible infinite loop in fib6_info_uses_dev() (Eric Dumazet) [task:520571] {CVE-2025-38587}
  - bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (Wang Yufen) [task:168910]
  - ext4: fix WARNING in mb_find_extent (Ye Bin) [task:166857]
  - ext4: Fix function prototype mismatch for ext4_feat_ktype (Kees Cook) [task:164562]
  - ext4: add bounds checking in get_max_inline_xattr_value_size() (Theodore Ts'o) [task:166857]
  - scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (James Smart) [task:167824, task:441322] {CVE-2022-49535}
  - drm/amdgpu: install stub fence into potential unused fence pointers (Lang Yu) [task:531789, task:534643] {CVE-2023-53248}
  - dma-buf: add dma_fence_get_stub (Christian König) [task:531789, task:534643]
  - udf: Fix uninitialized array access for some pathnames (Jan Kara) [task:373027]
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong) [task:532227, task:534643] {CVE-2022-50327}
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (Felix Fietkau) [task:166857]
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl() (Shigeru Yoshida) [task:164562]
  - block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (Bart Van Assche) [task:440716] {CVE-2022-49720}
  - mm: fix unexpected zeroed page mapping with zram swap (Minchan Kim) [task:169355]
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Dmitry Torokhov) [bug:407309]
  - media: venus: hfi_parser: add check to avoid out of bound access (Vikash Garodia) [task:460230] {CVE-2025-23157}
  - media: venus: hfi_parser: Add check to keep the number of codecs within range (Vikash Garodia) [task:460230]
  - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Tasos Sahanidis) [task:330552]
  - USB: core: Make do_proc_control() and do_proc_bulk() killable (Alan Stern) [task:330552] {CVE-2021-47582}
  - USB: usbfs: Don't WARN about excessively large memory allocations (Alan Stern) [task:158827]
  - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (Zeng Heng) [task:328464] {CVE-2024-36959}
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (Zeng Heng) [task:164562]
  - ALSA: jack: Access input_dev under mutex (Amadeusz Sławiński) [task:162162]
  - gpio: prevent potential speculation leaks in gpio_device_get_desc() (Hagar Hemdan) [task:352677] {CVE-2024-44931}
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (Jakub Sitnicki) [task:222089] {CVE-2023-52735}
  - ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. (Kuniyuki Iwashima) [task:440400] {CVE-2022-49580}
  - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() (Ashish Kalra) [task:460284] {CVE-2022-49885}
  - ACPI / APEI: Make estatus pool allocation a static size (James Morse) [task:460284]
  - ACPI / APEI: Make hest.c manage the estatus memory pool (James Morse) [task:460284]
  - ACPI / APEI: Remove silent flag from ghes_read_estatus() (James Morse) [task:460284]
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Dong Chenchen) [task:494275] {CVE-2025-38129}
  - page_pool: fix inconsistency for page_pool_ring_[un]lock() (Yunsheng Lin) [task:494275]
  - net: page_pool: use in_softirq() instead (Qingfang DENG) [task:494275]
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Pavel Tikhomirov) [task:221965] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Pavel Tikhomirov) [task:221965]
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Pavel Tikhomirov) [task:221965]
  - neighbour: annotate lockless accesses to n->nud_state (Eric Dumazet) [task:221965]
  - nvmet: always initialize cqe.result (Daniel Wagner) [task:344611] {CVE-2024-41079}
  - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [task:476359] {CVE-2025-38004}
  - can: bcm: check the result of can_send() in bcm_can_tx() (Ziyang Xuan) [task:164562]
  - io_uring/af_unix: disable sending io_uring over sockets (Pavel Begunkov) [task:370797] {CVE-2023-6531}
  - NFS: Fix an Oops in nfs_d_automount() (Trond Myklebust) [task:533901] {CVE-2022-50385}
  - security: smack and tomoyo not support stacking (penghuaihe) [task:535691]
  - security: support extend modules request label slot (penghuaihe) [task:535691]
  - security: do hook support checking while register (penghuaihe) [task:535691]
  - security: fix memleak in sem_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in shm_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in msg_queue_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in msg_msg_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in file_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in inode_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in sb_alloc_security (penghuaihe) [task:535691]
  - security: fix memleak in cred_alloc_blank (penghuaihe) [task:535691]
  - security: fix memleak in sk_alloc_security hook (penghuaihe) [task:535691]
  - security: fix memleak in key_alloc hook (penghuaihe) [task:535691]
  - security: support task_alloc stacking (penghuaihe) [task:535691]
  - security: support audit rules stacking (penghuaihe) [task:535691]
  - locking/qspinlock: use xchg with _mb in slowpath for arm64 (pengyu) [task:524633, task:526703, task:535495]
  - ext4: fix warning when submitting superblock in ext4_commit_super() (Zhang Yi) [task:539973]
  - Revert "ext4: Use rbtrees to manage PAs instead of inode i_prealloc_list" (pengyu) [task:449973]
  - Revert "ext4: mballoc: Remove useless setting of ac_criteria" (pengyu) [task:449973]
  - Revert "ext4: fix rbtree traversal bug in ext4_mb_use_preallocated" (pengyu) [task:449973]
  - scsi: libsas: Abort all in-flight requests when device is gone (Jason Yan) [bug:408215]
  - ceph: take snap_empty_lock atomically with snaprealm refcount change (Jeff Layton) [task:530217]
  - net: Fix TOCTOU issue in sk_is_readable() (Michal Luczaj) [task:491659] {CVE-2025-38112}
  - net/mlx5e: Fix cleanup null-ptr deref on encap lock (Paul Blakey) [task:461217] {CVE-2023-53105}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [task:532203] {CVE-2025-39812}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [task:534347] {CVE-2025-39866}
  - writeback: Fix inode->i_io_list not be protected by inode->i_lock error (Jchao Sun) [task:534347]
  - wifi: mac80211_hwsim: drop short frames (Johannes Berg) [task:532575] {CVE-2023-53321}
  - netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (Pavel Tikhomirov) [task:531791] {CVE-2023-53200}
  - selinux: fix cred stacking bug (penghuaihe) [task:490643]
  - security: support bpf hooks stacking (penghuaihe) [task:490643]
  - drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() (Hangyu Hua) [task:440742] {CVE-2022-49644}
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags (Mohamed Khalfella) [task:532803] {CVE-2023-53354}
  - modpost: fix off by one in is_executable_section() (Dan Carpenter) [task:534137] {CVE-2023-53397}
  - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() (Yang Yingliang) [task:532165] {CVE-2022-50246}
  - RDMA/bnxt_re: wraparound mbox producer index (Kashyap Desai) [task:531719] {CVE-2023-53201}
  - drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug (K Prateek Nayak) [task:532209]
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (Yong-Xuan Wang) [task:532209] {CVE-2023-53254}
  - cacheinfo: Align checks in cache_shared_cpu_map_{setup,remove} for readability (Sudeep Holla) [task:532209]
  - cacheinfo: Add helper to access any cache index for a given CPU (Sudeep Holla) [task:532209]
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [task:519689] {CVE-2025-38530}
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [task:519361] {CVE-2025-38529}
  - tee: fix NULL pointer dereference in tee_shm_put (Pei Xiao) [task:534351] {CVE-2025-39865}
  - af_unix: Fix data-races around user->unix_inflight. (Kuniyuki Iwashima) [task:532219] {CVE-2023-53204}
  - net: sched: sfb: fix null pointer access issue when sfb_init() fails (Zhengchao Shao) [task:532833] {CVE-2022-50356}
  - KVM: SVM: Fix vgif feature not enabled (张浩) [task:532315]
  - driver: base: fix UAF when driver_attach failed (Schspa Shi) [task:440534] {CVE-2022-49385}
  - drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table (Ivan Stepchenko) [task:442357] {CVE-2024-58052}
  - drm/amdgpu: fix usage slab after free (Vitaly Prosyak) [task:429491] {CVE-2024-56551}
  - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again (shaoyunl) [task:225612] {CVE-2021-47551}
  - drm/amdkfd: don't use dqm lock during device reset/suspend/resume (Philip Yang) [task:225612]
  - drm/i915/selftests: fix subtraction overflow bug (Andrzej Hajda) [task:440726] {CVE-2022-49635}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [task:530189] {CVE-2025-39751}
  - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (Soenke Huster) [task:440402] {CVE-2022-49139}
  - ALSA: seq: oss: Send fragmented SysEx messages immediately (Takashi Iwai) [task:429534] {CVE-2024-57893}
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (Zhang Shurong) [task:532109] {CVE-2023-53220}
  - ipv6: sr: Fix MAC comparison to be constant-time (Eric Biggers) [task:527963] {CVE-2025-39702}
  - net/sched: Fix backlog accounting in qdisc_dequeue_internal (William Liu) [task:527995] {CVE-2025-39677}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [task:530193]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [task:530193] {CVE-2025-39757}
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [task:520111] {CVE-2025-38539}
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [task:527509]
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [task:527383] {CVE-2025-38729}
  - wifi: mac80211: reject TDLS operations when station is not associated (Moon Hee Lee) [task:523365] {CVE-2025-38644}
  - srcu: Tighten cleanup_srcu_struct() GP checks (Paul E. McKenney) [task:440484] {CVE-2022-49651}
  - tcp: also NULL skb->dev when copy was needed (Florian Westphal) [task:526817]
  - tcp: ensure skb->dev is NULL before leaving TCP stack (Eric Dumazet) [task:526817]
  - net: 9p: fix refcount leak in p9_read_work() error handling (Hangyu Hua) [task:482233] {CVE-2022-50114}
  - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [task:476201] {CVE-2025-37992}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [task:471767] {CVE-2025-37998}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [task:523421] {CVE-2025-38617}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [task:519707] {CVE-2025-38546}
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu) [task:520783] {CVE-2025-38578}
  - iavf: Fix reset error handling (Przemyslaw Patynowski) [task:482117] {CVE-2022-50053}
  - ipv4: use RCU protection in __ip_rt_update_pmtu() (Eric Dumazet) [task:515369] {CVE-2025-21766}
  - io_uring: prevent opcode speculation (Pavel Begunkov) [task:444117] {CVE-2025-21863}
  - Remove sensitive words (Haofeng Li) [task:524133]
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [task:503861] {CVE-2025-38352}
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [task:507017] {CVE-2025-38497}
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [task:523419] {CVE-2025-38618}
  - REDHAT: spec: Fix internal "File listed twice" errors (Prarit Bhargava) [task:506475]
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Jann Horn) [task:486335] {CVE-2025-38085}
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [task:520771] {CVE-2025-38553}
  - ALSA: hda: Manage concurrent reg access more properly (Takashi Iwai) [task:221568]
  - ALSA: seq: Fix race of snd_seq_timer_open() (Takashi Iwai) [task:491893] {CVE-2021-47281}
  - pktgen: use cpus_read_lock() in pg_net_init() (Eric Dumazet) [task:363783] {CVE-2024-46681}
  - pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() (Di Zhu) [task:158034, task:363783]
  - udf: Avoid excessive partition lengths (Jan Kara) [task:363799] {CVE-2024-46777}
  - udf: Define EFSCORRUPTED error code (Jan Kara) [task:166857, task:363799]
  - ELF: fix kernel.randomize_va_space double read (Alexey Dobriyan) [task:368307] {CVE-2024-46826}
  - block, bfq: switch 'bfqg->ref' to use atomic refcount apis (Yu Kuai) [task:515911]
  - block, bfq: deschedule empty bfq_queues not referred by any process (Paolo Valente) [task:515911]
  - wifi: prevent A-MSDU attacks in mesh networks (Mathy Vanhoef) [task:519717] {CVE-2025-38512}
  - RDMA/srpt: Fix a use-after-free (Bart Van Assche) [task:482173] {CVE-2022-50129}


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.54.v2207
changelog:
  - Revert "blk-sysfs: Rework documention of __blk_release_queue" (liyouhong) [bug:480255]
  - Revert "block: add docs for gendisk / request_queue refcount helpers" (liyouhong) [bug:480255]
  - Revert "block: revert back to synchronous request_queue removal" (liyouhong) [bug:480255]
  - Revert "blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue" (liyouhong) [bug:480255]
  - Revert "blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()" (liyouhong) [bug:480255]
  - Revert "blk-mq: Add the check on disk->queue before calling blk_mq_cancel_work_sync()" (liyouhong) [bug:480255]
  - secondly update changelog for upcoming 4.19.90-52.54.v2207 (Zhengyuan Liu)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [task:527589] {CVE-2025-38727}
  - net: Fix kabi caused linux/sched/isolation.h (Xiangqian Zhang) [task:550259]
  - update changelog for upcoming 4.19.90-52.54.v2207 (Zhengyuan Liu)
  - dm: Fix inaccurate iostat statistics that occur when I/O requests are split (zhanggenjian) [task:560365]
  - scsi: hisi_sas: Create all dump files during debugfs initialization (Yihang Li) [task:185107, task:429527] {CVE-2024-56588}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs (Yihang Li) [task:185107, task:196398]
  - scsi: hisi_sas: Free irq vectors in order for v3 HW (Qi Liu) [task:185107, task:440479] {CVE-2022-49118}
  - scsi: hisi_sas: Directly snapshot registers when executing a reset (Jianqin Xie) [task:185107, task:429527]
  - scsi: hisi_sas: Delete some unused callbacks (Luo Jiaxing) [task:574489, task:429527]
  - scsi: hisi_sas: Move debugfs code to v3 hw driver (Luo Jiaxing) [task:574489, task:429527]
  - scsi: hisi_sas: Fix up probe error handling for v3 hw (Xiang Chen) [task:574489, task:429527]
  - Revert "scsi: hisi_sas: Switch v3 hw to MQ" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Fix up probe error handling for v3 hw" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Move debugfs code to v3 hw driver" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Delete some unused callbacks" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Directly snapshot registers when executing a reset" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Free irq vectors in order for v3 HW" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs" (Cao Guanghui) [task:574489]
  - Revert "scsi: hisi_sas: Create all dump files during debugfs initialization" (Cao Guanghui) [task:574489]
  - scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (James Smart) [task:167824]
  - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (Dan Carpenter) [task:160493]
  - ext4: fix another off-by-one fsmap error on 1k block filesystems (Darrick J. Wong) [task:166857]
  - kprobes: don't call disarm_kprobe() for disabled kprobes (Kuniyuki Iwashima) [task:162162]
  - nvme: fix a possible use-after-free in controller reset during load (Sagi Grimberg) [task:162162]
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (Maciej S. Szmigiero) [task:162162]
  - netfilter: nft_tproxy: restrict to prerouting hook (Florian Westphal) [task:164562]
  - arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level (Sudeep Holla) [task:162162]
  - ipvs: fix WARNING in __ip_vs_cleanup_batch() (Zhengchao Shao) [task:164562]
  - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (Yang Yingliang) [task:164562]
  - net: fix a memleak when uncloning an skb dst and its metadata (Antoine Tenart) [task:160493]
  - md/bitmap: don't set sb values if can't pass sanity check (Heming Zhao) [task:162162]
  - bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation (Luis Gerhorst) [task:164562]
  - net: tun: unlink NAPI from device on destruction (Jakub Kicinski) [task:122626]
  - ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (Eric Dumazet) [task:164562]
  - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). (Kuniyuki Iwashima) [task:162162]
  - ext4: zero i_disksize when initializing the bootloader inode (Zhihao Cheng) [task:166857]
  - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (Rafael J. Wysocki) [task:162162]
  - tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (Kuniyuki Iwashima) [task:162162]
  - ip: Fix a data-race around sysctl_fwmark_reflect. (Kuniyuki Iwashima) [task:162162]
  - ip: Fix data-races around sysctl_ip_fwd_use_pmtu. (Kuniyuki Iwashima) [task:162162]
  - nbd: call genl_unregister_family() first in nbd_cleanup() (Yu Kuai) [task:162162]
  - igmp: Fix data-races around sysctl_igmp_llm_reports. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_mtu_probing. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. (Kuniyuki Iwashima) [task:162162]
  - dm raid: fix address sanitizer warning in raid_resume (Mikulas Patocka) [task:162162]
  - net: macvlan: fix memory leaks of macvlan_common_newlink (Chuang Wang) [task:164562]
  - af_netlink: Fix shift out of bounds in group mask calculation (Petr Machata) [task:162162]
  - btrfs: fix inode list leak during backref walking at resolve_indirect_refs() (Filipe Manana) [task:164562]
  - net/9p: Fix a potential socket leak in p9_socket_open (Wang Hai) [task:164562]
  - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network (Alexander Potapenko) [task:164562]
  - net: phy: fix null-ptr-deref while probe() failed (Yang Yingliang) [task:164562]
  - mm/gup: fix gup_pud_range() for dax (John Starks) [task:153981]
  - btrfs: fix ulist leaks in error paths of qgroup self tests (Filipe Manana) [task:164562]
  - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (Miaoqian Lin) [task:162162]
  - net: phy: micrel: Allow probing without .driver_data (Fabio Estevam) [task:162162]
  - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (ChenXiaoSong) [task:164562]
  - tcp: tcp_rtx_synack() can be called from process context (Eric Dumazet) [task:162162]
  - tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header (Xin Long) [task:153627]
  - RDMA/hfi1: Fix potential integer multiplication overflow errors (Dennis Dalessandro) [task:162162]
  - NFSD: prevent integer overflow on 32 bit systems (Dan Carpenter) [task:162162]
  - net: gso: fix panic on frag_list with mixed head alloc types (Jiri Benc) [task:153627]
  - mm/mempolicy: fix mpol_new leak in shared_policy_replace (Miaohe Lin) [task:162162]
  - ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock (Junxiao Bi via Ocfs2-devel) [task:162162]
  - drivers/base/node.c: fix compaction sysfs file leak (Miaohe Lin) [task:162162]
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo) [task:164562]
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Alan Stern) [task:160493]
  - usb: fix various gadget panics on 10gbps cabling (Maciej Żenczykowski) [task:158827]
  - usb: typec: tipd: Remove WARN_ON in tps6598x_block_read (Sven Peter) [task:160493]
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (Ilya Dryomov) [task:166857]
  - sctp: check send stream number after wait_for_sndbuf (Xin Long) [task:166857]
  - crypto: seqiv - Handle EBUSY correctly (Herbert Xu) [task:166857]
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu) [task:164562]
  - igb: Do not bring the device up after non-fatal error (Mohamed Khalfella) [task:371789]
  - igb: Fix igb_down hung on surprise removal (Ying Hsu) [task:371789]
  - cifs: Fix warning and UAF when destroy the MR list (Zhang Xiaoxu) [task:166857]
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS (Kai-Heng Feng) [task:164562]
  - sctp: handle the error returned from sctp_auth_asoc_init_active_key (Xin Long) [task:164562]
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal) [task:162162]
  - usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() (Maciej Żenczykowski) [task:164562]
  - usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. (Lorenzo Colitti) [task:158034]
  - x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (Thomas Gleixner) [task:164562]
  - f2fs: let's avoid panic if extent_tree is not created (Jaegeuk Kim) [task:164562]
  - efi: fix NULL-deref in init error path (Johan Hovold) [task:164562]
  - usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe (Miaoqian Lin) [task:162162]
  - net: usb: fix possible use-after-free in smsc75xx_bind (Dongliang Mu) [task:158827]
  - net: usb: fix memory leak in smsc75xx_bind (Pavel Skripkin) [task:158827]
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (Sergey Shtylyov) [task:162162]
  - btrfs: fix qgroup reserve overflow the qgroup limit (Ethan Lien) [task:162162]
  - net: ipv6: unexport __init-annotated seg6_hmac_init() (Masahiro Yamada) [task:162162]
  - scsi: core: Fix unremoved procfs host directory regression (Guilherme G. Piccoli) [task:217556] {CVE-2024-26935}
  - scsi: core: Fix a procfs host directory removal regression (Bart Van Assche) [task:172278]
  - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (Bart Van Assche) [task:166857]
  - scsi: core: Fix a source code comment (Bart Van Assche) [task:217556]
  - net-sysfs: add check for netdevice being present to speed_show (suresh kumar) [task:162162]
  - net: stmmac: fix dma queue left shift overflow issue (Junxiao Chang) [task:162162]
  - usb: gadget: Fix use-after-free bug by not setting udc->dev.driver (Alan Stern) [task:162162]
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (Tuo Li) [task:366437] {CVE-2024-23196}
  - net: auto affinity to exclude isolated CPU cores (Xiangqian Zhang) [task:550259]
  - usb: host: ohci-tmio: check return value after calling platform_get_resource() (Yang Yingliang) [task:160493]
  - bpf: Move skb->len == 0 checks into __bpf_redirect (Stanislav Fomichev) [task:328841]
  - bpf: make sure skb->len != 0 when redirecting to a tunneling device (Stanislav Fomichev) [task:164562]
  - net/ieee802154: don't warn zero-sized raw_sendmsg() (Tetsuo Handa) [task:164562]
  - net/af_packet: check len when min_header_len equals to 0 (Zhengchao Shao) [task:328841]
  - bpf: Don't redirect packets with invalid pkt_len (Zhengchao Shao) [task:328841]
  - net: rose: convert 'use' field to refcount_t (Takamitsu Iwai) [task:532201] {CVE-2025-39826}
  - net: rose: split remove and free operations in rose_remove_neigh() (Takamitsu Iwai) [task:532201]
  - net/rose: fix races in rose_kill_by_device() (Eric Dumazet) [task:397891]
  - net: rose: fix netdev reference changes (Eric Dumazet) [task:162162]
  - net/rose: remove redundant assignment to variable failed (Colin Ian King) [task:532201]
  - tracing: Fix the missing smp_store_release issue (chenyuan) [task:535437]
  - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (Yuan Chen) [task:546811] {CVE-2025-40042}
  - tun: Fix memory leak for detached NAPI queue. (Kuniyuki Iwashima) [task:539057] {CVE-2023-53685}
  - net: tun: rebuild error handling in tun_get_user (Chuang Wang) [task:539057]
  - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() (Xuanqiang Luo) [task:524251]
  - inet: Avoid ehash lookup race in inet_ehash_insert() (Xuanqiang Luo) [task:524251]
  - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() (Xuanqiang Luo) [task:524251]
  - net: tcp: un-pin the tw_timer (Florian Westphal) [task:524251]
  - net: tcp/dccp: prepare for tw_timer un-pinning (Valentin Schneider) [task:524251]
  - kprobes: Fix the KABI issue (Feng Yang) [task:485647]
  - add a NULL check for ring/ring->desc in NIC rnp (Gang Yan) [task:562563]
  - scsi: hisi_sas: Create all dump files during debugfs initialization (Yihang Li) [task:429527] {CVE-2024-56588}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs (Yihang Li) [task:196398]
  - scsi: hisi_sas: Free irq vectors in order for v3 HW (Qi Liu) [task:440479] {CVE-2022-49118}
  - scsi: hisi_sas: Directly snapshot registers when executing a reset (Jianqin Xie) [task:185107]
  - scsi: hisi_sas: Delete some unused callbacks (Luo Jiaxing) [task:185107]
  - scsi: hisi_sas: Move debugfs code to v3 hw driver (Luo Jiaxing) [task:185107]
  - scsi: hisi_sas: Fix up probe error handling for v3 hw (Xiang Chen) [task:185107]
  - scsi: hisi_sas: Switch v3 hw to MQ (John Garry) [task:429527]
  - Revert "scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs" (Cao Guanghui) [task:429527]
  - Revert "scsi: hisi_sas: Free irq vectors in order for v3 HW" (Cao Guanghui) [task:429527]
  - scsi: qla2xxx: Fix crash during module load unload test (Arun Easi) [task:149541, task:441336]
  - ipv6: mcast: extend RCU protection in igmp6_send() (Eric Dumazet) [task:440728] {CVE-2025-21759}
  - Revert "ipv6: mcast: extend RCU protection in igmp6_send()" (taowei) [task:440728]
  - net: phy: Fix "link partner" information disappear issue (Yonglong Liu) [task:502961]
  - net: phy: fix race in genphy_update_link (Heiner Kallweit) [task:502961]
  - net: phy: fix setting autoneg_complete in genphy_update_link (Heiner Kallweit) [task:502961]
  - net: phy: don't double-read link status register if link is up (Heiner Kallweit) [task:502961]
  - net: phy: fix autoneg mismatch case in genphy_read_status (Heiner Kallweit) [task:502961]
  - net: phy: avoid unneeded MDIO reads in genphy_read_status (Heiner Kallweit) [task:502961]
  - xfs: dump log about filesystem when allocation failed (Chi Zhiling) [task:540343]
  - xfs: use XFS_ALLOCTYPE_START_BNO in xfs_bmap_extents_to_btree (Chi Zhiling) [task:540343]
  - CONFIG_GPIO_PHYTIUM_PCI=m (Wang Yan) [bug:417541]
  - Revert "gpio: add support for gpio on ft-2000+ based on ACPI" (zhouyuhang) [bug:417541]
  - PHYTIUM: gpio: phytium: Add Phytium GPIO driver (zhouyuhang) [bug:417541]
  - gpio/phytium: solve can't detect the gpio rising edge interrupt (songxiebing) [task:159076]
  - PHYTIUM: gpio: Support for Phytium GPIO controller behind PCI (Riwen Lu) [task:159076]
  - media: rc: fix races with imon_disconnect() (Larshin Sergey) [task:542879] {CVE-2025-39993}
  - media: imon: reorganize serialization (Tetsuo Handa) [task:542879]
  - PHYTIUM: drm/phytium: Avoid NULL PTR issue when setting gamma (YuDa) [task:562451]
  - PHYTIUM: drm: Phytium: Add DC driver module_device_table (Liu Tianyu) [task:562451]
  - PHYTIUM: drm/phytium: Bugfix lane count parameter can't be set problem (WangHao) [task:562451]
  - PHYTIUM: drm/phytium: read EDID in bmc mode (WangHao) [task:562451]
  - PHITIUM: drm/phytium: Enable dither function (YuDa) [task:562451]
  - PHYTIUM: drm/phytium: Fix gpio resource release logic (YuDa) [task:562451]
  - PHYTIUM: drm/phytium: Change the maximum resolution supported by pe220x (YuDa) [task:550747]
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() (Dan Carpenter) [task:488955]
  - net: loopback: Avoid sending IP packets without an Ethernet header (Ido Schimmel) [task:488955]
  - ipv4: give an IPv4 dev to blackhole_netdev (Xin Long) [task:488955]
  - loopback: fix lockdep splat (Mahesh Bandewar) [task:488955]
  - ipv6: blackhole_netdev needs snmp6 counters (Ido Schimmel) [task:488955]
  - ipv6: give an IPv6 dev to blackhole_netdev (Eric Dumazet) [task:488955]
  - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Mahesh Bandewar) [task:488955]
  - loopback: create blackhole net device similar to loopack. (Mahesh Bandewar) [task:488955]
  - Revert "LoongArch: Remove shm_align_mask and use SHMLBA instead" (Wang Yan) [task:541467]
  - Revert "mm/mmap: teach generic_get_unmapped_area{_topdown} to handle hugetlb mappings" (Wang Yan) [task:541467]
  - Revert "LoongArch: Set hugetlb mmap base address aligned with pmd size" (Wang Yan) [task:541467]
  - Revert "ipv6: Fix soft lockups in fib6_select_path under high next hop churn" (Wang Yan) [task:520985]
  - OPENEULER: notifiers: Add oops check in blocking_notifier_call_chain() (Yi Yang) [task:551737]
  - OPENEULER: PCI/sysfs: Prohibit unaligned access to I/O port on non-x86 (Yongqiang Liu) [task:551727]
  - Revert "kernel version changelog generation and normalization script" (Qingshuang Fu) [task:556805]
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (Takashi Iwai) [task:554289] {CVE-2025-40154}
  - kernel version changelog generation and normalization script (Qingshuang Fu) [task:543713]
  - xfs: punch out data fork delalloc blocks on COW writeback failure (Brian Foster) [task:536187]
  - x86/kernel: fix occasional hang-up during 'reboot -f' on HG4 platform (luoliang) [task:545109]
  - fs: quota: create dedicated workqueue for quota_release_work (Shashank A P) [task:547337]
  - qed: Don't collect too many protection override GRC elements (Jamie Bainbridge) [task:539015] {CVE-2025-39949}
  - wifi: mt7601u: fix an integer underflow (Jisoo Jang) [task:539337] {CVE-2023-53679}
  - mt7601u: do not use WARN_ON in the datapath (Lorenzo Bianconi) [task:539337]
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() (Chao Yu) [task:460243] {CVE-2025-37739}
  - f2fs: lost matching-pair of trace in f2fs_truncate_inode_blocks (Yubo Feng) [task:460243]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.55.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.55.v2207 (Zhengyuan Liu)
  - net: ipv4: fix one memleak in __inet_del_ifa() (Liu Jian) [task:576891] {CVE-2023-53995}
  - net: ipv4: fix rcu lockdep splat due to wrong annotation (Florian Westphal) [task:358305]
  - net: ipv4: remove erroneous advancement of list pointer (Florian Westphal) [task:358305]
  - net: ipv4: fix infinite loop on secondary addr promotion (Florian Westphal) [task:358305]
  - plip: avoid rcu debug splat (Florian Westphal) [task:358305]
  - net: ipv4: provide __rcu annotation for ifa_list (Florian Westphal) [task:358305]
  - drivers: use in_dev_for_each_ifa_rtnl/rcu (Florian Westphal) [task:358305]
  - net: use new in_dev_ifa iterators (Florian Westphal) [task:358305]
  - devinet: use in_dev_for_each_ifa_rcu in more places (Florian Westphal) [task:358305]
  - block: blkcg: avoid extending blkcg_gq to preserve kABI (chengkaitao) [task:575765]
  - block: avoid calling blkg_free() in atomic context (Ming Lei) [task:575765]
  - net: tcp: add tcp no delay ack function (Chenguang Zhao) [task:546453]
  - OPENEULER: net: Add Huawei Intelligent Network Card Driver (zhoubin) [task:544303]
  - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() (Minsuk Kang) [task:577645] {CVE-2022-50881}
  - ath9k: Fix typo in function name (Pavel Machek) [task:577645]
  - ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx (Qiujun Huang) [task:157172]
  - cifs: return errors during session setup during reconnects (Shyam Prasad N) [task:162162, task:562209]
  - cifs: fail i/o on soft mounts if sessionsetup errors out (Ronnie Sahlberg) [task:153627, task:562209]
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [task:532169] {CVE-2025-39824}
  - HID: multitouch: Add NULL check in mt_input_configured (Charles Han) [task:540621]
