[ol8_baseos_latest] kernel-uek-debug-5.4.17-2136.348.3.1.el8uek.aarch64

The kernel package contains the Linux kernel (vmlinuz), the core of any
Linux operating system.  The kernel handles the basic functions
of the operating system:  memory allocation, process allocation, device
input and output, etc.

This variant of the kernel has numerous debugging options enabled.
It should only be installed when trying to gather additional information
on kernel bugs, as some of these options impact performance noticably.

Changelog (Show File list) (Show related packages)

• Sat Nov 01 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.3.1.el8uek]

  - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604168]  {CVE-2025-39973} 
  - i40e: increase max descriptors for XL710 (Justin Bronder)  [Orabug: 38604168]  {CVE-2025-39973}

• Fri Sep 26 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.3.el8uek]

  - hugetlbfs: take read_lock on i_mmap for PMD sharing (Waiman Long) [Orabug: 38459576]
  - kallsyms: add module_kallsyms_on_each_symbol_locked (Julian Pidancet) [Orabug: 38418686]
  - kallsyms: export module_kallsyms_on_each_symbol (Julian Pidancet) [Orabug: 38418686]

• Thu Sep 18 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.348.2.el8uek]

  - uek-rpm: Move ifb module to nano modules (Harshit Mogalapalli) [Orabug: 38443798]
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38310007,38453918] {CVE-2025-38499}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424094]
  - x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424094]
  - x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424094]
  - Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424094]

• Fri Sep 05 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.348.1.el8uek]