  - HID: multitouch: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu) [task:540621] {CVE-2023-53454}
  - i40e: Fix potential invalid access when MAC list is empty (Zhen Ni) [task:534327] {CVE-2025-39853}
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (Kuniyuki Iwashima) [task:534337] {CVE-2025-39860}
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (Lu Wei) [task:578201] {CVE-2022-50865}
  - tcp: minor optimization in tcp_add_backlog() (Eric Dumazet) [task:578201]
  - tcp: do not mess with cloned skbs in tcp_add_backlog() (Eric Dumazet) [task:578201]
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [task:520585] {CVE-2025-38565}
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [task:507041] {CVE-2025-38483}
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [task:527973] {CVE-2025-39691}
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu) [task:530221] {CVE-2025-39743}
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [task:528081] {CVE-2025-39689}
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [task:527673] {CVE-2025-38680}
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko) [task:527591] {CVE-2025-38714}
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu) [task:523433] {CVE-2025-38652}
  - pptp: fix pptp_xmit() error path (Eric Dumazet) [task:520779]
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [task:520779] {CVE-2025-38574}
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Tao Xue) [task:520579] {CVE-2025-38555}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (Xinyu Liu) [task:530219] {CVE-2025-39760}
  - USB: core: Change configuration warnings to notices (Alan Stern) [task:530219]
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Wupeng Ma) [task:491653] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy) [task:491653]
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (Kuniyuki Iwashima) [task:540449] {CVE-2025-39913}
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (Sravan Kumar Gundu) [task:527585] {CVE-2025-38685}
  - lwt: Fix return values of BPF xmit ops (Yan Zhai) [task:532829] {CVE-2023-53338}
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (Abhishek Mainkar) [task:533643] {CVE-2023-53395}
  - bonding: avoid send_ns_work UAF when toggling ns_probe_active (pengyu) [task:558047, task:582151]
  - bonding: add broadcast NS and NA packets to all slaves for 802.3ad mode (Yun Lu) [task:422173, task:582151]
  - bonding: add sending arp and NS packets on each bonding slave interface (Yun Lu) [task:107642, task:582151]
  - Bonding: split bond_handle_vlan from bond_arp_send (Hangbin Liu) [task:107642, task:582151]
  - ipv6: separate ndisc_ns_create() from ndisc_send_ns() (Hangbin Liu) [task:122630]
  - crypto: hisilicon/hpre - fix resource leak in remove process (Zhiqi Song) [task:540073]
  - OPENEULER: xfs: fix sb write verify for lazysbcount (Shida Zhang) [task:583267]
  - xfs: update superblock counters correctly for !lazysbcount (Dave Chinner) [task:583267]
  - xfs: reduce free inode accounting overhead (Dave Chinner) [task:583267]
  - xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() (Dave Chinner) [task:583267]
  - iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni) [task:583485]
  - REDHAT: kernel.spec: avoid keeping two copies of vmlinux (Ondrej Mosnacek) [task:556803]
  - REDHAT: spec: speed up "cp -r" when it overwrites existing files. (Denys Vlasenko) [task:556803]
  - REDHAT: kernel.spec: Force remove tmp file (Prarit Bhargava) [task:556803]
  - REDHAT: kernel.spec: remove some temporary files early (Ondrej Mosnacek) [task:556803]
  - REDHAT: kernel.spec: Remove unnecessary output from pathfix.py (Prarit Bhargava) [task:556803]
  - SUNRPC: prevent port reuse on transports which don't request it. (NeilBrown) [task:566683]
  - md/raid0, raid10: Don't set discard sectors for request queue (Xiao Ni) [task:569813] {CVE-2022-50583}
  - sit: replace 68 with micro IPV4_MIN_MTU (zhang kai) [task:576945]
  - sit: use dst_cache in ipip6_tunnel_xmit (Haishuang Yan) [task:576945]
  - scsi: qla2xxx: Fix buffer overrun (Quinn Tran) [task:577017] {CVE-2023-54054}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (Jonathan Curley) [task:576577] {CVE-2025-68349}
  - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (Long Li) [task:577049] {CVE-2025-68367}
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (Shay Drory) [task:576227] {CVE-2023-54015}
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (Edward Adam Davis) [task:573827] {CVE-2025-68305}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [task:567355] {CVE-2025-40277}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [task:570205] {CVE-2025-40322}
  - xprtrdma: Ensure MRs are DMA-unmapped when posting LOCAL_INV fails (Chuck Lever) [task:570023]
  - xprtrdma: Explicitly resetting MRs is no longer necessary (Chuck Lever) [task:570023]
  - fs: use do_splice_direct() for nfsd/ksmbd server-side-copy (Amir Goldstein) [task:540123]
  - mm/memory.c: skip spurious TLB flush for retried page fault (Yang Shi) [task:572449]
  - i40e: remove read access to debugfs files (Jacob Keller) [task:552823] {CVE-2025-39901}
  - sched: Fix race between yield_to() and try_to_wake_up() (Tianchen Ding) [task:564633]
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [task:570029] {CVE-2025-40304}
  - USB: usbtmc: Fix direction for 0-length ioctl control messages (Alan Stern) [task:569979] {CVE-2023-53761}
  - OPENEULER: proc: fix use-after-free in proc_get_inode() (Ye Bin) [task:451122] {CVE-2025-21999}
  - smb: client: fix use-after-free in cifs_oplock_break (Wang Zhaolong) [task:519691] {CVE-2025-38527}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [task:520773] {CVE-2025-38572}
  - scsi: qla2xxx: Wait for io return on terminate rport (Quinn Tran) [task:532105] {CVE-2023-53322}
  - jfs: Verify inode mode when loading from disk (Tetsuo Handa) [task:569317] {CVE-2025-40312}
  - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [task:569293] {CVE-2025-40309}
  - e1000e: fix heap overflow in e1000_set_eeprom (Vitaly Lifshits) [task:539845] {CVE-2025-39898}
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Kuniyuki Iwashima) [task:540117] {CVE-2025-39955}
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() (Duoming Zhou) [task:540515] {CVE-2022-50422}
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow (Wang Haoran) [task:542893] {CVE-2025-39998}
  - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [task:566401] {CVE-2025-40259}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [task:567267] {CVE-2025-40275}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (John Evans) [task:534335] {CVE-2025-39841}
  - pstore/ram: Check start of empty przs during init (Enlin Mu) [task:532113] {CVE-2023-53331}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [task:532215] {CVE-2025-39817}
  - sched/fair: Don't balance task to its current running CPU (Yicong Yang) [task:531901] {CVE-2023-53215}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [task:527961] {CVE-2025-39730}
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [task:527687] {CVE-2025-38718}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [task:505915] {CVE-2025-38445}
  - sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [task:566441] {CVE-2025-40240}
  - net: Remove acked SYN flag from packet in the transmit queue correctly (Dong Chenchen) [task:455283]
  - icmp: guard against too small mtu (Eric Dumazet) [task:455283]
  - net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc (Victor Nogueira) [task:573535]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [task:505935] {CVE-2025-38457}
  - net: sched: simplify the qdisc_leaf code (Tonghao Zhang) [task:505935]
  - team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov) [task:575753] {CVE-2025-68340}
  - net: team: Unsync device addresses on ndo_stop (Benjamin Poirier) [task:162162]


author: Zhengyuan Liu <liuzhengyuan@kylinos.cn> - 4.19.90-52.56.v2207
changelog:
  - update changelog for upcoming 4.19.90-52.56.v2207 (Zhengyuan Liu)
  - scsi: megaraid_sas: Fix resource leak in case of probe failure (Chandrakanth Patil) [task:156664]
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue (Anirudh Venkataramanan) [task:162874, task:161899]
  - net: hns3: do not allow call hns3_nic_net_open repeatedly (Jian Shen) [task:185104]
  - tty: fix deadlock caused by calling printk() under tty_port->lock (Qi Zheng) [task:162162]
  - seg6: fix the iif in the IPv6 socket control block (Andrea Mayer) [task:153627]
  - igc: Fix use-after-free error during reset (Vinicius Costa Gomes) [task:163480]
  - trace/fgraph: Fix error handling (Guenter Roeck) [task:532591]
  - trace/fgraph: Fix the warning caused by missing unregister notifier (Ye Weihua) [task:532591] {CVE-2025-39829}
  - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [task:573257] {CVE-2025-68241}
  - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (Pengcheng Yang) [task:168910]
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() (Petko Manolov) [task:592321] {CVE-2026-23021}
  - vhost-scsi: protect vq->log_used with vq->mutex (Dongli Zhang) [task:482145] {CVE-2025-38074}
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (Raphael Pinsonneault-Thibeault) [task:590073] {CVE-2025-71082}
  - af_unix: Fix data-race around unix_tot_inflight. (Kuniyuki Iwashima) [task:198156]
  - RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task" (Zhu Yanjun) [task:576721] {CVE-2023-54028}
  - net: stmmac: Correctly handle Rx checksum offload errors (Oleksij Rempel) [task:569745] {CVE-2025-40337}
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kashyap Desai) [task:576569] {CVE-2023-54048}
  - nbd: fix incomplete validation of ioctl arg (Zhong Jinghua) [task:183259]
  - nbd: validate the block size in nbd_set_size (Christoph Hellwig) [task:183259]
  - nbd: refactor size updates (Christoph Hellwig) [task:183259]
  - nbd: move the task_recv check into nbd_size_update (Christoph Hellwig) [task:183259]
  - nbd: remove the call to set_blocksize (Christoph Hellwig) [task:183259]
  - ipmi: fix use after free in _ipmi_destroy_user() (Dan Carpenter) [task:153627]
  - net/mlx5e: Check for NOT_READY flag state after locking (Vlad Buslov) [task:540111] {CVE-2023-53581}
  - scsi: target: Fix multiple LUN_RESET handling (Mike Christie) [task:540457] {CVE-2023-53586}
  - s390/ism: fix concurrency management in ism_cmd() (Halil Pasic) [task:528075] {CVE-2025-39726}
  - wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() (Zhang Changzhong) [task:577789] {CVE-2022-50832}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Shigeru Yoshida) [task:328474] {CVE-2024-36903}
  - dm flakey: don't corrupt the zero page (Mikulas Patocka) [task:153627]
  - ALSA: wavefront: Fix integer overflow in sample size validation (Junrui Luo) [task:576613] {CVE-2025-68344}
  - bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log (Andrii Nakryiko) [task:576899] {CVE-2023-54145}
  - comedi: c6xdigio: Fix invalid PNP driver unregistration (Ian Abbott) [task:576313] {CVE-2025-68332}
  - platform/x86: intel: punit_ipc: fix memory corruption (Dan Carpenter) [task:573037] {CVE-2025-68303}
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() (Shuchang Li) [task:167824]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Sean Christopherson) [task:546815] {CVE-2025-40026}
  - Drivers: hv: vmbus: Don't dereference ACPI root object handle (Maciej S. Szmigiero) [task:539901] {CVE-2023-53647}
  - scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() (Wenchao Hao) [task:540399]
  - scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() (Yang Yingliang) [task:540399] {CVE-2022-50532}
  - scsi: mpt3sas: Fix a memory leak (Tomas Henzl) [task:539867] {CVE-2023-53512}
  - drm/hisilicon/hibmc: fix the hibmc loaded failed bug (Baihan Li) [task:530225] {CVE-2025-39772}
  - mm: /proc/pid/smaps_rollup: fix no vma's null-deref (Seth Jenkins) [task:164562]
  - kprobes: Fix check for probe enabled in kill_kprobe() (Li Huafei) [task:531833] {CVE-2022-50266}
  - net/mlx5: Check device memory pointer before usage (Stav Aviram) [task:522997] {CVE-2025-38645}
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (Marc Kleine-Budde) [task:522907] {CVE-2025-38665}
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jeongjun Park) [task:491385]
  - ALSA: usb-audio: Kill timer properly at removal (Takashi Iwai) [task:491385] {CVE-2025-38105}
  - ALSA: usb-audio: Fix race against the error recovery URB submission (Takashi Iwai) [task:157172]
  - sch_htb: make htb_deactivate() idempotent (Cong Wang) [task:466415] {CVE-2025-37953}
  - bpf: Fix signed_{sub,add32}_overflows type handling (Daniel Borkmann) {CVE-2021-20268}
  - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() (Christophe Leroy) [task:346935] {CVE-2024-42068}
  - sctp: clear out_curr if all frag chunks of current msg are pruned (Xin Long) [task:460129] {CVE-2022-49838}
  - net: usb: rtl8150: enable basic endpoint checking (Nikita Zhandarovich) [task:440694] {CVE-2025-21708}
  - bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() (Christophe Leroy) [task:345285] {CVE-2024-42067}
  - net: hsr: avoid possible NULL deref in skb_clone() (Eric Dumazet) [task:218810]
  - media: tuner: xc5000: Fix use-after-free in xc5000_release (Duoming Zhou) [task:542895] {CVE-2025-39994}
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow (Justin Tee) [task:167824]
  - HID: core: Harden s32ton() against conversion to 0 bits (Alan Stern) [task:520575] {CVE-2025-38556}
  - tracing: Limit access to parser->buffer when trace_get_user failed (Pu Lehui) [task:527975] {CVE-2025-39683}
  - tracing: Remove unneeded goto out logic (Steven Rostedt) [task:527975]
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (Philip Yang) [task:376149] {CVE-2024-49991}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [task:520549] {CVE-2025-38563}
  - media: xc2028: avoid use-after-free in load_firmware_cb() (Chi Zhiling) [task:219526]
  - bpf: Fix scalar32_min_max_or bounds tracking (Daniel Borkmann) [task:161887]
  - x86/unwind/orc: Fall back to using frame pointers for generated code (Josh Poimboeuf) [task:605427]
  - ext4: guard against EA inode refcount underflow in xattr update (Ahmet Eray Karadag) [task:554287] {CVE-2025-40190}
  - ACPICA: Avoid walking the Namespace if start_node is NULL (Cryolitia PukNgae) [task:589059] {CVE-2025-71118}
  - ACPICA: Avoid walking the ACPI Namespace if it is not there (Rafael J. Wysocki) [task:589059]
  - ACPI: CPPC: Assume no transition latency if no PCCT (Pierre Gondois) [bug:474457, bug:498271]
  - HYGON: crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong) [task:556059]
  - ring-buffer: Fix deadloop issue on reading trace_pipe (Zheng Yejian) [task:539297, task:604597] {CVE-2023-53668}
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li) [task:540557, task:604597] {CVE-2023-53622}
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (Konstantin Shelekhin) [task:540563, task:604597] {CVE-2023-53676}
  - cnic: Fix use-after-free bugs in cnic_delete_task (Duoming Zhou) [task:539197, task:604597] {CVE-2025-39945}
  - jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount (Liu Shixin via Jfs-discussion) [task:539047, task:604597] {CVE-2023-53616}
  - iavf: Fix use-after-free in free_netdev (Ding Hui) [task:539329, task:604597] {CVE-2023-53556}
  - wifi: mwifiex: Initialize the chan_stats array to zero (Qianfeng Rong) [task:539911, task:604597] {CVE-2025-39891}