  - LTS tag: v5.4.298 (Sherry Yang)
  - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" (Imre Deak)
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions (Fabio Porcedda)
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo" (Alex Deucher) [Orabug: 38343661]
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() (Minjong Kim) [Orabug: 38440228] {CVE-2025-39808}
  - HID: wacom: Add a new Art Pen 2 (Ping Cheng)
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation (Qasim Ijaz) [Orabug: 38440310] {CVE-2025-39824}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (Li Nan) [Orabug: 38440277] {CVE-2025-39817}
  - sctp: initialize more fields in sctp_v6_from_sk() (Eric Dumazet) [Orabug: 38440251] {CVE-2025-39812}
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts (Rohan G Thomas)
  - net/mlx5e: Set local Xoff after FW update (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon port speed set (Alexei Lazar)
  - net/mlx5e: Update and set Xon/Xoff upon MTU set (Alexei Lazar)
  - net: dlink: fix multicast stats being counted incorrectly (Moon Yeounsu)
  - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). (Kuniyuki Iwashima) [Orabug: 38440347] {CVE-2025-39828}
  - net/atm: remove the atmdev_ops {get, set}sockopt methods (Christoph Hellwig)
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced (Luiz Augusto von Dentz)
  - powerpc/kvm: Fix ifdef to remove build warning (Madhavan Srinivasan)
  - net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343661]
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() (Nikolay Kuratov)
  - scsi: core: sysfs: Correct sysfs attributes access rights (Damien Le Moal)
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (Tengda Wu) [Orabug: 38440259] {CVE-2025-39813}
  - pinctrl: STMFX: add missing HAS_IOMEM dependency (Randy Dunlap)
  - LTS tag: v5.4.297 (Sherry Yang)
  - alloc_fdtable(): change calling conventions. (Al Viro)
  - s390/hypfs: Enable limited access during lockdown (Peter Oberparleiter)
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (Peter Oberparleiter)
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation (Takashi Iwai)
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate (William Liu)
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (William Liu) [Orabug: 38423457] {CVE-2025-39766}
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc (Jason Xing)
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add (Heminhong)
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343661]
  - scsi: qla4xxx: Prevent a potential error pointer dereference (Dan Carpenter) [Orabug: 38401514] {CVE-2025-39676}
  - usb: xhci: Fix slot_id resource race conflict (Weitao Wang)
  - nfs: fix UAF in direct writes (Josef Bacik) [Orabug: 36596831] {CVE-2024-26958}
  - NFS: Fix up commit deadlocks (Trond Myklebust)
  - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) [Orabug: 36983927] {CVE-2023-52572}
  - Bluetooth: fix use-after-free in device_for_each_child() (Dmitry Antipov) [Orabug: 37433654] {CVE-2024-53237}
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti)
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti)
  - net/sched: act_mirred: refactor the handle of xmit (Wenxu)
  - selftests: forwarding: tc_actions.sh: add matchall mirror test (Jiri Pirko)
  - net: sched: don't expose action qstats to skb_tc_reinsert() (Vlad Buslov)
  - net: sched: extract qstats update code into functions (Vlad Buslov)
  - net: sched: extract bstats update code into function (Vlad Buslov)
  - net: sched: extract common action counters update code into function (Vlad Buslov)
  - mm: perform the mapping_map_writable() check after call_mmap() (Lorenzo Stoakes)
  - mm: update memfd seal write check to include F_SEAL_WRITE (Lorenzo Stoakes)
  - mm: drop the assumption that VM_SHARED always implies writable (Lorenzo Stoakes)
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Cong Wang) [Orabug: 37908492] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Cong Wang)
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [Orabug: 38158396] {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent (Cong Wang)
  - btrfs: populate otime when logging an inode item (Qu Wenruo)
  - media: venus: hfi: explicitly release IRQ during teardown (Jorge Ramirez-Ortiz)
  - f2fs: fix to avoid out-of-boundary access in dnode page (Chao Yu) [Orabug: 38375870] {CVE-2025-38677}
  - media: venus: protect against spurious interrupts during probe (Jorge Ramirez-Ortiz) [Orabug: 38401659] {CVE-2025-39709}
  - media: qcom: camss: cleanup media device allocated resource on error path (Vladimir Zapolskiy)
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. (Ricardo Ribalda)
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS (Imre Deak)
  - pwm: mediatek: Fix duty and period setting (Uwe Kleine-König)
  - pwm: mediatek: Handle hardware enable and clock enable separately (Uwe Kleine-König)
  - pwm: mediatek: Implement .apply() callback (Uwe Kleine-König)
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() (Gui-Dong Han) [Orabug: 38401677] {CVE-2025-39713}
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() (Sakari Ailus)
  - media: v4l2-ctrls: always copy the controls on completion (Hans Verkuil)
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig (Damien Le Moal)
  - soc: qcom: mdt_loader: Ensure we don't read past the ELF header (Bjorn Andersson) [Orabug: 38423524] {CVE-2025-39787}
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 (Meagan Lloyd)
  - usb: musb: omap2430: fix device leak at unbind (Johan Hovold)
  - NFS: Fix the setting of capabilities when automounting a new filesystem (Trond Myklebust) [Orabug: 38429211] {CVE-2025-39798}
  - NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() (Trond Myklebust)
  - NFSv4: Fix nfs4_bitmap_copy_adjust() (Trond Myklebust)
  - usb: typec: fusb302: cache PD RX state (Sebastian Reichel)
  - cdc-acm: fix race between initial clearing halt and open (Oliver Neukum)
  - USB: cdc-acm: do not log successful probe on later errors (Johan Hovold)
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock (Breno Leitao) [Orabug: 38423261] {CVE-2025-39736}
  - mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t (He Zhe)
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() (Geoffrey D. Bennett)
  - x86/fpu: Delay instruction pointer fixup until after warning (Dave Hansen)
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery (Andy Shevchenko)
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38395081] {CVE-2025-38724}
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov (Maulik Shah)
  - tracing: Add down_write(trace_event_sem) when adding trace event (Steven Rostedt) [Orabug: 38324271] {CVE-2025-38539}
  - usb: hub: Don't try to recover devices lost during warm reset. (Mathias Nyman)
  - usb: hub: avoid warm port reset during USB3 disconnect (Mathias Nyman)
  - x86/mce/amd: Add default names for MCA banks and blocks (Yazen Ghannam)
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation (Zhang Lixu)
  - f2fs: fix to do sanity check on ino and xnid (Chao Yu) [Orabug: 38180774] {CVE-2025-38347}
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n (Harry Yoo)
  - mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() (Miaohe Lin)
  - drm/sched: Remove optimization that causes hang when killing dependent jobs (Lin Cao)
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Haoxiang Li) [Orabug: 38351930] {CVE-2025-38664}
  - net: usbnet: Fix the wrong netif_carrier_on() call (Ammar Faizi)
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event (John Ernberg)
  - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports (Lukas Wunner)
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (Li Zhong)
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large (Ian Abbott) [Orabug: 38254285] {CVE-2025-38481}
  - comedi: Fix initialization of data for instructions that write to subdevice (Ian Abbott) [Orabug: 38254272] {CVE-2025-38478}
  - kbuild: Add KBUILD_CPPFLAGS to as-option invocation (Nathan Chancellor)
  - kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS (Masahiro Yamada)
  - kbuild: Add CLANG_FLAGS to as-instr (Nathan Chancellor)
  - mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation (Nathan Chancellor)
  - kbuild: Update assembler calls to use proper flags and language target (Nick Desaulniers)
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS (Nathan Chancellor)
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout (Kuen-Han Tsai)
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles (Zenm Chen)
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue (Thorsten Blum)
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera (Mael Guerin)
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive (Miao Li)
  - iio: proximity: isl29501: fix buffered read on big-endian systems (David Lechner)
  - ftrace: Also allocate and copy hash for reading of filter files (Steven Rostedt) [Orabug: 38401581] {CVE-2025-39689}
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() (Xu Yilun)
  - use uniform permission checks for all mount propagation changes (Al Viro)
  - move_mount: allow to add a mount into an existing group (Pavel Tikhomirov)
  - fs/buffer: fix use-after-free when call bh_read() helper (Ye Bin) [Orabug: 38401587] {CVE-2025-39691}
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs (Timur Kristóf)
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 (Timur Kristóf)
  - memstick: Fix deadlock by moving removing flag earlier (Jiayi Li)
  - media: venus: Add a check for packet size after reading from shared memory (Vedang Nagar) [Orabug: 38401666] {CVE-2025-39710}
  - media: ov2659: Fix memory leaks in ov2659_probe() (Zhang Shurong)
  - media: usbtv: Lock resolution while streaming (Ludwig Disterhof) [Orabug: 38401684] {CVE-2025-39714}
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() (Haoxiang Li)
  - media: gspca: Add bounds checking to firmware parser (Dan Carpenter)
  - soc/tegra: pmc: Ensure power-domains are in a known state (Jonathan Hunter)
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() (Baokun Li) [Orabug: 38423509] {CVE-2025-39782}
  - PCI: endpoint: Fix configfs group removal on driver teardown (Damien Le Moal)
  - PCI: endpoint: Fix configfs group list head handling (Damien Le Moal) [Orabug: 38423515] {CVE-2025-39783}
  - mtd: rawnand: fsmc: Add missing check after DMA map (Thomas Fourier)
  - pwm: imx-tpm: Reset counter if CMOD is 0 (Laurentiu Mihalcea)
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() (Nathan Chancellor)
  - zynq_fpga: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - ata: libata-scsi: Fix ata_to_sense_error() status handling (Damien Le Moal)
  - ext4: fix reserved gdt blocks handling in fsmap (Ojaswin Mujoo)
  - ext4: fix fsmap end of range reporting with bigalloc (Ojaswin Mujoo)
  - ext4: check fast symlink for ea_inode correctly (Andreas Dilger)
  - vt: defkeymap: Map keycodes above 127 to K_HOLE (Myrrh Periwinkle)
  - vt: keyboard: Don't process Unicode characters in K_OFF mode (Myrrh Periwinkle)
  - usb: dwc3: meson-g12a: fix device leaks at unbind (Johan Hovold)
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind (Johan Hovold)
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() (Nathan Chancellor)
  - m68k: Fix lost column on framebuffer debug console (Finn Thain)
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (Dan Carpenter)
  - serial: 8250: fix panic due to PSLVERR (Yunhui Cui) [Orabug: 38401729] {CVE-2025-39724}
  - media: uvcvideo: Do not mark valid metadata as invalid (Ricardo Ribalda)
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (Youngjun Lee) [Orabug: 38394816] {CVE-2025-38680}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() (Waiman Long) [Orabug: 38423265] {CVE-2025-39737}
  - parisc: Makefile: fix a typo in palo.conf (Randy Dunlap)
  - btrfs: fix log tree replay failure due to file with 0 links and extents (Filipe Manana)
  - thunderbolt: Fix copy+paste error in match_service_id() (Eric Biggers)
  - comedi: fix race between polling and detaching (Ian Abbott) [Orabug: 38394854] {CVE-2025-38687}
  - misc: rtsx: usb: Ensure mmc child device is active when card is present (Ricky Wu)
  - drm/amdgpu: fix incorrect vm flags to map bo (Jack Xiao)
  - scsi: lpfc: Remove redundant assignment to avoid memory leak (Jiasheng Jiang)
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe (Meagan Lloyd)
  - pNFS: Fix uninited ptr deref in block/scsi layout (Sergey Bashirov) [Orabug: 38394867] {CVE-2025-38691}
  - pNFS: Handle RPC size limit for layoutcommits (Sergey Bashirov)
  - pNFS: Fix disk addr range check in block/scsi layout (Sergey Bashirov)
  - pNFS: Fix stripe mapping in block/scsi layout (Sergey Bashirov)
  - net: phy: smsc: add proper reset flags for LAN8710A (Csaba Buday)
  - ipmi: Fix strcpy source and destination the same (Corey Minyard)
  - kconfig: lxdialog: fix 'space' to (de)select options (Yann E. MORIN)
  - kconfig: gconf: fix potential memory leak in renderer_edited() (Masahiro Yamada)
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() (Masahiro Yamada)
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Breno Leitao)
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY (John Garry)
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans (Ranjan Kumar)
  - kconfig: nconf: Ensure null termination where strncpy is used (Shankari Anand)
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c (Suchit Karunakaran)
  - i3c: don't fail if GETHDRCAP is unsupported (Wolfram Sang)
  - PCI: pnv_php: Work around switches with broken presence detection (Timothy Pearson)
  - i3c: add missing include to internal header (Wolfram Sang)
  - media: uvcvideo: Fix bandwidth issue for Alcor camera (Chenchangcheng)
  - media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar (Alex Guo) [Orabug: 38394880] {CVE-2025-38693}
  - media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() (Alex Guo) [Orabug: 38394887] {CVE-2025-38694}
  - media: usb: hdpvr: disable zero-length read messages (Wolfram Sang)
  - media: tc358743: Increase FIFO trigger level to 374 (Dave Stevenson)
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt (Dave Stevenson)
  - media: tc358743: Check I2C succeeded during probe (Dave Stevenson)
  - pinctrl: stm32: Manage irq affinity settings (Cheick Traore)
  - scsi: mpt3sas: Correctly handle ATA device errors (Damien Le Moal)
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (Justin Tee) [Orabug: 38394894] {CVE-2025-38695}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (Yury Norov) [Orabug: 38423286] {CVE-2025-39742}
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO (Thomas Weißschuh)
  - jfs: upper bound check of tree index in dbAllocAG (Arnaud Lecomte) [Orabug: 38394912] {CVE-2025-38697}
  - jfs: Regular file corruption check (Edward Adam Davis) [Orabug: 38394918] {CVE-2025-38698}
  - jfs: truncate good inode pages when hard link is 0 (Lizhi Xu) [Orabug: 38423294] {CVE-2025-39743}
  - scsi: bfa: Double-free fix (Jackysliu) [Orabug: 38394925] {CVE-2025-38699}
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} (Shiji Yang)
  - watchdog: dw_wdt: Fix default timeout (Sebastian Reichel)
  - fs/orangefs: use snprintf() instead of sprintf() (Amir Mohammad Jahangirzad)
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (Showrya M N) [Orabug: 38394931] {CVE-2025-38700}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (Theodore Ts'O) [Orabug: 38394937] {CVE-2025-38701}
  - cifs: Fix calling CIFSFindFirst() for root path without msearch (Pali Rohár)
  - vhost: fail early when __vhost_add_used() fails (Jason Wang)
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 (Álvaro Fernández Rojas)
  - uapi: in6: restore visibility of most IPv6 socket options (Jakub Kicinski)
  - net: ncsi: Fix buffer overflow in fetching version id (Hari Kalavakunta)
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 (Álvaro Fernández Rojas)
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 (Álvaro Fernández Rojas)
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs (Gal Pressman)
  - wifi: iwlegacy: Check rate_idx range after addition (Stanislaw Gruszka)
  - netmem: fix skb_frag_address_safe with unreadable skbs (Mina Almasry)
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. (Thomas Fourier)
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect (Anjaneyulu)
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() (Rand Deeb)
  - net: fec: allow disable coalescing (Jonas Rebmann)
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer (Thomas Fourier)
  - s390/stp: Remove udelay from stp_sync_clock() (Sven Schnelle)
  - wifi: iwlwifi: mvm: fix scan request validation (Avraham Stern)
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() (Alok Tiwari)
  - net: ipv4: fix incorrect MTU in broadcast routes (Oscar Maes)
  - wifi: cfg80211: Fix interface type validation (Ilan Peer)
  - rcu: Protect ->defer_qs_iw_pending from data race (Paul E. McKenney) [Orabug: 38423341] {CVE-2025-39749}
  - net: ag71xx: Add missing check after DMA map (Thomas Fourier)
  - et131x: Add missing check after DMA map (Thomas Fourier)
  - be2net: Use correct byte order and format string for TCP seq and ack_seq (Alok Tiwari)
  - s390/time: Use monotonic clock in get_cycles() (Sven Schnelle)
  - wifi: cfg80211: reject HTC bit for management frames (Johannes Berg)
  - ktest.pl: Prevent recursion of default variable options (Steven Rostedt)
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification (Xinxin Wan)
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros (Cristian Ciocaltea)
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (Lucy Thrun) [Orabug: 38423359] {CVE-2025-39751}
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches (Kees Cook)
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() (Gautham R. Shenoy)
  - usb: core: usb_submit_urb: downgrade type check (Oliver Neukum)
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 (Alok Tiwari)
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection (Mark Brown)
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() (Ulf Hansson)