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang) [task:532589, task:604597] {CVE-2023-53305}
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [task:527683, task:604597] {CVE-2025-38708}
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte) [task:527301, task:604597] {CVE-2025-38697}
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko) [task:527343, task:604597] {CVE-2025-38713}
  - fbdev: fix potential buffer overflow in do_register_framebuffer() (Yongzhen Zhang) [task:527563, task:604597] {CVE-2025-38702}
  - regulator: core: Fix resolve supply lookup issue (ChiYuan Huang) [task:569843]
  - regulator: core: Use different devices for resource allocation and DT lookup (ChiYuan Huang) [task:569843] {CVE-2022-50616}
  - regulator: gpio: Convert to devm_regulator_register (Axel Lin) [task:569843]
  - regulator: dummy: Use devm_regulator_register() (Zenghui Yu) [task:569843]
  - regulator: Avoid a double 'of_node_get' in 'regulator_of_get_init_node()' (Christophe JAILLET) [task:569843]
  - regulator: of: Add of_node_put() before return in function (Nishka Dasgupta) [task:569843]
  - regulator: Factor out location of init data OF node (Charles Keepax) [task:569843]
  - ip: Fix data-races around sysctl_ip_prot_sock. (Kuniyuki Iwashima) [task:440771] {CVE-2022-49578}
  - net: port < inet_prot_sock(net) --> inet_port_requires_bind_service(net, port) (Maciej Żenczykowski) [task:440771]
  - mm/khugepaged: fix ->anon_vma race (Jann Horn) [task:448841] {CVE-2023-52935}
  - scsi/ps3: Fix compile error for high version gcc (Bing Huang) [task:588907]
  - net: add a judgment to decide whether to enable network auto affinity (xiaolinkui) [task:195287]
  - net: add a sysctl interface for network affinity setting (xiaolinkui) [task:195287]
  - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none (Ming Lei) [task:532123] {CVE-2023-53292}
  - blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (Ming Lei) [task:532123]
  - bpf: Fix alu32 const subreg bound tracking on bitwise operations (Daniel Borkmann) [task:161887]
  - bpf: Fix a verifier failure with xor (Yonghong Song) [task:161887]
  - mmc: via-sdmmc: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla) [task:573679] {CVE-2025-68204}
  - firmware: arm_scmi: Add SCMI PM driver remove routine (Cristian Marussi) [task:164562]
  - firmware: arm_scmi: pm: Propagate return value to caller (Peng Fan) [task:160493]
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (Dongxiang Ke) [task:162162]
  - mac80211: validate extended element ID is present (Johannes Berg) [task:160493]
  - rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (Eric Dumazet) [task:160493]
  - net: systemport: Add global locking for descriptor lifecycle (Florian Fainelli) [task:160493]
  - kvm: avoid speculation-based attacks from out-of-range memslot accesses (Paolo Bonzini) [task:158827]
  - samples/bpf: Fix buffer overflow in tcp_basertt (Pengcheng Yang) [task:371789]
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (Hector Martin) [task:166857]
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING (Deren Wu) [task:164562]
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara) [task:164562]
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir) [task:373027]
  - comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey) [task:548711] {CVE-2025-40106}
  - bpf: Address KCSAN report on bpf_lru_list (Martin KaFai Lau) [task:371789]
  - drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback (Nathan Chancellor) [task:578035] {CVE-2022-50844}
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() (Sven Schnelle) [task:166857]
  - scsi: ipr: Fix WARNING in ipr_init() (Shang XiaoJing) [task:164562]
  - xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() (Harshit Mogalapalli) [task:164562]
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo) [task:164562]
  - net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). (Kuniyuki Iwashima) [task:166857]
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (Miaoqian Lin) [task:164562]
  - USB: sisusbvga: Add endpoint checks (Alan Stern) [task:166857]
  - dm thin: Fix UAF in run_timer_softirq() (Luo Meng) [task:164562]
  - RDMA/rxe: Fix "kernel NULL pointer dereference" error (Zhu Yanjun) [task:164562]
  - ASoC: pxa: fix null-pointer dereference in filter() (Zeng Heng) [task:164562]
  - ACPI: EC: Fix oops when removing custom query handlers (Armin Wolf) [task:166857]
  - ipv6: ensure sane device mtu in tunnels (Eric Dumazet) [task:164562]
  - md/raid10: fix null-ptr-deref in raid10_sync_request (Li Nan) [task:166857]
  - net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (Tetsuo Handa) [task:164562]
  - netlink: annotate accesses to nlk->cb_running (Eric Dumazet) [task:166857]
  - dm flakey: fix a crash with invalid table line (Mikulas Patocka) [task:166857]
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir) [task:373027]
  - cifs: Fix lost destroy smbd connection when MR allocate failed (Zhang Xiaoxu) [task:166857]
  - smbd: Make upper layer decide when to destroy the transport (Long Li) [task:164562]
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (Rongwei Wang) [task:166857]
  - MIPS: fw: Allow firmware to pass a empty env (Jiaxun Yang) [task:166857]
  - af_unix: Fix data races around sk->sk_shutdown. (Kuniyuki Iwashima) [task:166857]
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [task:527993] {CVE-2025-39713}
  - mmc: core: Fix kernel panic when remove non-standard SDIO card (Matthew Ma) [task:164562]
  - media: av7110: prevent underflow in write_ts_to_decoder() (Dan Carpenter) [task:166857]
  - drm: Prevent drm_copy_field() to attempt copying a NULL pointer (Javier Martinez Canillas) [task:164562]
  - ext4: refuse to create ea block when umounted (Jun Nie) [task:166857]
  - mmc: toshsd: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - net: macb: fix a memory corruption in extended buffer descriptor mode (Roman Gushchin) [task:166857]
  - usb: typec: altmodes/displayport: fix pin_assignment_show (Badhri Jagan Sridharan) [task:166857]
  - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya) [task:371789]
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path (Ye Bin) [task:164562]
  - acct: fix potential integer overflow in encode_comp_t() (Zheng Yejian) [task:164562]
  - hwrng: amd - Fix PCI device refcount leak (Xiongfeng Wang) [task:164562]
  - binder: fix memory leak in binder_init() (Qi Zheng) [task:371789]
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() (Ziyang Xuan) [task:166857]
  - RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (Zhang Xiaoxu) [task:164562]
  - RDMA/rxe: Fix the error caused by qp->sk (Zhu Yanjun) [task:164562]
  - ext4: fix invalid free tracking in ext4_xattr_move_to_block() (Theodore Ts'o) [task:166857]
  - ext4: optimize ea_inode block expansion (Jun Nie) [task:166857]
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin) [task:164562]
  - hfs: Fix OOB Write in hfs_asc2mac (ZhangPeng) [task:164562]
  - apparmor: fix a memleak in multi_transaction_new() (Gaosheng Cui) [task:164562]
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects (void0red) [task:166857]
  - ext4: set goal start correctly in ext4_mb_normalize_request (Kemeng Shi) [task:166857]
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). (Kuniyuki Iwashima) [task:166857]
  - ALSA: line6: fix stack overflow in line6_midi_transmit (Artem Egorkine) [task:164562]
  - f2fs: fix to drop all dirty pages during umount() if cp_error is set (Chao Yu) [task:166857]
  - drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (Xiongfeng Wang) [task:164562]
  - orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (Zhang Xiaoxu) [task:164562]
  - ubifs: fix possible dereference after free (Konstantin Meskhidze) [task:371789]
  - ubifs: Fix memleak when insert_old_idx() failed (Zhihao Cheng) [task:166857]
  - Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" (Zhihao Cheng) [task:166857]
  - ubifs: dirty_cow_znode: Fix memleak in error handling path (Zhihao Cheng) [task:166857]
  - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (Tetsuo Handa) [task:164562]
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode (Baokun Li) [task:164562]
  - quota: Factor out setup of quota inode (Jan Kara) [task:164562]
  - ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (Gaosheng Cui) [task:164562]
  - ubi: Fix possible null-ptr-deref in ubi_free_volume() (Yang Yingliang) [task:166857]
  - mrp: introduce active flags to prevent UAF when applicant uninit (Schspa Shi) [task:164562]
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe) [task:371789]
  - vmci_host: fix a race condition in vmci_host_poll() causing GPF (Dae R. Jeong) [task:166857]
  - hwrng: virtio - Fix race on data_avail and actual data (Herbert Xu) [task:371789]
  - hwrng: virtio - always add a pending request (Laurent Vivier) [task:371789]
  - hwrng: virtio - don't waste entropy (Laurent Vivier) [task:371789]
  - hwrng: virtio - don't wait on cleanup (Laurent Vivier) [task:371789]
  - hwrng: virtio - add an internal buffer (Laurent Vivier) [task:371789]
  - md/raid1: stop mdx_raid1 thread when raid1 array run failed (Jiang Li) [task:164562]
  - usb: idmouse: fix an uninit-value in idmouse_open (Dongliang Mu) [task:164562]
  - md/raid10: fix memleak for 'conf->bio_split' (Yu Kuai) [task:166857]
  - udf: Avoid double brelse() in udf_rename() (Shigeru Yoshida) [task:164562]
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf) [task:373027]
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet) [task:373027]
  - net: fix UaF in netns ops registration error path (Paolo Abeni) [task:164562]
  - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (Zhengchao Shao) [task:164562]
  - ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() (Zhihao Cheng) [task:166857]
  - x86/xen: Fix memory leak in xen_init_lock_cpu() (Xiu Jianfeng) [task:164562]
  - x86/xen: don't unbind uninitialized lock_kicker_irq (Brian Masney) [task:158034]
  - drm/amd/display: Check NULL before accessing (Alex Hung) [task:573219] {CVE-2025-68286}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern) [task:371789]
  - power: supply: bq27xxx: Fix poll_interval handling and races on remove (Hans de Goede) [task:166857]
  - power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition (Hans de Goede) [task:166857]
  - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create (Liu Shixin) [task:166857]
  - clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe (Miaoqian Lin) [task:164562]
  - f2fs: fix information leak in f2fs_move_inline_dirents() (Eric Biggers) [task:166857]
  - ppp: associate skb with a device at tx (Stanislav Fomichev) [task:164562]
  - media: dvb-frontends: fix leak of memory fw (Yan Lei) [task:164562]
  - wifi: brcmfmac: fix invalid address access when enabling SCAN log level (Wright Feng) [task:164562]
  - ubi: Fix use-after-free when volume resizing failed (Li Zetao) [task:166857]
  - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() (Ryusuke Konishi) [task:166857]
  - wifi: ipw2200: fix memory leak in ipw_wdev_init() (Zhengchao Shao) [task:166857]
  - scsi: hpsa: Fix possible memory leak in hpsa_init_one() (Yuan Can) [task:164562]
  - scsi: hpsa: use local workqueues instead of system workqueues (Don Brace) [task:164562]
  - nilfs2: fix infinite loop in nilfs_mdt_get_block() (Ryusuke Konishi) [task:166857]
  - netlink: do not hard code device address lenth in fdb dumps (Eric Dumazet) [task:371789]
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init() (Mazin Al Haddad) [task:164562]
  - media: dvb-usb: fix memory leak in dvb_usb_adapter_init (Pavel Skripkin) [task:158827]
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (George Kennedy) [task:166857]
  - vc_screen: rewrite vcs_size to accept vc, not inode (Jiri Slaby) [task:166857]
  - class: fix possible memory leak in __class_register() (Yang Yingliang) [task:164562]
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe` (Ke Zhang) [task:166857]
  - xfrm: Update ipcomp_scratches with NULL when freed (Khalid Masum) [task:164562]
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() (Xiongfeng Wang) [task:164562]
  - mtd: Fix device name leak when register device failed in add_mtd_device() (Zhang Xiaoxu) [task:164562]
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() (Jianglei Nie) [task:164562]
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng) [task:164562]
  - netlink: Add __sock_i_ino() for __netlink_diag_dump(). (Kuniyuki Iwashima) [task:371789]
  - netlink: fix potential deadlock in netlink_set_err() (Eric Dumazet) [task:371789]
  - media: radio-shark: Add endpoint checks (Alan Stern) [task:166857]
  - drm/amd/display: Fix potential null-deref in dm_resume (Roman Li) [task:166857]
  - drm/amd/display: Fix allocate_mst_payload assert on resume (Roman Li) [task:162162]
  - tipc: fix a null-ptr-deref in tipc_topsrv_accept (Xin Long) [task:164562]
  - fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (Tetsuo Handa) [task:166857]
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling (Linus Torvalds) [task:164562]
  - hfs: fix OOB Read in __hfs_brec_find (ZhangPeng) [task:164562]
  - hfs/hfsplus: use WARN_ON for sanity check (Arnd Bergmann) [task:164562]
  - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure (Ryusuke Konishi) [task:164562]
  - tipc: fix an information leak in tipc_topsrv_kern_subscr (Alexander Potapenko) [task:164562]
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() (Yu Liao) [task:164562]
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern) [task:371789]
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar) [task:164562]
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() (Yang Yingliang) [task:164562]
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical) [task:373027]
  - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (Zheng Wang) [task:371789]
  - bcache: remove 'int n' from parameter list of bch_bucket_alloc_set() (Coly Li) [task:371789]
  - net: fix skb leak in __skb_tstamp_tx() (Pratyush Yadav) [task:166857]
  - drm/mipi-dsi: Detach devices when removing the host (Maxime Ripard) [task:164562]
  - thermal: intel_powerclamp: Use first online CPU as control_cpu (Rafael J. Wysocki) [task:164562]
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash (Srinivas Pandruvada) [task:164562]
  - ocfs2: fix defrag path triggering jbd2 ASSERT (Heming Zhao via Ocfs2-devel) [task:166857]
  - ALSA: usb-audio: Fix potential memory leaks (Takashi Iwai) [task:164562]
  - spi: qup: Don't skip cleanup in remove's error path (Uwe Kleine-König) [task:166857]
  - spi: qup: fix PM reference leak in spi_qup_remove() (Wang Li) [task:166857]
  - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds (Jisoo Jang) [task:166857]
  - drm/radeon: free iio for atombios when driver shutdown (Liwei Song) [task:166857]
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong) [task:373027]
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Bikash Hazarika) [task:371789]
  - blk-mq: fix possible memleak when register 'hctx' failed (Ye Bin) [task:164562]
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() (Yang Yingliang) [task:164562]
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() (Theodore Ts'o) [task:166857]
  - tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (Kuniyuki Iwashima) [task:166857]
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (Zhihao Cheng) [task:166857]