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (Breno Leitao)
  - ACPI: processor: fix acpi_object initialization (Sebastian Ott)
  - PM: sleep: console: Fix the black screen issue (Tuhaowen)
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads (Hsin-Te Yuan)
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() (Rafael J. Wysocki)
  - selftests: tracing: Use mutex_unlock for testing glob filter (Masami Hiramatsu)
  - ARM: tegra: Use I/O memcpy to write to IRAM (Aaron Kling) [Orabug: 38429180] {CVE-2025-39794}
  - gpio: tps65912: check the return value of regmap_update_bits() (Bartosz Golaszewski)
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed (Kuninori Morimoto)
  - ARM: rockchip: fix kernel hang during smp initialization (Alexander Kochetkov) [Orabug: 38423372] {CVE-2025-39752}
  - cpufreq: Exit governor when failed to start old governor (Lifeng Zheng)
  - usb: xhci: Avoid showing errors during surprise removal (Mario Limonciello)
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command (Jay Chen)
  - usb: xhci: Avoid showing warnings for dying controller (Mario Limonciello)
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t (Cynthia Huang)
  - usb: xhci: print xhci->xhc_state when queue_command failed (Su Hui)
  - securityfs: don't pin dentries twice, once is enough... (Al Viro)
  - hfs: fix not erasing deleted b-tree node issue (Viacheslav Dubeyko)
  - drbd: add missing kref_get in handle_write_conflicts (Sarah Newman) [Orabug: 38394995] {CVE-2025-38708}
  - udf: Verify partition map count (Jan Kara)
  - arm64: Handle KCOV __init vs inline mismatches (Kees Cook)
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() (Tetsuo Handa)
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Viacheslav Dubeyko) [Orabug: 38395027] {CVE-2025-38713}
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395033] {CVE-2025-38714}
  - hfs: fix slab-out-of-bounds in hfs_bnode_read() (Viacheslav Dubeyko) [Orabug: 38395039] {CVE-2025-38715}
  - sctp: linearize cloned gso packets in sctp_rcv (Xin Long) [Orabug: 38395059] {CVE-2025-38718}
  - netfilter: ctnetlink: fix refcount leak on table dump (Florian Westphal) [Orabug: 38395068] {CVE-2025-38721}
  - udp: also consider secpath when evaluating ipsec use for checksumming (Sabrina Dubroca)
  - ACPI: processor: perflib: Move problematic pr->performance check (Rafael J. Wysocki)
  - ACPI: processor: perflib: Fix initial _PPC limit application (Jiayi Li)
  - Documentation: ACPI: Fix parent device references (Andy Shevchenko)
  - fs: Prevent file descriptor table allocations exceeding INT_MAX (Sasha Levin) [Orabug: 38423397] {CVE-2025-39756}
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check (Ma Ke)
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op (Dai Ngo)
  - net: dpaa: fix device leak when querying time stamp info (Johan Hovold)
  - net: gianfar: fix device leak when querying time stamp info (Johan Hovold)
  - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38401319] {CVE-2025-38727}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Takashi Iwai) [Orabug: 38423407] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Takashi Iwai) [Orabug: 38395101] {CVE-2025-38729}
  - io_uring: don't use int for ABI (Pavel Begunkov)
  - usb: gadget : fix use-after-free in composite_dev_cleanup() (Taoxue) [Orabug: 38334898] {CVE-2025-38555}
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init (Jiaxun Yang)
  - USB: serial: option: add Foxconn T99W709 (Slark Xiao)
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38351771,38453914] {CVE-2025-38618}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() (Quang Le) [Orabug: 38351764] {CVE-2025-38617}
  - perf/core: Prevent VMA split of buffer mappings (Thomas Gleixner) [Orabug: 38334948] {CVE-2025-38563}
  - perf/core: Exit early on perf_mmap() fail (Thomas Gleixner) [Orabug: 38334959] {CVE-2025-38565}
  - perf/core: Don't leak AUX buffer refcount on allocation failure (Thomas Gleixner)
  - pptp: fix pptp_xmit() error path (Eric Dumazet)
  - smb: client: let recv_done() cleanup before notifying the callers. (Stefan Metzmacher)
  - benet: fix BUG when creating VFs (Michal Schmidt) [Orabug: 38334976] {CVE-2025-38569}
  - net: drop UFO packets in udp_rcv_segment() (Wang Liang) [Orabug: 38351786] {CVE-2025-38622}
  - ipv6: reject malicious packets in ipv6_gso_segment() (Eric Dumazet) [Orabug: 38334988] {CVE-2025-38572}
  - pptp: ensure minimal skb length in pptp_xmit() (Eric Dumazet) [Orabug: 38335004] {CVE-2025-38574}
  - netpoll: prevent hanging NAPI when netcons gets enabled (Jakub Kicinski)
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (Trond Myklebust) [Orabug: 38401745] {CVE-2025-39730}
  - pci/hotplug/pnv-php: Wrap warnings in macro (Frederic Barrat)
  - pci/hotplug/pnv-php: Improve error msg on power state change failure (Frederic Barrat)
  - usb: chipidea: udc: fix sleeping function called from invalid context (Peter Chen)
  - f2fs: fix to avoid out-of-boundary access in devs.path (Chao Yu) [Orabug: 38351895] {CVE-2025-38652}
  - f2fs: fix to avoid panic in f2fs_evict_inode (Chao Yu) [Orabug: 38335025] {CVE-2025-38577}
  - f2fs: fix to avoid UAF in f2fs_sync_inode_meta() (Chao Yu) [Orabug: 38335033] {CVE-2025-38578}
  - rtc: pcf8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: hym8563: fix incorrect maximum clock rate handling (Brian Masney)
  - rtc: ds1307: fix incorrect maximum clock rate handling (Brian Masney)
  - module: Restore the moduleparam prefix length check (Petr Pavlu)
  - bpf: Check flow_dissector ctx accesses are aligned (Paul Chaignon)
  - mtd: rawnand: atmel: set pmecc data setup time (Balamanikandan Gunasundar)
  - mtd: rawnand: atmel: Fix dma_mapping_error() address (Thomas Fourier)
  - jfs: fix metapage reference count leak in dbAllocCtl (Zheng Yu)
  - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref (Chenyuan Yang) [Orabug: 38351831] {CVE-2025-38630}
  - crypto: qat - fix seq_file position update in adf_ring_next() (Giovanni Cabiddu)
  - dmaengine: nbpfaxi: Add missing check after DMA map (Thomas Fourier)
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap (Thomas Fourier)
  - fs/orangefs: Allow 2 more characters in do_c_string() (Dan Carpenter)
  - soundwire: stream: restore params when prepare ports fail (Bard Liao)
  - crypto: img-hash - Fix dma_unmap_sg() nents value (Thomas Fourier)
  - hwrng: mtk - handle devm_pm_runtime_enable errors (Ovidiu Panait)
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify() (Dan Carpenter)
  - scsi: isci: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: mvsas: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - clk: sunxi-ng: v3s: Fix de clock definition (Paul Kocialkowski)
  - perf tests bp_account: Fix leaked file descriptor (Leo Yan)
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko (Mengbiao Xiong) [Orabug: 38335042] {CVE-2025-38581}
  - pinctrl: sunxi: Fix memory leak on krealloc failure (Yuan Chen)
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set (Charles Han)
  - clk: davinci: Add NULL check in davinci_lpsc_clk_register() (Henry Martin) [Orabug: 38351846] {CVE-2025-38635}
  - mtd: fix possible integer overflow in erase_xfer() (Ivan Stepchenko)
  - crypto: marvell/cesa - Fix engine load inaccuracy (Herbert Xu)
  - PCI: rockchip-host: Fix "Unexpected Completion" log message (Hans Zhang)
  - vrf: Drop existing dst reference in vrf_ip6_input_dst (Stanislav Fomichev)
  - selftests: rtnetlink.sh: remove esp4_offload after test (Xiumei Mu)
  - netfilter: xt_nfacct: don't assume acct name is null-terminated (Florian Westphal) [Orabug: 38351854] {CVE-2025-38639}
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index (Jimmy Assarsson)
  - can: kvaser_pciefd: Store device channel index (Jimmy Assarsson)
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE (Gokul Sivakumar)
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" (Remi Pommarel)
  - mwl8k: Add missing check after DMA map (Thomas Fourier)
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled (Martin Kaistra)
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree (William Liu) [Orabug: 38331466] {CVE-2025-38553}
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX (Johan Korsnes)
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value (Fedor Pchelkin)
  - m68k: Don't unregister boot console needlessly (Finn Thain)
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range (Xin Guo)
  - iwlwifi: Add missing check for alloc_ordered_workqueue (Jiasheng Jiang) [Orabug: 38335110] {CVE-2025-38602}
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init() (Xiu Jianfeng)
  - wifi: rtl818x: Kill URBs before clearing tx status queue (Daniil Dulov) [Orabug: 38335120] {CVE-2025-38604}
  - caif: reduce stack size, again (Arnd Bergmann)
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure (Yuan Chen)
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls (Jiayuan Chen) [Orabug: 38335131] {CVE-2025-38608}
  - staging: nvec: Fix incorrect null termination of battery manufacturer (Alok Tiwari)
  - samples: mei: Fix building on musl libc (Brahmajit Das)
  - cpufreq: Init policy->rwsem before it may be possibly used (Lifeng Zheng)
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface (Annette Kobou)
  - usb: early: xhci-dbc: Fix early_ioremap leak (Lucas De Marchi)
  - Revert "vmci: Prevent the dispatching of uninitialized payloads" (Greg Kroah-Hartman)
  - pps: fix poll support (Denis Osterland-Heim)
  - vmci: Prevent the dispatching of uninitialized payloads (Lizhi Xu)
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() (Abdun Nihaal) [Orabug: 38335153] {CVE-2025-38612}
  - ARM: dts: vfxxx: Correctly use two tuples for timer address (Krzysztof Kozlowski)
  - hfsplus: remove mutex_lock check in hfsplus_free_extents (Yangtao Li) [Orabug: 38351890] {CVE-2025-38650}
  - ASoC: Intel: fix SND_SOC_SOF dependencies (Arnd Bergmann)
  - ethernet: intel: fix building with large NR_CPUS (Arnd Bergmann)
  - usb: phy: mxs: disconnect line when USB charger is attached (Xu Yang)
  - usb: chipidea: add USB PHY event (Xu Yang)
  - usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use (Peter Chen)
  - usb: chipidea: udc: protect usb interrupt enable (Li Jun)
  - usb: chipidea: udc: add new API ci_hdrc_gadget_connect (Peter Chen)
  - ALSA: hda: Add missing NVIDIA HDA codec IDs (Daniel Dadap)
  - comedi: comedi_test: Fix possible deletion of uninitialized timers (Ian Abbott)
  - nilfs2: reject invalid file types when reading inodes (Ryusuke Konishi) [Orabug: 38351921] {CVE-2025-38663}
  - i2c: qup: jump out of the loop in case of timeout (Yang Xiwen) [Orabug: 38351994] {CVE-2025-38671}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Xiang Mei)
  - net: appletalk: Fix use-after-free in AARP proxy probe (Kito Xu) [Orabug: 38351969] {CVE-2025-38666}
  - net: appletalk: fix kerneldoc warnings (Andrew Lunn)
  - RDMA/core: Rate limit GID cache warning messages (Maor Gottlieb)
  - regulator: core: fix NULL dereference on unbind due to stale coupling data (Alessandro Carminati) [Orabug: 38351978] {CVE-2025-38668}
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (Mathias Nyman)
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs (Mathias Nyman)
  - net_sched: sch_sfq: reject invalid perturb period (Eric Dumazet) [Orabug: 38158477] {CVE-2025-38193}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang)
  - power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync (Minghao Chi)
  - power: supply: bq24190_charger: Fix runtime PM imbalance on error (Dinghao Liu)
  - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS (Hongyu Xie)
  - virtio-net: ensure the received length does not exceed allocated size (Bui Quang Minh) [Orabug: 38253834] {CVE-2025-38375}
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode (Arun Raghavan)
  - usb: dwc3: qcom: Don't leave BCR asserted (Krishna Kurapati)
  - usb: musb: fix gadget state on disconnect (Drew Hamilton)
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (William Liu) [Orabug: 38254214] {CVE-2025-38468}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (Dong Chenchen) [Orabug: 38254225] {CVE-2025-38470}
  - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU (Luiz Augusto von Dentz)
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout (Luiz Augusto von Dentz)
  - Bluetooth: SMP: If an unallowed command is received consider it a failure (Luiz Augusto von Dentz)
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() (Kuniyuki Iwashima) [Orabug: 38254241] {CVE-2025-38473}
  - usb: net: sierra: check for no status endpoint (Oliver Neukum) [Orabug: 38254249] {CVE-2025-38474}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (Xiang Mei) [Orabug: 38254266] {CVE-2025-38477}
  - net: emaclite: Fix missing pointer increment in aligned_read() (Alok Tiwari)
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits() (Ian Abbott) [Orabug: 38254278] {CVE-2025-38480}
  - comedi: Fix some signed shift left operations (Ian Abbott)
  - comedi: das6402: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254294] {CVE-2025-38482}
  - comedi: das16m1: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38254301] {CVE-2025-38483}
  - comedi: aio_iiro_16: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324231] {CVE-2025-38529}
  - comedi: pcl812: Fix bit shift out of bounds (Ian Abbott) [Orabug: 38324238] {CVE-2025-38530}
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler (Chen Ni)
  - iio: adc: max1363: Reorder mode_list[] entries (Fabio Estevam)
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] (Fabio Estevam)
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled (Andrew Jeffery)
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order (Andrew Jeffery)
  - mmc: sdhci_am654: Workaround for Errata i2312 (Judith Mendez)
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models (Edson Juliano Drosdeck)
  - mmc: bcm2835: Fix dma_unmap_sg() nents value (Thomas Fourier)
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() (Nathan Chancellor)
  - isofs: Verify inode mode when loading from disk (Jan Kara)
  - dmaengine: nbpfaxi: Fix memory corruption in probe() (Dan Carpenter) [Orabug: 38324264] {CVE-2025-38538}
  - af_packet: fix soft lockup issue caused by tpacket_snd() (Yun Lu)
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() (Yun Lu)
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() (Nathan Chancellor)
  - HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38254340,38453904] {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte (Benjamin Tissoires)
  - HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38254348,38453908] {CVE-2025-38495}
  - pch_uart: Fix dma_sync_sg_for_device() nents value (Thomas Fourier)
  - Input: xpad - set correct controller type for Acer NGR200 (Nilton Perim Neto)
  - i2c: stm32: fix the device used for the DMA map (Clément Le Goffic)
  - usb: gadget: configfs: Fix OOB read on empty string write (Xinyu Liu) [Orabug: 38254358] {CVE-2025-38497}
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI (Ryan Mann)
  - USB: serial: option: add Foxconn T99W640 (Slark Xiao)
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition (Fabio Porcedda)
  - LTS tag: v5.4.296 (Sherry Yang)
  - x86/mm: Disable hugetlb page table sharing on 32-bit (Jann Horn)
  - Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID (Hans de Goede)
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras (Chia-Lin Kao) [Orabug: 38324280] {CVE-2025-38540}
  - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY (Zhang Heng)
  - vt: add missing notification when switching back to text mode (Nicolas Pitre)
  - net: usb: qmi_wwan: add SIMCom 8230C composition (Xiaowei Li)
  - atm: idt77252: Add missing `dma_map_error()` (Thomas Fourier)
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT (Somnath Kotur) [Orabug: 38254090] {CVE-2025-38439}
  - bnxt_en: Fix DCB ETS validation (Shravya Kn)
  - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level (Sean Nyekjaer)
  - net: phy: microchip: limit 100M workaround to link-down events on LAN88xx (Oleksij Rempel)
  - net: appletalk: Fix device refcount leak in atrtr_create() (Kito Xu) [Orabug: 38324290] {CVE-2025-38542}
  - md/raid1: Fix stack memory use after return in raid1_reshape (Wang Jinchao) [Orabug: 38254109] {CVE-2025-38445}
  - wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() (Daniil Dulov) [Orabug: 38324161] {CVE-2025-38513}
  - dma-buf: fix timeout handling in dma_resv_wait_timeout v2 (Christian König)
  - Input: xpad - support Acer NGR 200 Controller (Nilton Perim Neto)
  - Input: xpad - add VID for Turtle Beach controllers (Vicki Pfau)
  - Input: xpad - add support for Amazon Game Controller (Matt Reynolds)
  - NFSv4/flexfiles: Fix handling of NFS level errors in I/O (Trond Myklebust)
  - flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes (Tigran Mkrtchyan)
  - RDMA/mlx5: Fix vport loopback for MPV device (Patrisious Haddad)
  - netlink: Fix rmem check in netlink_broadcast_deliver(). (Kuniyuki Iwashima)
  - netlink: make sure we allow at least one dump skb (Jakub Kicinski)
  - Revert "ACPI: battery: negate current when discharging" (Rafael J. Wysocki)
  - usb: gadget: u_serial: Fix race condition in TTY wakeup (Kuen-Han Tsai) [Orabug: 38254118] {CVE-2025-38448}
  - drm/sched: Increment job count before swapping tail spsc queue (Matthew Brost) [Orabug: 38324180] {CVE-2025-38515}
  - pinctrl: qcom: msm: mark certain pins as invalid for interrupts (Bartosz Golaszewski) [Orabug: 38324186] {CVE-2025-38516}
  - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel (Jp Kobryn)
  - x86/mce: Don't remove sysfs if thresholding sysfs init fails (Yazen Ghannam)
  - x86/mce/amd: Fix threshold limit reset (Yazen Ghannam)
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct (David Howells) [Orabug: 38324172] {CVE-2025-38514}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Victor Nogueira) [Orabug: 38254147] {CVE-2025-38457}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() (Yue Haibing) [Orabug: 38254153] {CVE-2025-38458}