  - wifi: iwl3945: Add missing check for create_singlethread_workqueue (Jiasheng Jiang) [task:166857]
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley) [task:371789]
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [task:490967] {CVE-2025-38145}
  - Bluetooth: L2CAP: Fix potential user-after-free (Luiz Augusto von Dentz) [task:166857]
  - dax: make sure inodes are flushed before destroy cache (Tong Zhang) [task:440563] {CVE-2022-49220}
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (Minsuk Kang) [task:166857]
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register (Jiamei Xie) [task:164562]
  - Bluetooth: Fix race condition in hidp_session_thread (Min Li) [task:166857]
  - PCI: Fix pci_device_is_present() for VFs by checking PF (Michael S. Tsirkin) [task:164562]
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (Fedor Pchelkin) [task:371789]
  - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (Kuninori Morimoto) [task:166857]
  - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (Stephen Boyd) [task:164562]
  - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (Wen Gong) [task:164562]
  - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (Dan Carpenter) [task:166857]
  - usb: rndis_host: Secure rndis_query check against int overflow (Szymon Heidrich) [task:164562]
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags (Liu Shixin) [task:164562]
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (Hans de Goede) [task:166857]
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode (Baokun Li) [task:164562]
  - nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() (Ryusuke Konishi) [task:164562]
  - Bluetooth: Fix l2cap_disconnect_req deadlock (Ying Hsu) [task:166857]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Luiz Augusto von Dentz) [task:166857]
  - Bluetooth: prefetch channel before killing sock (Hillf Danton) [task:122624]
  - Bluetooth: Fix refcount use-after-free issue (Manish Mandlik) [task:122624]
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (Mike Snitzer) [task:166857]
  - ubifs: Free memory for tmpfile name (Mårten Lindahl) [task:166857]
  - fs: prevent out-of-bounds array speculation when closing a file descriptor (Theodore Ts'o) [task:166857]
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (Xiongfeng Wang) [task:164562]
  - vt_ioctl: fix array_index_nospec in vt_setactivate (Jakob Koschel) [task:160493]
  - igmp: Fix data-races around sysctl_igmp_qrv. (Kuniyuki Iwashima) [task:162162]
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka) [task:164562]
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 (Chen Zhongjin) [task:166857]
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (Jann Horn) [task:164562]
  - drm/amd/pm: fix double free in si_parse_power_table() (Keita Suzuki) [task:162162]
  - scsi: sg: Allow waiting for commands to complete on removed device (Tony Battersby) [task:162162]
  - ASoC: ops: Correct bounds check for second channel on SX controls (Charles Keepax) [task:164562]
  - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() (Mark Brown) [task:164562]
  - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (Yi Yang) [task:412137] {CVE-2024-56690}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin) [task:182757]
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (Gavrilov Ilia) [task:166857]
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (Florent Revest) [task:371789]
  - xhci: Remove device endpoints from bandwidth list when freeing the device (Mathias Nyman) [task:164562]
  - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() (Ryusuke Konishi) [task:166857]
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh) [task:373027]
  - kernfs: fix use-after-free in __kernfs_remove (Christian A. Ehrhardt) [task:164562]
  - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails (Chuck Lever) [task:164562]
  - SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() (Martijn de Gouw) [task:153627]
  - SUNRPC: Fix svcauth_gss_proxy_init() (Chuck Lever) [task:153627]
  - udf: Do not bother merging very long extents (Jan Kara) [task:166857]
  - ext4: fix use-after-free in ext4_orphan_cleanup (Baokun Li) [task:164562]
  - ext4: lost matching-pair of trace in ext4_truncate (zhengliang) [task:164562]
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() (Li Zetao) [task:166857]
  - rtlwifi: fix -Wpointer-sign warning (Arnd Bergmann) [task:166857]
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (Li Zetao) [task:164562]
  - tracing/histograms: Return an error if we fail to add histogram to hist_vars list (Mohamed Khalfella) [task:371789]
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables (Mohamed Khalfella) [task:371789]
  - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() (Ben Hutchings) [task:166857]
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries (Eli Cohen) [task:166857]
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() (Zhang Changzhong) [task:166857]
  - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() (Li Zhong) [task:164562]
  - serial: 8250: Reinit port->pm on port specific driver unbind (Tony Lindgren) [task:166857]
  - ocfs2: fix memory leak in ocfs2_stack_glue_init() (Shang XiaoJing) [task:164562]
  - media: netup_unidvb: fix use-after-free at del_timer() (Duoming Zhou) [task:166857]
  - wifi: libertas: fix memory leak in lbs_init_adapter() (Zhengchao Shao) [task:166857]
  - ALSA: hda: Fix Oops by 9.1 surround channel names (Takashi Iwai) [task:166857]
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Ivan Orlov) [task:166857]
  - nilfs2: do not write dirty data after degenerating to read-only (Ryusuke Konishi) [task:166857]
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - wifi: iwl4965: Add missing check for create_singlethread_workqueue() (Jiasheng Jiang) [task:166857]
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() (ruanjinjie) [task:164562]
  - rapidio: fix possible name leaks when rio_add_device() fails (Yang Yingliang) [task:164562]
  - recordmcount: Fix memory leaks in the uwrite function (Hao Zeng) [task:166857]
  - caif: fix memory leak in cfctrl_linkup_request() (Zhengchao Shao) [task:164562]
  - drivers: serial: jsm: fix some leaks in probe (Dan Carpenter) [task:164562]
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer (Tamir Duberstein) [task:166857]
  - rapidio: fix possible UAF when kfifo_alloc() fails (Wang Weiyang) [task:164562]
  - mmc: vub300: fix return value check of mmc_add_host() (Yang Yingliang) [task:164562]
  - chardev: fix error handling in cdev_device_add() (Yang Yingliang) [task:164562]
  - PNP: fix name memory leak in pnp_alloc_dev() (Yang Yingliang) [task:164562]
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak (Hanjun Guo) [task:164562]
  - pnode: terminate at peers of source (Christian Brauner) [task:164562]
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times (Luiz Augusto von Dentz) [task:164562]
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (Alexander Coffin) [task:164562]
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma) [task:164562]
  - ACPICA: Fix error code path in acpi_ds_call_control_method() (Rafael J. Wysocki) [task:164562]
  - Bluetooth: L2CAP: Fix user-after-free (Luiz Augusto von Dentz) [task:164562]
  - media: uvcvideo: Handle cameras with invalid descriptors (Ricardo Ribalda) [task:166857]
  - media: cx88: Fix a null-ptr-deref bug in buffer_prepare() (Zheyu Ma) [task:164562]
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing) [task:182920]
  - udf: Do not update file length for failed writes to inline files (Jan Kara) [task:166857]
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (Fedor Pchelkin) [task:166857]
  - wifi: ath9k: use proper statements in conditionals (Arnd Bergmann) [task:166857]
  - ath9k: htc: clean up statistics macros (Pavel Skripkin) [task:166857]
  - ath9k: hif_usb: simplify if-if to if-else (Wan Jiabing) [task:166857]
  - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream (Zekun Shen) [task:160493]
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (Min Li) [task:166857]
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size (Zhihao Cheng) [task:166857]
  - ubi: ensure that VID header offset + VID header size <= alloc, size (George Kennedy) [task:166857]
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (Jisoo Jang) [task:166857]
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Pin-yen Lin) [task:374297]
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Polaris Pi) [task:374297]
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (Fedor Pchelkin) [task:371789]
  - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg (Qiujun Huang) [task:157172]
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" (Hector Martin) [task:166857]
  - wifi: cfg80211: Fix use after free for wext (Alexander Wetzel) [task:166857]
  - wifi: libertas: Fix possible refcount leak in if_usb_probe() (Hangyu Hua) [task:162162]
  - thermal: int340x: fix memory leak in int3400_notify() (Chuansheng Liu) [task:162162]
  - PM: core: keep irq flags in device_pm_check_callbacks() (Dmitry Baryshkov) [task:162162]
  - apparmor: Fix memleak in aa_simple_write_to_buffer() (Xiu Jianfeng) [task:162162]
  - firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region (Takashi Sakamoto) [task:164562]
  - nilfs2: fix general protection fault in nilfs_btree_insert() (Ryusuke Konishi) [task:164562]
  - mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start (Liang He) [task:162162]
  - media: pvrusb2: fix memory leak in pvr_probe (Dongliang Mu) [task:162162]
  - MIPS: smp: fill in sibling and core maps earlier (Alexander Lobakin) [task:162162]
  - sfc: fix kernel panic when creating VF (Íñigo Huguet) [task:162162]
  - ALSA: oss: Fix PCM OSS buffer allocation overflow (Takashi Iwai) [task:162162]
  - ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe (Miaoqian Lin) [task:162162]
  - drm/amdkfd: Fix an illegal memory access (Qu Huang) [task:166857]
  - drm/amdkfd: Check for potential null return of kmalloc_array() (QintaoShen) [task:162162]
  - tcp: tcp_make_synack() can be called from process context (Breno Leitao) [task:166857]
  - ath9k_htc: fix uninit value bugs (Pavel Skripkin) [task:162162]
  - f2fs: fix dereference of stale list iterator after loop body (Jakob Koschel) [task:162162]
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() (Yu Kuai) [task:166857]
  - drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (Zhou Qingyang) [task:162162]
  - drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. (Dave Airlie) [task:162162]
  - nvmet: avoid potential UAF in nvmet_req_complete() (Damien Le Moal) [task:166857]
  - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) (Paolo Bonzini) [task:162162]
  - jffs2: fix memory leak in jffs2_scan_medium (Baokun Li) [task:162162]
  - drm/virtio: Fix GEM handle creation UAF (Rob Clark) [task:164562]
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka) [task:166857]
  - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (Daniil Tatianin) [task:166857]
  - zsmalloc: fix races between asynchronous zspage free and page migration (Sultan Alsawaf) [task:162162]
  - drm/plane: Move range check for format_count earlier (Steven Price) [task:162162]
  - dm raid: fix accesses beyond end of raid member array (Heinz Mauelshagen) [task:162162]
  - nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() (Ryusuke Konishi) [task:166857]
  - i40e: Fix call trace in setup_tx_descriptors (Aleksandr Loktionov) [task:162162]
  - bpf, arm64: Clear prog->jited_len along prog->jited (Eric Dumazet) [task:162162]
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (Xiongfeng Wang) [task:164562]
  - ipv6: fix panic when forwarding a pkt with no in6 dev (Nicolas Dichtel) [task:162162]
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() (Zheyu Ma) [task:162162]
  - tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd (Eric Dumazet) [task:162162]
  - nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags (Smith, Kyle Miller (Nimble Kernel)) [task:162162]
  - nilfs2: fix use-after-free bug of ns_writer on remount (Ryusuke Konishi) [task:164562]
  - RDMA/hfi1: Prevent use of lock before it is initialized (Douglas Miller) [task:162162]
  - drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (Xin Xiong) [task:162162]
  - ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe (Miaoqian Lin) [task:162162]
  - ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (Takashi Sakamoto) [task:162162]
  - hwmon: (coretemp) Check for null before removing sysfs attrs (Phil Auld) [task:164562]
  - video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup (Miaoqian Lin) [task:162162]
  - jffs2: fix memory leak in jffs2_do_mount_fs (Baokun Li) [task:162162]
  - Bluetooth: Fix not cleanup led when bt_init fails (Chen Zhongjin) [task:164562]
  - ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event (Kees Cook) [task:164562]
  - apparmor: fix reference count leak in aa_pivotroot() (Xin Xiong) [task:162162]
  - be2net: Fix buffer overflow in be_get_module_eeprom (Hristo Venev) [task:162162]
  - tracing: Fix sleeping function called from invalid context on RT kernel (Jun Miao) [task:162162]
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() (Wang Cheng) [task:162162]
  - RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (Jianglei Nie) [task:162162]
  - nilfs2: fix deadlock in nilfs_count_free_blocks() (Ryusuke Konishi) [task:164562]
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (Wei Yongjun) [task:164562]
  - veth: Ensure eth header is in skb's linear part (Guillaume Nault) [task:162162]
  - firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (Miaoqian Lin) [task:162162]
  - drbd: use after free in drbd_create_device() (Dan Carpenter) [task:164562]
  - net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (Miaoqian Lin) [task:162162]
  - ASoC: soc-pcm: Add NULL check in BE reparenting (Srinivasa Rao Mandadapu) [task:164562]
  - mtd: maps: Fix refcount leak in ap_flash_init (Miaoqian Lin) [task:162162]
  - ntfs: check overflow when iterating ATTR_RECORDs (Hawkins Jiawei) [task:164562]
  - mtd: maps: Fix refcount leak in of_flash_probe_versatile (Miaoqian Lin) [task:162162]
  - ipw2x00: Fix potential NULL dereference in libipw_xmit() (Haowen Bai) [task:162162]
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (Yang Yingliang) [task:164562]
  - ASoC: mxs: Fix error handling in mxs_sgtl5000_probe (Miaoqian Lin) [task:162162]
  - can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (Vincent Mailhol) [task:158034]
  - HID: hidraw: fix memory leak in hidraw_release() (Karthik Alapati) [task:162162]
  - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (ZhangPeng) [task:164562]
  - gfs2: Always check inode size of inline inodes (Andreas Gruenbacher) [task:166857]
  - erspan: do not use skb_mac_header() in ndo_start_xmit() (Eric Dumazet) [task:166857]
  - erspan: do not assume transport header is always set (Eric Dumazet) [task:162162]
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL (Kinglong Mee) [task:162162]
  - udf: Fix preallocation discarding at indirect extent boundary (Jan Kara) [task:164562]
  - tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. (Kuniyuki Iwashima) [task:162162]
  - video: fbdev: amba-clcd: Fix refcount leak bugs (Liang He) [task:162162]