  - atm: clip: Fix infinite recursive call of clip_push(). (Kuniyuki Iwashima) [Orabug: 38254161] {CVE-2025-38459}
  - atm: clip: Fix memory leak of struct clip_vcc. (Kuniyuki Iwashima) [Orabug: 38324309] {CVE-2025-38546}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). (Kuniyuki Iwashima) [Orabug: 38254167] {CVE-2025-38460}
  - tipc: Fix use-after-free in tipc_conn_close(). (Kuniyuki Iwashima) [Orabug: 38254181] {CVE-2025-38464}
  - netlink: Fix wraparounds of sk->sk_rmem_alloc. (Kuniyuki Iwashima) [Orabug: 38254188] {CVE-2025-38465}
  - fix proc_sys_compare() handling of in-lookup dentries (Al Viro)
  - proc: Clear the pieces of proc_inode that proc_evict_inode cares about (Eric W. Biederman)
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling (Kaustabh Chakraborty) [Orabug: 38254203] {CVE-2025-38467}
  - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() (Nathan Chancellor)
  - media: uvcvideo: Rollback non processed entities on error (Ricardo Ribalda)
  - media: uvcvideo: Send control events for partial succeeds (Ricardo Ribalda)
  - media: uvcvideo: Return the number of processed controls (Ricardo Ribalda)
  - ACPI: PAD: fix crash in exit_round_robin() (Seiji Nishikawa) [Orabug: 37206006] {CVE-2024-49935}
  - usb: typec: displayport: Fix potential deadlock (Andrei Kuchynski) [Orabug: 38401436] {CVE-2025-38404}
  - Logitech C-270 even more broken (Oliver Neukum)
  - rose: fix dangling neighbour pointers in rose_rt_device_down() (Kohei Enju) [Orabug: 38253842] {CVE-2025-38377}
  - net: rose: Fix fall-through warnings for Clang (Gustavo A R Silva)
  - drm/i915/gt: Fix timeline left held on VMA alloc error (Janusz Krzysztofik) [Orabug: 38253887] {CVE-2025-38389}
  - drm/i915/selftests: Change mock_request() to return error pointers (Dan Carpenter)
  - spi: spi-fsl-dspi: Clear completion counter before initiating transfer (James Clark)
  - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (Vladimir Oltean)
  - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (Vladimir Oltean)
  - dpaa2-eth: fix xdp_rxq_info leak (Wangfushuai)
  - ethernet: atl1: Add missing DMA mapping error checks and count errors (Thomas Fourier)
  - btrfs: use btrfs_record_snapshot_destroy() during rmdir (Filipe Manana)
  - btrfs: propagate last_unlink_trans earlier when doing a rmdir (Filipe Manana)
  - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad)
  - RDMA/core: Create and destroy counters in the ib_core (Leon Romanovsky)
  - scsi: ufs: core: Fix spelling of a sysfs attribute name (Bart Van Assche)
  - drm/v3d: Disable interrupts before resetting the GPU (Maíra Canal) [Orabug: 38253821] {CVE-2025-38371}
  - mtk-sd: reset host->mrq on prepare_data() error (Sergey Senozhatsky)
  - mtk-sd: Prevent memory corruption from DMA map failure (Masami Hiramatsu) [Orabug: 38253928] {CVE-2025-38401}
  - mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() (Yue Hu)
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods (Manivannan Sadhasivam) [Orabug: 38253907] {CVE-2025-38395}
  - regulator: gpio: Add input_supply support in gpio_regulator_config (Jerome Neanne)
  - ACPICA: Refuse to evaluate a method if arguments are missing (Rafael J. Wysocki) [Orabug: 38253875] {CVE-2025-38386}
  - wifi: ath6kl: remove WARN on bad firmware input (Johannes Berg) [Orabug: 38253946] {CVE-2025-38406}
  - wifi: mac80211: drop invalid source address OCB frames (Johannes Berg)
  - powerpc: Fix struct termio related ioctl macros (Madhavan Srinivasan)
  - ata: pata_cs5536: fix build on 32-bit UML (Johannes Berg)
  - ALSA: sb: Force to disable DMAs once when DMA mode is changed (Takashi Iwai)
  - nui: Fix dma_mapping_error() check (Thomas Fourier)
  - enic: fix incorrect MTU comparison in enic_change_mtu() (Alok Tiwari)
  - amd-xgbe: align CL37 AN sequence as per databook (Raju Rangoju)
  - lib: test_objagg: Set error message in check_expect_hints_stats() (Dan Carpenter)
  - drm/exynos: fimd: Guard display clock control with runtime PM calls (Marek Szyprowski)
  - btrfs: fix missing error handling when searching for inode refs during log replay (Filipe Manana)
  - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() (Thomas Fourier)
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. (Kuniyuki Iwashima) [Orabug: 38253923] {CVE-2025-38400}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Mark Zhang) [Orabug: 38253881] {CVE-2025-38387}
  - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment (David Thompson)
  - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data (Masami Hiramatsu)
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments (Rd Babiera) [Orabug: 38253894] {CVE-2025-38391}
  - mmc: sdhci: Add a helper function for dump register in dynamic debug mode (Victor Shih)
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (Harshavardhana S A) [Orabug: 38253937] {CVE-2025-38403}
  - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (Omar Sandoval) [Orabug: 36530119] {CVE-2024-26644}
  - arm64: Restrict pagetable teardown to avoid false warning (Dev Jain)
  - s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS (Nathan Chancellor)
  - drm/bridge: cdns-dsi: Check return value when getting default PHY config (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix connecting to next bridge (Aradhya Bhatia)
  - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid() (Aradhya Bhatia)
  - drm/tegra: Assign plane type before registration (Thierry Reding)
  - HID: wacom: fix kobject reference count leak (Qasim Ijaz)
  - HID: wacom: fix memory leak on sysfs attribute creation failure (Qasim Ijaz)
  - HID: wacom: fix memory leak on kobject creation failure (Qasim Ijaz)
  - dm-raid: fix variable in journal device check (Heinz Mauelshagen)
  - Bluetooth: L2CAP: Fix L2CAP MTU negotiation (Frédéric Danis)
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). (Kuniyuki Iwashima) [Orabug: 38175045] {CVE-2025-38245}
  - net: enetc: Correct endianness handling in _enetc_rd_reg64 (Simon Horman)
  - um: ubd: Add missing error check in start_io_thread() (Tiwei Bie)
  - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors (Stefano Garzarella)
  - wifi: mac80211: fix beacon interval calculation overflow (Lachlan Hodges)
  - attach_recursive_mnt(): do not lock the covering tree when sliding something under it (Al Viro)
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() (Youngjun Lee) [Orabug: 38175065] {CVE-2025-38249}
  - i2c: robotfuzz-osif: disable zero-length read messages (Wolfram Sang)
  - i2c: tiny-usb: disable zero-length read messages (Wolfram Sang)
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Shin'Ichiro Kawasaki) [Orabug: 38158592] {CVE-2025-38211}
  - RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private (Weihang Li)
  - media: vivid: Change the siize of the composing (Denis Arefev) [Orabug: 38158681] {CVE-2025-38226}
  - media: omap3isp: use sgtable-based scatterlist wrappers (Marek Szyprowski)
  - media: cxusb: no longer judge rbuf when the write fails (Edward Adam Davis) [Orabug: 38158692] {CVE-2025-38229}
  - media: cxusb: use dev_dbg() rather than hand-rolled debug (Sean Young)
  - jfs: validate AG parameters in dbMount() to prevent crashes (Vasiliy Kovalev) [Orabug: 38158701] {CVE-2025-38230}
  - fs/jfs: consolidate sanity checking in dbMount (Dave Kleikamp)
  - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing (Martin Blumenstingl)
  - of: Add of_property_present() helper (Rob Herring)
  - of: property: define of_property_read_u{8,16,32,64}_array() unconditionally (Michael Walle)
  - kbuild: hdrcheck: fix cross build with clang (Arnd Bergmann)
  - kbuild: add --target to correctly cross-compile UAPI headers with Clang (Masahiro Yamada)
  - bpfilter: match bit size of bpfilter_umh to that of the kernel (Masahiro Yamada)
  - kbuild: use -MMD instead of -MD to exclude system headers from dependency (Masahiro Yamada)
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify (Ma Wupeng) [Orabug: 38152869] {CVE-2025-38102}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (George Kennedy)
  - ovl: Check for NULL d_inode() in ovl_dentry_upper() (Kees Cook)
  - ceph: fix possible integer overflow in ceph_zero_objects() (Dmitry Kandybka)
  - ALSA: hda: Ignore unsol events for cards being shut down (Cezary Rojewski)
  - usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode (Jos Wang)
  - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s (Robert Hodaszi)
  - usb: Add checks for snprintf() calls in usb_alloc_dev() (Andy Shevchenko)
  - tty: serial: uartlite: register uart driver in init (Jakub Lewalski) [Orabug: 38175114] {CVE-2025-38262}
  - usb: potential integer overflow in usbg_make_tpg() (Chen Yufeng)
  - iio: pressure: zpa2326: Use aligned_s64 for the timestamp (Jonathan Cameron)
  - md/md-bitmap: fix dm-raid max_write_behind setting (Yu Kuai)
  - dmaengine: xilinx_dma: Set dma_device directions (Thomas Gessler)
  - mfd: max14577: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski)
  - mailbox: Not protect module_put with spin_lock_irqsave (Peng Fan)
  - cifs: Fix cifs_query_path_info() for Windows NT servers (Pali Rohár)