  - spmi: trace: fix stack-out-of-bound access in SPMI tracing functions (David Collins) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_early_retrans. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_notsent_lowat. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_fastopen. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_probe_interval. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_recovery. (Kuniyuki Iwashima) [task:162162]
  - tcp: Fix data-races around sysctl_tcp_max_reordering. (Kuniyuki Iwashima) [task:162162]
  - cipso: Fix data-races around sysctl. (Kuniyuki Iwashima) [task:162162]
  - HID: betop: check shape of output reports (Pietro Borrello) [task:164562]
  - HID: betop: fix slab-out-of-bounds Write in betop_probe (F.A.Sulaiman) [task:160493]
  - igb: Initialize mailbox message for VF reset (Tony Nguyen) [task:164562]
  - net: xfrm: unexport __init-annotated xfrm4_protocol_init() (Masahiro Yamada) [task:162162]
  - tcp: Fix a data-race around sysctl_tcp_probe_threshold. (Kuniyuki Iwashima) [task:162162]
  - Input: aiptek - properly check endpoint type (Pavel Skripkin) [task:162162]
  - Input: aiptek - fix endpoint sanity check (Johan Hovold) [task:153627]
  - tipc: check attribute length for bearer name (Hoang Le) [task:162162]
  - tipc: add extack messages for bearer/media failure (Hoang Le) [task:158827]
  - jffs2: fix memory leak in jffs2_do_fill_super (Baokun Li) [task:162162]
  - jffs2: fix use-after-free in jffs2_clear_xattr_subsystem (Baokun Li) [task:162162]
  - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() (Chen Zhongjin) [task:164562]
  - ASoC: core: Fix use-after-free in snd_soc_exit() (Chen Zhongjin) [task:164562]
  - net: tun: Fix use-after-free in tun_detach() (Shigeru Yoshida) [task:164562]
  - igc: Reinstate IGC_REMOVED logic and implement it properly (Lennert Buytenhek) [task:163480]
  - igc: remove IGC_REMOVED function (Vitaly Lifshits) [task:163480]
  - trace_events_hist: add check for return value of 'create_hist_field' (Natalia Petrova) [task:164562]
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK (Gaosheng Cui) [task:164562]
  - ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (Dan Carpenter) [task:162162]
  - um: Fix out-of-bounds read in LDT setup (Vincent Whitchurch) [task:162162]
  - vsock: remove vsock from connected table when connect is interrupted by a signal (Seth Forshee) [task:162162]
  - wifi: cfg80211: fix memory leak in query_regdb_file() (Arend van Spriel) [task:164562]
  - virtio_console: eliminate anonymous module_init & module_exit (Randy Dunlap) [task:162162]
  - mISDN: fix possible memory leak in mISDN_dsp_element_register() (Yang Yingliang) [task:164562]
  - tracing/histograms: Fix memory leak problem (Zheng Yejian) [task:162162]
  - macvlan: enforce a consistent minimal mtu (Eric Dumazet) [task:164562]
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (Yang Jihong) [task:162162]
  - scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (James Smart) [task:167824]
  - scsi: lpfc: Remove use of kmalloc() in trace event logging (James Smart) [task:167824]
  - scsi: lpfc: Enhancements to LOG_TRACE_EVENT for better readability (James Smart) [task:167824]
  - drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes (Liu Zixian) [task:162162]
  - drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() (Alexey Kodanev) [task:162162]
  - PM: hibernate: defer device probing when resuming from hibernation (Tetsuo Handa) [task:162162]
  - HID: cp2112: prevent a buffer overflow in cp2112_xfer() (Harshit Mogalapalli) [task:162162]
  - md: call __md_stop_writes in md_stop (Guoqing Jiang) [task:162162]
  - vt: Clear selection before changing the font (Helge Deller) [task:162162]
  - net: usb: smsc95xx: Limit packet length to skb->len (Szymon Heidrich) [task:166857]
  - dm raid: fix KASAN warning in raid5_add_disks (Mikulas Patocka) [task:162162]
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add() (Yang Yingliang) [task:164562]
  - ALSA: hda: fix potential memleak in 'add_widget_node' (Ye Bin) [task:164562]
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (ZhangPeng) [task:164562]
  - HID: core: detect and skip invalid inputs to snto32() (Randy Dunlap) [task:158034]
  - nfs4: Fix kmemleak when allocate slot failed (Zhang Xiaoxu) [task:164562]
  - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (Takashi Iwai) [task:164562]
  - RDMA/rxe: Fix error unwind in rxe_create_qp() (Zhu Yanjun) [task:162162]
  - 9p/trans_fd: always use O_NONBLOCK read/write (Tetsuo Handa) [task:164562]
  - net/9p: validate fds in p9_fd_open (Christoph Hellwig) [task:157172]
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register (Gaosheng Cui) [task:164562]
  - ipvs: fix WARNING in ip_vs_app_net_cleanup() (Zhengchao Shao) [task:164562]
  - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq (Saurabh Sengar) [task:162162]
  - net: fix refcount bug in sk_psock_get (2) (Hawkins Jiawei) [task:218801]
  - net, sk_msg: Don't use RCU_INIT_POINTER on sk_user_data (Jakub Sitnicki) [task:218801]
  - net, sk_msg: Clear sk_user_data pointer on clone if tagged (Jakub Sitnicki) [task:218801]
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() (Artemii Karasev) [task:164562]
  - xen/netfront: fix crash when removing device (Juergen Gross) [task:408535] {CVE-2024-53240}
  - xen-netfront: Fix NULL sring after live migration (Lin Liu) [task:164562]
  - xen/netfront: destroy queues before real_num_tx_queues is zeroed (Marek Marczykowski-Górecki) [task:162162]
  - tracing: Fix potential double free in create_var_ref() (Keita Suzuki) [task:162162]
  - media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (Pavel Skripkin) [task:162162]
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (Gaosheng Cui) [task:164562]
  - can: peak_usb: fix use after free bugs (Vincent Mailhol) [task:158034]
  - drivers:md:fix a potential use-after-free bug (Wentao_Liang) [task:162162]
  - gadgetfs: ep_io - wait until IRQ finishes (Jozef Martiniak) [task:162162]
  - wifi: mac80211: Fix UAF in ieee80211_scan_rx() (Siddh Raman Pant) [task:162162]
  - HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report (Lee Jones) [task:162162]
  - f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() (Chao Yu) [task:162162]
  - drm/amd/display: clear optc underflow before turn off odm clock (Fudong Wang) [task:162162]
  - extcon: Modify extcon device to be created after driver data is set (bumwoo lee) [task:162162]
  - extcon: Fix error handling in extcon_dev_register (Dinghao Liu) [task:158827]
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing (Zheyu Ma) [task:162162]
  - wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected (Siddh Raman Pant) [task:162162]
  - RDMA/hfi1: Prevent panic when SDMA is disabled (Douglas Miller) [task:162162]
  - IB/hfi1: Close window for pq and request coliding (Mike Marciniszyn) [task:153627]
  - Squashfs: fix handling and sanity checking of xattr_ids count (Phillip Lougher) [task:164562]
  - Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (Miaoqian Lin) [task:162162]
  - Drivers: hv: vmbus: Expose monitor data only when monitor pages are used (Kimberly Brown) [task:162162]
  - gfs2: Check sb_bsize_shift after reading superblock (Andrew Price) [task:164562]
  - gfs2: add validation checks for size of superblock (Anant Thazhemadam) [task:158034]
  - ceph: avoid putting the realm twice when decoding snaps fails (Xiubo Li) [task:164562]
  - ceph: do not update snapshot context when there is no new snapshot (Xiubo Li) [task:164562]
  - mISDN: fix misuse of put_device() in mISDN_register_device() (Wang ShaoBo) [task:164562]
  - mISDN: fix possible memory leak in mISDN_register_device() (Yang Yingliang) [task:164562]
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (Alexander Potapenko) [task:164562]
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (ZhangPeng) [task:164562]
  - dlm: fix plock invalid read (Alexander Aring) [task:162162]
  - dm ioctl: prevent potential spectre v1 gadget (Jordy Zomer) [task:162162]
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich) [task:166857]
  - net: usb: smsc75xx: Limit packet length to skb->len (Szymon Heidrich) [task:166857]
  - dmaengine: Fix double increment of client_count in dma_chan_get() (Koba Ko) [task:164562]
  - netfilter: fix use-after-free in __nf_register_net_hook() (Eric Dumazet) [task:162162]
  - wifi: mac80211: fix use-after-free in chanctx code (Johannes Berg) [task:162162]
  - usb: f_fs: Fix use-after-free for epfile (Udipto Goswami) [task:160493]
  - usb: gadget: f_fs: Add unbind event before functionfs_unbind (Uttkarsh Aggarwal) [task:166857]
  - usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait (Udipto Goswami) [task:164562]
  - usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait (Udipto Goswami) [task:164562]
  - usb: gadget: f_fs: Ensure io_completion_wq is idle during unbind (Wesley Cheng) [task:158827]
  - nvme-rdma: fix possible use-after-free in transport error_recovery work (Sagi Grimberg) [task:162162]
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Yevhen Orlov) [task:162162]
  - ASoC: rt5645: Fix errorenous cleanup order (Lin Ma) [task:162162]
  - cifs: potential buffer overflow in handling symlinks (Harshit Mogalapalli) [task:162162]
  - ntfs: fix use-after-free in ntfs_attr_find() (Hawkins Jiawei) [task:164562]
  - usb: gadget: uvc: Prevent buffer overflow in setup handler (Szymon Heidrich) [task:164562]
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed (Zhihao Cheng) [task:162162]
  - media: pci: cx23885: Fix the error handling in cx23885_initdev() (Zheyu Ma) [task:162162]
  - ipv6: avoid use-after-free in ip6_fragment() (Eric Dumazet) [task:164562]
  - sfc: fix use after free when disabling sriov (Íñigo Huguet) [task:162162]
  - sfc: error code if SRIOV cannot be disabled (Íñigo Huguet) [task:158827]
  - can: dev: can_restart: fix use after free bug (Vincent Mailhol) [task:158034]
  - can: dev: can_restart(): post buffer from the right context (Alejandro Concepcion Rodriguez) [task:158034]
  - HID: elan: Fix potential double free in elan_input_configured (Miaoqian Lin) [task:162162]
  - HID: elan: Fix memleak in elan_input_configured (Dinghao Liu) [task:157172]
  - nfp: Fix memory leak in nfp_cpp_area_cache_add() (Jianglei Nie) [task:160493]
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Miko Larsson) [task:164562]
  - usbnet: sanity check for maxpacket (Oliver Neukum) [task:160493]
  - RDMA/cma: Fix rdma_resolve_route() memory leak (Gerd Rausch) [task:158827]
  - perf hist: Fix memory leak of a perf_hpp_fmt (Ian Rogers) [task:160493]
  - media: mxl111sf: change mutex_init() location (Pavel Skripkin) [task:160493]
  - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (John Meneghini) [task:160493]
  - net: encx24j600: check error in devm_regmap_init_encx24j600 (Nanyong Sun) [task:160493]
  - isdn: mISDN: Fix sleeping function called from invalid context (Zheyu Ma) [task:160493]
  - drm/nouveau/debugfs: fix file release memory leak (Yang Yingliang) [task:160493]
  - net: USB: Fix wrong-direction WARNING in plusb.c (Alan Stern) [task:164562]
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Stephen Boyd) [task:160493]
  - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() (Gustavo A. R. Silva) [task:158827]
  - igbvf: fix double free in `igbvf_probe` (Letu Ren) [task:160493]
  - scsi: mpt3sas: Fix kernel panic during drive powercycle test (Sreekanth Reddy) [task:160493]
  - mmc: sdio: fix possible resource leaks in some error paths (Yang Yingliang) [task:164562]
  - IB/hfi1: Restore allocated resources on failed copyout (Dean Luick) [task:164562]
  - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (Lukas Wunner) [task:162162]
  - net: cdc_eem: fix tx fixup skb leak (Linyu Yuan) [task:158827]
  - ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() (Mark Brown) [task:160493]
  - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (Tasos Sahanidis) [task:162162]
  - drm: Fix use-after-free read in drm_getunique() (Desmond Cheong Zhi Xi) [task:158827]
  - HID: usbhid: free raw_report buffers in usbhid_stop (Anirudh Rayabharam) [task:160493]
  - drm/radeon: fix a possible null pointer dereference (Gong Yuanjun) [task:162162]
  - udf: Fix NULL pointer dereference in udf_symlink function (Arturo Giusti) [task:158827]
  - nilfs2: fix underflow in second superblock position calculations (Ryusuke Konishi) [task:164562]
  - drm/radeon: add a force flush to delay work when radeon (Zhenneng Li) [task:162162]
  - aio: fix mremap after fork null-deref (Seth Jenkins) [task:164562]
  - ip_gre: test csum_start instead of transport header (Willem de Bruijn) [task:162162]
  - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (Wang Yufen) [task:162162]
  - s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup (Stefan Haberland) [task:162162]
  - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (Sean Christopherson) [task:160493]
  - ALSA: gus: fix null pointer dereference on pointer block (Chengfeng Ye) [task:160493]
  - mac80211-hwsim: fix late beacon hrtimer handling (Johannes Berg) [task:122623]
  - isofs: Fix out of bound access for corrupted isofs image (Jan Kara) [task:160493]
  - gfs2: Fix use-after-free in gfs2_glock_shrink_scan (Hillf Danton) [task:158827]
  - btrfs: fix memory ordering between normal and ordered work functions (Nikolay Borisov) [task:160493]
  - net: ieee802154: fix null deref in parse dev addr (Dan Robertson) [task:158827]
  - ocfs2: mount fails with buffer overflow in strlen (Valentin Vidic) [task:160493]
  - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (Nguyen Dinh Phi) [task:160493]
  - scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() (James Smart) [task:160493]
  - net: fix uninit-value in caif_seqpkt_sendmsg (Ziyang Xuan) [task:158827]
  - i40e: Fix NULL ptr dereference on VSI filter sync (Michal Maloszewski) [task:160493]
  - mac80211: track only QoS data frames for admission control (Johannes Berg) [task:160493]
  - can: peak_pci: peak_pci_remove(): fix UAF (Zheyu Ma) [task:160493]
  - isdn: mISDN: netjet: Fix crash in nj_probe: (Zheyu Ma) [task:158827]
  - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb (Xin Long) [task:160493]
  - ASoC: max9759: fix underflow in speaker_gain_control_put() (Dan Carpenter) [task:160493]
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Sudeep Holla) [task:160493]
  - i2c: acpi: fix resource leak in reconfiguration device addition (Jamie Iles) [task:160493]
  - i2c: i801: Don't generate an interrupt on bus reset (Jean Delvare) [task:158827]
  - drm/amdgpu: Fix a use-after-free (xinhui pan) [task:158827]
  - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (John Meneghini) [task:160493]
  - net: amd-xgbe: Fix skb data length underflow (Shyam Sundar S K) [task:160493]
  - mISDN: fix possible use-after-free in HFC_cleanup() (Zou Wei) [task:158827]
  - mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap (Lorenzo Bianconi) [task:160493]
  - watchdog: Fix possible use-after-free by calling del_timer_sync() (Zou Wei) [task:158827]
  - igb: Fix use-after-free error during reset (Vinicius Costa Gomes) [task:158827]
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Teng Qi) [task:160493]
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header (Lu Wei) [task:162162]
  - phylib: fix potential use-after-free (Marek Behún) [task:160493]
  - drm/nouveau: fix off by one in BIOS boundary checking (Nick Lopez) [task:160493]