• Wed Sep 03 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.6.el8uek]

  - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926,38394593] {CVE-2025-37752}
  - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926]
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) [Orabug: 38377926] {CVE-2024-57996}
  - net_sched: sch_sfq: handle bigger packets (Eric Dumazet) [Orabug: 38377926]
  - net_sched: sch_sfq: annotate data-races around q->perturb_period (Eric Dumazet) [Orabug: 38377926]

• Thu Aug 28 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.5.el8uek]

  - squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343661]
  - netfilter: nf_tables: adjust lockdep assertions handling (Fedor Pchelkin)
  - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" (Helge Deller) [Orabug: 38343661]
  - ASoC: ops: dynamically allocate struct snd_ctl_elem_value (Arnd Bergmann)

• Thu Aug 21 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.4.el8uek]

  - KVM: x86: use array_index_nospec with indices that come from guest (Thijs Raymakers) [Orabug: 38319938,38440302] {CVE-2025-39823}
  - KVM: APIC: add helper func to remove duplicate code in kvm_pv_send_ipi (Miaohe Lin) [Orabug: 38319938]
  - rds: Fix NULL ptr deref in xas_start (Håkon Bugge) [Orabug: 38169303]

• Thu Aug 07 2025 Sherry Yang <sherry.yang@oracle.com> [5.4.17-2136.347.3.el8uek]

  - mm: make page_mapped_in_vma() hugetlb walk aware (Jane Chu) [Orabug: 38146326]
  - mm/rmap: Fix handling of hugetlbfs pages in page_vma_mapped_walk (Zhenwei Pi) [Orabug: 38146326]

• Thu Jul 31 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.2.el8uek]

  - rds: tcp: block BH in TCP callbacks (Eric Dumazet) [Orabug: 38236847]
  - kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [Orabug: 38134902]
  - module: correctly exit module_kallsyms_on_each_symbol when fn() != 0 (Jon Mediero) [Orabug: 37820709]
  - module: potential uninitialized return in module_kallsyms_on_each_symbol() (Dan Carpenter) [Orabug: 37820709]
  - module: use RCU to synchronize find_module (Christoph Hellwig) [Orabug: 37820709]
  - kallsyms: refactor {,module_}kallsyms_on_each_symbol (Christoph Hellwig) [Orabug: 37820709]

• Thu Jul 31 2025 Alok Tiwari <alok.a.tiwari@oracle.com> [5.4.17-2136.347.1.el8uek]