  - ocfs2: fix data corruption after conversion from inline format (Jan Kara) [task:160493]
  - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (Zhou Qingyang) [task:160493]
  - mac80211: fix use-after-free in CCMP/GCMP RX (Johannes Berg) [task:160493]
  - regmap: Fix possible double-free in regcache_rbtree_exit() (Yang Yingliang) [task:160493]
  - net: qcom/emac: fix UAF in emac_remove (Pavel Skripkin) [task:158827]
  - IB/mlx5: Fix initializing CQ fragments buffer (Alaa Hleihel) [task:158827]
  - mm/slub: fix to return errno if kmalloc() fails (Chao Yu) [task:162162]
  - xen/balloon: fix cancelled balloon action (Juergen Gross) [task:160493]
  - xen/balloon: fix balloon kthread freezing (Juergen Gross) [task:160493]
  - xen/balloon: use a kernel thread instead a workqueue (Juergen Gross) [task:160493]
  - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [task:224218] {CVE-2024-36954}
  - xhci: Fix commad ring abort, write all 64 bits to CRCR register. (Mathias Nyman) [task:160493]
  - xhci: Fix command ring pointer corruption while aborting a command (Pavankumar Kondeti) [task:160493]
  - ASoC: ops: Fix bounds check for _sx controls (Mark Brown) [task:164562]
  - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() (Mark Brown) [task:160493]
  - ALSA: pcm: oss: Limit the period size to 16MB (Takashi Iwai) [task:160493]
  - ALSA: pcm: oss: Fix potential out-of-bounds shift (Takashi Iwai) [task:158034]
  - tipc: skb_linearize the head skb when reassembling msgs (Xin Long) [task:158827]
  - i40e: Fix queues reservation for XDP (Sylwester Dziedziuch) [task:160493]
  - i40e: Fix issue when maximum queues is exceeded (Jedrzej Jagielski) [task:160493]
  - usb: misc: fix improper handling of refcount in uss720_probe() (Hangyu Hua) [task:162162]
  - misc/uss720: fix memory leak in uss720_probe (Dongliang Mu) [task:158827]
  - ipv6: Add lwtunnel encap size of all siblings in nexthop  calculation (Lu Wei) [task:540241] {CVE-2023-53477}
  - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [task:481987] {CVE-2022-50073}
  - wifi: mt76: do not run mt76u_status_worker if the device is not running (Lorenzo Bianconi) [task:576303] {CVE-2022-50735}
  - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [task:593641] {CVE-2026-23086}
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [task:593641]
  - vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() (Nikolay Kuratov) [task:593641]
  - bpf: Fix invalid prog->stats access when update_effective_progs fails (Pu Lehui) [task:577043] {CVE-2025-68742}
  - PCI: pnv_php: Clean up allocated IRQs on unplug (Timothy Pearson) [task:522801] {CVE-2025-38624}
  - media: imon: make send_packet() more robust (Tetsuo Handa) [task:573221] {CVE-2025-68194}
  - media: imon: fix a race condition in send_packet() (Gautam Menghani) [task:573221]
  - i40e: fix input validation logic for action_meta (Lukasz Czapnik) [task:542887] {CVE-2025-39970}
  - i40e: Fix filter input checks to prevent config with invalid values (Sudheer Mogilappagari) [task:542887]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Aditya Garg) [task:593597] {CVE-2026-23054}
  - hv_netvsc: Allocate rx indirection table size dynamically (Shradha Gupta) [task:593597]
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [task:567289] {CVE-2025-40280}
  - net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [task:554173] {CVE-2025-40173}
  - KVM: arm64: Prevent access to vCPU events before init (Oliver Upton) [task:547765] {CVE-2025-40102}
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure (Tetsuo Handa) [task:533075] {CVE-2022-50374}
  - Bluetooth: hci_serdev: call init_rwsem() before p->open() (Pavel Skripkin) [task:533075]
  - net/mlx5: Prevent high-rate FW commands from populating all slots (Tariq Toukan) [task:583189]
  - xfs: make inode reclaim almost non-blocking (Dave Chinner) [task:603105]
  - debugfs: add debugfs_lookup_and_remove() (Greg Kroah-Hartman) [task:162162]
  - net: Fix data-races around sysctl_[rw]mem(_offset)?. (Kuniyuki Iwashima) [task:581109]
  - mm/hugetlb: add mempolicy check in the reservation routine (Muchun Song) [task:595137]
  - xfs: Retry allocating space in xfs_bmap_extents_to_btree (Chi Zhiling) [task:566335, task:587243, task:589957, task:593187, task:594873, task:595621]
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU (Gui-Dong Han) [task:590075] {CVE-2025-71111}
  - ocfs2: fix kernel BUG in ocfs2_find_victim_chain (Prithvi Tambewagh) [task:590365] {CVE-2025-68771}
  - libceph: make free_choose_arg_map() resilient to partial allocation (Tuo Li) [task:590171] {CVE-2026-22991}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (Ilya Dryomov) [task:590125] {CVE-2026-22990}
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (Zilin Guan) [task:592301] {CVE-2026-23038}
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [task:593557] {CVE-2026-23089}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [task:593631] {CVE-2026-23060}
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi Salim) [task:593799] {CVE-2026-23105}
  - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [task:593593] {CVE-2026-23074}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [task:593615] {CVE-2026-23108}
  - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [task:593625] {CVE-2026-23073}
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [task:593621] {CVE-2026-23061}
  - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [task:593595] {CVE-2026-23071}
  - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [task:593803] {CVE-2026-23101}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [task:593611] {CVE-2026-23084}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [task:593635] {CVE-2026-23058}
  - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [task:593633] {CVE-2025-71194}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [task:593607] {CVE-2026-23076}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (Jason Gunthorpe) [task:590149] {CVE-2025-71096}
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue (Weiming Shi) [task:590147] {CVE-2026-22977}
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (fuqiang wang) [task:590143] {CVE-2025-71104}
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() (Karina Yankevich) [task:590135] {CVE-2025-68820}
  - mlxsw: spectrum_router: Fix neighbour use-after-free (Ido Schimmel) [task:590137] {CVE-2025-68801}
  - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits (Gregory CLEMENT) [task:589963] {CVE-2025-71109}
  - caif: fix integer underflow in cffrml_receive() (Junrui Luo) [task:590063] {CVE-2025-68799}
  - arp: do not assume dev_hard_header() does not change skb->head (Eric Dumazet) [task:589975]
  - ip6_gre: make ip6gre_header() robust (Eric Dumazet) [task:589975] {CVE-2025-71098}
  - e1000: fix OOB in e1000_tbi_should_accept() (Guangshuo Li) [task:590055] {CVE-2025-71093}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() (Kohei Enju) [task:589971] {CVE-2025-71087}
  - tracing: Do not register unsupported perf events (Steven Rostedt) [task:589945] {CVE-2025-71125}
  - wifi: avoid kernel-infoleak from struct iw_point (Eric Dumazet) [task:589519] {CVE-2026-22978}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (Herbert Xu) [task:589525] {CVE-2025-71131}
  - crypto: seqiv - Use kmemdup in seqiv_aead_encrypt() (YueHaibing) [task:589525]
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure (Deepakkumar Karn) [task:589521] {CVE-2025-71154}
  - ipv4: ip_gre: make ipgre_header() robust (Eric Dumazet) [task:589547] {CVE-2026-23011}
  - hwmon: (ibmpex) fix use-after-free in high/low store (Junrui Luo) [task:589061] {CVE-2025-68789}
  - usb: typec: ucsi: Handle incorrect num_connectors capability (Mark Pearson) [task:589027] {CVE-2025-71108}
  - net: hns3: using the num_tqps in the vf driver to apply for resources (Jian Shen) [task:589009] {CVE-2025-71064}
  - via_wdt: fix critical boot hang due to unnamed resource allocation (Li Qiang) [task:588997] {CVE-2025-71114}
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() (Jeongjun Park) [task:589007] {CVE-2025-68819}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (Will Rosenberg) [task:589013] {CVE-2025-71085}
  - net/sched: sch_qfq: do not free existing class in qfq_change_class() (Eric Dumazet) [task:588975] {CVE-2026-22999}
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [task:567353] {CVE-2025-40283}
  - Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (Luiz Augusto von Dentz) [task:515351] {CVE-2022-50233}
  - PCI/AER: Fix NULL pointer access by aer_info (Vernon Yang) [task:573049] {CVE-2025-68309}
  - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (Zhu Yanjun) [task:576735] {CVE-2025-68379}
  - wifi: ath10k: Delay the unmapping of the buffer (Youghandhar Chintala) [task:576839] {CVE-2022-50700}
  - sfc: complete the next packet when we receive a timestamp (Tom Zhao) [task:582061]
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Shipei Qu) [task:590965] {CVE-2025-68783}
  - OPENEULER: livepatch: support for super-long symbol repositioning (caixiaomeng 00662745) [task:479611]
  - net: hns3: add VLAN id validation before using (Jian Shen) [task:589439] {CVE-2025-71112}
  - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (Pavel Zhigulin) [task:566417] {CVE-2025-40252}
  - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [task:593547] {CVE-2026-23095}
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Kuniyuki Iwashima) [task:593627] {CVE-2026-23083}
  - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [task:593735] {CVE-2026-23103}
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [task:583035]
  - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create (Yang Chenzhi) [task:589039] {CVE-2025-68774}
  - ipvs: fix ipv4 null-ptr-deref in route error path (Slavin Liu) [task:589523] {CVE-2025-68813}
  - btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer (Tetsuo Handa) [task:576527] {CVE-2022-50766}
  - btrfs: fix race when deleting free space root from the dirty cow roots list (Filipe Manana) [task:576625] {CVE-2023-54067}
  - usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [task:553671] {CVE-2025-40164}
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [task:569685] {CVE-2025-40321}
  - brcmfmac: Add P2P Action Frame retry delay to fix GAS Comeback Response failure issue (Justin Li) [task:569685]
  - brcmfmac: Fix P2P Group Formation failure via Go-neg method (Joseph Chuang) [task:569685]
  - brcmfmac: p2p cert 6.1.9-support GOUT handling p2p presence request (Madhan Mohan R) [task:569685]
  - net: fix stack overflow when LRO is disabled for virtual interfaces (Taehee Yoo) [task:576549] {CVE-2023-54012}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Ilya Dryomov) [task:573593] {CVE-2025-68285}
  - net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set (Mike Manning) [task:583459]
  - ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() (Eric Dumazet) [task:583459]
  - inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() (Eric Dumazet) [task:583459]
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg (Herbert Xu) [task:540405] {CVE-2025-39931}
  - apparmor: Fix memleak in alloc_ns() (Xiu Jianfeng) [task:578001] {CVE-2022-50860}
  - net/net_failover: fix txq exceeding warning (Faicker Mo) [task:577763] {CVE-2023-54236}
  - objtool: Fix SEGFAULT (Christophe Leroy) [task:577749] {CVE-2022-50879}
  - dm cache: free background tracker's queued work in btracker_destroy (Joe Thornber) [task:567625] {CVE-2023-53765}
  - ext4: fix deadlock when converting an inline directory in nojournal mode (Theodore Ts'o) [task:578181] {CVE-2023-54311}
  - ext4: refresh inline data size before write operations (Deepanshu Kartikey) [task:572651] {CVE-2025-68264}
  - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer (Zhang Shurong) [task:577843] {CVE-2023-54314}
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (Filipe Manana) [task:577835] {CVE-2023-54224}
  - scsi: target: iscsit: Free cmds before session free (Dmitry Bogdanov) [task:577935] {CVE-2023-54184}
  - scsi: iscsi: target: fix spelling mistake "entires" -> "entries" (Colin Ian King) [task:577935]
  - drm/i915/gvt: fix gvt debugfs destroy (Zhenyu Wang) [task:576469] {CVE-2023-54098}
  - iavf: use internal state to free traffic IRQs (Ahmed Zaki) [task:570137] {CVE-2023-53850}
  - drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (Min Li) [task:578229] {CVE-2023-54202}
  - f2fs: fix potential corruption when moving a directory (Jaegeuk Kim) [task:578145] {CVE-2023-54187}
  - f2fs: report ENOENT correctly in f2fs_rename (Jaegeuk Kim) [task:578145]
  - amba: bus: fix refcount leak (Peng Fan) [task:578027] {CVE-2023-54230}
  - bpf: Prevent decl_tag from being referenced in func_proto arg (Stanislav Fomichev) [task:578175] {CVE-2022-50883}
  - media: tuners: qt1010: replace BUG_ON with a regular error (Hans Verkuil) [task:577985] {CVE-2023-54282}
  - scsi: qedf: Fix NULL dereference in error handling (Jinhong Zhu) [task:577959] {CVE-2023-54289}
  - scsi: qedf: Fix error codes in qedf_alloc_global_queues() (Dan Carpenter) [task:577959]
  - crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr (Ye Weihua) [task:577881] {CVE-2022-50814}
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer (Saravanan Vajravel) [task:577875] {CVE-2023-54274}
  - RDMA/srpt: Fix disabling device management (Kamal Heib) [task:577875]
  - nilfs2: fix shift-out-of-bounds due to too large exponent of block size (Ryusuke Konishi) [task:577823] {CVE-2022-50864}
  - tracing: Fix incomplete locking when disabling buffered events (Petr Pavlu) [task:578221]
  - tracing: Fix warning in trace_buffered_event_disable() (Zheng Yejian) [task:578221] {CVE-2023-54211}
  - scsi: qla2xxx: Array index may go out of bound (Nilesh Javali) [task:578169] {CVE-2023-54179}
  - bpf: Fix issue in verifying allow_ptr_leaks (Yafang Shao) [task:577649] {CVE-2023-54181}
  - ipv6/sit: use DEV_STATS_INC() to avoid data-races (Eric Dumazet) [task:576945] {CVE-2022-50764}
  - configfs: fix possible memory leak in configfs_create_dir() (Chen Zhongjin) [task:576961] {CVE-2022-50751}
  - configfs: factor dirent removal into helpers (Christoph Hellwig) [task:576961]
  - ext4: silence the warning when evicting inode with dioread_nolock (Zhang Yi) [task:577027] {CVE-2022-50730}
  - audit: fix possible soft lockup in __audit_inode_child() (Gaosheng Cui) [task:576981] {CVE-2023-54045}
  - autofs: fix memory leak of waitqueues in autofs_catatonic_mode (Fedor Pchelkin) [task:576959] {CVE-2023-54134}
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali) [task:576931] {CVE-2023-54014}
  - btrfs: fix race when deleting quota root from the dirty cow roots list (Filipe Manana) [task:576951] {CVE-2023-54032}
  - nbd: defer config put in recv_work (Zheng Qixing) [task:576921] {CVE-2025-68372}
  - nbd: defer config unlock in nbd_genl_connect (Zheng Qixing) [task:576883] {CVE-2025-68366}
  - media: anysee: fix null-ptr-deref in anysee_master_xfer (Zhang Shurong) [task:576879] {CVE-2023-54093}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (Thorsten Blum) [task:576567] {CVE-2025-68724}
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [task:576581] {CVE-2025-68734}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng) [task:576543] {CVE-2025-68750}
  - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() (Andrew Kanner) [task:576553] {CVE-2023-54127}
  - RDMA/core: Fix GID entry ref leak when create_ah fails (Saravanan Vajravel) [task:576593] {CVE-2023-54003}
  - nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse (Ryusuke Konishi) [task:576337] {CVE-2023-54140}
  - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() (Dmitry Antipov) [task:576289] {CVE-2025-68364}
  - atm/fore200e: Fix possible data race in fore200e_open() (Gui-Dong Han) [task:575751] {CVE-2025-68339}
  - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (Alexey Nepomnyashih) [task:573201] {CVE-2025-68261}
  - usb: storage: Fix memory leak in USB bulk transport (Desnes Nunes) [task:573401] {CVE-2025-68288}
  - udp_tunnel: use netdev_warn() instead of netdev_WARN() (Alok Tiwari) [task:573277] {CVE-2025-68191}
  - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers (Seungjin Bae) [task:573259] {CVE-2025-68308}
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [task:573675] {CVE-2025-68229}
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko) [task:573523] {CVE-2025-40351}
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (Al Viro) [task:573519] {CVE-2025-68185}
  - hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi) [task:573411] {CVE-2025-40349}
  - hfsplus: fix to avoid false alarm of circular locking (Chao Yu) [task:573411]
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [task:573407] {CVE-2025-68192}
  - bfs: Reconstruct file type when loading from disk (Tetsuo Handa) [task:573225] {CVE-2025-68266}
  - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane) [task:573105] {CVE-2025-68168}
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Junrui Luo) [task:576229] {CVE-2025-68346}
  - drm/amdgpu: fix nullptr err of vm_handle_moved (Heng Zhou) [task:569749] {CVE-2025-40339}
  - drm/amdgpu: update mappings not managed by KFD (Felix Kuehling) [task:569749]
  - drm/amdkfd: keep BOs in system memory if restore failed (Philip Yang) [task:569749]
  - drm/amdgpu: KFD Restore process: Optimize waiting (Harish Kasiviswanathan) [task:569749]
  - drm/amdgpu: Remove explicit wait after VM validate (Harish Kasiviswanathan) [task:569749]
  - usbnet: Prevents free active kevent (Lizhi Xu) [task:573207] {CVE-2025-68312}
  - timers: Fix NULL function pointer race in timer_shutdown_sync() (Yipeng Zou) [task:573247] {CVE-2025-68214}
  - page_pool: always add GFP_NOWARN for ATOMIC allocations (Jakub Kicinski) [task:573099] {CVE-2025-68321}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [task:466416] {CVE-2025-37958}
  - usb: storage: sddr55: Reject out-of-bound new_pba (Tianchu Chen) [task:571709] {CVE-2025-40345}
  - sctp: Fix MAC comparison to be constant-time (Eric Biggers) [task:554169] {CVE-2025-40204}
  - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [task:569903] {CVE-2025-40308}
  - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [task:570215] {CVE-2025-40331}
  - usb: early: xhci-dbc: Fix a potential out-of-bound memory access (Christophe JAILLET) [task:569807] {CVE-2023-53840}
  - net: read sk->sk_family once in sk_mc_loop() (Eric Dumazet) [task:569859] {CVE-2023-53831}
  - crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (Mark O'Donovan) [task:570033] {CVE-2023-53817}
  - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (Dmitry Antipov) [task:570061] {CVE-2023-53808}
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() (Ma Ke) [task:534325] {CVE-2025-39846}
  - ppp: fix memory leak in pad_compress_skb (Qingfang Deng) [task:534321] {CVE-2025-39847}
  - driver core: fix resource leak in device_add() (Zhengchao Shao) [task:539843] {CVE-2023-53594}
  - trace/blktrace: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:533251] {CVE-2023-53408}
  - blktrace: fix use after free for struct blk_trace (Yu Kuai) [task:533251]
  - drivers: base: dd: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:533259] {CVE-2023-53390}
  - driver core: dd: remove deferred_devices variable (Greg Kroah-Hartman) [task:533259]
  - ocfs2: fix recursive semaphore deadlock in fiemap call (Mark Tinguely) [task:535625] {CVE-2025-39885}
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (Hans de Goede) [task:539117] {CVE-2025-39937}
  - net: rfkill: gpio: add DT support (Philipp Zabel) [task:539117]
  - btrfs: output extra debug info if we failed to find an inline backref (Qu Wenruo) [task:539195] {CVE-2023-53672}
  - scsi: qla4xxx: Add length check when parsing nlattrs (Lin Ma) [task:539903] {CVE-2023-53456}
  - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (Dan Carpenter) [task:539905] {CVE-2023-53476}
  - scsi: qla2xxx: Fix deletion race condition (Quinn Tran) [task:540555] {CVE-2023-53615}
  - iommu: Fix error unwind in iommu_group_alloc() (Jason Gunthorpe) [task:540195] {CVE-2023-53482}
  - pcmcia: Add error handling for add_interval() in do_validate_mem() (Wentao Liang) [task:540201] {CVE-2025-39920}
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() (Zhen Lei) [task:540453] {CVE-2023-53480}
  - i40e: fix idx validation in i40e_validate_queue_map (Lukasz Czapnik) [task:542885] {CVE-2025-39972}
  - i40e: add max boundary check for VF filters (Lukasz Czapnik) [task:542889] {CVE-2025-39968}
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove (Duoming Zhou) [task:542891] {CVE-2025-39996}
  - drm/omap: dss: Fix refcount leak bugs (Liang He) [task:544551] {CVE-2022-50574}
  - drm/omap: dss: Cleanup DSS ports on initialisation failure (Laurent Pinchart) [task:544551]
  - drm/omap: dss: Handle DPI and SDI port initialization failures (Laurent Pinchart) [task:544551]
  - soc: qcom: qmi_encdec: Restrict string length in decode (Chris Lew) [task:544625] {CVE-2023-53729}
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup (Slavin Liu) [task:546067] {CVE-2025-40018}
  - Squashfs: fix uninit-value in squashfs_get_parent (Phillip Lougher) [task:546583] {CVE-2025-40049}
  - fs: udf: fix OOB read in lengthAllocDescs handling (Larshin Sergey) [task:546611] {CVE-2025-40044}
  - nfsd: remove non-existent struct in flexfiles (liuyunchen) [task:569939]
  - net: dlink: handle copy_thresh allocation failure (Yeounsu Moon) [task:546803] {CVE-2025-40053}
  - net: dl2k: switch from 'pci_' to 'dma_' API (Christophe JAILLET) [task:546803]
  - ocfs2: fix double free in user_cluster_connect() (Dan Carpenter) [task:546813] {CVE-2025-40055}
  - pinctrl: check the return value of pinmux_ops::get_function_name() (Bartosz Golaszewski) [task:546825] {CVE-2025-40030}
  - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (Leo Yan) [task:546827] {CVE-2025-40081}
  - net/9p: fix double req put in p9_fd_cancelled (Nalivayko Sergey) [task:546995] {CVE-2025-40027}
  - bpf: Explicitly check accesses to bpf_sock_addr (Paul Chaignon) [task:546823] {CVE-2025-40078}
  - NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [task:547733] {CVE-2025-40087}
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko) [task:547751] {CVE-2025-40088}
  - usb: gadget: f_ecm: Refactor bind path to use __free() (Kuen-Han Tsai) [task:547759] {CVE-2025-40093}
  - usb: gadget: remove max support speed info in bind operation (Linyu Yuan) [task:547759]
  - usb: gadget: f_acm: Refactor bind path to use __free() (Kuen-Han Tsai) [task:547763] {CVE-2025-40094}
  - md/raid1: fix error: ISO C90 forbids mixed declarations (Nigel Croxon) [task:544627]
  - md: raid1: fix potential OOB in raid1_remove_disk() (Zhang Shurong) [task:544627] {CVE-2023-53722}
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [task:547995] {CVE-2025-40083}
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast (I Viswanath) [task:554197] {CVE-2025-40140}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Alexandr Sapozhnikov) [task:554269] {CVE-2025-40187}
  - pid: Add a judgment for ns null in pid_nr_ns (gaoxiang17) [task:554209] {CVE-2025-40178}
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx (Li Nan) [task:554213] {CVE-2025-40125}
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() (Ranjan Kumar) [task:554257] {CVE-2025-40115}
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area (Yang Shi) [task:554271] {CVE-2025-40153}
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (Daniel Borkmann) [task:554313] {CVE-2025-40183}
  - Squashfs: reject negative file sizes in squashfs_read_inode() (Phillip Lougher) [task:555251] {CVE-2025-40200}
  - Squashfs: add additional inode sanity checking (Phillip Lougher) [task:555251]
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [task:559713] {CVE-2025-40211}
  - ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [task:566411] {CVE-2025-40233}
  - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko) [task:566403] {CVE-2025-40243}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [task:508235] {CVE-2025-38498}
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [task:527679] {CVE-2025-38695}
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [task:527979] {CVE-2025-39676}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov [NVIDIA]) [task:530267] {CVE-2025-39742}
  - scsi: qla2xxx: Pointer may be dereferenced (Shreyas Deodhar) [task:531899] {CVE-2023-53150}
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN (Lin Ma) [task:533859] {CVE-2023-53369}
  - wifi: mwifiex: avoid possible NULL skb pointer dereference (Dmitry Antipov) [task:533893] {CVE-2023-53384}
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (Li Nan) [task:533857] {CVE-2023-53380}
  - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() (Nikita Zhandarovich) [task:532845] {CVE-2023-53335}
  - USB: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:532729] {CVE-2023-53359}
  - USB: core: no need to save usb_devices_root (Greg Kroah-Hartman) [task:532729]
  - USB: move usb debugfs directory creation to the usb common core (Greg Kroah-Hartman) [task:532729]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [task:532225] {CVE-2025-39808}
  - USB: uhci: fix memory leak with using debugfs_lookup() (Greg Kroah-Hartman) [task:531787] {CVE-2023-53197}
  - USB: host: uhci: remove dentry pointer for debugfs (Greg Kroah-Hartman) [task:531787]
  - md/raid10: fix wrong setting of max_corr_read_errors (Li Nan) [task:532129] {CVE-2023-53313}
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [task:532363] {CVE-2025-39813}
  - ext4: fix i_disksize exceeding i_size problem in paritally written case (Zhihao Cheng) [task:532121] {CVE-2023-53270}
  - mISDN: hfcpci: Fix warning when deleting uninitialized timer (Vladimir Riabchun) [task:532231] {CVE-2025-39833}
  - ipv6/addrconf: fix a potential refcount underflow for idev (Ziyang Xuan) [task:531859] {CVE-2023-53189}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [task:530329] {CVE-2025-39756}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'o) [task:527339] {CVE-2025-38701}
  - net: kcm: Fix race condition in kcm_unattach() (Sven Stegemann) [task:527571] {CVE-2025-38717}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh) [task:527669] {CVE-2025-38696}
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [task:527579] {CVE-2025-38691}
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [task:527691] {CVE-2025-38700}
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa) [task:527561] {CVE-2025-38712}
  - jfs: Regular file corruption check (Edward Adam Davis) [task:527667] {CVE-2025-38698}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [task:527379] {CVE-2025-38694}
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [task:527341] {CVE-2025-38693}
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [task:522999] {CVE-2025-38671}
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi) [task:522913] {CVE-2025-38663}
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li) [task:523427] {CVE-2025-38650}
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [task:523363] {CVE-2025-38639}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [task:520109] {CVE-2025-38515}
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao (AceLan)) [task:519339] {CVE-2025-38540}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (NeilBrown) [task:506037] {CVE-2025-38430}
  - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko) [task:566437] {CVE-2025-40244}
  - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [task:566439] {CVE-2025-40264}
  - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen) [task:567195] {CVE-2025-40282}
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (Manish Rangankar) [task:532367] {CVE-2023-53280}
  - dm: fix NULL pointer dereference in __dm_suspend() (Zheng Qixing) [task:554253] {CVE-2025-40134}
  - null_blk: Always check queue mode setting from configfs (Chaitanya Kulkarni) [task:540445] {CVE-2023-53576}
  - xen/events: Return -EEXIST for bound VIRQs (Jason Andryuk) [task:553675] {CVE-2025-40160}
  - xen/events: Cleanup find_virq() return codes (Jason Andryuk) [task:553675]
  - xen: Use evtchn_type_t as a type for event channels (Yan Yankovskyi) [task:553675]
  - IB/mad: Don't call to function that might sleep while in atomic context (Leonid Ravich) [task:539101] {CVE-2022-50472}
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Takashi Iwai) [task:554195] {CVE-2025-40121}
  - drm/vmwgfx: Fix a null-ptr access in the cursor snooper (Zack Rusin) [task:553045] {CVE-2025-40110}
  - netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed (Zhengchao Shao) [task:540047] {CVE-2022-50500}
  - can: peak_usb: fix shift-out-of-bounds issue (Stéphane Grosjean) [task:546085] {CVE-2025-40020}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (Zhen Ni) [task:546817] {CVE-2025-40035}
  - scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list (Xingui Yang) [task:540093] {CVE-2023-53627}
  - usb: gadget: f_rndis: Refactor bind path to use __free() (Kuen-Han Tsai) [task:547767] {CVE-2025-40095}
  - drm/gma500: Fix null dereference in hdmi teardown (Zabelin Nikita) [task:543789] {CVE-2025-40011}
  - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (Shang XiaoJing) [task:544705] {CVE-2022-50556}
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Li Qiong) [task:539857] {CVE-2025-39902}
  - bnxt: avoid overflow in bnxt_get_nvram_directory() (Maxim Korotkov) [task:539303] {CVE-2023-53661}
  - dm-stripe: fix a possible integer overflow (Mikulas Patocka) [task:538939] {CVE-2025-39940}
  - ALSA: ac97: Fix possible error value of *rac97 (Su Hui) [task:540131]
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (Su Hui) [task:540131] {CVE-2023-53648}
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller) [task:540451] {CVE-2023-53488}
  - jbd2: check 'jh->b_transaction' before removing it from checkpoint (Zhihao Cheng) [task:539839] {CVE-2023-53526}
  - lib/fonts: fix undefined behavior in bit shift for get_default_font (Gaosheng Cui) [task:539359] {CVE-2022-50511}
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [task:528079] {CVE-2025-39724}
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors (Yazen Ghannam) [task:533313] {CVE-2023-53438}
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002) [task:532389] {CVE-2023-53309}
  - wifi: iwlwifi: mvm: don't trust firmware n_channels (Johannes Berg) [task:540147] {CVE-2023-53589}
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (Baokun Li) [task:539011] {CVE-2022-50485}
  - ext4: avoid deadlock in fs reclaim with page writeback (Jan Kara) [task:532081] {CVE-2023-53149}
  - RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (Shay Drory) [task:533401] {CVE-2023-53393}
  - cifs: prevent NULL pointer dereference in UTF16 conversion (Makar Semyonov) [task:534323] {CVE-2025-39838}