  - LTS tag: v5.4.295 (Alok Tiwari)
  - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops (Kees Cook)
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() (Tengda Wu) [Orabug: 38180596] {CVE-2025-38320}
  - perf: Fix sample vs do_exit() (Peter Zijlstra) [Orabug: 38254030] {CVE-2025-38424}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Heiko Carstens)
  - rtc: test: Fix invalid format specifier. (David Gow)
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() (Jeongjun Park) [Orabug: 38180707] {CVE-2025-38337}
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976985] {CVE-2025-37958}
  - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat)
  - rtc: Improve performance of rtc_time64_to_tm(). Add tests. (Cassio Neri)
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (Dan Aloni) [Orabug: 37101886] {CVE-2022-48773}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [Orabug: 38223087] {CVE-2025-38352}
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms (Geert Uytterhoeven)
  - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time (Colin Foster)
  - ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board (Shengyu Qu)
  - net: atm: fix /proc/net/atm/lec handling (Eric Dumazet) [Orabug: 38158407] {CVE-2025-38180}
  - net: atm: add lec_mutex (Eric Dumazet) [Orabug: 38180612] {CVE-2025-38323}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). (Kuniyuki Iwashima) [Orabug: 38158413] {CVE-2025-38181}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (Haixia Qu) [Orabug: 38158425] {CVE-2025-38184}
  - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior (Neal Cardwell)
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send(). (Kuniyuki Iwashima) [Orabug: 38158434] {CVE-2025-38185}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). (Kuniyuki Iwashima) [Orabug: 38180618] {CVE-2025-38324}
  - wifi: carl9170: do not ping device which has failed to load firmware (Dmitry Antipov) [Orabug: 38254011] {CVE-2025-38420}
  - aoe: clean device rq_list in aoedev_downdev() (Justin Sanders) [Orabug: 38180629] {CVE-2025-38326}
  - hwmon: (occ) fix unaligned accesses (Arnd Bergmann)
  - drm/nouveau/bl: increase buffer size to avoid truncate warning (Jacob Keller)
  - erofs: remove unused trace event erofs_destroy_inode (Gao Xiang)
  - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged (Jonathan Lane)
  - ALSA: hda/intel: Add Thinkpad E15 to PM deny list (Takashi Iwai)
  - Input: sparcspkr - avoid unannotated fall-through (Yuli Wang)
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (Terry Junge) [Orabug: 38152878] {CVE-2025-38103}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. (Kuniyuki Iwashima) [Orabug: 38158458] {CVE-2025-38190}
  - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (Stephen Smalley)
  - scsi: s390: zfcp: Ensure synchronous unit_add (Peter Oberparleiter)
  - scsi: storvsc: Increase the timeouts to storvsc_timeout (Dexuan Cui)
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places (Fedor Pchelkin) [Orabug: 38180636] {CVE-2025-38328}
  - jffs2: check that raw node were preallocated before writing summary (Artem Sadovnikov) [Orabug: 38158484] {CVE-2025-38194}
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite (Andrew Morton) [Orabug: 38137454] {CVE-2025-38090}
  - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery (Narayana Murty N)
  - platform/x86: dell_rbu: Stop overwriting data buffer (Stuart Hayes)
  - platform: Add Surface platform directory (Maximilian Luz)
  - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first" (Alexander Sverdlin)
  - tee: Prevent size calculation wraparound on 32-bit kernels (Jann Horn)
  - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY (Sukrut Bellary)
  - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value (Laurentiu Tudor)
  - watchdog: da9052_wdt: respect TWDMIN (Marcus Folkesson)
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Kyungwook Boo) [Orabug: 38158518] {CVE-2025-38200}
  - sock: Correct error checking condition for (assign|release)_proto_idx() (Zijun Hu)
  - scsi: lpfc: Use memcpy() for BIOS version (Daniel Wagner) [Orabug: 38180668] {CVE-2025-38332}
  - vxlan: Do not treat dst cache initialization errors as fatal (Ido Schimmel)
  - clk: rockchip: rk3036: mark ddrphy as critical (Heiko Stuebner)
  - wifi: mac80211: do not offer a mesh path if forwarding is disabled (Benjamin Berg)
  - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info (Jason Xing)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() (Gabor Juhos)
  - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() (Gabor Juhos)
  - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT (Sebastian Andrzej Siewior)
  - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows (Eric Dumazet)
  - tcp: always seek for minimal rtt in tcp_rcv_rtt_update() (Eric Dumazet)
  - net: dlink: add synchronization for stats update (Moon Yeounsu)
  - sctp: Do not wake readers in __sctp_write_space() (Petr Malat)
  - emulex/benet: correct command version selection in be_cmd_get_stats() (Alok Tiwari)
  - i2c: designware: Invoke runtime suspend on quick slave re-registration (Tan En De)
  - net: macb: Check return value of dma_set_mask_and_coherent() (Sergio Perez Gonzalez)
  - cpufreq: Force sync policy boost with global boost on sysfs update (Viresh Kumar)
  - nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults (Simon Schuster)
  - media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (Xu Wang) [Orabug: 38175014] {CVE-2025-38237}
  - media: tc358743: ignore video while HPD is low (Hans Verkuil)
  - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB (Amber Lin)
  - jfs: Fix null-ptr-deref in jfs_ioc_trim (Dylan Wolff) [Orabug: 38158546] {CVE-2025-38203}
  - drm/amdgpu/gfx9: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx8: fix CSIB handling (Alex Deucher)
  - jfs: fix array-index-out-of-bounds read in add_missing_indices (Aditya Dutt) [Orabug: 38158553] {CVE-2025-38204}
  - drm/amdgpu/gfx7: fix CSIB handling (Alex Deucher)
  - drm/amdgpu/gfx10: fix CSIB handling (Alex Deucher)
  - drm/msm/a6xx: Increase HFI response timeout (Akhil P Oommen)
  - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() (Srinivasan Shanmugam)
  - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition (Nas Chung)
  - drm/msm/hdmi: add runtime PM calls to DDC transfer function (Dmitry Baryshkov)
  - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq() (Damon Ding)
  - sunrpc: update nextcheck time when adding new cache entries (Long Li)
  - drm/amdgpu/gfx6: fix CSIB handling (Alex Deucher)
  - ACPI: battery: negate current when discharging (Peter Marheine)
  - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn() (Charan Teja Kalla)
  - power: supply: bq27xxx: Retrieve again when busy (Jerry Lv)
  - ACPICA: fix acpi parse and parseext cache leaks (Seunghun Han) [Orabug: 38180748] {CVE-2025-38344}
  - ACPICA: Avoid sequence overread in call to strncmp() (Ahmed Salem)
  - ACPICA: fix acpi operand cache leak in dswstate.c (Seunghun Han) [Orabug: 38180756] {CVE-2025-38345}
  - iio: adc: ad7606_spi: fix reg write value mask (David Lechner)
  - PCI: Fix lock symmetry in pci_slot_unlock() (Ilpo Järvinen)
  - PCI: Add ACS quirk for Loongson PCIe (Huacai Chen)
  - uio_hv_generic: Use correct size for interrupt and monitor pages (Long Li)
  - regulator: max14577: Add error check for max14577_read_reg() (Xu Wang)
  - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS (Khem Raj)
  - staging: iio: ad5933: Correct settling cycles encoding per datasheet (Gabriel)
  - net: ch9200: fix uninitialised access during mii_nway_restart (Qasim Ijaz) [Orabug: 38132189] {CVE-2025-38086}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled (Ye Bin) [Orabug: 38180768] {CVE-2025-38346}
  - dm-mirror: fix a tiny race condition (Mikulas Patocka)
  - mtd: nand: sunxi: Add randomizer configuration before randomizer enable (Xu Wang)
  - mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk (Xu Wang)
  - mm: fix ratelimit_pages update error in dirty_ratio_handler() (Jinliang Zheng)
  - ipc: fix to protect IPCS lookups using RCU (Jeongjun Park) [Orabug: 38158598] {CVE-2025-38212}
  - parisc: fix building with gcc-15 (Arnd Bergmann)
  - vgacon: Add check for vc_origin address range in vgacon_scroll() (Gong, Ruiqi)
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var (Murad Masimov) [Orabug: 38158615] {CVE-2025-38214}
  - EDAC/altera: Use correct write width with the INTTEST register (Niravkumar L Rabara)
  - NFC: nci: uart: Set tty->disc_data only in success path (Krzysztof Kozlowski) [Orabug: 38253992] {CVE-2025-38416}
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image (Jaegeuk Kim) [Orabug: 38158649] {CVE-2025-38219}
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware() (Dan Carpenter) [Orabug: 38254054] {CVE-2025-38428}
  - ext4: fix calculation of credits for extent tree modification (Jan Kara)
  - ext4: inline: fix len overflow in ext4_prepare_inline_data (Thadeu Lima de Souza Cascardo) [Orabug: 38158662] {CVE-2025-38222}
  - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device (Ioana Ciornei)
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (Tasos Sahanidis) [Orabug: 38180697] {CVE-2025-38336}
  - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap() (Ross Stutterheim)
  - media: v4l2-dev: fix error handling in __video_register_device() (Ma Ke)
  - media: gspca: Add error handling for stv06xx_read_sensor() (Xu Wang)
  - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 (Mingcong Bai)
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request (Neil Brown) [Orabug: 38254062] {CVE-2025-38430}
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() (Christian Lamparter) [Orabug: 38180783] {CVE-2025-38348}
  - gfs2: move msleep to sleepable context (Alexander Aring)
  - configfs: Do not override creating attribute file failure in populate_attrs() (Zijun Hu)
  - net: usb: aqc111: debug info before sanitation (Oliver Neukum)
  - calipso: unlock rcu before returning -EAFNOSUPPORT (Eric Dumazet)
  - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall (Stefano Stabellini)
  - usb: Flush altsetting 0 endpoints before reinitializating them after reset. (Mathias Nyman)
  - fs/filesystems: Fix potential unsigned integer underflow in fs_name() (Zijun Hu)
  - net/mdiobus: Fix potential out-of-bounds read/write access (Jakub Raczynski)
  - drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang (Nathan Chancellor)
  - drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang (Nathan Chancellor)
  - MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option (Nathan Chancellor)
  - x86/boot/compressed: prefer cc-option for CFLAGS additions (Nick Desaulniers)
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided (Andrew Lunn)
  - net_sched: tbf: fix a race in tbf_change() (Eric Dumazet)
  - net_sched: red: fix a race in __red_change() (Eric Dumazet) [Orabug: 38152899] {CVE-2025-38108}
  - net_sched: prio: fix a race in prio_tune() (Eric Dumazet) [Orabug: 38105335] {CVE-2025-38083}
  - net/mlx5: Fix return value when searching for existing flow group (Patrisious Haddad)
  - net/mlx5: Wait for inactive autogroups (Paul Blakey)
  - i40e: retry VFLR handling if there is ongoing VF reset (Robert Malz)
  - i40e: return false from i40e_reset_vf if reset is in progress (Robert Malz)
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling (Eric Dumazet) [Orabug: 38152923] {CVE-2025-38115}
  - scsi: iscsi: Fix incorrect error path labels for flashnode operations (Alok Tiwari)
  - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (Chuck Lever) [Orabug: 36954169] {CVE-2022-48829}
  - NFSD: Fix ia_size underflow (Chuck Lever) [Orabug: 36954164] {CVE-2022-48828}
  - Input: synaptics-rmi - fix crash with unsupported versions of F34 (Dmitry Torokhov)
  - Input: synaptics-rmi4 - convert to use sysfs_emit() APIs (Zhang Songyi)
  - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter)
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Al Viro) [Orabug: 38256450] {CVE-2025-38498}
  - ice: create new Tx scheduler nodes for new queues only (Michal Kubiak)
  - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION (Luiz Augusto von Dentz)
  - net/mlx4_en: Prevent potential integer overflow calculating Hz (Dan Carpenter)
  - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl() (Nicolas Pitre)
  - serial: Fix potential null-ptr-deref in mlb_usio_probe() (Henry Martin) [Orabug: 38153012] {CVE-2025-38135}
  - usb: renesas_usbhs: Reorder clock handling and power management in probe (Lad Prabhakar) [Orabug: 38153017] {CVE-2025-38136}
  - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat)
  - rtc: sh: assign correct interrupts with DT (Wolfram Sang)
  - perf record: Fix incorrect --user-regs comments (Dapeng Mi)
  - perf tests switch-tracking: Fix timestamp comparison (Leo Yan)
  - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE (Alexey Gladkov)
  - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() (Christophe Jaillet)
  - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() (Dan Carpenter)
  - perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3 (Adrian Hunter)
  - perf ui browser hists: Set actions->thread before calling do_zoom_thread() (Arnaldo Carvalho de Melo)
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() (Sergey Shtylyov) [Orabug: 38180566] {CVE-2025-38312}
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() (Henry Martin) [Orabug: 38153060] {CVE-2025-38145}
  - soc: aspeed: lpc: Fix impossible judgment condition (Su Hui)
  - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou (Quentin Schulz)
  - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device (Dmitry Baryshkov)
  - bus: fsl-mc: fix double-free on mc_dev (Ioana Ciornei) [Orabug: 38180573] {CVE-2025-38313}
  - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() (Ryusuke Konishi)
  - nilfs2: add pointer check for nilfs_direct_propagate() (Xu Wang)
  - Squashfs: check return result of sb_min_blocksize (Phillip Lougher) [Orabug: 38253985] {CVE-2025-38415}
  - ARM: dts: at91: at91sam9263: fix NAND chip selects (Wolfram Sang)
  - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select (Wolfram Sang)
  - f2fs: fix to correct check conditions in f2fs_cross_rename (Zhiguo Niu)
  - f2fs: use d_inode(dentry) cleanup dentry->d_inode (Zhiguo Niu)
  - calipso: Don't call calipso functions for AF_INET sk. (Kuniyuki Iwashima) [Orabug: 38153070] {CVE-2025-38147}
  - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy (Thangaraj Samynathan)
  - net: usb: aqc111: fix error handling of usbnet read calls (Nikita Zhandarovich) [Orabug: 38153090] {CVE-2025-38153}
  - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy (Florian Westphal)
  - wifi: ath9k_htc: Abort software beacon handling if disabled (Toke Høiland-Jørgensen) [Orabug: 38153110] {CVE-2025-38157}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs (Tao Chen) [Orabug: 38180489] {CVE-2025-38285}
  - pinctrl: at91: Fix possible out-of-boundary access (Andy Shevchenko) [Orabug: 38180495] {CVE-2025-38286}
  - ktls, sockmap: Fix missing uncharge operation (Jiayuan Chen)
  - netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it (Huajian Yang)
  - f2fs: clean up w/ fscrypt_is_bounce_page() (Chao Yu)
  - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h (Junxian Huang)
  - wifi: rtw88: do not ignore hardware read error during DPK (Dmitry Antipov)
  - net: ncsi: Fix GCPS 64-bit member variables (Hari Kalavakunta)
  - f2fs: fix to do sanity check on sbi->total_valid_block_count (Chao Yu) [Orabug: 38153150] {CVE-2025-38163}
  - drm/tegra: rgb: Fix the unbound reference count (Biju Das)
  - drm/vkms: Adjust vkms_state->active_planes allocation type (Kees Cook)
  - drm: rcar-du: Fix memory leak in rcar_du_vsps_init() (Biju Das)
  - selftests/seccomp: fix syscall_restart test for arm compat (Neill Kapron)
  - firmware: psci: Fix refcount leak in psci_dt_init (Miaoqian Lin)
  - m68k: mac: Fix macintosh_config for Mac II (Finn Thain)
  - drm/vmwgfx: Add seqno waiter for sync_files (Ian Forbes)
  - spi: sh-msiof: Fix maximum DMA transfer size (Geert Uytterhoeven)
  - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" (Armin Wolf)
  - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (Jiaqing Zhao)
  - PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks() (Zijun Hu)
  - EDAC/skx_common: Fix general protection fault (Qiuxu Zhuo) [Orabug: 38180525] {CVE-2025-38298}
  - crypto: marvell/cesa - Avoid empty transfer descriptor (Herbert Xu)
  - crypto: marvell/cesa - Handle zero-length skcipher requests (Herbert Xu) [Orabug: 38153190] {CVE-2025-38173}
  - x86/cpu: Sanitize CPUID(0x80000000) output (Ahmed S. Darwish)
  - perf/core: Fix broken throttling when max_samples_per_tick=1 (Qing Wang)
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher)
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [Orabug: 37116555] {CVE-2024-46855}
  - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) [Orabug: 38158384] {CVE-2025-38174}
  - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler)
  - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie)
  - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li)
  - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos)
  - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos)