[ubuntu/jammy-security] linux-azure-6.8 6.8.0-1051.57~22.04.1 (Accepted)

Andy Whitcroft apw at canonical.com
Wed Mar 25 08:26:06 UTC 2026


linux-azure-6.8 (6.8.0-1051.57~22.04.1) jammy; urgency=medium

  [ Ubuntu-azure: 6.8.0-1051.57 ]

  [ Ubuntu: 6.8.0-106.106 ]
  * Miscellaneous upstream changes
    - apparmor: validate DFA start states are in bounds in unpack_pdb
    - apparmor: fix memory leak in verify_header
    - apparmor: replace recursive profile removal with iterative approach
    - apparmor: fix: limit the number of levels of policy namespaces
    - apparmor: fix side-effect bug in match_char() macro usage
    - apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
    - apparmor: Fix double free of ns_name in aa_replace_profiles()
    - apparmor: fix unprivileged local user can do privileged policy
      management
    - apparmor: fix differential encoding verification
    - apparmor: fix race on rawdata dereference
    - apparmor: fix race between freeing data and fs accessing it

linux-azure-6.8 (6.8.0-1049.55~22.04.1) jammy; urgency=medium

  * jammy/linux-azure-6.8: 6.8.0-1049.55~22.04.1 -proposed tracker (LP: #2141075)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.azure-6.8/dkms-versions -- update from kernel-
      versions (main/2026.02.09)

  [ Ubuntu-azure: 6.8.0-1049.55 ]

  * noble/linux-azure: 6.8.0-1049.55 -proposed tracker (LP: #2141849)
  [ Ubuntu: 6.8.0-104.104 ]
  * noble/linux: 6.8.0-104.104 -proposed tracker (LP: #2141774)
  * Change of ABI in 6.8.0 kernel breaks some OTT modules (LP: #2141778)
    - Revert "net: tls: Cancel RX async resync request on rcd_delta overflow"
    - Revert "net: tls: Change async resync helpers argument"

  [ Ubuntu-azure: 6.8.0-1048.54 ]

  * noble/linux-azure: 6.8.0-1048.54 -proposed tracker (LP: #2141076)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.azure/dkms-versions -- update from kernel-versions
      (main/2026.02.09)
  [ Ubuntu: 6.8.0-103.103 ]
  * noble/linux: 6.8.0-103.103 -proposed tracker (LP: #2141411)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2026.02.09)
  * xhci_find_slot_id_by_port kernel panic on boot on arm64 (LP: #2141314)
    - Revert "xhci: fix stale flag preventig URBs after link state error is
      cleared"
  * Boot up hang with ucsi call trace while plug power cord or device on tbt5
    port (LP: #2127764)
    - SAUCE: usb: typec: ucsi: Fix workqueue destruction race during connector
      cleanup
  * TBT call trace while connecting TBT4 monitor on TBT5 port (LP: #2137613)
    - thunderbolt: Show path name in debug log when path is deactivated
    - thunderbolt: Log path activation failures without WARN backtraces
  *  x86: tsc: Fix TSC clock source being disabled when SNC is enabled causing
    fall back to less precise HPET (LP: #2138120)
    - x86/tsc: Use topology_max_packages() to get package number
  * Random flickering with Intel i915 (CoffeeLake and WhiskeyLake) on Linux
    6.8 (LP: #2136958)
    - SAUCE: iommu/intel: disable DMAR for CFL and WHL integrated gfx
  * CXL: Fix slab-out-of-bounds in cxl_setup_parent_dport (LP: #2130240)
    - cxl/pci: Get AER capability address from RCRB only for RCH dport
    - cxl/test: Skip cxl_setup_parent_dport() for emulated dports
  * net:tap in ubuntu_kselftests_net fails on Noble (buffer overflow detected)
    (LP: #2067642)
    - SAUCE: selftests: net: fix "buffer overflow detected" for tap.c
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633)
    - Bluetooth: SMP: Fix not generating mackey and ltk when repairing
    - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY
    - net: aquantia: Add missing descriptor cache invalidation on ATL2
    - net: lan966x: Fix the initialization of taprio
    - net/mlx5e: Fix validation logic in rate limiting
    - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
    - net: dsa: sja1105: simplify static configuration reload
    - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing
      traffic
    - net: fec: cancel perout_timer when PEROUT is disabled
    - net: fec: do not update PEROUT if it is enabled
    - net: fec: do not allow enabling PPS and PEROUT simultaneously
    - net: fec: do not register PPS event for PEROUT
    - iio: st_lsm6dsx: Fixed calibrated timestamp calculation
    - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
    - mailbox: mailbox-test: Fix debugfs_create_dir error checking
    - mailbox: pcc: Refactor error handling in irq handler into separate
      function
    - mailbox: pcc: don't zero error register
    - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
    - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
    - spi: spi-mem: Allow specifying the byte order in Octal DTR mode
    - spi: spi-mem: Extend spi-mem operations with a per-operation maximum
      frequency
    - spi: spi-mem: Add a new controller capability
    - spi: nxp-fspi: Support per spi-mem operation frequency switches
    - spi: nxp-fspi: Propagate fwnode in ACPI case as well
    - spi: bcm63xx: fix premature CS deassertion on RX-only transactions
    - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
    - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
    - iio:common:ssp_sensors: Fix an error handling path ssp_probe()
    - iio: accel: fix ADXL355 startup race condition
    - iio: adc: ad7280a: fix ad7280_store_balance_timer()
    - MIPS: mm: Prevent a TLB shutdown on initial uniquification
    - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
    - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230
    - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
    - can: sja1000: fix max irq loop handling
    - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
    - dm-verity: fix unreliable memory allocation
    - drivers/usb/dwc3: fix PCI parent check
    - thunderbolt: Add support for Intel Wildcat Lake
    - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
    - mptcp: clear scheduled subflows on retransmit
    - serial: amba-pl011: prefer dma_mapping_error() over explicit address
      checking
    - usb: cdns3: Fix double resource release in cdns3_pci_probe
    - USB: storage: Remove subclass and protocol overrides from Novatek quirk
    - usb: dwc3: pci: add support for the Intel Nova Lake -S
    - usb: dwc3: pci: Sort out the Intel device IDs
    - xhci: dbgtty: Fix data corruption when transmitting data form DbC to
      host
    - xhci: dbgtty: fix device unregister
    - USB: serial: ftdi_sio: add support for u-blox EVK-M101
    - USB: serial: option: add support for Rolling RW101R-GL
    - drm: sti: fix device leaks at component probe
    - net: dsa: microchip: common: Fix checks on irq_find_mapping()
    - net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
    - nfsd: Replace clamp_t in nfsd4_get_drc_mem()
    - usb: udc: Add trace event for usb_gadget_set_state
    - usb: typec: ucsi: psy: Set max current to zero when disconnected
    - can: rcar_canfd: Fix CAN-FD mode as default
    - iio: adc: rtq6056: Correct the sign bit index
    - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()
    - net: dsa: microchip: Free previously initialized ports on init failures
    - mailbox: mtk-cmdq: Refine DMA address handling for the command buffer
    - iio: humditiy: hdc3020: fix units for temperature and humidity
      measurement
    - arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos
    - nvmem: layouts: fix nvmem_layout_bus_uevent
    - xhci: fix stale flag preventig URBs after link state error is cleared
    - drm/amd/display: Don't change brightness for disabled connectors
    - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()
    - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv()
    - KVM: nSVM: Fix and simplify LBR virtualization handling with nested
    - KVM: SVM: Fix redundant updates of LBR MSR intercepts
    - wifi: ath12k: correctly handle mcast packets for clients
    - drm/i915/dp: Initialize the source OUI write timestamp always
    - SAUCE: bpf: introduce __MAX_BPF_PROG_TYPE delimiter
    - Upstream stable to v6.6.119, v6.12.61
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68340
    - team: Move team device type change at the end of team_port_add
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68282
    - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68283
    - libceph: replace BUG_ON with bounds check for map->max_osd
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68284
    - libceph: prevent potential out-of-bounds writes in
      handle_auth_session_key()
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68285
    - libceph: fix potential use-after-free in have_mon_and_osd_map()
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68286
    - drm/amd/display: Check NULL before accessing
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68287
    - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests()
      call paths
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68331
    - usb: uas: fix urb unmapping issue when the uas device is remove during
      ongoing data transfer
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-40345
    - usb: storage: sddr55: Reject out-of-bound new_pba
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68288
    - usb: storage: Fix memory leak in USB bulk transport
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68327
    - usb: renesas_usbhs: Fix synchronous external abort on unbind
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68289
    - usb: gadget: f_eem: Fix memory leak in eem_unwrap
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68290
    - most: usb: fix double free on late probe failure
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68328
    - firmware: stratix10-svc: fix bug in saving controller data
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68295
    - smb: client: fix memory leak in cifs_construct_tcon()
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68297
    - ceph: fix crash in process_v2_sparse_read() for encrypted directories
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68339
    - atm/fore200e: Fix possible data race in fore200e_open()
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68330
    - iio: accel: bmc150: Fix irq assumption regression
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68301
    - net: atlantic: fix fragment overflow handling in RX path
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68302
    - net: sxgbe: fix potential NULL dereference in sxgbe_rx()
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68303
    - platform/x86: intel: punit_ipc: fix memory corruption
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68305
    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68342
    - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
      accessing data
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68343
    - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before
      accessing header
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68307
    - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted
      URBs
  * Noble update: upstream stable patchset 2026-02-03 (LP: #2139633) //
    CVE-2025-68308
    - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624)
    - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
    - shmem: fix tmpfs reconfiguration (remount) when noswap is set
    - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
    - mptcp: Disallow MPTCP subflows from sockmap
    - ata: libata-scsi: Fix system suspend for a security locked drive
    - smb: client: introduce close_cached_dir_locked()
    - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
    - net: dsa: microchip: lan937x: Fix RGMII delay tuning
    - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
    - Input: goodix - add support for ACPI ID GDIX1003
    - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl()
    - MIPS: Malta: Fix !EVA SOC-it PCI MMIO
    - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
    - LoongArch: Don't panic if no valid cache info for PCI
    - mptcp: fix ack generation for fallback msk
    - mptcp: fix premature close in case of fallback
    - mptcp: avoid unneeded subflow-level drops
    - mptcp: decouple mptcp fastclose from tcp close
    - mptcp: do not fallback when OoO is present
    - drm/tegra: dc: Fix reference leak in tegra_dc_couple()
    - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
    - drm/amd/display: Increase DPCD read retries
    - drm/amd/display: Move sleep into each retry for retrieve_link_cap()
    - xfrm: Determine inner GSO type from packet inner protocol
    - xfrm: Prevent locally generated packets from direct output in tunnel
      mode
    - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
    - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
    - net: dsa: hellcreek: fix missing error handling in LED registration
    - net: mlxsw: linecards: fix missing error check in
      mlxsw_linecard_devlink_info_get()
    - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to
      errnos
    - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
    - LoongArch: Use UAPI types in ptrace UAPI header
    - bcma: don't register devices disabled in OF
    - cifs: fix typo in enable_gcm_256 module parameter
    - scsi: core: Fix a regression triggered by scsi_host_busy()
    - x86/microcode/AMD: Limit Entrysign signature checking to known
      generations
    - selftests: net: use BASH for bareudp testing
    - net: tls: Cancel RX async resync request on rcd_delta overflow
    - kconfig/mconf: Initialize the default locale at startup
    - kconfig/nconf: Initialize the default locale at startup
    - f2fs: compress: change the first parameter of page_array_{alloc,free} to
      sbi
    - s390/mm: Fix __ptep_rdp() inline assembly
    - ALSA: usb-audio: fix uac2 clock source at terminal parser
    - tracing/tools: Fix incorrcet short option in usage text for --threads
    - smb: client: fix incomplete backport in cfids_invalidation_worker()
    - uio_hv_generic: Set event for all channels on the device
    - maple_tree: fix tracepoint string pointers
    - selftests: mptcp: join: endpoints: longer transfer
    - HID: amd_sfh: Stop sensor before starting
    - arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
    - mptcp: fix duplicate reset on fastclose
    - selftests: mptcp: join: endpoints: longer timeout
    - selftests: mptcp: join: userspace: longer timeout
    - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
    - xfrm: set err and extack on failure to create pcpu SA
    - pinctrl: realtek: Select REGMAP_MMIO for RTD driver
    - selftests: net: lib: Do not overwrite error messages
    - af_unix: Cache state->msg in unix_stream_read_generic().
    - af_unix: Read sk_peek_offset() again after sleeping in
      unix_stream_read_generic().
    - net: tls: Change async resync helpers argument
    - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check
    - drm/xe: Prevent BIT() overflow when handling invalid prefetch region
    - tty/vt: fix up incorrect backport to stable releases
    - Upstream stable to v6.6.118, v6.12.60
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68213
    - idpf: fix possible vport_config NULL pointer deref in remove
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68223
    - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40257
    - mptcp: fix a race in mptcp_pm_del_add_timer()
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68231
    - mm/mempool: fix poisoning order>0 pages with HIGHMEM
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68198
    - crash: fix crashkernel resource shrink
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40266
    - KVM: arm64: Check the untrusted offset in FF-A memory share
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68220
    - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return
      NULL on error
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-38627
    - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40248
    - vsock: Ignore signal/timeout on connect() if already established
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68219
    - cifs: fix memory leak in smb3_fs_context_parse_param error path
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40250
    - net/mlx5: Clean up only new IRQ glue on request_irq() failure
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40251
    - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68222
    - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40252
    - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont()
      and qede_tpa_end()
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40253
    - s390/ctcm: Fix double-kfree
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68218
    - nvme-multipath: fix lockdep WARN due to partition scan work
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40254
    - net: openvswitch: remove never-working support for setting nsh fields
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68233
    - drm/tegra: Add call to put_pid()
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40258
    - mptcp: fix race condition in mptcp_schedule_work()
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68229
    - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40259
    - scsi: sg: Do not sleep in atomic context
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40261
    - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68235
    - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68217
    - Input: pegasus-notetaker - fix potential out-of-bounds access
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40262
    - Input: imx_sc_key - fix memory corruption on unload
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40263
    - Input: cros_ec_keyb - fix an invalid memory access
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-40264
    - be2net: pass wrb_params in case of OS2BMC
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68227
    - mptcp: Fix proto fallback detection with BPF
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68237
    - mtdchar: fix integer overflow in read/write ioctls
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68238
    - mtd: rawnand: cadence: fix DMA device NULL pointer dereference
  * Noble update: upstream stable patchset 2026-02-02 (LP: #2139624) //
    CVE-2025-68214
    - timers: Fix NULL function pointer race in timer_shutdown_sync()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460)
    - net: usb: asix_devices: Check return value of usbnet_get_endpoints
    - fbdev: atyfb: Check if pll_ops->init_pll failed
    - ACPI: button: Call input_free_device() on failing input device
      registration
    - Bluetooth: rfcomm: fix modem control handling
    - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
    - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
    - mptcp: drop bogus optimization in __mptcp_check_push()
    - mptcp: restore window probe
    - ASoC: qdsp6: q6asm: do not sleep while atomic
    - wifi: ath10k: Fix memory leak on unsupported WMI command
    - wifi: ath11k: Add missing platform IDs for quirk table
    - wifi: ath12k: free skb during idr cleanup callback
    - drm/msm/a6xx: Fix GMU firmware parser
    - ALSA: usb-audio: fix control pipe direction
    - scsi: ufs: core: Initialize value of an attribute returned by uic cmd
    - ASoC: Intel: avs: Unprepare a stream when XRUN occurs
    - ASoC: fsl_sai: fix bit order for DSD format
    - libbpf: Fix powerpc's stack register definition in bpf_tracing.h
    - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during
      reset
    - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
    - Bluetooth: ISO: Fix another instance of dst_type handling
    - Bluetooth: hci_core: Fix tracking of periodic advertisement
    - drm/etnaviv: fix flush sequence logic
    - net: hns3: return error code when function fails
    - sfc: fix potential memory leak in efx_mae_process_mport()
    - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
    - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
    - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
    - block: make REQ_OP_ZONE_OPEN a write operation
    - drm/mediatek: Fix device use-after-free on unbind
    - mptcp: fix MSG_PEEK stream corruption
    - cpuidle: governors: menu: Rearrange main loop in menu_select()
    - cpuidle: governors: menu: Select polling state in some more cases
    - net: phy: dp83867: Disable EEE support as not implemented
    - [Config] disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP for s390x
    - drm/sched: Fix race in drm_sched_entity_select_rq()
    - soc: aspeed: socinfo: Add AST27xx silicon IDs
    - soc: qcom: smem: Fix endian-unaware access of num_entries
    - spi: loopback-test: Don't use %pK through printk
    - bpf: Don't use %pK through printk
    - pinctrl: single: fix bias pull up/down handling in pin_config_set
    - mmc: host: renesas_sdhi: Fix the actual clock
    - memstick: Add timeout to prevent indefinite waiting
    - irqchip/sifive-plic: Respect mask state when setting affinity
    - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
    - arc: Fix __fls() const-foldability via __builtin_clzl()
    - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh
    - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
    - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA
    - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[]
    - power: supply: qcom_battmgr: add OOI chemistry
    - hwmon: (k10temp) Add device ID for Strix Halo
    - hwmon: (sbtsi_temp) AMD CPU extended temperature range support
    - pinctrl: keembay: release allocated memory in detach path
    - power: supply: sbs-charger: Support multiple devices
    - hwmon: sy7636a: add alias
    - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller
    - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106
    - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
    - ARM: tegra: transformer-20: add missing magnetometer interrupt
    - ARM: tegra: transformer-20: fix audio-codec interrupt
    - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
    - ACPICA: dispatcher: Use acpi_ds_clear_operands() in
      acpi_ds_call_control_method()
    - tee: allow a driver to allocate a tee_device without a pool
    - bpf: Do not limit bpf_cgroup_from_id to current's namespace
    - video: backlight: lp855x_bl: Set correct EPROM start for LP8556
    - tools/cpupower: fix error return value in cpupower_write_sysfs()
    - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
    - power: supply: qcom_battmgr: handle charging state change notifications
    - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21
    - cpuidle: Fail cpuidle device registration if there is one already
    - spi: rpc-if: Add resume support for RZ/G3E
    - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
    - riscv: bpf: Fix uninitialized symbol 'retval_off'
    - bpf: Clear pfmemalloc flag when freeing all fragments
    - nvme: Use non zero KATO for persistent discovery connections
    - uprobe: Do not emulate/sstep original instruction when ip is changed
    - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex
    - hwmon: (dell-smm) Add support for Dell OptiPlex 7040
    - tools/cpupower: Fix incorrect size in cpuidle_state_disable()
    - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
    - tools/power x86_energy_perf_policy: Enhance HWP enable
    - tools/power x86_energy_perf_policy: Prefer driver HWP limits
    - mfd: stmpe: Remove IRQ domain upon removal
    - mfd: stmpe-i2c: Add missing MODULE_LICENSE
    - mfd: madera: Work around false-positive -Wininitialized warning
    - mfd: da9063: Split chip variant reading in two bus transactions
    - drm/amd/display: ensure committing streams is seamless
    - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
    - drm/amd/display: add more cyan skillfish devices
    - drm/amd/display: update dpp/disp clock from smu clock table
    - drm/amd/pm: Use cached metrics data on aldebaran
    - drm/amd/pm: Use cached metrics data on arcturus
    - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
    - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
    - PCI: Disable MSI on RDC PCI to PCIe bridges
    - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
    - selftests/net: Ensure assert() triggers in psock_tpacket.c
    - wifi: rtw88: sdio: use indirect IO for device registers before power-on
    - drm/amdkfd: return -ENOTTY for unsupported IOCTLs
    - media: pci: ivtv: Don't create fake v4l2_fh
    - media: amphion: Delete v4l2_fh synchronously in .release()
    - drm/tidss: Use the crtc_* timings when programming the HW
    - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
    - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
    - drm/tidss: Set crtc modesetting parameters with adjusted mode
    - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for
      VIDEO_CAMERA_SENSOR
    - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
    - net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
    - ice: Don't use %pK through printk or tracepoints
    - thunderbolt: Use is_pciehp instead of is_hotplug_bridge
    - powerpc/eeh: Use result of error_detected() in uevent
    - s390/pci: Use pci_uevent_ers() in PCI recovery
    - bridge: Redirect to backup port when port is administratively down
    - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
    - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO
      mode change
    - scsi: ufs: host: mediatek: Change reset sequence for improved stability
    - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
    - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
    - drm/amdkfd: Handle lack of READ permissions in SVM mapping
    - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before
      setting register
    - iio: adc: imx93_adc: load calibrated values even calibration failed
    - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
    - char: misc: Make misc_register() reentry for miscdevice who wants
      dynamic minor
    - char: misc: Does not request module for miscdevice with dynamic minor
    - net: When removing nexthops, don't call synchronize_net if it is not
      necessary
    - net: Call trace_sock_exceed_buf_limit() for memcg failure with
      SK_MEM_RECV.
    - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
    - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
    - rds: Fix endianness annotation for RDS_MPATH_HASH
    - scsi: mpi3mr: Fix controller init failure on fault during queue creation
    - scsi: pm80xx: Fix race condition caused by static variables
    - extcon: adc-jack: Fix wakeup source leaks on device unbind
    - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
    - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
    - fuse: zero initialize inode private data
    - drm/amdkfd: fix vram allocation failure for a special case
    - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
    - media: fix uninitialized symbol warnings
    - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
    - mips: lantiq: danube: add missing properties to cpu node
    - mips: lantiq: danube: add model to EASY50712 dts
    - mips: lantiq: danube: add missing device_type in pci node
    - mips: lantiq: xway: sysctrl: rename stp clock
    - mips: lantiq: danube: rename stp node on EASY50712 reference board
    - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
    - scsi: pm8001: Use int instead of u32 to store error codes
    - ptp: Limit time setting of PTP clocks
    - dmaengine: sh: setup_xref error handling
    - dmaengine: mv_xor: match alloc_wc and free_wc
    - dmaengine: dw-edma: Set status for callback_result
    - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
    - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
    - drm/amdgpu: Allow kfd CRIU with no buffer objects
    - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
    - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
    - media: adv7180: Add missing lock in suspend callback
    - media: adv7180: Do not write format to device in set_fmt
    - media: adv7180: Only validate format in querystd
    - media: verisilicon: Explicitly disable selection api ioctls for decoders
    - ALSA: usb-audio: apply quirk for MOONDROP Quark2
    - net: call cond_resched() less often in __release_sock()
    - smsc911x: add second read of EEPROM mac when possible corruption seen
    - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
    - drm/amd: add more cyan skillfish PCI ids
    - drm/amdgpu: don't enable SMU on cyan skillfish
    - drm/amdgpu: add support for cyan skillfish gpu_info
    - usb: gadget: f_hid: Fix zero length packet transfer
    - drm/msm: make sure to not queue up recovery more than once
    - char: Use list_del_init() in misc_deregister() to reinitialize list
      pointer
    - media: ov08x40: Fix the horizontal flip control
    - media: i2c: og01a1b: Specify monochrome media bus format instead of
      Bayer
    - scsi: ufs: host: mediatek: Enhance recovery on resume failure
    - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure
    - net: phy: marvell: Fix 88e1510 downshift counter errata
    - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode
      changes
    - wifi: mac80211: Fix HE capabilities element check
    - phy: cadence: cdns-dphy: Enable lower resolutions in dphy
    - phy: renesas: r8a779f0-ether-serdes: add new step added to latest
      datasheet
    - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0
    - net: sh_eth: Disable WoL if system can not suspend
    - selftests: net: replace sleeps in fcnal-test with waits
    - media: redrat3: use int type to store negative error codes
    - selftests: traceroute: Use require_command()
    - netfilter: nf_reject: don't reply to icmp error messages
    - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
      PV_UNHALT
    - selftests: Disable dad for ipv6 in fcnal-test.sh
    - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
    - [Config] disable 8139TOO_PIO for armhf
    - selftests: Replace sleep with slowwait
    - HID: asus: add Z13 folio to generic group for multitouch to work
    - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
    - crypto: sun8i-ce - remove channel timeout field
    - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
    - crypto: caam - double the entropy delay interval for retry
    - net/cls_cgroup: Fix task_get_classid() during qdisc run
    - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device
    - wifi: mt76: mt7996: Temporarily disable EPCS
    - ALSA: serial-generic: remove shared static buffer
    - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
    - drm/amd: Avoid evicting resources at S5
    - drm/amd/display: Fix DVI-D/HDMI adapters
    - drm/amd/display: Disable VRR on DCE 6
    - ethernet: Extend device_get_mac_address() to use NVMEM
    - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
    - drm/amdgpu: reject gang submissions under SRIOV
    - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
      clean net/lib dependency
    - scsi: ufs: core: Disable timestamp functionality if not supported
    - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
      TGT_RESET
    - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
      lpfc_cleanup
    - scsi: lpfc: Define size of debugfs entry for xri rebalancing
    - allow finish_no_open(file, ERR_PTR(-E...))
    - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
    - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
    - ipv6: np->rxpmtu race annotation
    - ASoC: qcom: sc8280xp: explicitly set S16LE format in
      sc8280xp_be_hw_params_fixup()
    - net: phy: clear link parameters on admin link down
    - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
    - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
    - wifi: ath10k: Fix connection after GTK rekeying
    - net: intel: fm10k: Fix parameter idx set but not used
    - sparc/module: Add R_SPARC_UA64 relocation handling
    - sparc64: fix prototypes of reads[bwl]()
    - vfio: return -ENOTTY for unsupported device feature
    - PCI/PM: Skip resuming to D0 if device is disconnected
    - remoteproc: qcom: q6v5: Avoid handling handover twice
    - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
    - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream
    - NFSv4: handle ERR_GRACE on delegation recalls
    - NFSv4.1: fix mount hang after CREATE_SESSION failure
    - net: bridge: Install FDB for bridge MAC on VLAN 0
    - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
    - accel/habanalabs/gaudi2: fix BMON disable configuration
    - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
    - accel/habanalabs: return ENOMEM if less than requested pages were pinned
    - accel/habanalabs/gaudi2: read preboot status after recovering from dirty
      state
    - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
    - ext4: increase IO priority of fastcommit
    - ASoC: stm32: sai: manage context in set_sysclk callback
    - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
    - net/mlx5e: Don't query FEC statistics when FEC is disabled
    - net: macb: avoid dealing with endianness in macb_set_hwaddr()
    - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI
      frames
    - ALSA: usb-audio: add mono main switch to Presonus S1824c
    - exfat: limit log print for IO error
    - 6pack: drop redundant locking and refcounting
    - page_pool: Clamp pool size to max 16K pages
    - ksmbd: use sock_create_kern interface to create kernel socket
    - smb: client: transport: avoid reconnects triggered by pending task work
    - char: misc: restrict the dynamic range to exclude reserved minors
    - ACPICA: Update dsmethod.c to get rid of unused variable warning
    - RDMA/irdma: Fix SD index calculation
    - RDMA/irdma: Remove unused struct irdma_cq fields
    - RDMA/irdma: Set irdma_cq cq_num field during CQ create
    - RDMA/hns: Fix the modification of max_send_sge
    - RDMA/hns: Fix wrong WQE data when QP wraps around
    - btrfs: mark dirty extent range for out of bound prealloc extents
    - fs/hpfs: Fix error code for new_inode() failure in
      mkdir/create/mknod/symlink
    - um: Fix help message for ssl-non-raw
    - clk: sunxi-ng: sun6i-rtc: Add A523 specifics
    - rtc: pcf2127: clear minute/second interrupt
    - ARM: at91: pm: save and restore ACR during PLL disable/enable
    - clk: at91: clk-master: Add check for divide by 3
    - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register
    - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled
    - NTB: epf: Allow arbitrary BAR mapping
    - 9p: fix /sys/fs/9p/caches overwriting itself
    - cpufreq: tegra186: Initialize all cores to max frequencies
    - 9p: sysfs_init: don't hardcode error to ENOMEM
    - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS
    - ACPI: property: Return present device nodes only on fwnode interface
    - tools bitmap: Add missing asm-generic/bitsperlong.h include
    - tools: lib: thermal: don't preserve owner in install
    - tools: lib: thermal: use pkg-config to locate libnl3
    - rtc: pcf2127: fix watchdog interrupt mask on pcf2131
    - kbuild: uapi: Strip comments before size type check
    - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
    - ceph: add checking of wait_for_completion_killable() return value
    - ceph: refactor wake_up_bit() pattern of calling
    - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
    - media: uvcvideo: Use heuristic to find stream entity
    - net: libwx: fix device bus LAN ID
    - riscv: Improve exception and system call latency
    - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
    - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
    - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for
      bcm63xx
    - selftests/net: fix out-of-order delivery of FIN in gro:tcp test
    - selftests/net: use destination options instead of hop-by-hop
    - netdevsim: add Makefile for selftests
    - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing
      ethtool-common.sh
    - net: vlan: sync VLAN features with lower device
    - net: dsa: b53: fix resetting speed and pause on forced link
    - net: dsa: b53: fix enabling ip multicast
    - net: dsa: b53: stop reading ARL entries if search is done
    - sctp: Hold RCU read lock while iterating over address list
    - sctp: Hold sock lock while iterating over address list
    - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
    - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup
    - net/mlx5e: Use extack in get module eeprom by page callback
    - net/mlx5e: Fix return value in case of module EEPROM read error
    - net/mlx5e: SHAMPO, Fix skb size check for 64K pages
    - net: dsa: microchip: Fix reserved multicast address table programming
    - net: bridge: fix MST static key usage
    - tracing: Fix memory leaks in create_field_var()
    - drm/amd/display: Enable mst when it's detected but yet to be initialized
    - rtc: rx8025: fix incorrect register reference
    - x86/microcode/AMD: Add more known models to entry sign checking
    - smb: client: validate change notify buffer before copy
    - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
    - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers
    - extcon: adc-jack: Cleanup wakeup source only if it was enabled
    - drm/amdgpu: Fix function header names in amdgpu_connectors.c
    - drm/amd/display: Fix black screen with HDMI outputs
    - riscv: stacktrace: fix backtracing through exceptions
    - selftests: netdevsim: set test timeout to 10 minutes
    - drm/i915: Fix conversion between clock ticks and nanoseconds
    - smb: client: fix refcount leak in smb2_set_path_attr
    - iommufd: Make vfio_compat's unmap succeed if the range is already empty
    - drm/amd: Fix suspend failure with secure display TA
    - compiler_types: Move unused static inline functions warning to W=2
    - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid
      rfence errors
    - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used
    - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks
    - NFS4: Fix state renewals missing after boot
    - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
    - NFS: check if suid/sgid was cleared after a write as needed
    - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel
    - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
    - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp()
    - selftests: net: local_termination: Wait for interfaces to come up
    - net: fec: correct rx_bytes statistic for the case SHIFT16 is set
    - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
    - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
    - net/smc: fix mismatch between CLC header and proposal
    - net/handshake: Fix memory leak in tls_handshake_accept()
    - net: mdio: fix resource leak in mdiobus_register_device()
    - wifi: mac80211: skip rate verification for not captured PSDUs
    - net_sched: act_connmark: use RCU in tcf_connmark_dump()
    - net/mlx5e: Fix maxrate wraparound in threshold between units
    - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
    - net/mlx5e: Fix potentially misleading debug message
    - net_sched: limit try_bulk_dequeue_skb() batches
    - virtio-net: fix incorrect flags recording in big mode
    - hsr: Fix supervision frame sending on HSRv0
    - ACPI: CPPC: Check _CPC validity for only the online CPUs
    - ACPI: CPPC: Perform fast check switch only for online CPUs
    - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs
    - Bluetooth: L2CAP: export l2cap_chan_hold for modules
    - cifs: stop writeback extension when change of size is detected
    - cifs: Fix uncached read into ITER_KVEC iterator
    - acpi,srat: Fix incorrect device handle check for Generic Initiator
    - regulator: fixed: fix GPIO descriptor leak on register failure
    - ASoC: cs4271: Fix regulator leak on probe failure
    - ASoC: codecs: va-macro: fix resource leak in probe error path
    - ASoC: tas2781: fix getting the wrong device number
    - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
    - NFS: enable nconnect for RDMA
    - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
    - NFS: sysfs: fix leak when nfs_client kobject add fails
    - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
    - acpi/hmat: Fix lockdep warning for hmem_register_resource()
    - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
    - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
    - mtd: onenand: Pass correct pointer to IRQ handler
    - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1
    - ARM: dts: imx51-zii-rdu1: Fix audmux node names
    - HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
    - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
    - HID: uclogic: Fix potential memory leak in error path
    - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated
    - gcov: add support for GCC 15
    - strparser: Fix signed/unsigned mismatch bug
    - dma-mapping: benchmark: Restore padding to ensure uABI remained
      consistent
    - LoongArch: Use correct accessor to read FWPC/MWPC
    - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY
    - selftests/tracing: Run sample events to clear page cache events
    - wifi: mac80211: reject address change while connecting
    - mm/mm_init: fix hash table order logging in alloc_large_system_hash()
    - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
    - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value
    - smb: client: fix cifs_pick_channel when channel needs reconnect
    - spi: Try to get ACPI GPIO IRQ earlier
    - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
    - selftests/user_events: fix type cast for write_index packed member in
      perf_test
    - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY
    - EDAC/altera: Handle OCRAM ECC enable after warm reset
    - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
    - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe()
    - btrfs: do not update last_log_commit when logging inode due to a new
      name
    - pmdomain: samsung: plug potential memleak during probe
    - selftests: mptcp: connect: fix fallback note due to OoO
    - selftests: mptcp: join: rm: set backup flag
    - selftests: mptcp: connect: trunc: read all recv data
    - Revert "perf dso: Add missed dso__put to dso__load_kcore"
    - mm, percpu: do not consider sleepable allocations atomic
    - netpoll: remove netpoll_srcu
    - net: netpoll: Individualize the skb pool
    - net: netpoll: flush skb pool during cleanup
    - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE
    - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller
    - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE
    - scsi: ufs: core: Add fill_crypto_prdt variant op
    - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT
    - scsi: ufs: core: Add a quirk for handling broken LSDBS field in
      controller capabilities register
    - scsi: ufs: core: Add a quirk to suppress link_startup_again
    - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel
      ADL
    - filemap: cap PTE range to be created to allowed zero fill in
      folio_map_range()
    - mm/memory: do not populate page table entries beyond i_size
    - mm/truncate: unmap large folio on split failure
    - net: netpoll: ensure skb_pool list is always initialized
    - memory tiers: use default_dram_perf_ref_source in log message
    - memcg: fix data-race KCSAN bug in rstats
    - s390/pci: Restore IRQ unconditionally for the zPCI device
    - wifi: ath11k: add support for MU EDCA
    - wifi: ath11k: avoid bit operation on key flags
    - wifi: mac80211: don't mark keys for inactive links as uploaded
    - wifi: mac80211: fix key tailroom accounting leak
    - kunit: test_dev_action: Correctly cast 'priv' pointer to long*
    - bpf: Find eligible subprogs for private stack support
    - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth
    - bpf: Do not audit capability check in do_jit()
    - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave
    - Bluetooth: ISO: Fix BIS connection dst_type handling
    - dpll: spec: add missing module-name and clock-id to pin-get reply
    - ASoC: fsl_sai: Fix sync error in consumer mode
    - ACPI: fan: Use ACPI handle when retrieving _FST
    - drm/sched: avoid killing parent entity on child SIGKILL
    - drm/nouveau: Fix race in nouveau_sched_fini()
    - drm/ast: Clear preserved bits from register output value
    - drm/amd: Check that VPE has reached DPM0 in idle handler
    - drm/amd/display: Fix incorrect return of vblank enable on unconfigured
      crtc
    - firmware: qcom: scm: preserve assign_mem() error return value
    - soc: ti: pruss: don't use %pK through printk
    - bpf: Use tnums for JEQ/JNE is_branch_taken logic
    - ACPI: video: force native for Lenovo 82K8
    - libbpf: Fix USDT SIB argument handling causing unrecognized register
      error
    - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU
    - thermal: gov_step_wise: Allow cooling level to be reduced earlier
    - thermal: intel: selftests: workload_hint: Mask unsupported types
    - cpufreq: ondemand: Update the efficient idle check for Intel extended
      Families
    - pwm: pca9685: Use bulk write to atomicially update registers
    - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C
    - hwmon: (dell-smm) Remove Dell Precision 490 custom config data
    - selftests/bpf: Fix flaky bpf_cookie selftest
    - mfd: core: Increment of_node's refcount before linking it to the
      platform device
    - mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
    - drm/amdgpu: add range check for RAS bad page address
    - drm/amdgpu: Check vcn sram load return value
    - ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
    - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
    - wifi: rtw89: print just once for unknown C2H events
    - PCI/ERR: Update device error_state already after reset
    - scsi: ufs: host: mediatek: Fix PWM mode switch issue
    - HID: pidff: Use direction fix only for conditional effects
    - HID: pidff: PERMISSIVE_CONTROL quirk autodetection
    - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
    - dm error: mark as DM_TARGET_PASSES_INTEGRITY
    - bnxt_en: Add Hyper-V VF ID
    - idpf: do not linearize big TSO packets
    - net: wangxun: limit tx_max_coalesced_frames_irq
    - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
    - net: ipv4: allow directed broadcast routes to use dst hint
    - scsi: mpi3mr: Fix I/O failures during controller reset
    - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits
    - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
    - ASoC: SOF: ipc4-pcm: Add fixup for channels
    - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
    - inet_diag: annotate data-races in inet_diag_bc_sk()
    - scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on
      suspend
    - drm/xe/guc: Increase GuC crash dump buffer size
    - drm: panel-backlight-quirks: Make EDID match optional
    - PCI: imx6: Enable the Vaux supply if available
    - drm/xe/guc: Set upper limit of H2G retries over CTB
    - crypto: ccp: Skip SEV and SNP INIT for kdump boot
    - drm/amd/display: Fix pbn_div Calculation Error
    - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
    - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
    - selftests: mptcp: join: allow more time to send ADD_ADDR
    - scsi: ufs: host: mediatek: Correct system PM flow
    - selftests: traceroute: Return correct value on failure
    - openrisc: Add R_OR1K_32_PCREL relocation type module support
    - wifi: mt76: mt76_eeprom_override to int
    - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
    - drm/amd/display: Set up pixel encoding for YCBCR422
    - drm/amd/display: fix dml ms order of operations
    - scsi: lpfc: Clean up allocated queues when queue setup mbox commands
      fail
    - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
    - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
      topology
    - wifi: rtw89: renew a completion for each H2C command waiting C2H event
    - usb: xhci-pci: add support for hosts with zero USB3 ports
    - RDMA/ipoib: Remove NULL check before dev_{put, hold}
    - IB/ipoib: Ignore L3 master device
    - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
    - wifi: mac80211: Track NAN interface start/stop
    - crypto: hisilicon/qm - invalidate queues in use
    - crypto: hisilicon/qm - adjust the internal processing sequence of the vf
      enable and disable
    - crypto: hisilicon/qm - clear all VF configurations in the hardware
    - selftests: forwarding: Reorder (ar)ping arguments to obey POSIX getopt
    - net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463
    - drm/amd/display: Init dispclk from bootup clock for DCN314
    - drm/amd/display: Fix for test crash due to power gating
    - drm/amd/display: change dc stream color settings only in atomic commit
    - ACPI: scan: Update honor list for RPMI System MSI
    - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
    - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
    - net: stmmac: est: Drop frames causing HLBS error
    - usb: xhci-pci: Fix USB2-only root hub registration
    - drm/amd/display: Add fallback path for YCBCR422
    - RDMA/hns: Fix recv CQ and QP cache affinity
    - clk: clocking-wizard: Fix output clock register offset for Versal
      platforms
    - LoongArch: Handle new atomic instructions for probes
    - net: wwan: t7xx: add support for HP DRMR-H01
    - ceph: fix potential race condition in ceph_ioctl_lazyio()
    - net: ionic: add dma_wmb() before ringing TX doorbell
    - net: ionic: map SKB after pseudo-header checksum prep
    - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type
    - bnxt_en: Refactor bnxt_free_ctx_mem()
    - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem()
    - net: wan: framer: pef2256: Switch to devm_mfd_add_devices()
    - drm/amdgpu/smu: Handle S0ix for vangogh
    - drm/amd/display: update color on atomic commit time
    - drm/mediatek: Add pm_runtime support for GCE power control
    - arm64: kprobes: check the return value of set_memory_rox()
    - NFS4: Apply delay_retrans to async operations
    - HID: nintendo: Wait longer for initial probe
    - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL
    - NFSD: Skip close replay processing if XDR encoding fails
    - net: ethernet: ti: am65-cpsw-qos: fix IET verify/response timeout
    - net: ethernet: ti: am65-cpsw-qos: fix IET verify retry mechanism
    - proc: fix the issue of proc_mem_open returning NULL
    - ext4: introduce ITAIL helper
    - LoongArch: KVM: Add delay until timer interrupt injected
    - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes
    - ftrace: Fix BPF fexit with livepatch
    - btrfs: zoned: fix conventional zone capacity calculation
    - btrfs: release root after error in data_reloc_print_warning_inode()
    - pmdomain: imx: Fix reference count leak in imx_gpc_remove
    - selftests: mptcp: join: userspace: longer transfer
    - selftests: mptcp: join: properly kill background tasks
    - wifi: cfg80211: add an hrtimer based delayed work item
    - proc: proc_maps_open allow proc_mem_open to return NULL
    - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
    - Upstream stable to v6.6.117, v6.12.58, v6.12.59
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68204
    - pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-22107
    - net: dsa: sja1105: fix kasan out-of-bounds warning in
      sja1105_table_delete_entry()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-39981
    - Bluetooth: MGMT: Fix possible UAFs
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-22121
    - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-23129
    - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq()
      in error path
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40287
    - exfat: fix improper check of dentry.stream.valid_size
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40289
    - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68201
    - drm/amdgpu: remove two invalid BUG_ON()s
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68180
    - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68322
    - parisc: Avoid crash due to unaligned access in unwinder
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40305
    - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40307
    - exfat: validate cluster allocation bits of the allocation bitmap
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68190
    - drm/amdgpu/atom: Check kcalloc() for WS buffer in
      amdgpu_atom_execute_table_locked()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68315
    - f2fs: fix to detect potential corrupted nid in free_nid_list
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40339
    - drm/amdgpu: fix nullptr err of vm_handle_moved
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68311
    - tty: serial: ip22zilog: Use platform device for probing
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68313
    - x86/CPU/AMD: Add RDSEED fix for Zen5
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40360
    - drm/sysfb: Do not dereference NULL pointer in plane reset
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68734
    - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40272
    - mm/secretmem: fix use-after-free race in fault handler
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40077
    - f2fs: fix to avoid overflow while left shift operation
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68245
    - net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40293
    - iommufd: Don't overflow during division for dirty tracking
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40303
    - btrfs: ensure no dirty metadata is written back for an fs with errors
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68184
    - drm/mediatek: Disable AFBC support on Mediatek DRM driver
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40268
    - cifs: client: fix memory leak in smb3_fs_context_parse_param
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40269
    - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40271
    - fs/proc: fix uaf in proc_readdir_de()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68241
    - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68246
    - ksmbd: close accepted socket when per-IP limit rejects connection
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40273
    - NFSD: free copynotify stateid in nfs4_free_ol_stateid()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68208
    - bpf: account for current allocated stack depth in
      widen_imprecise_scalars()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68200
    - bpf: Add bpf_prog_run_data_pointers()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40275
    - ALSA: usb-audio: Fix NULL pointer dereference in
      snd_usb_mixer_controls_badd
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40277
    - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40278
    - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-
      infoleak
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40279
    - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40280
    - tipc: Fix use-after-free in tipc_mon_reinit_self().
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40281
    - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40282
    - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40283
    - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40284
    - Bluetooth: MGMT: cancel mesh send timer when hdev removed
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40285
    - smb/server: fix possible refcount leak in smb2_sess_setup()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40286
    - smb/server: fix possible memory leak in smb2_read()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40288
    - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68244
    - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40292
    - virtio-net: fix received length check in big packets
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40328
    - smb: client: fix potential UAF in smb2_close_cached_fid()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40294
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40329
    - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68320
    - lan966x: Fix sleeping in atomic context
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68192
    - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40331
    - sctp: Prevent TOCTOU out-of-bounds write
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40301
    - Bluetooth: hci_event: validate skb length for unknown CC opcode
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40358
    - riscv: stacktrace: Disable KASAN checks for non-current tasks
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40304
    - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68183
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68173
    - ftrace: Fix softlockup in ftrace_module_enable
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40306
    - orangefs: fix xattr related buffer overflow...
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40308
    - Bluetooth: bcsp: receive data only if registered
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40309
    - Bluetooth: SCO: Fix UAF on sco_conn_free
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40310
    - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40311
    - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68185
    - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
      dereferencing
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68176
    - PCI: cadence: Check for the existence of cdns_pcie::ops before using it
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68168
    - jfs: fix uninitialized waitqueue in transaction manager
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40312
    - jfs: Verify inode mode when loading from disk
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40333
    - f2fs: fix infinite loop in __insert_extent_tree()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68321
    - page_pool: always add GFP_NOWARN for ATOMIC allocations
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68191
    - udp_tunnel: use netdev_warn() instead of netdev_WARN()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40313
    - ntfs3: pretend $Extend records as regular files
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40314
    - usb: cdns3: gadget: Use-after-free during failed initialization and exit
      of cdnsp gadget
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40337
    - net: stmmac: Correctly handle Rx checksum offload errors
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68194
    - media: imon: make send_packet() more robust
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40363
    - net: ipv6: fix field-spanning memcpy warning in AH output
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68178
    - blk-cgroup: fix possible deadlock while configuring policy
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40341
    - futex: Don't leak robust_list pointer on exec race
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40342
    - nvme-fc: use lock accessing port_state and rport state
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40343
    - nvmet-fc: avoid scheduling association deletion twice
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68177
    - cpufreq/longhaul: handle NULL policy in longhaul_exit
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40315
    - usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68310
    - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68179
    - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40317
    - regmap: slimbus: fix bus_context pointer in regmap init calls
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40318
    - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68312
    - usbnet: Prevents free active kevent
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68172
    - crypto: aspeed - fix double free caused by devm
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40319
    - bpf: Sync pending IRQ work before freeing ring buffer
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-68171
    - x86/fpu: Ensure XFD state on signal delivery
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40320
    - smb: client: fix potential cfid UAF in smb2_query_info_compound
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40321
    - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP
      Mode
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40322
    - fbdev: bitblit: bound-check glyph index in bit_putcs*
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40211
    - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40323
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released
  * Noble update: upstream stable patchset 2026-01-30 (LP: #2139460) //
    CVE-2025-40324
    - NFSD: Fix crash in nfsd4_read_release()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282)
    - exec: Fix incorrect type for ret
    - hfs: clear offset and space out of valid records in b-tree node
    - hfs: make proper initalization of struct hfs_find_data
    - dlm: check for defined force value in dlm_lockspace_release
    - hfsplus: return EIO when type of hidden directory mismatch in
      hfsplus_fill_super()
    - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure
    - m68k: bitops: Fix find_*_bit() signatures
    - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure
    - drivers/perf: hisi: Relax the event ID check in the framework
    - smb: server: let smb_direct_flush_send_list() invalidate a remote key
      first
    - Unbreak 'make tools/*' for user-space targets
    - net/mlx5e: Return 1 instead of 0 in invalid case in
      mlx5e_mpwrq_umr_entry_size()
    - rtnetlink: Allow deleting FDB entries in user namespace
    - net: enetc: correct the value of ENETC_RXB_TRUESIZE
    - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
    - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of
      can_dropped_invalid_skb()
    - selftests: net: fix server bind failure in sctp_vrf.sh
    - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
    - arm64, mm: avoid always making PTE dirty in pte_mkwrite()
    - net: bonding: fix possible peer notify event loss or dup issue
    - dma-debug: don't report false positives with
      DMA_BOUNCE_UNALIGNED_KMALLOC
    - gpio: pci-idio-16: Define maximum valid register address offset
    - gpio: 104-idio-16: Define maximum valid register address offset
    - Revert "cpuidle: menu: Avoid discarding useful information"
    - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
    - can: netlink: can_changelink(): allow disabling of automatic restart
    - cifs: Fix TCP_Server_Info::credits to be signed
    - MIPS: Malta: Fix keyboard resource preventing i8042 driver from
      registering
    - net: stmmac: dwmac-rk: Fix disabling set_clock_selection
    - net: usb: rtl8150: Fix frame padding
    - net: ravb: Enforce descriptor type ordering
    - net: ravb: Ensure memory write completes before ringing TX doorbell
    - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported
    - selftests: mptcp: join: mark implicit tests as skipped if not supported
    - spi: spi-nxp-fspi: add extra delay after dll locked
    - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw
      mode
    - RISC-V: Define pgprot_dmacoherent() for non-coherent devices
    - RISC-V: Don't print details of CPUs disabled in DT
    - hwmon: (sht3x) Fix error handling
    - gpio: ljca: Fix duplicated IRQ mapping
    - io_uring: correct __must_hold annotation in io_install_fixed_file
    - sched: Remove never used code in mm_cid_get()
    - USB: serial: option: add UNISOC UIS7720
    - USB: serial: option: add Quectel RG255C
    - USB: serial: option: add Telit FN920C04 ECM compositions
    - usb/core/quirks: Add Huawei ME906S to wakeup quirk
    - usb: raw-gadget: do not limit transfer length
    - xhci: dbc: enable back DbC in resume if it was enabled before suspend
    - x86/microcode: Fix Entrysign revision check for Zen1/Naples
    - binder: remove "invalid inc weak" check
    - mei: me: add wildcat lake P DID
    - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
    - tcpm: switch check for role_sw device with fw_node
    - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
    - serial: 8250_dw: handle reset control deassert error
    - serial: 8250_exar: add support for Advantech 2 port card with Device ID
      0x0018
    - serial: 8250_mtk: Enable baud clock and manage in runtime PM
    - devcoredump: Fix circular locking dependency with devcd->mutex.
    - xfs: always warn about deprecated mount options
    - fuse: allocate ff->release_args only if release is needed
    - audit: record fanotify event regardless of presence of rules
    - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
      current->mm == NULL
    - perf: Have get_perf_callchain() return NULL if crosstask and user are
      set
    - perf: Skip user unwind if the task is a kernel thread
    - x86/bugs: Report correct retbleed mitigation status
    - x86/bugs: Fix reporting of LFENCE retpoline
    - EDAC/mc_sysfs: Increase legacy channel support to 16
    - btrfs: zoned: return error from btrfs_zone_finish_endio()
    - btrfs: zoned: refine extent allocator hint selection
    - btrfs: scrub: replace max_t()/min_t() with clamp() in
      scrub_throttle_dev_io()
    - btrfs: always drop log root tree reference in btrfs_replay_log()
    - btrfs: use level argument in log tree walk callback replay_one_buffer()
    - btrfs: use smp_mb__after_atomic() when forcing COW in
      create_pending_snapshot()
    - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
    - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
    - selftests: mptcp: disable add_addr retrans in endpoint_tests
    - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not
      supported
    - serial: sc16is7xx: remove useless enable of enhanced features
    - xhci: dbc: poll at different rate depending on data transfer activity
    - xhci: dbc: Allow users to modify DbC poll interval via sysfs
    - xhci: dbc: Improve performance by removing delay in transfer event
      polling.
    - xhci: dbc: Avoid event polling busyloop if pending rx transfers are
      inactive.
    - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
      event
    - bits: add comments and newlines to #if, #else and #endif directives
    - bits: introduce fixed-type GENMASK_U*()
    - gpio: regmap: Allow to allocate regmap-irq device
    - gpio: regmap: add the .fixed_direction_output configuration parameter
    - gpio: idio-16: Define fixed direction of the GPIO lines
    - PCI: Test for bit underflow in pcie_set_readrq()
    - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
    - s390/mm: Use __GFP_ACCOUNT for user page table allocations
    - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
    - riscv: hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
    - perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK
    - cpuset: Use new excpus for nocpu error check when enabling root
      partition
    - btrfs: abort transaction on specific error places when walking log tree
    - btrfs: abort transaction in the process_one_buffer() log tree walk
      callback
    - btrfs: abort transaction if we fail to update inode in log replay dir
      fixup
    - btrfs: tree-checker: add inode extref checks
    - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
    - bonding: return detailed error when loading native XDP fails
    - btrfs: tree-checker: fix bounds check in check_inode_extref()
    - Upstream stable to v6.6.115, v6.6.116, v6.12.56, v6.12.57
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-37860
    - sfc: fix NULL dereferences in ef100_process_design_param()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-21833
    - iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-22105
    - bonding: check xdp prog when set bond mode
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-38643
    - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-23130
    - f2fs: fix to avoid panic once fallocation fails for pinfile
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40353
    - arm64: mte: Do not warn if the page is already tagged in copy_highpage()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-39678
    - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40235
    - btrfs: directly free partially initialized fs_info in
      btrfs_check_leaked_roots()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40238
    - net/mlx5: Fix IPsec cleanup over MPV device
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40242
    - gfs2: Fix unlikely race in gdlm_put_lock
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40083
    - net/sched: sch_qfq: Fix null-deref in agg_dequeue
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40084
    - ksmbd: transport_ipc: validate payload size before reading handle
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40220
    - fuse: fix livelock in synchronous file put from fuseblk workers
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40237
    - fs/notify: call exportfs_encode_fid with s_umount
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-68249
    - most: usb: hdm_probe: Fix calling put_device() before device
      initialization
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40223
    - most: usb: Fix use-after-free in hdm_disconnect
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40106
    - comedi: fix divide-by-zero in comedi_buf_munge()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40226
    - firmware: arm_scmi: Account for failed debug initialization
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40231
    - vsock: fix lock inversion in vsock_assign_transport()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40233
    - ocfs2: clear extent cache after moving/defragmenting extents
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40346
    - arch_topology: Fix incorrect error check in
      topology_parse_cpu_capacity()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40240
    - sctp: avoid NULL dereference when chunk data buffer is missing
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40350
    - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding
      RQ
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40347
    - net: enetc: fix the deadlock of enetc_mdio_lock
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40243
    - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40351
    - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40349
    - hfs: validate record offset in hfsplus_bmap_alloc
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40244
    - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  * Noble update: upstream stable patchset 2026-01-29 (LP: #2139282) //
    CVE-2025-40245
    - nios2: ensure that memblock.current_limit is set when setting pfn limits
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267)
    - r8152: add error handling in rtl8152_driver_init
    - f2fs: fix wrong block mapping for multi-devices
    - jbd2: ensure that all ongoing I/O complete before freeing blocks
    - ext4: wait for ongoing I/O to complete before freeing blocks
    - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
      running
    - btrfs: fix incorrect readahead expansion length
    - can: gs_usb: gs_make_candev(): populate net_device->dev_port
    - can: gs_usb: increase max interface to U8_MAX
    - drm/amdgpu: use atomic functions with memory barriers for vm fault info
    - drm/amd: Check whether secure display TA loaded successfully
    - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
    - epoll: Remove ep_scan_ready_list() in comments
    - eventpoll: Replace rwlock with spinlock
    - drm/msm/adreno: De-spaghettify the use of memory barriers
    - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in
      functions
    - drm/exynos: exynos7_drm_decon: properly clear channels during bind
    - drm/exynos: exynos7_drm_decon: remove ctx->suspended
    - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain()
    - usb: gadget: Store endpoint pointer in usb_request
    - usb: gadget: Introduce free_usb_request helper
    - HID: multitouch: fix sticky fingers
    - dax: skip read lock assertion for read-only filesystems
    - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
    - net: dlink: handle dma_map_single() failure properly
    - doc: fix seg6_flowlabel path
    - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
    - amd-xgbe: Avoid spurious link down messages during interface toggle
    - tcp: fix tcp_tso_should_defer() vs large RTT
    - tg3: prevent use of uninitialized remote_adv and local_adv variables
    - tls: trim encrypted message to match the plaintext on short splice
    - net: tls: wait for async completion on last message
    - tls: wait for async encrypt in case of error during latter iterations of
      sendmsg
    - tls: always set record_type in tls_process_cmsg
    - tls: don't rely on tx_work during send()
    - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
    - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
      lan78xx_reset
    - nvme-multipath: Skip nr_active increments in RETRY disposition
    - riscv: kprobes: Fix probe address validation
    - drm/bridge: lt9211: Drop check for last nibble of version register
    - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec
    - ASoC: nau8821: Cancel jdet_work before handling jack ejection
    - ASoC: nau8821: Generalize helper to clear IRQ status
    - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
    - drm/i915/guc: Skip communication warning on reset in progress
    - drm/amd/powerplay: Fix CIK shutdown temperature
    - drm/rockchip: vop2: use correct destination rectangle height check
    - sched/balancing: Rename newidle_balance() => sched_balance_newidle()
    - sched/fair: Fix pelt lost idle time detection
    - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
    - selftests/bpf: make arg_parsing.c more robust to crashes
    - HID: hid-input: only ignore 0 battery events for digitizers
    - HID: multitouch: fix name of Stylus input devices
    - selftests: arg_parsing: Ensure data is flushed to disk before reading.
    - arm64: cputype: Add Neoverse-V3AE definitions
    - arm64: errata: Apply workarounds for Neoverse-V3AE
    - NFSD: Rework encoding and decoding of nfsd4_deviceid
    - NFSD: Minor cleanup in layoutcommit processing
    - xfs: rename the old_crc variable in xlog_recover_process
    - xfs: fix log CRC mismatches between i386 and other architectures
    - PM: runtime: Add new devm functions
    - iio: imu: inv_icm42600: Simplify pm_runtime setup
    - phy: cdns-dphy: Store hs_clk_rate and return it
    - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling
    - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure
    - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime
      suspended
    - quota: remove unneeded return value of register_quota_format
    - phy: cadence: cdns-dphy: Update calibration wait time for startup state
      machine
    - PCI: Add PCI_VDEVICE_SUB helper macro
    - ixgbevf: Add support for Intel(R) E610 device
    - ixgbevf: fix getting link speed data for E610 devices
    - nfsd: decouple the xprtsec policy check from check_nfsd_access()
    - PCI/sysfs: Ensure devices are powered for config reads (part 2)
    - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
    - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl"
      exists
    - PCI: j721e: Fix programming sequence of "strap" settings
    - perf/core: Fix address filter match with backing files
    - perf/core: Fix MMAP event path names with backing files
    - perf/core: Fix MMAP2 event device with backing files
    - drm/msm/a6xx: Fix PDC sleep sequence
    - can: m_can: m_can_handle_state_errors(): fix CAN state transition to
      Error Active
    - can: m_can: m_can_chip_config(): bring up interface in correct state
    - drm/amdgpu: add ip offset support for cyan skillfish
    - drm/amdgpu: add support for cyan skillfish without IP discovery
    - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
    - nvme/tcp: handle tls partially sent records in write_space()
    - nfsd: Use correct error code when decoding extents
    - nfsd: Drop dprintk in blocklayout xdr functions
    - NFSD: Implement large extent array support in pNFS
    - NFSD: Fix last write offset handling in layoutcommit
    - wifi: rtw89: avoid possible TX wait initialization race
    - xfs: use deferred intent items for reaping crosslinked blocks
    - md/raid0: Handle bio_split() errors
    - md/raid1: Handle bio_split() errors
    - md/raid10: Handle bio_split() errors
    - md: fix mssing blktrace bio split events
    - x86/resctrl: Refactor resctrl_arch_rmid_read()
    - x86/resctrl: Fix miscount of bandwidth event when reactivating
      previously unavailable RMID
    - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
    - dmaengine: Add missing cleanup on module unload
    - Upstream stable to v6.6.114, v6.12.55
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40105
    - vfs: Don't leak disconnected dentries on umount
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40092
    - usb: gadget: f_ncm: Refactor bind path to use __free()
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40101
    - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
      an RST
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40166
    - drm/xe/guc: Check GuC running state before deregistering exec queue
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40104
    - ixgbevf: fix mailbox API compatibility by negotiating supported features
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40087
    - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40196
    - fs: quota: create dedicated workqueue for quota_release_work
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40088
    - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40085
    - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40172
    - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40176
    - tls: wait for pending async decryptions if tls_strp_msg_hold fails
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40173
    - net/ip6_tunnel: Prevent perpetual tunnel growth
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40095
    - usb: gadget: f_rndis: Refactor bind path to use __free()
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40094
    - usb: gadget: f_acm: Refactor bind path to use __free()
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40093
    - usb: gadget: f_ecm: Refactor bind path to use __free()
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40165
    - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40096
    - drm/sched: Fix potential double free in
      drm_sched_job_add_resv_dependencies
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40099
    - cifs: parse_dfs_referrals: prevent oob on malformed input
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40100
    - btrfs: do not assert we found block group item when creating free space
      tree
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40167
    - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
  * Noble update: upstream stable patchset 2026-01-28 (LP: #2139267) //
    CVE-2025-40103
    - smb: client: Fix refcount leak for cifs_sb_tlink
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158)
    - fs: always return zero on success from replace_fd()
    - fscontext: do not consume log entries when returning -EMSGSIZE
    - clocksource/drivers/clps711x: Fix resource leaks in error paths
    - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
    - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
    - perf evsel: Avoid container_of on a NULL leader
    - libperf event: Ensure tracing data is multiple of 8 sized
    - clk: at91: peripheral: fix return value
    - perf util: Fix compression checks returning -1 as bool
    - rtc: x1205: Fix Xicor X1205 vendor prefix
    - rtc: optee: fix memory leak on driver removal
    - perf arm_spe: Correct setting remote access
    - perf arm-spe: Rename the common data source encoding
    - perf arm_spe: Correct memory level for remote access
    - perf session: Fix handling when buffer exceeds 2 GiB
    - perf test: Don't leak workload gopipe in PERF_RECORD_*
    - perf test: Add a test for default perf stat command
    - perf tools: Add fallback for exclude_guest
    - perf evsel: Ensure the fallback message is always written to
    - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
    - clk: mediatek: clk-mux: Do not pass flags to
      clk_mux_determine_rate_flags()
    - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
    - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
    - clk: tegra: do not overallocate memory for bpmp clocks
    - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
    - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
    - LoongArch: Init acpi_gbl_use_global_lock to false
    - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
    - drm/vmwgfx: Fix copy-paste typo in validation
    - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
    - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
    - tools build: Align warning options with perf
    - perf python: split Clang options when invoking Popen
    - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
    - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
    - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
    - drm/amdgpu: Add additional DCE6 SCL registers
    - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
    - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
    - drm/amd/display: Properly disable scaling on DCE6
    - netfilter: nf_tables: drop unused 3rd argument from validate callback
      ops
    - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
    - smb: client: fix missing timestamp updates after utime(2)
    - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
    - gpio: wcd934x: mark the GPIO controller as sleeping
    - bpf: Avoid RCU context warning when unpinning htab with internal structs
    - ACPI: property: Fix buffer properties extraction for subnodes
    - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
    - ACPI: debug: fix signedness issues in read/write helpers
    - arm64: dts: qcom: msm8916: Add missing MDSS reset
    - arm64: dts: qcom: msm8939: Add missing MDSS reset
    - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
    - arm64: dts: ti: k3-am62a-main: Fix main padcfg length
    - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in
      amx3_idle_init
    - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-
      required
    - xen/events: Cleanup find_virq() return codes
    - xen/manage: Fix suspend error path
    - xen/events: Update virq_to_irq on migration
    - firmware: meson_sm: fix device leak at probe
    - media: cx18: Add missing check after DMA map
    - media: i2c: mt9v111: fix incorrect type for ret
    - media: mc: Fix MUST_CONNECT handling for pads with no links
    - media: pci: ivtv: Add missing check after DMA map
    - media: venus: firmware: Use correct reset sequence for IRIS2
    - media: lirc: Fix error handling in lirc_register()
    - drm/rcar-du: dsi: Fix 1/2/3 lane support
    - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
    - blk-crypto: fix missing blktrace bio split events
    - bus: mhi: ep: Fix chained transfer handling in read path
    - bus: mhi: host: Do not use uninitialized 'dev' pointer in
      mhi_init_irq_setup()
    - copy_sighand: Handle architectures where sizeof(unsigned long) <
      sizeof(u64)
    - crypto: aspeed - Fix dma_unmap_sg() direction
    - crypto: atmel - Fix dma_unmap_sg() direction
    - crypto: rockchip - Fix dma_unmap_sg() nents value
    - fbdev: Fix logic error in "offb" name match
    - fs/ntfs3: Fix a resource leak bug in wnd_extend()
    - iio: dac: ad5360: use int type to store negative error codes
    - iio: dac: ad5421: use int type to store negative error codes
    - iio: frequency: adf4350: Fix prescaler usage.
    - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
    - iio: xilinx-ams: Unmask interrupts after updating alarms
    - init: handle bootloader identifier in kernel parameters
    - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
      resume
    - iommu/vt-d: PRS isn't usable if PDS isn't supported
    - KEYS: trusted_tpm1: Compare HMAC values in constant time
    - lib/genalloc: fix device leak in of_gen_pool_get()
    - of: unittest: Fix device reference count leak in
      of_unittest_pci_node_verify
    - openat2: don't trigger automounts with RESOLVE_NO_XDEV
    - parisc: don't reference obsolete termio struct for TC* constants
    - parisc: Remove spurious if statement from raw_copy_from_user()
    - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
    - pinctrl: samsung: Drop unused S3C24xx driver data
    - power: supply: max77976_charger: fix constant current reporting
    - powerpc/powernv/pci: Fix underflow and leak issue
    - powerpc/pseries/msi: Fix potential underflow and leak issue
    - sched/deadline: Fix race in push_dl_task()
    - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
    - sparc64: fix hugetlb for sun4u
    - sparc: fix error handling in scan_one_device()
    - mtd: rawnand: fsmc: Default to autodetect buswidth
    - mmc: core: SPI mode remove cmd7
    - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
    - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
    - rtc: interface: Fix long-standing race when setting alarm
    - rseq/selftests: Use weak symbol reference, not definition, to link with
      glibc
    - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
    - PCI/sysfs: Ensure devices are powered for config reads
    - PCI/ERR: Fix uevent on failure to recover
    - PCI/AER: Fix missing uevent on recovery when a reset is requested
    - PCI/AER: Support errors introduced by PCIe r6.0
    - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on
      exit
    - PCI: rcar-host: Drop PMSR spinlock
    - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
    - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
    - PCI: tegra194: Handle errors in BPMP response
    - spi: cadence-quadspi: Flush posted register writes before INDAC access
    - spi: cadence-quadspi: Flush posted register writes before DAC access
    - x86/umip: Check that the instruction opcode is at least two bytes
    - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
      aliases)
    - selftests: mptcp: join: validate C-flag + def limit
    - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
    - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
    - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
    - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
      max_huge_pages=0
    - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
    - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
    - ext4: increase i_disksize to offset + len in
      ext4_update_disksize_before_punch()
    - ext4: correctly handle queries for metadata mappings
    - ext4: fix an off-by-one issue during moving extents
    - ext4: guard against EA inode refcount underflow in xattr update
    - ext4: validate ea_ino and size in check_xattrs
    - ACPICA: Allow to skip Global Lock initialization
    - ext4: free orphan info with kvfree
    - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
    - Squashfs: add additional inode sanity checking
    - media: mc: Clear minor number before put device
    - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register
      value
    - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
    - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
    - ksmbd: add max ip connections parameter
    - misc: fastrpc: Add missing dev_err newlines
    - misc: fastrpc: Save actual DMA size in fastrpc_map structure
    - PCI: endpoint: Remove surplus return statement from
      pci_epf_test_clean_dma_chan()
    - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
    - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
    - ipmi: Fix handling of messages with provided receive message pointer
    - arm64: kprobes: call set_memory_rox() for kprobe page
    - arm64: mte: Do not flag the zero page as PG_mte_tagged
    - ACPI: battery: allocate driver data through devm_ APIs
    - ACPI: battery: initialize mutexes through devm_ APIs
    - ACPI: battery: Check for error code from devm_mutex_init() call
    - ACPI: battery: Add synchronization between interface updates
    - ACPI: property: Disregard references in data-only subnode lists
    - ACPI: property: Add code comments explaining what is going on
    - ACPI: property: Do not pass NULL handles to acpi_attach_data()
    - s390/bpf: Change seen_reg to a mask
    - s390/bpf: Centralize frame offset calculations
    - s390/bpf: Describe the frame using a struct instead of constants
    - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
    - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
    - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is
      disabled
    - mptcp: pm: in-kernel: usable client side with C-flag
    - irqchip/sifive-plic: Make use of __assign_bit()
    - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
    - minixfs: Verify inode mode when loading from disk
    - fs: Add 'initramfs_options' to set initramfs mount options
    - cramfs: Verify inode mode when loading from disk
    - writeback: Avoid softlockup when switching many inodes
    - writeback: Avoid excessively long inode switching times
    - perf test stat: Avoid hybrid assumption when virtualized
    - rseq: Protect event mask against membarrier IPI
    - perf vendor events arm64 AmpereOneX: Fix typo - should be
      l1d_cache_access_prefetches
    - ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer
      size
    - ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead
      of buffer time
    - ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
    - s390/cio: Update purge function to unregister the unused subchannels
    - mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend()
    - mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
    - mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data()
    - cifs: Fix copy_to_iter return value check
    - ARM: AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
      reset)
    - media: s5p-mfc: remove an unused/uninitialized variable
    - media: ti: j721e-csi2rx: Use devm_of_platform_populate
    - media: ti: j721e-csi2rx: Fix source subdev link creation
    - drm/xe/uapi: loosen used tracking restriction
    - PCI: xilinx-nwl: Fix ECAM programming
    - PCI: tegra194: Reset BARs when running in PCIe endpoint mode
    - s390: Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
    - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
    - ext4: add ext4_sb_bread_nofail() helper function for
      ext4_free_branches()
    - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
    - KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
    - copy_file_range: limit size if in compat mode
    - Upstream stable to v6.6.113, v6.12.54
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40198
    - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40159
    - xsk: Harden userspace-supplied xdp_desc validation
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40221
    - media: pci: mg4b: fix uninitialized iio scan data
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40180
    - mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40178
    - pid: Add a judgment for ns null in pid_nr_ns
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40202
    - ipmi: Rework user message limit handling
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40032
    - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before
      release
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40038
    - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40042
    - tracing: Fix race condition in kprobe initialization causing NULL
      pointer dereference
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40200
    - Squashfs: reject negative file sizes in squashfs_read_inode()
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40179
    - ext4: verify orphan file size is not too big
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40218
    - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40219
    - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40193
    - xtensa: simdisk: add input size check in proc_write_simdisk
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40204
    - sctp: Fix MAC comparison to be constant-time
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40192
    - Revert "ipmi: fix msg stack when IPMI is disconnected"
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40188
    - pwm: berlin: Fix wrong register in suspend/resume
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40201
    - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
      sys_prlimit64() paths
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40194
    - cpufreq: intel_pstate: Fix object lifecycle issue in
      update_qos_request()
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40205
    - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40160
    - xen/events: Return -EEXIST for bound VIRQs
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40206
    - netfilter: nft_objref: validate objref and objrefmap expressions
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40183
    - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40187
    - net/sctp: fix a null dereference in sctp_disposition
      sctp_sf_do_5_1D_ce()
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40111
    - drm/vmwgfx: Fix Use-after-free in validation
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40110
    - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40001
    - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  * Noble update: upstream stable patchset 2026-01-27 (LP: #2139158) //
    CVE-2025-40207
    - media: v4l2-subdev: Fix alloc failure check in
      v4l2_subdev_call_state_try()
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072)
    - media: tunner: xc5000: Refactor firmware load
    - USB: serial: option: add SIMCom 8230C compositions
    - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
    - ASoC: amd: acp: Adjust pdm gain value
    - dm-integrity: limit MAX_TAG_SIZE to 255
    - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
    - perf subcmd: avoid crash in exclude_cmds when excludes is empty
    - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
    - btrfs: ref-verify: handle damaged extent root tree
    - can: rcar_canfd: Fix controller mode setting
    - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
      quirks list
    - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
    - hid: fix I2C read buffer overflow in raw_event() for mcp2221
    - serial: stm32: allow selecting console when the driver is module
    - [Config] enable SERIAL_STM32_CONSOLE
    - staging: axis-fifo: fix maximum TX packet length check
    - staging: axis-fifo: fix TX handling on copy_from_user() failure
    - staging: axis-fifo: flush RX FIFO on read errors
    - driver core/PM: Set power.no_callbacks along with power.no_pm
    - riscv: mm: Use hint address in mmap if available
    - riscv: mm: Do not restrict mmap address based on hint
    - filelock: add FL_RECLAIM to show_fl_flags() macro
    - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
    - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too
      fast
    - selftests: arm64: Check fread return value in exec_target
    - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
    - coresight: trbe: Prevent overflow in PERF_IDX2OFF()
    - perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
    - smb: server: fix IRD/ORD negotiation with the client
    - x86/vdso: Fix output operand size of RDPID
    - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
    - regmap: Remove superfluous check for !config in __regmap_init()
    - bpf/selftests: Fix test_tcpnotify_user
    - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
    - libbpf: Fix reuse of DEVMAP
    - ARM: dts: renesas: porter: Fix CAN pin group
    - leds: flash: leds-qcom-flash: Update torch current clamp setting
    - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
    - ACPI: processor: idle: Fix memory leak when register cpuidle device
      failed
    - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
    - pinctrl: meson-gxl: add missing i2c_d pinmux
    - blk-mq: check kobject state_in_sysfs before deleting in
      blk_mq_unregister_hctx
    - ARM: at91: pm: fix MCKx restore routine
    - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
    - regulator: scmi: Use int type to store negative error codes
    - selftests/nolibc: fix EXPECT_NZ macro
    - block: use int to store blk_stack_limits() return value
    - PM: sleep: core: Clear power.must_resume in noirq suspend error path
    - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS
      to use correct boolean syntax
    - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property
      to use correct boolean syntax in DTS
    - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
      property
    - PM / devfreq: mtk-cci: Fix potential error pointer dereference in
      probe()
    - power: supply: cw2015: Fix a alignment coding style issue
    - pinctrl: renesas: Use int type to store negative error codes
    - null_blk: Fix the description of the cache_size module argument
    - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
    - nbd: restrict sockets to TCP and UDP
    - firmware: firmware: meson-sm: fix compile-test default
    - cpuidle: qcom-spm: fix device and OF node leaks at probe
    - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
    - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
    - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
    - pwm: tiehrpwm: Fix corner case in clock divisor calculation
    - ACPICA: Fix largest possible resource descriptor index
    - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
    - i3c: master: svc: Use manual response for IBI events
    - i3c: master: svc: Recycle unused IBI slot
    - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
    - bpf: Explicitly check accesses to bpf_sock_addr
    - smp: Fix up and expand the smp_call_function_many() kerneldoc
    - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in
      host headers
    - once: fix race by moving DO_ONCE to separate section
    - hwmon: (mlxreg-fan) Separate methods of fan setting coming from
      different subsystems
    - thermal/drivers/qcom: Make LMH select QCOM_SCM
    - thermal/drivers/qcom/lmh: Add missing IRQ includes
    - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
    - i2c: designware: Fix clock issue when PM is disabled
    - i2c: designware: Add disabling clocks when probe fails
    - bpf: Enforce expected_attach_type for tailcall compatibility
    - drm/panel: novatek-nt35560: Fix invalid return value
    - drm/radeon/r600_cs: clean up of dead code in r600_cs
    - f2fs: fix condition in __allow_reserved_blocks()
    - drm/bridge: it6505: select REGMAP_I2C
    - media: zoran: Remove zoran_fh structure
    - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
    - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
    - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
    - serial: max310x: Add error checking in probe()
    - drm/amd/display: Remove redundant semicolons
    - crypto: keembay - Add missing check after sg_nents_for_len()
    - hwrng: nomadik - add ARM_AMBA dependency
    - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
    - scsi: myrs: Fix dma_alloc_coherent() error check
    - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
    - RDMA/mlx5: Fix vport loopback forcing for MPV device
    - ALSA: lx_core: use int type to store negative error codes
    - media: st-delta: avoid excessive stack usage
    - crypto: hisilicon/zip - remove unnecessary validation for high-
      performance mode configurations
    - crypto: hisilicon - re-enable address prefetch after device resuming
    - crypto: hisilicon/qm - check whether the input function and PF are on
      the same device
    - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
    - coresight: Only register perf symlink for sinks with alloc_buffer
    - drm/amdgpu: Power up UVD 3 for FW validation (v2)
    - drm/amd/pm: Disable ULV even if unsupported (v3)
    - drm/amd/pm: Fix si_upload_smc_data (v3)
    - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
    - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
    - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
    - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
    - wifi: mwifiex: send world regulatory domain to driver
    - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
    - tcp: fix __tcp_close() to only send RST when required
    - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
    - usb: phy: twl6030: Fix incorrect type for ret
    - usb: gadget: configfs: Correctly set use_os_string at bind
    - tty: n_gsm: Don't block input queue by waiting MSC
    - misc: genwqe: Fix incorrect cmd field being reported in error
    - pps: fix warning in pps_register_cdev when register device fail
    - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
    - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
    - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
    - drm/msm/dpu: fix incorrect type for ret
    - fs: ntfs3: Fix integer overflow in run_unpack()
    - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
    - iio: consumers: Fix handling of negative channel scale in
      iio_convert_raw_to_processed()
    - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
    - netfilter: ipset: Remove unused htable_bits in macro ahash_region
    - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
    - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the
      watchdog
    - drivers/base/node: handle error properly in register_one_node()
    - RDMA/cm: Rate limit destroy CM ID timeout error message
    - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
    - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
    - f2fs: fix to truncate first page in error path of f2fs_truncate()
    - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
    - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
    - scsi: qla2xxx: edif: Fix incorrect sign of error code
    - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
    - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
    - f2fs: fix zero-sized extent for precache extents
    - RDMA/core: Resolve MAC of next-hop device without ARP support
    - IB/sa: Fix sa_local_svc_timeout_ms read race
    - Documentation: trace: historgram-design: Separate sched_waking histogram
      section heading and the following diagram
    - wifi: mac80211: fix Rx packet handling when pubsta information is not
      available
    - sparc: fix accurate exception reporting in copy_{from_to}_user for
      UltraSPARC
    - sparc: fix accurate exception reporting in copy_{from_to}_user for
      UltraSPARC III
    - sparc: fix accurate exception reporting in copy_{from_to}_user for
      Niagara
    - sparc: fix accurate exception reporting in copy_to_user for Niagara 4
    - sparc: fix accurate exception reporting in copy_{from,to}_user for M7
    - vfio/pds: replace bitmap_free with vfree
    - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
    - RDMA/rxe: Fix race in do_task() when draining
    - wifi: rtw89: avoid circular locking dependency in ser_state_run()
    - PCI: tegra194: Fix duplicate PLL disable in
      pex_ep_event_pex_rst_assert()
    - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
    - coresight-etm4x: Conditionally access register TRCEXTINSELR
    - coresight: etm4x: Support atclk
    - coresight: trbe: Return NULL pointer for allocation failures
    - NFSv4.1: fix backchannel max_resp_sz verification check
    - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
    - usb: vhci-hcd: Prevent suspending virtually attached devices
    - RDMA/siw: Always report immediate post SQ errors
    - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
    - vhost: vringh: Fix copy_to_iter return value check
    - Bluetooth: MGMT: Fix not exposing debug UUID on
      MGMT_OP_READ_EXP_FEATURES_INFO
    - Bluetooth: ISO: Fix possible UAF on iso_conn_free
    - Bluetooth: ISO: don't leak skb in ISO_CONT RX
    - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
    - KEYS: X.509: Fix Basic Constraints CA flag parsing
    - hwrng: ks-sa - fix division by zero in ks_sa_rng_init
    - ocfs2: fix double free in user_cluster_connect()
    - drivers/base/node: fix double free in register_one_node()
    - mtd: rawnand: atmel: Fix error handling path in
      atmel_nand_controller_add_nands
    - nfp: fix RSS hash key size when RSS is not supported
    - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
      configurable
    - net: dlink: handle copy_thresh allocation failure
    - net/mlx5: Stop polling for command response if interface goes down
    - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
    - net/mlx5: fw reset, add reset timeout work
    - smb: client: fix crypto buffers in non-linear memory
    - vhost: vringh: Modify the return value check
    - bpf: Reject negative offsets for ALU ops
    - Squashfs: fix uninit-value in squashfs_get_parent
    - uio_hv_generic: Let userspace take care of interrupt mask
    - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
    - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
    - fs: udf: fix OOB read in lengthAllocDescs handling
    - net: nfc: nci: Add parameter validation for packet data
    - mfd: rz-mtu3: Fix MTU5 NFCR register offset
    - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
    - dm: fix queue start/stop imbalance under suspend/load/resume races
    - dm: fix NULL pointer dereference in __dm_suspend()
    - LoongArch: Automatically disable kaslr if boot from kexec_file
    - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
    - ext4: fix checks for orphan inodes
    - mm: hugetlb: avoid soft lockup when mprotect to large memory area
    - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
    - misc: fastrpc: Fix fastrpc_map_lookup operation
    - misc: fastrpc: fix possible map leak in fastrpc_put_args
    - misc: fastrpc: Skip reference for DMA handles
    - Input: atmel_mxt_ts - allow reset GPIO to sleep
    - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info
      leak
    - sunrpc: fix null pointer dereference on zero-length checksum
    - remoteproc: pru: Fix potential NULL pointer dereference in
      pru_rproc_set_ctable()
    - pinctrl: check the return value of pinmux_ops::get_function_name()
    - bus: fsl-mc: Check return value of platform_get_resource()
    - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
    - usb: typec: tipd: Clear interrupts first
    - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
    - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
    - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
    - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
    - netfs: Prevent duplicate unlocking
    - nvmem: layouts: fix automatic module loading
    - uprobes: uprobe_warn should use passed task
    - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
    - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
    - selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing
      vDSO
    - PM / devfreq: rockchip-dfi: double count on RK3588
    - soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
    - soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
    - pwm: tiehrpwm: Don't drop runtime PM reference in .free()
    - pwm: tiehrpwm: Make code comment in .free() more useful
    - pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation
    - spi: fix return code when spi device has too many chipselects
    - bpf: Mark kfuncs as __noclone
    - crypto: octeontx2 - Call strscpy() with correct size argument
    - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
    - idpf: fix Rx descriptor ready check barrier in splitq
    - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
    - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
    - HID: hidraw: tighten ioctl command parsing
    - wifi: ath12k: fix wrong logging ID used for CE
    - coresight: tmc: Move ACPI support from AMBA driver to platform driver
    - coresight: tmc: Support atclk
    - coresight: catu: Move ACPI support from AMBA driver to platform driver
    - coresight: catu: Support atclk
    - PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
    - PCI: rcar-gen4: Assure reset occurs before DBI access
    - Bluetooth: ISO: free rx_skb if not consumed
    - PCI: j721e: Fix incorrect error message in probe()
    - Upstream stable to v6.6.111, v6.6.112, v6.12.52, v6.12.53
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40031
    - tee: fix register_shm_helper()
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40037
    - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40047
    - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40057
    - ptp: Add a upper bound on max_vclocks
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40058
    - iommu/vt-d: Disallow dirty tracking if incoherent page walk
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40059
    - coresight: Fix incorrect handling for return value of devm_kzalloc
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40155
    - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40079
    - riscv, bpf: Sign extend struct ops return values properly
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40000
    - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40026
    - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40027
    - net/9p: fix double req put in p9_fd_cancelled
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40109
    - crypto: rng - Ensure set_ent is always present
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-38105
    - ALSA: usb-audio: Kill timer properly at removal
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-40107
    - can: hi311x: fix null pointer dereference when resuming from sleep
      before interface was enabled
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-39995
    - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in
      probe
  * Noble update: upstream stable patchset 2026-01-26 (LP: #2139072) //
    CVE-2025-39994
    - media: tuner: xc5000: Fix use-after-free in xc5000_release
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938)
    - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
    - firewire: core: fix overlooked update of subsystem ABI version
    - ALSA: usb-audio: Fix block comments in mixer_quirks
    - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
    - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
    - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
    - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
    - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
    - ALSA: usb-audio: Convert comma to semicolon
    - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
    - usb: core: Add 0x prefix to quirks debug output
    - mmc: sdhci-cadence: add Mobileye eyeQ support
    - i2c: designware: Add quirk for Intel Xe
    - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
    - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
    - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
    - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
    - mm: add folio_expected_ref_count() for reference count calculation
    - mm/gup: check ref_count instead of lru before migration
    - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
    - mm: folio_may_be_lru_cached() unless folio_test_large()
    - arm64: dts: imx8mp: Correct thermal sensor index
    - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
    - cpufreq: Initialize cpufreq-based invariance before subsys
    - smb: server: don't use delayed_work for post_recv_credits_work
    - wifi: virt_wifi: Fix page fault on connect
    - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
    - bpf: Reject bpf_timer for PREEMPT_RT
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
    - ethernet: rvu-af: Remove slash from the driver name
    - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
    - bnxt_en: correct offset handling for IPv6 destination address
    - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
    - selftests: fib_nexthops: Fix creation of non-FDB nexthops
    - net: dsa: lantiq_gswip: do also enable or disable cpu port
    - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to
      port_setup()
    - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries
      added to the CPU port
    - HID: asus: add support for missing PX series fn keys
    - i40e: add mask to apply valid bits for itr_idx
    - i40e: improve VF MAC filters accounting
    - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
    - fbcon: Fix OOB access in font allocation
    - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
    - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
    - gpiolib: Extend software-node support to support secondary software-
      nodes
    - drm/ast: Use msleep instead of mdelay for edid read
    - minmax: make generic MIN() and MAX() macros available everywhere
    - minmax: simplify min()/max()/clamp() implementation
    - minmax: don't use max() in situations that want a C constant expression
    - minmax: improve macro expansion and type checking
    - minmax: fix up min3() and max3() too
    - minmax.h: add whitespace around operators and after commas
    - minmax.h: update some comments
    - minmax.h: reduce the #define expansion of min(), max() and clamp()
    - minmax.h: move all the clamp() definitions after the min/max() ones
    - minmax.h: simplify the variants of clamp()
    - minmax.h: remove some #defines that are only expanded once
    - drm/i915/backlight: Return immediately when scale() finds invalid
      parameters
    - ALSA: usb-audio: Fix code alignment in mixer_quirks
    - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
    - net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
    - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
    - net: sfp: add quirk for FLYPRO copper SFP+ module
    - HID: amd_sfh: Add sync across amd sfh work functions
    - platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
    - crypto: sha256 - fix crash at kexec
    - gcc-plugins: Remove TODO_verify_il for GCC >= 16
    - Upstream stable to v6.6.109, v6.6.110, v6.12.50, v6.12.51
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39991
    - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39992
    - mm: swap: check for stable address space before operating on the VMA
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40013
    - ASoC: qcom: audioreach: fix potential null pointer dereference
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40016
    - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39996
    - media: b2c2: Fix use-after-free causing by irq_check_work in
      flexcop_pci_remove
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39998
    - scsi: target: target_core_configfs: Add length check to avoid buffer
      overflow
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40009
    - fs/proc/task_mmu: check p->vec_buf for NULL
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39973
    - i40e: add validation for ring_len param
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-38709
    - loop: Avoid updating block size under exclusive owner
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39967
    - fbcon: fix integer overflow in fbcon_do_set_font
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40006
    - mm/hugetlb: fix folio is still mapped when deleted
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40008
    - kmsan: fix out-of-bounds access to shadow memory
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40010
    - afs: Fix potential null pointer dereference in afs_put_server
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40021
    - tracing: dynevent: Add a missing lockdown check on dynevent
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39968
    - i40e: add max boundary check for VF filters
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39969
    - i40e: fix validation of VF state in get resources
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39970
    - i40e: fix input validation logic for action_meta
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39971
    - i40e: fix idx validation in config queues msg
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39972
    - i40e: fix idx validation in i40e_validate_queue_map
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39977
    - futex: Prevent use-after-free during requeue-PI
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40011
    - drm/gma500: Fix null dereference in hdmi teardown
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39978
    - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39980
    - nexthop: Forbid FDB status change while nexthop is in a group
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40024
    - vhost: Take a reference on the task in struct vhost_task.
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39982
    - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-40020
    - can: peak_usb: fix shift-out-of-bounds issue
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39985
    - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39986
    - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39987
    - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  * Noble update: upstream stable patchset 2026-01-23 (LP: #2138938) //
    CVE-2025-39988
    - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867)
    - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is
      not supported
    - wifi: mac80211: fix incorrect type for ret
    - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section
      mismatch
    - bonding: set random address only when slaves already exist
    - power: supply: bq27xxx: fix error return in case of no bq27000 hdq
      battery
    - power: supply: bq27xxx: restrict no-battery detection to bq27000
    - LoongArch: Update help info of ARCH_STRICT_ALIGN
    - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
    - LoongArch: Check the return value when creating kobj
    - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
    - btrfs: tree-checker: fix the incorrect inode ref size check
    - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
      interface
    - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
    - rds: ib: Increment i_fastreg_wrs before bailing out
    - selftests: mptcp: connect: catch IO errors on listen side
    - selftests: mptcp: avoid spurious errors on TCP disconnect
    - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
    - io_uring: backport io_should_terminate_tw()
    - io_uring: include dying ring in task_work "should cancel" state
    - ASoC: wm8940: Correct PLL rate rounding
    - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
      message
    - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
    - selftests: mptcp: userspace pm: validate deny-join-id0 flag
    - xhci: dbc: decouple endpoint allocation from initialization
    - xhci: dbc: Fix full DbC transfer ring after several reconnects
    - rtc: pcf2127: fix SPI command byte for PCF2131 backport
    - mptcp: propagate shutdown to subflows when possible
    - minmax: avoid overly complicated constant expressions in VM code
    - minmax: simplify and clarify min_t()/max_t() implementation
    - minmax: add a few more MIN_T/MAX_T users
    - nvme: fix PI insert on write
    - btrfs: fix invalid extref key setup when replaying dentry
    - dpaa2-switch: fix buffer pool seeding for control traffic
    - mptcp: set remote_deny_join_id0 on SYN recv
    - mptcp: tfo: record 'deny join id0' info
    - selftests: mptcp: sockopt: fix error messages
    - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
    - ice: store max_frame and rx_buf_len only in ice_rx_ring
    - i40e: remove redundant memory barrier when cleaning Tx descs
    - bonding: don't set oif to bond dev when getting NS target destination
    - octeon_ep: fix VF MAC address lifecycle handling
    - net: liquidio: fix overflow in octeon_init_instr_queue()
    - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
    - dm-raid: don't set io_min and io_opt for raid1
    - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
    - mmc: mvsdio: Fix dma_unmap_sg() nents value
    - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
    - ASoC: wm8940: Correct typo in control name
    - ASoC: wm8974: Correct PLL rate rounding
    - ASoC: Intel: catpt: Expose correct bit depth to userspace
    - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
    - smb: client: fix filename matching of deferred files
    - platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG
      Z13
    - platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
    - x86/bugs: Add SRSO_USER_KERNEL_NO support
    - x86/bugs: KVM: Add support for SRSO_MSR_FIX
    - KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
      transitions
    - mptcp: pm: nl: announce deny-join-id0 flag
    - Upstream stable to v6.6.108, v6.12.49
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39932
    - smb: client: let smbd_destroy() call
      disable_work_sync(&info->post_send_credits_work)
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39940
    - dm-stripe: fix a possible integer overflow
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39948
    - ice: fix Rx page leak on multi-buffer frames
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39950
    - net/tcp: Fix a NULL pointer dereference when using TCP-AO with
      TCP_REPAIR
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39961
    - iommu/amd/pgtbl: Fix possible race while increase page table level
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-22106
    - vmxnet3: unregister xdp rxq info in the reset path
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39929
    - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39931
    - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39934
    - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39937
    - net: rfkill: gpio: Fix crash due to dereferencering uninitialized
      pointer
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39938
    - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source
      graph failed
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39942
    - ksmbd: smbdirect: verify remaining_data_length respects
      max_fragmented_recv_size
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39943
    - ksmbd: smbdirect: validate data_offset and data_length field of
      smb_direct_data_transfer
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39944
    - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39945
    - cnic: Fix use-after-free bugs in cnic_delete_task
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39955
    - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39947
    - net/mlx5e: Harden uplink netdev access against device unbind
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39949
    - qed: Don't collect too many protection override GRC elements
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39951
    - um: virtio_uml: Fix use-after-free after put_device in probe
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39953
    - cgroup: split cgroup_destroy_wq into 3 workqueues
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39957
    - wifi: mac80211: increase scan_ies_len for S1G
  * Noble update: upstream stable patchset 2026-01-22 (LP: #2138867) //
    CVE-2025-39952
    - wifi: wilc1000: avoid buffer overflow in WID string configuration
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681)
    - mm: introduce and use {pgd,p4d}_populate_kernel()
    - kasan: fix GCC mem-intrinsic prefix with sw tags
    - ima: limit the number of ToMToU integrity violations
    - flexfiles/pNFS: fix NULL checks on result of
      ff_layout_choose_ds_for_read
    - SUNRPC: call xs_sock_process_cmsg for all cmsg
    - NFSv4: Don't clear capabilities that won't be reset
    - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
    - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
    - tracing: Fix tracing_marker may trigger page fault during
      preempt_disable
    - ftrace/samples: Fix function size computation
    - fs/nfs/io: make nfs_start_io_*() killable
    - NFS: Serialise O_DIRECT i/o and truncate()
    - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
    - NFSv4.2: Serialise O_DIRECT i/o and clone range
    - NFSv4.2: Serialise O_DIRECT i/o and copy range
    - NFSv4/flexfiles: Fix layout merge mirror check.
    - s390/cpum_cf: Deny all sampling events by counter PMU
    - proc: fix type confusion in pde_set_flags()
    - EDAC/altera: Delete an inappropriate dma_free_coherent() call
    - compiler-clang.h: define __SANITIZE_*__ macros only when undefined
    - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
      wakeups
    - mtd: rawnand: stm32_fmc2: fix ECC overwrite
    - fuse: check if copy_file_range() returns larger than requested size
    - fuse: prevent overflow in copy_file_range return value
    - mm/damon/core: set quota->charged_from to jiffies at first charge window
    - drm/mediatek: fix potential OF node use-after-free
    - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
    - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
    - mtd: nand: raw: atmel: Fix comment in timings preparation
    - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
    - btrfs: use readahead_expand() on compressed extents
    - btrfs: fix corruption reading compressed range when block size is
      smaller than page size
    - mm/khugepaged: fix the address passed to notifier on testing young
    - Input: iqs7222 - avoid enabling unused interrupts
    - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk
      table
    - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
    - serial: sc16is7xx: fix bug in flow control levels init
    - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
    - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
    - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
    - net: bridge: Bounce invalid boolopts
    - tunnels: reset the GSO metadata before reusing the skb
    - docs: networking: can: change bcm_msg_head frames member to support
      flexible array
    - igb: fix link test skipping when interface is admin down
    - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
      j1939_local_ecu_get() failed
    - can: j1939: j1939_local_ecu_get(): undo increment when
      j1939_local_ecu_get() fails
    - net: hsr: Add VLAN CTAG filter support
    - hsr: use rtnl lock when iterating over ports
    - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
    - dmaengine: idxd: Remove improper idxd_free
    - dmaengine: idxd: Fix refcount underflow on module unload
    - dmaengine: idxd: Fix double free in idxd_setup_wqs()
    - regulator: sy7636a: fix lifecycle of power good gpio
    - hrtimer: Remove unused function
    - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
    - hrtimers: Unconditionally update target CPU base after offline timer
      migration
    - RISC-V: Remove unnecessary include from compat.h
    - xhci: fix memory leak regression when freeing xhci vdev devices depth
      first
    - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
    - usb: gadget: midi2: Fix missing UMP group attributes initialization
    - usb: gadget: midi2: Fix MIDI2 IN EP max packet size
    - dmaengine: dw: dmamux: Fix device reference leak in
      rzn1_dmamux_route_allocate
    - phy: tegra: xusb: fix device and OF node leak at probe
    - phy: ti-pipe3: fix device leak at unbind
    - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
    - drm/amdgpu: fix a memory leak in fence cleanup when unloading
    - drm/i915/power: fix size for for_each_set_bit() in abox iteration
    - nvme-pci: skip nvme_write_sq_db on empty rqlist
    - ext4: introduce linear search for dentries
    - drm/i915/pmu: Fix zero delta busyness issue
    - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
    - Revert "drm/amd/display: Optimize cursor position updates"
    - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
    - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
    - trace/fgraph: Fix error handling
    - NFS: nfs_invalidate_folio() must observe the offset and size arguments
    - s390/pai: Deny all events not handled by this PMU
    - btrfs: fix squota compressed stats leak
    - netlink: specs: mptcp: add missing 'server-side' attr
    - netlink: specs: mptcp: clearly mention attributes
    - netlink: specs: mptcp: replace underscores with dashes in names
    - netlink: specs: mptcp: fix if-idx attribute type
    - ceph: fix race condition where r_parent becomes stale before sending
      message
    - mtd: spinand: winbond: Fix oob_layout for W25N01JW
    - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
      runtime PM wakeups"
    - drm/amd/display: use udelay rather than fsleep
    - netfilter: nft_set_rbtree: continue traversal if element is inactive
    - netfilter: nf_tables: place base_seq in struct net
    - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
    - netfilter: nf_tables: restart set lookup on base_seq change
    - phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
    - phy: ti: omap-usb2: fix device leak at unbind
    - Upstream stable to v6.6.107, v6.12.48
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39927
    - ceph: fix race condition validating r_parent before applying state
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39923
    - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39869
    - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39873
    - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted
      SKB
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39911
    - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39876
    - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39881
    - kernfs: Fix UAF in polling when open file is released
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39909
    - mm/damon/lru_sort: avoid divide-by-zero in
      damon_lru_sort_apply_parameters()
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39916
    - mm/damon/reclaim: avoid divide-by-zero in
      damon_reclaim_apply_parameters()
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39877
    - mm/damon/sysfs: fix use-after-free in state_show()
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39880
    - libceph: fix invalid accesses to ceph_connection_v1_info
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39883
    - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
      memory
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39907
    - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39885
    - ocfs2: fix recursive semaphore deadlock in fiemap call
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39913
    - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to
      allocate psock->cork.
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39886
    - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-39914
    - tracing: Silence warning when chunk allocation fails in trace_pid_write
  * Noble update: upstream stable patchset 2026-01-20 (LP: #2138681) //
    CVE-2025-23143
    - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502)
    - bpf: Add cookie object to bpf maps
    - bpf: Move cgroup iterator helpers to bpf.h
    - btrfs: fix race between logging inode and checking if it was logged
      before
    - btrfs: fix race between setting last_dir_index_offset and inode logging
    - btrfs: avoid load/store tearing races when checking if an inode was
      logged
    - LoongArch: Save LBT before FPU in setup_sigcontext()
    - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
    - drm/amd/display: Don't warn when missing DCE encoder caps
    - cpupower: Fix a bug where the -t option of the set subcommand was not
      working.
    - Bluetooth: hci_sync: Avoid adding default advertising on startup
    - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
    - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
    - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
      i.MX8M Plus DHCOM
    - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
      Plus eDM SBC
    - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
    - xirc2ps_cs: fix register access when enabling FullDuplex
    - mISDN: Fix memory leak in dsp_hwec_enable()
    - icmp: fix icmp_ndo_send address translation for reply direction
    - net: macb: Fix tx_ptr_lock locking
    - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
    - wifi: ath11k: rename ath11k_start_vdev_delay()
    - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()
    - wifi: ath11k: fix group data packet drops during rekey
    - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
    - wifi: cw1200: cap SSID length in cw1200_do_join()
    - wifi: libertas: cap SSID len in lbs_associate()
    - net: thunder_bgx: add a missing of_node_put
    - net: thunder_bgx: decrement cleanup index before use
    - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
    - net/smc: Remove validation of reserved bits in CLC Decline message
    - mctp: return -ENOPROTOOPT for unknown getsockopt options
    - net: atm: fix memory leak in atm_register_sysfs when device_register
      fail
    - selftest: net: Fix weird setsockopt() in bind_bhash.c.
    - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
    - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
    - arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with
      CONFIG_DYNAMIC_FTRACE
    - proc: fix missing pde_set_flags() for net proc files
    - soc: qcom: mdt_loader: Deal with zero e_shentsize
    - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
    - drm/amdgpu: drop hw access in non-DC audio fini
    - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
      quirks list
    - e1000e: fix heap overflow in e1000_set_eeprom
    - net: pcs: rzn1-miic: Correct MODCTRL register offset
    - cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller
    - cpufreq: intel_pstate: Do not update global.turbo_disabled after
      initialization
    - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
    - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
      threshold
    - PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
    - dmaengine: mediatek: Fix a possible deadlock error in
      mtk_cqdma_tx_status()
    - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
    - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
    - pcmcia: omap: Add missing check for platform_get_resource
    - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
    - spi: spi-fsl-lpspi: Fix transmissions when using CONT
    - spi: spi-fsl-lpspi: Set correct chip-select polarity bit
    - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
    - spi: spi-fsl-lpspi: Clear status register after disabling the module
    - drm/bridge: ti-sn65dsi86: fix REFCLK setting
    - perf bpf-event: Fix use-after-free in synthesis
    - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
    - drm/amd/amdgpu: Fix missing error return on kzalloc failure
    - tools: gpio: rm .*.cmd on make clean
    - tools: gpio: remove the include directory on make clean
    - riscv: use lw when reading int cpu in asm_per_cpu
    - cpufreq: intel_pstate: Rearrange show_no_turbo() and store_no_turbo()
    - cpufreq: intel_pstate: Read global.no_turbo under READ_ONCE()
    - cpufreq: intel_pstate: Check turbo_is_disabled() in store_no_turbo()
    - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
    - bpf: Move bpf map owner out of common struct
    - btrfs: zoned: skip ZONE FINISH of conventional zones
    - arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off
    - HID: simplify snto32()
    - HID: stop exporting hid_snto32()
    - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
    - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
    - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
    - LoongArch: vDSO: Remove --hash-style=sysv
    - LoongArch: vDSO: Remove -nostdlib complier flag
    - mmc: sdhci-of-arasan: Support for emmc hardware reset
    - mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up
    - bnxt_en: fix incorrect page count in RX aggr ring log
    - net: mctp: mctp_fraq_queue should take ownership of passed skb
    - idpf: set mac type when adding and removing MAC filters
    - net: skb: add pskb_network_may_pull_reason() helper
    - net: tunnel: add pskb_inet_may_pull_reason() helper
    - net: vxlan: add skb drop reasons to vxlan_rcv()
    - net: vxlan: make vxlan_snoop() return drop reasons
    - net: vxlan: make vxlan_set_mac() return drop reasons
    - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
    - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
    - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
    - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
    - vxlan: Avoid unnecessary updates to FDB 'used' time
    - vxlan: Add RCU read-side critical sections in the Tx path
    - vxlan: Rename FDB Tx lookup function
    - mm: fix possible deadlock in kmemleak
    - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
    - net: dsa: add hook to determine whether EEE is supported
    - net: dsa: provide implementation of .support_eee()
    - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
    - md/raid1,raid10: strip REQ_NOWAIT from member bios
    - ext4: define ext4_journal_destroy wrapper
    - wifi: ath11k: update channel list in worker when wait flag is set
    - nouveau: fix disabling the nonstall irq due to storm code
    - kunit: kasan_test: disable fortify string checker on kasan_strings()
      test
    - platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk
    - perf bpf-utils: Constify bpil_array_desc
    - perf bpf-utils: Harden get_bpf_prog_info_linear
    - md/raid1: fix data lost for writemostly rdev
    - Upstream stable to v6.6.105, v6.6.106, v6.12.46, v6.12.47
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-22124
    - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-22103
    - net: fix NULL pointer dereference in l3mdev_l3_rcv
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-23133
    - wifi: ath11k: update channel list in reg notifier instead reg worker
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-22113
    - ext4: avoid journaling sb update on error if journal is destroying
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-22125
    - md/raid1,raid10: don't ignore IO flags
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39899
    - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39897
    - net: xilinx: axienet: Add error handling for RX metadata pointer
      retrieval
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39850
    - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39851
    - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39852
    - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39901
    - i40e: remove read access to debugfs files
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39854
    - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-38556
    - HID: core: Harden s32ton() against conversion to 0 bits
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-38502
    - bpf: Fix oob access in cgroup local storage
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39843
    - mm: slub: avoid wake up kswapd in set_track_prepare
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39920
    - pcmcia: Add error handling for add_interval() in do_validate_mem()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39902
    - mm/slub: avoid accessing metadata when pointer is invalid in
      object_err()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39838
    - cifs: prevent NULL pointer dereference in UTF16 conversion
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39839
    - batman-adv: fix OOB read/write in network-coding decode
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39841
    - scsi: lpfc: Fix buffer free/clear order in deferred receive path
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39891
    - wifi: mwifiex: Initialize the chan_stats array to zero
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39842
    - ocfs2: prevent release journal inode after journal shutdown
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39895
    - sched: Fix sched_numa_find_nth_cpu() if mask offline
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39844
    - mm: move page table sync declarations to linux/pgtable.h
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39845
    - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
      arch_sync_kernel_mappings()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39846
    - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39847
    - ppp: fix memory leak in pad_compress_skb
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39848
    - ax25: properly unshare skbs in ax25_kiss_rcv()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39849
    - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39853
    - i40e: Fix potential invalid access when MAC list is empty
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39857
    - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39860
    - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39861
    - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39894
    - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
      after confirm
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39863
    - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
      work
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39864
    - wifi: cfg80211: fix use-after-free in cmp_bss()
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39865
    - tee: fix NULL pointer dereference in tee_shm_put
  * Noble update: upstream stable patchset 2026-01-16 (LP: #2138502) //
    CVE-2025-39866
    - fs: writeback: fix use-after-free in __mark_inode_dirty()
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664)
    - of: dynamic: Fix memleak when of_pci_add_properties() failed
    - pinctrl: STMFX: add missing HAS_IOMEM dependency
    - mips: dts: lantiq: danube: add missing burst length property
    - mips: lantiq: xway: sysctrl: rename the etop node
    - of: Add a helper to free property struct
    - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
    - scsi: core: sysfs: Correct sysfs attributes access rights
    - smb: client: fix race with concurrent opens in unlink(2)
    - ASoC: codecs: tx-macro: correct tx_macro_component_drv name
    - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
    - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
    - nfs: fold nfs_page_group_lock_subrequests into
      nfs_lock_and_join_requests
    - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
    - net: ipv4: fix regression in local-broadcast routes
    - drm/msm: Defer fd_install in SUBMIT ioctl
    - powerpc/kvm: Fix ifdef to remove build warning
    - HID: input: rename hidinput_set_battery_charge_status()
    - HID: input: report battery status changes immediately
    - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
    - Bluetooth: hci_event: Mark connection as closed during suspend
      disconnect
    - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
    - Bluetooth: hci_sync: fix set_local_name race condition
    - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
    - drm/nouveau: remove unused memory target test
    - ice: fix incorrect counter for buffer allocation failures
    - dt-bindings: display/msm: qcom,mdp5: drop lut clock
    - net: dlink: fix multicast stats being counted incorrectly
    - phy: mscc: Fix when PTP clock is register and unregister
    - net/mlx5: Reload auxiliary drivers on fw_activate
    - net/mlx5: Add device cap for supporting hot reset in sync reset flow
    - net/mlx5: Add support for sync reset using hot reset
    - net/mlx5: Nack sync reset when SFs are present
    - net/mlx5e: Set local Xoff after FW update
    - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
    - net: stmmac: Rename phylink_get_caps() callback to update_caps()
    - net: stmmac: xgmac: Correct supported speed modes
    - net: stmmac: Set CIC bit only for TX queues with COE
    - net: rose: split remove and free operations in rose_remove_neigh()
    - x86/microcode/AMD: Handle the case of no BIOS microcode
    - HID: quirks: add support for Legion Go dual dinput modes
    - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
    - HID: wacom: Add a new Art Pen 2
    - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
    - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
    - smb3 client: fix return code mapping of remap_file_range
    - drm/nouveau/disp: Always accept linear modifier
    - net: rose: fix a typo in rose_clear_routes()
    - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
    - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
    - drm/msm/kms: move snapshot init earlier in KMS init
    - drm/mediatek: Add error handling for old state CRTC in atomic_disable
    - drm/xe/xe_sync: avoid race during ufence signaling
    - drm/xe: Don't trigger rebind on initial dma-buf validation
    - bnxt_en: Adjust TX rings if reservation is less than requested
    - hv_netvsc: Link queues to NAPIs
    - net: hv_netvsc: fix loss of early receive events from host during
      channel open.
    - net: macb: Disable clocks once
    - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
    - drm/mediatek: Fix device/node reference count leaks in
      mtk_drm_get_all_drm_priv
    - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
    - PCI: Add PCIE_RESET_CONFIG_DEVICE_WAIT_MS waiting time value
    - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to
      PCIE_RESET_CONFIG_WAIT_MS
    - PCI: dwc: Rename 'dw_pcie::link_gen' to 'dw_pcie::max_link_speed'
    - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
    - thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to
      static const
    - thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes
      to driver data
    - thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
    - Upstream stable to v6.6.104, v6.12.45
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39811
    - drm/xe/vm: Clear the scratch_pt pointer on error
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39815
    - RISC-V: KVM: fix stack overrun when loading vlenb
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39810
    - bnxt_en: Fix memory corruption when FW resources change during ifdown
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39836
    - efi: stmm: Fix incorrect buffer allocation method
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39805
    - net: macb: fix unregister_netdev call order in macb_remove()
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39829
    - trace/fgraph: Fix the warning caused by missing unregister notifier
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39835
    - xfs: do not propagate ENODATA disk errors into xattr code
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39819
    - fs/smb: Fix inconsistent refcnt update
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39808
    - HID: hid-ntrig: fix unable to handle page fault in
      ntrig_report_version()
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39806
    - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39824
    - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39823
    - KVM: x86: use array_index_nospec with indices that come from guest
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39817
    - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39812
    - sctp: initialize more fields in sctp_v6_from_sk()
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39827
    - net: rose: include node references in rose_neigh refcount
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39826
    - net: rose: convert 'use' field to refcount_t
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39832
    - net/mlx5: Fix lockdep assertion on sync reset unload event
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39828
    - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39697
    - NFS: Fix a race when updating an existing write
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39825
    - smb: client: fix race with concurrent opens in rename(2)
  * Noble update: upstream stable patchset 2026-01-07 (LP: #2137664) //
    CVE-2025-39813
    - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  * CVE-2025-37899
    - ksmbd: fix use-after-free in session logoff
  * CVE-2025-22037
    - ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous
      session
    - ksmbd: fix race condition between destroy_previous_session() and smb2
      operations()
    - ksmbd: fix null pointer dereference in alloc_preauth_hash()

linux-azure-6.8 (6.8.0-1047.53~22.04.1) jammy; urgency=medium

  * jammy/linux-azure-6.8: 6.8.0-1047.53~22.04.1 -proposed tracker (LP: #2140921)

  [ Ubuntu-azure: 6.8.0-1047.53 ]

  * noble/linux-azure: 6.8.0-1047.53 -proposed tracker (LP: #2140922)
  * [storvsc][Backport] Backport storvsc patch for handling MODE_SENSE_10
    (LP: #2139232)
    - scsi: storvsc: Process unsupported MODE_SENSE_10
  * linux-azure-nvidia: Include cppc_cpufreq in linux-modules (LP: #2119465)
    - [Config] azure: add cppc_cpufreq to azure.inclusion-list
  [ Ubuntu: 6.8.0-101.101 ]
  * noble/linux: 6.8.0-101.101 -proposed tracker (LP: #2140964)
  * CVE-2025-37899
    - ksmbd: fix use-after-free in session logoff
  * CVE-2025-22037
    - ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous
      session
    - ksmbd: fix race condition between destroy_previous_session() and smb2
      operations()
    - ksmbd: fix null pointer dereference in alloc_preauth_hash()

linux-azure-6.8 (6.8.0-1046.52~22.04.1) jammy; urgency=medium

  * jammy/linux-azure-6.8: 6.8.0-1046.52~22.04.1 -proposed tracker (LP: #2137863)

  [ Ubuntu-azure: 6.8.0-1046.52 ]

  * noble/linux-azure: 6.8.0-1046.52 -proposed tracker (LP: #2137864)
  * Dell AIO backlight is not working, dell_uart_backlight module is missing
    (LP: #2083800)
    - [Config] azure: Defer to generic for CONFIG_SERIAL_DEV_BUS and
      CONFIG_SERIAL_DEV_CTRL_TTYPORT
  * azure: SAUCE: add a knob for serializing open/close operations on NFSv4.x
    (LP: #2138752)
    - SAUCE: NFSv4.x: by default serialize open/close operations.
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586)
    - [Config] azure: update page size on all architectures
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722)
    - [Config] azure: enable hid-universal-pidff driver
  * [Azure] AMDv4 VMs may get no timer interrupts or suffer from timer
    interrupt storms (LP: #2137674)
    - SAUCE: clocksource: hyper-v: do not use an insanely big TSC in
      hv_read_tsc_page_tsc()
    - SAUCE: clocksource: hyper-v: use the APIC timer if the Hyper-V timer is
      unreliable on some CPUs
  [ Ubuntu: 6.8.0-100.100 ]
  * noble/linux: 6.8.0-100.100 -proposed tracker (LP: #2138307)
  * Turbo boost stuck disabled on Clevo PD5x_7xSNC_SND_SNE (LP: #2122531)
    - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
  * [noble] write-sealed memfd mappings fail to map read-only (LP: #2138244)
    - SAUCE: Fix read-only mapping of write-sealed pages
  [ Ubuntu: 6.8.0-98.98 ]
  * noble/linux: 6.8.0-98.98 -proposed tracker (LP: #2137901)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2026.01.12)
  * ubuntu_kselftests:_net/net:gre_gso.sh failing (LP: #2136820)
    - SAUCE increase socat timeout in gre_gso.sh
  * TPM timeouts occur on some Infineon TPMs (LP: #2137528)
    - tpm: Make chip->{status,cancel,req_canceled} opt
    - tpm: Check for completion after timeout
  * power: intel_pstate: Fix unchecked MSR (LP: #2130244)
    - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722)
    - selftests/futex: futex_waitv wouldblock test should fail
    - drm/i915/dg2: wait for HuC load completion before running selftests
    - drm/i915: Disable RPG during live selftest
    - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
    - octeontx2-pf: qos: fix VF root node parent queue index
    - tc: Ensure we have enough buffer space when sending filter netlink
      notifications
    - net: ethtool: Don't call .cleanup_data when prepare_data fails
    - drm/tests: modeset: Fix drm_display_mode memory leak
    - drm/tests: helpers: Add atomic helpers
    - drm/tests: Add helper to create mock plane
    - drm/tests: Add helper to create mock crtc
    - drm/tests: helpers: Add helper for drm_display_mode_from_cea_vic()
    - drm/tests: helpers: Fix compiler warning
    - drm/tests: helpers: Create kunit helper to destroy a drm_display_mode
    - drm/tests: cmdline: Fix drm_display_mode memory leak
    - drm/tests: modes: Fix drm_display_mode memory leak
    - drm/tests: probe-helper: Fix drm_display_mode memory leak
    - ata: sata_sx4: Add error handling in pdc20621_i2c_read()
    - nvmet-fcloop: swap list_add_tail arguments
    - net_sched: sch_sfq: use a temporary work area for validating
      configuration
    - Revert "net_sched: sch_sfq: move the limit validation"
    - net_sched: sch_sfq: move the limit validation
    - ipv6: Align behavior across nexthops during path selection
    - nft_set_pipapo: fix incorrect avx2 match of 5th field octet
    - fs: consistently deref the files table with rcu_dereference_raw()
    - umount: Allow superblock owners to force umount
    - x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW
    - x86/ia32: Leave NULL selector values 0~3 unchanged
    - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD
      when running in a virtual machine
    - perf: arm_pmu: Don't disable counter in armpmu_add()
    - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
    - xen/mcelog: Add __nonstring annotations for unterminated strings
    - zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work
      around compiler segfault
    - ASoC: SOF: topology: Use krealloc_array() to replace krealloc()
    - HID: pidff: Convert infinite length from Linux API to PID standard
    - HID: pidff: Do not send effect envelope if it's empty
    - HID: pidff: Add MISSING_DELAY quirk and its detection
    - HID: pidff: Add MISSING_PBO quirk and its detection
    - HID: pidff: Add PERMISSIVE_CONTROL quirk
    - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol
    - HID: pidff: Add FIX_WHEEL_DIRECTION quirk
    - HID: Add hid-universal-pidff driver and supported device ids
    - [Config] enable hid-universal-pidff driver
    - HID: pidff: Add PERIODIC_SINE_ONLY quirk
    - ALSA: hda: intel: Fix Optimus when GPU has no sound
    - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist
    - ASoC: fsl_audmix: register card device depends on 'dais' property
    - media: uvcvideo: Add quirk for Actions UVC05
    - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves
    - ALSA: usb-audio: Fix CME quirk for UF series keyboards
    - ASoC: amd: Add DMI quirk for ACP6X mic support
    - ASoC: amd: yc: update quirk data for new Lenovo model
    - f2fs: don't retry IO for corrupted data scenario
    - scsi: target: spc: Fix RSOC parameter data header size
    - net: usb: asix_devices: add FiberGecko DeviceID
    - fs/jfs: cast inactags to s64 to prevent potential overflow
    - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
    - net: sfp: add quirk for 2.5G OEM BX SFP
    - ahci: add PCI ID for Marvell 88SE9215 SATA Controller
    - ext4: protect ext4_release_dquot against freezing
    - Revert "f2fs: rebuild nat_bits during umount"
    - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk
    - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
    - tracing: fix return value in __ftrace_event_enable_disable for
      TRACE_REG_UNREGISTER
    - Bluetooth: hci_uart: fix race during initialization
    - Bluetooth: qca: simplify WCN399x NVM loading
    - drm: allow encoder mode_set even when connectors change for crtc
    - drm/amd/display: Update Cursor request mode to the beginning prefetch
      always
    - drm/amd/display: add workaround flag to link to force FFE preset
    - drm: panel-orientation-quirks: Add support for AYANEO 2S
    - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB
    - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide
    - drm: panel-orientation-quirks: Add new quirk for GPD Win 2
    - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel)
    - drm/bridge: panel: forbid initializing a panel with unknown connector
      type
    - drivers: base: devres: Allow to release group on device release
    - drm/amdkfd: clamp queue size to minimum
    - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
    - drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data
    - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
    - drm/amdgpu: grab an additional reference on the gang fence v2
    - tracing: probe-events: Add comments about entry data storing code
    - ktest: Fix Test Failures Due to Missing LOG_FILE Directories
    - tpm, tpm_tis: Workaround failed command reception on Infineon devices
    - pwm: rcar: Improve register calculation
    - pwm: fsl-ftm: Handle clk_get_rate() returning 0
    - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
    - ext4: don't treat fhandle lookup of ea_inode as FS corruption
    - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems
    - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
    - media: i2c: adv748x: Fix test pattern selection mask
    - media: vim2m: print device name after registering device
    - media: siano: Fix error handling in smsdvb_module_init()
    - xenfs/xensyms: respect hypervisor's "next" indication
    - arm64: cputype: Add MIDR_CORTEX_A76AE
    - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
    - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
    - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe
      list
    - spi: cadence-qspi: Fix probe on AM62A LP SK
    - tpm, tpm_tis: Fix timeout handling when waiting for TPM status
    - media: streamzap: prevent processing IR data on URB failure
    - media: visl: Fix ERANGE error when setting enum controls
    - media: platform: stm32: Add check for clk_enable()
    - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
    - media: i2c: ccs: Set the device's runtime PM status correctly in remove
    - media: i2c: ccs: Set the device's runtime PM status correctly in probe
    - media: i2c: ov7251: Set enable GPIO low in probe
    - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
    - media: i2c: imx219: Rectify runtime PM handling in probe and remove
    - mptcp: sockopt: fix getting IPV6_V6ONLY
    - mtd: Add check for devm_kcalloc()
    - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320
      family
    - mtd: Replace kcalloc() with devm_kcalloc()
    - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init
      wakeup
    - wifi: mt76: Add check for devm_kstrdup()
    - wifi: mac80211: fix integer overflow in hwmp_route_info_get()
    - io_uring/kbuf: reject zero sized provided buffers
    - ASoC: q6apm: add q6apm_get_hw_pointer helper
    - ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment.
    - ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns.
    - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
    - f2fs: fix to avoid atomicity corruption of atomic file
    - vdpa/mlx5: Fix oversized null mkey longer than 32bit
    - udf: Fix inode_getblk() return value
    - smb311 client: fix missing tcon check when mounting with linux/posix
      extensions
    - i3c: master: svc: Use readsb helper for reading MDB
    - leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs
    - leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs
    - mailbox: tegra-hsp: Define dimensioning masks in SoC data
    - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
    - lib: scatterlist: fix sg_split_phys to preserve original scatterlist
      offsets
    - mptcp: only inc MPJoinAckHMacFailure for HMAC failures
    - mtd: rawnand: Add status chack in r852_ready()
    - arm64: mm: Correct the update of max_pfn
    - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
    - btrfs: fix non-empty delayed iputs list on unmount due to compressed
      write workers
    - btrfs: zoned: fix zone activation with missing devices
    - btrfs: zoned: fix zone finishing with missing devices
    - iommufd: Fix uninitialized rc in iommufd_access_rw()
    - sparc/mm: disable preemption in lazy mmu mode
    - sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes
    - mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
    - mm: make page_mapped_in_vma() hugetlb walk aware
    - mm: fix lazy mmu docs and usage
    - mm/mremap: correctly handle partial mremap() of VMA starting at 0
    - mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
    - mm/userfaultfd: fix release hang over concurrent GUP
    - mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
    - mm/hugetlb: move hugetlb_sysctl_init() to the __init section
    - x86/xen: fix balloon target initialization for PVH dom0
    - tracing: Do not add length to print format in synthetic events
    - thermal/drivers/rockchip: Add missing rk3328 mapping entry
    - cifs: fix integer overflow in match_server()
    - clk: qcom: clk-branch: Fix invert halt status bit check for votable
      clocks
    - clk: qcom: gdsc: Release pm subdomains in reverse add order
    - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
    - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
    - crypto: ccp - Fix check for the primary ASP device
    - dm-ebs: fix prefetch-vs-suspend race
    - dm-integrity: set ti->error on memory allocation failure
    - dm-verity: fix prefetch-vs-suspend race
    - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg'
    - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg'
    - gpio: tegra186: fix resource handling in ACPI probe path
    - gpio: zynq: Fix wakeup source leaks on device unbind
    - gve: handle overflow when reporting TX consumed descriptors
    - KVM: x86: Explicitly zero-initialize on-stack CPUID unions
    - ntb: use 64-bit arithmetic for the MSI doorbell mask
    - of/irq: Fix device node refcount leakage in API of_irq_parse_one()
    - of/irq: Fix device node refcount leakage in API of_irq_parse_raw()
    - of/irq: Fix device node refcount leakages in of_irq_count()
    - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
    - of/irq: Fix device node refcount leakages in of_irq_init()
    - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
    - PCI: Fix reference leak in pci_alloc_child_bus()
    - phy: freescale: imx8m-pcie: assert phy reset and perst in power off
    - pinctrl: qcom: Clear latched interrupt status when changing IRQ type
    - selftests: mptcp: close fd_in before returning in main_loop
    - selftests: mptcp: fix incorrect fd checks in main_loop
    - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected()
      lists
    - ACPI: platform-profile: Fix CFI violation when accessing sysfs files
    - iommufd: Fail replace if device has not been attached
    - x86/e820: Fix handling of subpage regions when calculating nosave ranges
      in e820__register_nosave_regions()
    - media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef
      noinline
    - Bluetooth: hci_uart: Fix another race during initialization
    - scsi: hisi_sas: Enable force phy when SATA disk directly connected
    - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
    - scsi: iscsi: Fix missing scsi_host_put() in error path
    - md/raid10: fix missing discard IO accounting
    - md/md-bitmap: fix stats collection for external bitmaps
    - ASoC: dwc: always enable/disable i2s irqs
    - ovl: remove unused forward declaration
    - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
    - RDMA/hns: Fix wrong maximum DMA segment size
    - ASoC: cs42l43: Reset clamp override on jack removal
    - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid
      address
    - Bluetooth: l2cap: Check encryption key size on incoming connection
    - Revert "wifi: mac80211: Update skb's control block key in
      ieee80211_tx_dequeue()"
    - igc: increase wait time before retrying PTM
    - igc: move ktime snapshot into PTM retry loop
    - igc: handle the IGC_PTP_ENABLED flag correctly
    - igc: cleanup PTP module if probe fails
    - igc: add lock preventing multiple simultaneous PTM transactions
    - test suite: use %zu to print size_t
    - pds_core: fix memory leak in pdsc_debugfs_add_qcq()
    - net: ethernet: ti: am65-cpsw-nuss: rename phy_node -> port_np
    - net: ethernet: ti: am65-cpsw: fix port_np reference counting
    - ata: libata-sata: Save all fields from sense data descriptor
    - netlink: specs: rt-link: add an attr layer around alt-ifname
    - netlink: specs: rt-link: adjust mctp attribute naming
    - net: b53: enable BPDU reception for management port
    - net: bridge: switchdev: do not notify new brentries as changed
    - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del()
      fails
    - ptp: ocp: fix start time alignment in ptp_ocp_signal_set
    - net: ti: icss-iep: Add pwidth configuration for perout signal
    - net: ti: icss-iep: Add phase offset configuration for perout signal
    - net: ethernet: mtk_eth_soc: correct the max weight of the queue limit
      for 100Mbps
    - net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
    - riscv: Properly export reserved regions in /proc/iomem
    - kunit: qemu_configs: SH: Respect kunit cmdline
    - riscv: KGDB: Do not inline arch_kgdb_breakpoint()
    - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
    - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
    - writeback: fix false warning in inode_to_wb()
    - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
    - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
    - asus-laptop: Fix an uninitialized variable
    - nfs: add missing selections of CONFIG_CRC32
    - nfsd: decrease sc_count directly if fail to queue dl_recall
    - i2c: atr: Fix wrong include
    - ftrace: fix incorrect hash size in register_ftrace_direct()
    - Bluetooth: l2cap: Process valid commands in too long frame
    - Bluetooth: vhci: Avoid needless snprintf() calls
    - btrfs: correctly escape subvol in btrfs_show_options()
    - crypto: caam/qi - Fix drv_ctx refcount bug
    - Revert "UBUNTU: SAUCE: fs: hfs/hfsplus: add key_len boundary check to
      hfs_bnode_read_key"
    - hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
    - loop: properly send KOBJ_CHANGED uevent for disk device
    - loop: LOOP_SET_FD: send uevents for partitions
    - mm/gup: fix wrongly calculated returned value in
      fault_in_safe_writeable()
    - mm: fix filemap_get_folios_contig returning batches of identical folios
    - mm: fix apply_to_existing_page_range()
    - ksmbd: Prevent integer overflow in calculation of deadtime
    - Revert "smb: client: fix TCP timers deadlock after rmmod"
    - riscv: Avoid fortify warning in syscall_get_arguments()
    - selftests/mm: generate a temporary mountpoint for cgroup filesystem
    - smb3 client: fix open hardlink on deferred close file error
    - string: Add load_unaligned_zeropad() code path to sized_strscpy()
    - tracing: Fix filter string testing
    - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any
      unreleased standalone Zen5 microcode patches
    - x86/cpu/amd: Fix workaround for erratum 1054
    - x86/boot/sev: Avoid shared GHCB page for early memory acceptance
    - scsi: megaraid_sas: Block zero-length ATA VPD inquiry
    - scsi: ufs: exynos: Ensure consistent phy reference counts
    - perf/x86/intel: Allow to update user space GPRs from PEBS records
    - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
    - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
    - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
    - drm/repaper: fix integer overflows in repeat functions
    - drm/msm/a6xx: Fix stale rpmh votes from GPU
    - drm/amd: Handle being compiled without SI or CIK support better
    - drm/amdgpu/dma_buf: fix page_link check
    - drm/sti: remove duplicate object names
    - drm/i915/gvt: fix unterminated-string-initialization warning
    - io_uring/net: fix accept multishot handling
    - cpufreq: Reference count policy in cpufreq_update_limits()
    - kbuild: Add '-fno-builtin-wcslen'
    - mptcp: sockopt: fix getting freebind & transparent
    - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
    - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32
    - x86/xen: move xen_reserve_extra_memory()
    - x86/xen: fix memblock_reserve() usage on PVH
    - x86/split_lock: Fix the delayed detection logic
    - LoongArch: Eliminate superfluous get_numa_distances_cnt()
    - Revert "usb: typec: fix potential array underflow in
      ucsi_ccg_sync_control()"
    - usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
    - usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
    - landlock: Add the errata interface
    - nvmet-fc: Remove unused functions
    - xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
    - sign-file,extract-cert: move common SSL helper functions to a header
    - sign-file,extract-cert: avoid using deprecated ERR_get_error_line()
    - sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
    - MIPS: dec: Declare which_prom() as static
    - MIPS: cevt-ds1287: Add missing ds1287.h include
    - MIPS: ds1287: Match ds1287_set_base_clock() function types
    - drm/tests: Build KMS helpers when DRM_KUNIT_TEST_HELPERS is enabled
    - ASoC: Intel: adl: add 2xrt1316 audio configuration
    - cgroup/cpuset: Fix incorrect isolated_cpus update in
      update_parent_effective_cpumask()
    - cgroup/cpuset: Correct invalid remote parition prs
    - cgroup/cpuset: Fix error handling in remote_partition_disable()
    - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in
      update_cpumasks_hier()"
    - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call
      per operation
    - cgroup/cpuset: Further optimize code if CONFIG_CPUSETS_V1 not set
    - cgroup/cpuset: Fix race between newly created partition and dying one
    - gpiolib: of: Fix the choice for Ingenic NAND quirk
    - ublk: refactor recovery configuration flag helpers
    - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
    - iommu/exynos: Fix suspend/resume with IDENTITY domain
    - perf/dwc_pcie: fix some unreleased resources
    - Flush console log from kernel_power_off()
    - ASoC: amd: ps: use macro for ACP6.3 pci revision id
    - media: s5p-mfc: Corrected NV12M/NV21M plane-sizes
    - wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues
    - wifi: ath11k: fix memory leak in ath11k_xxx_remove()
    - wifi: mac80211: ensure sdata->work is canceled before initialized.
    - can: flexcan: Add quirk to handle separate interrupt lines for mailboxes
    - can: flexcan: add NXP S32G2/S32G3 SoC support
    - Bluetooth: btusb: Add 2 HWIDs for MT7922
    - Bluetooth: Add quirk for broken READ_VOICE_SETTING
    - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
    - drm/debugfs: fix printk format for bridge index
    - drm/amd/display: stop DML2 from removing pipes based on planes
    - drm/xe/xelp: Move Wa_16011163337 from tunings to workarounds
    - PCI: Add Rockchip Vendor ID
    - HID: pidff: Clamp PERIODIC effect period to device's logical range
    - HID: pidff: Stop all effects before enabling actuators
    - HID: pidff: Completely rework and fix pidff_reset function
    - HID: pidff: Simplify pidff_upload_effect function
    - HID: pidff: Define values used in pidff_find_special_fields
    - HID: pidff: Rescale time values to match field units
    - HID: pidff: Factor out code for setting gain
    - HID: pidff: Move all hid-pidff definitions to a dedicated header
    - HID: pidff: Simplify pidff_rescale_signed
    - HID: pidff: Use macros instead of hardcoded min/max values for shorts
    - HID: pidff: Factor out pool report fetch and remove excess declaration
    - HID: hid-universal-pidff: Add Asetek wheelbases support
    - HID: pidff: Comment and code style update
    - HID: pidff: Support device error response from PID_BLOCK_LOAD
    - HID: pidff: Remove redundant call to pidff_find_special_keys
    - HID: pidff: Rename two functions to align them with naming convention
    - HID: pidff: Clamp effect playback LOOP_COUNT value
    - HID: pidff: Compute INFINITE value instead of using hardcoded 0xffff
    - HID: pidff: Fix 90 degrees direction name North -> East
    - HID: pidff: Fix set_device_control()
    - media: mgb4: Fix CMT registers update logic
    - media: mgb4: Fix switched CMT frequency range "magic values" sets
    - media: rockchip: rga: fix rga offset lookup
    - media: v4l: Add a helper for setting up link-frequencies control
    - media: v4l2-common.h: kerneldoc: correctly format return values
    - media: imx219: Adjust PLL settings based on the number of MIPI lanes
    - media: nuvoton: Fix reference handling of ece_node
    - media: nuvoton: Fix reference handling of ece_pdev
    - media: i2c: imx319: Rectify runtime PM handling probe and remove
    - media: i2c: imx214: Rectify probe error handling related to runtime PM
    - media: chips-media: wave5: Fix gray color on screen
    - media: chips-media: wave5: Fix a hang after seeking
    - wifi: mt76: mt7925: ensure wow pattern command align fw format
    - wifi: mt76: mt7925: fix country count limitation for CLC
    - ALSA: hda/realtek: Enable Mute LED on HP OMEN 16 Laptop xd000xx
    - accel/ivpu: Fix warning in ivpu_ipc_send_receive_internal()
    - ima: limit the number of open-writers integrity violations
    - arm64: dts: exynos: gs101: disable pinctrl_gsacore node
    - btrfs: tests: fix chunk map leak after failure to add it to the tree
    - mm/damon/ops: have damon_get_folio return folio even for tail pages
    - CIFS: Propagate min offload along with other parameters from primary to
      secondary channels.
    - dm-integrity: fix non-constant-time tag verification
    - landlock: Move code to ease future backports
    - landlock: Add erratum for TCP fix
    - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq'
      error
    - net: mana: Switch to page pool for jumbo frames
    - PCI: j721e: Fix the value of .linkdown_irq_regfield for J784S4
    - pinctrl: samsung: add support for eint_fltcon_offset
    - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
    - thermal/drivers/mediatek/lvts_thermal: Allow early empty sensor slots
    - thermal/drivers/mediatek/lvts_thermal: Fix wrong lvts_ctrl index
    - thermal/drivers/mediatek/lvts: Disable monitor mode during suspend
    - thermal/drivers/mediatek/lvts: Disable Stage 3 thermal threshold
    - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr
    - libbpf: Prevent compiler warnings/errors
    - Upstream stable to v6.6.88, v6.12.24
    - SAUCE: Enable upstream config option "CONFIG_CPUSETS_V1"
  * [SRU] ixgbe: Add support for E610 in Noble (LP: #2131265)
    - ixgbe: Add support for E610 FW Admin Command Interface
    - ixgbe: Add support for E610 device capabilities detection
    - ixgbe: Add link management support for E610 device
    - ixgbe: Add support for NVM handling in E610 device
    - ixgbe: Add support for EEPROM dump in E610 device
    - ixgbe: Add ixgbe_x540 multiple header inclusion protection
    - ixgbe: Clean up the E610 link management related code
    - ixgbe: Enable link management in E610 device
    - ixgbe: fix media type detection for E610 device
    - ixgbe: fix media cage present detection for E610 device
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586)
    - io_uring: don't use int for ABI
    - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
    - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
    - smb: client: remove redundant lstrp update in negotiate protocol
    - gpio: virtio: Fix config space reading.
    - gpio: mlxbf2: use platform_get_irq_optional()
    - gpio: mlxbf3: use platform_get_irq_optional()
    - netlink: avoid infinite retry looping in netlink_unicast()
    - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
    - net: gianfar: fix device leak when querying time stamp info
    - net: enetc: fix device and OF node leak at probe
    - net: mtk_eth_soc: fix device leak at probe
    - net: ti: icss-iep: fix device and OF node leaks at probe
    - net: dpaa: fix device leak when querying time stamp info
    - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
    - PCI: Extend isolated function probing to LoongArch
    - LoongArch: BPF: Fix jump offset calculation in tailcall
    - sunvdc: Balance device refcount in vdc_port_mpgroup_check
    - Documentation: ACPI: Fix parent device references
    - ACPI: processor: perflib: Fix initial _PPC limit application
    - ACPI: processor: perflib: Move problematic pr->performance check
    - smb: client: let send_done() cleanup before calling
      smbd_disconnect_rdma_connection()
    - smb: client: don't wait for info->send_pending == 0 on error
    - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
    - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer
      exits
    - KVM: VMX: Handle forced exit due to preemption timer in fastpath
    - KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
    - KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
    - KVM: x86: Fully defer to vendor code to decide how to force immediate
      exit
    - KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
      bitmap
    - KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
    - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
    - KVM: VMX: Extract checking of guest's DEBUGCTL into helper
    - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
    - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
    - KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the
      guest
    - udp: also consider secpath when evaluating ipsec use for checksumming
    - net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
    - intel_idle: Allow loading ACPI tables for any family
    - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
    - arm64: Handle KCOV __init vs inline mismatches
    - nvme-pci: try function level reset on init failure
    - udf: Verify partition map count
    - hfs: fix not erasing deleted b-tree node issue
    - better lockdep annotations for simple_recursive_removal()
    - ata: libata-sata: Disallow changing LPM state if not supported
    - fs/ntfs3: correctly create symlink for relative path
    - ext2: Handle fiemap on empty files to prevent EINVAL
    - fix locking in efi_secret_unlink()
    - securityfs: don't pin dentries twice, once is enough...
    - tracefs: Add d_delete to remove negative dentries
    - usb: xhci: print xhci->xhc_state when queue_command failed
    - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
    - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
    - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit
      time_t
    - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
    - usb: xhci: Avoid showing warnings for dying controller
    - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
    - usb: xhci: Avoid showing errors during surprise removal
    - soc: qcom: rpmh-rsc: Add RSC version 4 support
    - remoteproc: imx_rproc: skip clock enable when M-core is managed by the
      SCU
    - gpio: wcd934x: check the return value of regmap_update_bits()
    - cpufreq: Exit governor when failed to start old governor
    - PM / devfreq: governor: Replace sscanf() with kstrtoul() in
      set_freq_store()
    - EDAC/synopsys: Clear the ECC counters on init
    - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was
      successed
    - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when
      required
    - tools/nolibc: define time_t in terms of __kernel_old_time_t
    - iio: adc: ad_sigma_delta: don't overallocate scan buffer
    - gpio: tps65912: check the return value of regmap_update_bits()
    - tools/build: Fix s390(x) cross-compilation with clang
    - selftests: tracing: Use mutex_unlock for testing glob filter
    - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
    - firmware: tegra: Fix IVC dependency problems
    - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
    - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
    - PM: sleep: console: Fix the black screen issue
    - ACPI: processor: fix acpi_object initialization
    - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
    - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
    - pps: clients: gpio: fix interrupt handling order in remove path
    - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
    - char: misc: Fix improper and inaccurate error code returned by
      misc_init()
    - mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
    - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
    - ALSA: hda: Handle the jack polling always via a work
    - ALSA: hda: Disable jack polling at shutdown
    - x86/bugs: Avoid warning when overriding return thunk
    - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
    - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
    - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
    - usb: core: usb_submit_urb: downgrade type check
    - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
    - imx8m-blk-ctrl: set ISI panic write hurry level
    - soc: qcom: mdt_loader: Actually use the e_phoff
    - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
    - platform/chrome: cros_ec_typec: Defer probe on missing EC parent
    - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
    - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
    - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
    - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
    - ASoC: codecs: rt5640: Retry DEVICE_ID verification
    - ASoC: qcom: use drvdata instead of component to keep id
    - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
    - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
    - xen/netfront: Fix TX response spurious interrupts
    - net: usb: cdc-ncm: check for filtering capability
    - ktest.pl: Prevent recursion of default variable options
    - wifi: cfg80211: reject HTC bit for management frames
    - s390/time: Use monotonic clock in get_cycles()
    - be2net: Use correct byte order and format string for TCP seq and ack_seq
    - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
    - et131x: Add missing check after DMA map
    - net: ag71xx: Add missing check after DMA map
    - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
    - arm64: Mark kernel as tainted on SAE and SError panic
    - net: mctp: Prevent duplicate binds
    - wifi: cfg80211: Fix interface type validation
    - net: ipv4: fix incorrect MTU in broadcast routes
    - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
    - net: phy: micrel: Add ksz9131_resume()
    - perf/cxlpmu: Remove unintended newline from IRQ name format string
    - wifi: iwlwifi: mvm: set gtk id also in older FWs
    - um: Re-evaluate thread flags repeatedly
    - wifi: iwlwifi: mvm: fix scan request validation
    - s390/stp: Remove udelay from stp_sync_clock()
    - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
    - wifi: mac80211: don't complete management TX on SAE commit
    - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
    - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in
      __ipv6_dev_mc_inc().
    - wifi: mac80211: fix rx link assignment for non-MLO stations
    - drm/msm: use trylock for debugfs
    - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
    - wifi: rtw89: Disable deep power saving for USB/SDIO
    - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
    - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
    - net: thunderbolt: Enable end-to-end flow control also in transmit
    - net: thunderbolt: Fix the parameter passing of
      tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
    - net: atlantic: add set_power to fw_ops for atl2 to fix wol
    - net: fec: allow disable coalescing
    - drm/amd/display: Separate set_gsl from set_gsl_source_select
    - wifi: ath12k: Add memset and update default rate value in wmi tx
      completion
    - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
    - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
    - drm/amd/display: Fix 'failed to blank crtc!'
    - wifi: mac80211: update radar_required in channel context after channel
      switch
    - wifi: rtlwifi: fix possible skb memory leak in
      `_rtl_pci_rx_interrupt()`.
    - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
    - powerpc: floppy: Add missing checks after DMA map
    - netmem: fix skb_frag_address_safe with unreadable skbs
    - wifi: iwlegacy: Check rate_idx range after addition
    - neighbour: add support for NUD_PERMANENT proxy entries
    - dpaa_eth: don't use fixed_phy_change_carrier
    - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to
      manual
    - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
    - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
    - gve: Return error for unknown admin queue command
    - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
    - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
    - net: dsa: b53: prevent DIS_LEARNING access on BCM5325
    - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
    - bpftool: Fix JSON writer resource leak in version command
    - ptp: Use ratelimite for freerun error message
    - wifi: rtlwifi: fix possible skb memory leak in
      _rtl_pci_init_one_rxdesc()
    - ionic: clean dbpage in de-init
    - net: ncsi: Fix buffer overflow in fetching version id
    - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
    - drm/ttm: Should to return the evict error
    - uapi: in6: restore visibility of most IPv6 socket options
    - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
    - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
    - drm/amd/display: Avoid trying AUX transactions on disconnected ports
    - drm/ttm: Respect the shrinker core free target
    - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
    - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
    - vhost: fail early when __vhost_add_used() fails
    - drm/amd/display: Only finalize atomic_obj if it was initialized
    - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not
      supported
    - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race
      condition
    - cifs: Fix calling CIFSFindFirst() for root path without msearch
    - crypto: hisilicon/hpre - fix dma unmap sequence
    - clk: tegra: periph: Fix error handling and resolve unsigned compare
      warning
    - mfd: axp20x: Set explicit ID for AXP313 regulator
    - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
    - fs/orangefs: use snprintf() instead of sprintf()
    - watchdog: dw_wdt: Fix default timeout
    - hwmon: (emc2305) Set initial PWM minimum value during probe based on
      thermal state
    - clk: qcom: ipq5018: keep XO clock always on
    - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
    - watchdog: iTCO_wdt: Report error if timeout configuration fails
    - crypto: jitter - fix intermediary handling
    - MIPS: lantiq: falcon: sysctrl: fix request memory check logic
    - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ
      control
    - leds: leds-lp50xx: Handle reg to get correct multi_index
    - dmaengine: stm32-dma: configure next sg only if there are more than 2
      sgs
    - RDMA/core: reduce stack using in nldev_stat_get_doit()
    - power: supply: qcom_battmgr: Add lithium-polymer entry
    - scsi: mpt3sas: Correctly handle ATA device errors
    - scsi: mpi3mr: Correctly handle ATA device errors
    - pinctrl: stm32: Manage irq affinity settings
    - media: tc358743: Check I2C succeeded during probe
    - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
    - media: tc358743: Increase FIFO trigger level to 374
    - media: usb: hdpvr: disable zero-length read messages
    - media: uvcvideo: Fix bandwidth issue for Alcor camera
    - crypto: octeontx2 - add timeout for load_fvc completion poll
    - soundwire: amd: serialize amd manager resume sequence during pm_prepare
    - soundwire: Move handle_nested_irq outside of sdw_dev_lock
    - md: dm-zoned-target: Initialize return variable r to avoid uninitialized
      use
    - module: Prevent silent truncation of module name in delete_module(2)
    - i3c: add missing include to internal header
    - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
    - i3c: don't fail if GETHDRCAP is unsupported
    - i3c: master: Initialize ret in i3c_i2c_notifier_call()
    - dm-mpath: don't print the "loaded" message if registering fails
    - dm-table: fix checking for rq stackable devices
    - apparmor: use the condition in AA_BUG_FMT even with debug disabled
    - i2c: Force DLL0945 touchpad i2c freq to 100khz
    - f2fs: check the generic conditions first
    - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
    - vfio/type1: conditional rescheduling while pinning
    - kconfig: nconf: Ensure null termination where strncpy is used
    - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
    - scsi: target: core: Generate correct identifiers for PR OUT transport
      IDs
    - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
    - vfio/mlx5: fix possible overflow in tracking max message size
    - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
    - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
    - kconfig: gconf: fix potential memory leak in renderer_edited()
    - kconfig: lxdialog: fix 'space' to (de)select options
    - ipmi: Fix strcpy source and destination the same
    - net: phy: smsc: add proper reset flags for LAN8710A
    - ASoC: Intel: avs: Fix uninitialized pointer error in probe()
    - pNFS: Fix stripe mapping in block/scsi layout
    - pNFS: Fix disk addr range check in block/scsi layout
    - pNFS: Handle RPC size limit for layoutcommits
    - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
    - scsi: lpfc: Remove redundant assignment to avoid memory leak
    - ASoC: fsl_sai: replace regmap_write with regmap_update_bits
    - cifs: reset iface weights when we cannot find a candidate
    - iommufd: Report unmapped bytes in the error path of
      iopt_unmap_iova_range
    - ext4: fix zombie groups in average fragment size lists
    - ext4: fix largest free orders lists corruption on mb_optimize_scan
      switch
    - misc: rtsx: usb: Ensure mmc child device is active when card is present
    - usb: typec: ucsi: Update power_supply on power role change
    - thunderbolt: Fix copy+paste error in match_service_id()
    - cdc-acm: fix race between initial clearing halt and open
    - btrfs: zoned: use filesystem size not disk size for reclaim decision
    - btrfs: abort transaction during log replay if walk_log_tree() failed
    - btrfs: zoned: do not remove unwritten non-data block group
    - btrfs: clear dirty status from extent buffer on error at
      insert_new_root()
    - btrfs: fix log tree replay failure due to file with 0 links and extents
    - btrfs: zoned: do not select metadata BG as finish target
    - parisc: Makefile: fix a typo in palo.conf
    - media: uvcvideo: Do not mark valid metadata as invalid
    - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
    - HID: magicmouse: avoid setting up battery timer when not needed
    - HID: apple: avoid setting up battery timer for devices without battery
    - rcu: Fix racy re-initialization of irq_work causing hangs
    - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
    - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
    - m68k: Fix lost column on framebuffer debug console
    - usb: atm: cxacru: Merge cxacru_upload_firmware() into
      cxacru_heavy_init()
    - usb: gadget: udc: renesas_usb3: fix device leak at unbind
    - usb: musb: omap2430: fix device leak at unbind
    - usb: dwc3: meson-g12a: fix device leaks at unbind
    - bus: mhi: host: Fix endianness of BHI vector table
    - vt: keyboard: Don't process Unicode characters in K_OFF mode
    - vt: defkeymap: Map keycodes above 127 to K_HOLE
    - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
    - crypto: qat - lower priority for skcipher and aead algorithms
    - ksmbd: extend the connection limiting mechanism to support IPv6
    - tracing: fprobe-event: Sanitize wildcard for fprobe event name
    - ext4: check fast symlink for ea_inode correctly
    - ext4: fix fsmap end of range reporting with bigalloc
    - ext4: fix reserved gdt blocks handling in fsmap
    - ext4: don't try to clear the orphan_present feature block device is r/o
    - ext4: use kmalloc_array() for array space allocation
    - ext4: fix hole length calculation overflow in non-extent inodes
    - btrfs: zoned: fix write time activation failure for metadata block group
    - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
    - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
    - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
    - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
    - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
      constraints
    - scsi: mpi3mr: Fix race between config read submit and interrupt
      completion
    - ata: libata-scsi: Fix ata_to_sense_error() status handling
    - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like
      host controllers
    - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
    - ata: libata-scsi: Fix CDL control
    - zynq_fpga: use sgtable-based scatterlist wrappers
    - iio: adc: ad_sigma_delta: change to buffer predisable
    - wifi: brcmsmac: Remove const from tbl_ptr parameter in
      wlc_lcnphy_common_read_table()
    - wifi: ath12k: fix dest ring-buffer corruption
    - wifi: ath12k: fix source ring-buffer corruption
    - wifi: ath12k: fix dest ring-buffer corruption when ring is full
    - wifi: ath11k: fix dest ring-buffer corruption
    - wifi: ath11k: fix source ring-buffer corruption
    - wifi: ath11k: fix dest ring-buffer corruption when ring is full
    - pwm: imx-tpm: Reset counter if CMOD is 0
    - pwm: mediatek: Handle hardware enable and clock enable separately
    - pwm: mediatek: Fix duty and period setting
    - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
    - mtd: spi-nor: Fix spi_nor_try_unlock_all()
    - mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
    - mtd: rawnand: fsmc: Add missing check after DMA map
    - mtd: rawnand: renesas: Add missing check after DMA map
    - PCI: endpoint: Fix configfs group removal on driver teardown
    - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
    - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization
      sequence
    - soc/tegra: pmc: Ensure power-domains are in a known state
    - parisc: Check region is readable by user in raw_copy_from_user()
    - parisc: Define and use set_pte_at()
    - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit
      compilers
    - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
    - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of
      do_page_fault()
    - parisc: Update comments in make_insert_tlb
    - media: gspca: Add bounds checking to firmware parser
    - media: hi556: correct the test pattern configuration
    - media: imx: fix a potential memory leak in
      imx_media_csc_scaler_device_init()
    - media: vivid: fix wrong pixel_array control size
    - media: verisilicon: Fix AV1 decoder clock frequency
    - media: v4l2-ctrls: Don't reset handler's error in
      v4l2_ctrl_handler_free()
    - media: ov2659: Fix memory leaks in ov2659_probe()
    - media: qcom: camss: cleanup media device allocated resource on error
      path
    - media: venus: hfi: explicitly release IRQ during teardown
    - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
    - media: venus: venc: Clamp param smaller than 1fps and bigger than 240
    - drm/amd: Restore cached power limit during resume
    - drm/amdgpu: update mmhub 3.0.1 client id mappings
    - drm/amd/display: Add primary plane to commits for correct VRR handling
    - drm/amd/display: Don't overwrite dce60_clk_mgr
    - mptcp: drop skb if MPTCP skb extension allocation fails
    - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
    - selftests/memfd: add test for mapping write-sealed memfd read-only
    - net: Add net_passive_inc() and net_passive_dec().
    - smb: client: fix netns refcount leak after net_passive changes
    - net_sched: sch_ets: implement lockless ets_dump()
    - leds: flash: leds-qcom-flash: Limit LED current based on thermal
      condition
    - leds: flash: leds-qcom-flash: Fix registry access after re-bind
    - fscrypt: Don't use problematic non-inline crypto engines
    - block: Make REQ_OP_ZONE_FINISH a write operation
    - usb: typec: fusb302: cache PD RX state
    - btrfs: don't ignore inode missing when replaying log tree
    - btrfs: move transaction aborts to the error site in
      add_block_group_free_space()
    - btrfs: always abort transaction on failure to add block group to free
      space tree
    - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
    - btrfs: fix ssd_spread overallocation
    - btrfs: constify more pointer parameters
    - btrfs: populate otime when logging an inode item
    - btrfs: send: factor out common logic when sending xattrs
    - btrfs: send: only use boolean variables at process_recorded_refs()
    - btrfs: send: add and use helper to rename current inode when processing
      refs
    - btrfs: send: keep the current inode's path cached
    - btrfs: send: avoid path allocation for the current inode when issuing
      commands
    - btrfs: send: use fallocate for hole punching with send stream v2
    - btrfs: send: make fs_path_len() inline and constify its argument
    - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
    - usb: dwc3: imx8mp: fix device leak at unbind
    - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
    - PM: runtime: Take active children into account in
      pm_runtime_get_if_in_use()
    - ata: libata-scsi: Return aborted command when missing sense and result
      TF
    - kbuild: userprogs: use correct linker when mixing clang and GNU ld
    - memstick: Fix deadlock by moving removing flag earlier
    - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for
      consistency
    - squashfs: fix memory leak in squashfs_fill_super
    - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
    - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and
      EliteBook 830 G6
    - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
    - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
    - drm/amd/display: Find first CRTC and its line time in
      dce110_fill_display_configs
    - drm/amd/display: Fill display clock and vblank time in
      dce110_fill_display_configs
    - soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
    - PCI: rockchip: Use standard PCIe definitions
    - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
    - PCI: imx6: Delay link start until configfs 'start' written
    - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in
      epc_features
    - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
    - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
    - ext4: preserve SB_I_VERSION on remount
    - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
    - mptcp: remove duplicate sk_reset_timer call
    - mptcp: disable add_addr retransmission when timeout is 0
    - selftests: mptcp: pm: check flush doesn't reset limits
    - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
    - mmc: sdhci-pci-gli: Add a new function to simplify the code
    - cpuidle: menu: Remove iowait influence
    - cpuidle: governors: menu: Avoid selecting states with too much latency
    - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
    - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
    - iio: proximity: isl29501: fix buffered read on big-endian systems
    - most: core: Drop device reference after usage in get_channel()
    - cdx: Fix off-by-one error in cdx_rpmsg_probe()
    - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash
      Drive
    - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
      test
    - usb: renesas-xhci: Fix External ROM access timeouts
    - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
    - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
    - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
    - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
    - usb: dwc3: pci: add support for the Intel Wildcat Lake
    - drm/amd/display: Don't overclock DCE 6 by 15%
    - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
    - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
    - powerpc/boot: Fix build with gcc 15
    - tracing: Remove unneeded goto out logic
    - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
    - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8)
      to aligned_s64
    - iio: imu: inv_icm42600: use = { } instead of memset()
    - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
    - iio: imu: inv_icm42600: change invalid data error to -EBUSY
    - usb: xhci: Fix slot_id resource race conflict
    - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and
      port is clean
    - usb: typec: maxim_contaminant: disable low power mode when reading
      comparator values
    - spi: spi-fsl-lpspi: Clamp too high speed_hz
    - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
      cpusets_insane_config_key
    - iosys-map: Fix undefined behavior in iosys_map_clear()
    - RDMA/erdma: Fix ignored return value of init_kernel_qp
    - RDMA/bnxt_re: Fix to do SRQ armena by default
    - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
    - RDMA/bnxt_re: Fix to initialize the PBL array
    - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
    - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
    - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
    - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
    - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
    - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
    - phy: mscc: Fix timestamping for vsc8584
    - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
    - LoongArch: Optimize module load time by optimizing PLT/GOT counting
    - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
    - igc: fix disabling L1.2 PCI-E link substate on I226 on init
    - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
      htb_activate
    - bonding: update LACP activity flag after setting lacp_active
    - bonding: Add independent control state machine
    - bonding: send LACPDUs periodically in passive mode after receiving
      partner's LACPDU
    - Octeontx2-af: Skip overlap check for SPI field
    - net/mlx5: Base ECVF devlink port attrs from 0
    - net/mlx5e: Preserve shared buffer capacity during headroom updates
    - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
    - s390/hypfs: Avoid unnecessary ioctl registration in debugfs
    - s390/hypfs: Enable limited access during lockdown
    - alloc_fdtable(): change calling conventions.
    - LoongArch: Avoid in-place string operation on FDT content
    - clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD
    - mm/memory-tier: fix abstract distance calculation overflow
    - nvme-tcp: log TLS handshake failures at error level
    - ata: ahci: Disallow LPM policy control if not supported
    - ata: ahci: Disable DIPM if host lacks support
    - usb: typec: tcpm/tcpci_maxim: fix irq wake usage
    - pmdomain: ti: Select PM_GENERIC_DOMAINS
    - cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode
    - platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready
    - ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless
      mode
    - tty: serial: fix print format specifiers
    - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps
    - wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn
    - idpf: preserve coalescing settings across resets
    - wifi: mac80211: don't unreserve never reserved chanctx
    - sched/deadline: Fix accounting after global limits change
    - wifi: mac80211: avoid weird state in error path
    - perf/arm: Add missing .suppress_bind_attrs
    - drm/imagination: Clear runtime PM errors while resetting the GPU
    - drm/xe/xe_query: Use separate iterator while filling GT list
    - wifi: ath12k: Fix station association with MBSSID Non-TX BSS
    - lib: packing: Include necessary headers
    - arm64: stacktrace: Check kretprobe_find_ret_addr() return value
    - net: dsa: b53: ensure BCM5325 PHYs are enabled
    - drm/amd/display: Update DMCUB loading sequence for DCN3.5
    - drm/amd/display: Disable dsc_power_gate for dcn314 by default
    - RDMA/bnxt_re: Fix size of uverbs_copy_to() in
      BNXT_RE_METHOD_GET_TOGGLE_MEM
    - media: ipu-bridge: Add _HID for OV5670
    - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in
      dev_loss_tmo_callbk
    - media: uvcvideo: Add quirk for HP Webcam HD 2300
    - crypto: ccp - Add missing bootloader info reg for pspv6
    - soundwire: amd: cancel pending slave status handling workqueue during
      remove sequence
    - tools/power turbostat: Fix build with musl
    - tools/power turbostat: Handle cap_get_proc() ENOSYS
    - smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in
      _smbd_get_connection
    - lib/sbitmap: convert shallow_depth from one word to the whole sbitmap
    - drm/amdgpu: fix vram reservation issue
    - btrfs: qgroup: set quota enabled bit if quota disable fails flushing
      reservations
    - btrfs: qgroup: fix qgroup create ioctl returning success after quotas
      disabled
    - btrfs: don't skip remaining extrefs if dir not found during log replay
    - btrfs: error on missing block group when unaccounting log tree extent
      buffers
    - btrfs: fix iteration bug in __qgroup_excl_accounting()
    - xfs: fix scrub trace with null pointer in quotacheck
    - media: v4l2: Add support for NV12M tiled variants to v4l2_format_info()
    - PCI: Store all PCIe Supported Link Speeds
    - PCI: Allow PCI bridges to go to D3Hot on all non-x86
    - PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
    - ata: libata-sata: Add link_power_management_supported sysfs attribute
    - io_uring/rw: cast rw->flags assignment to rwf_t
    - PCI: Honor Max Link Speed when determining supported speeds
    - ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is
      disabled
    - crypto: octeontx2 - Fix address alignment issue on ucode loading
    - crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2
    - crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0
    - btrfs: fix incorrect log message for nobarrier mount option
    - btrfs: restore mount option info messages during mount
    - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
    - apparmor: Fix 8-byte alignment for initial dfa blob streams
    - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
    - PCI: imx6: Remove apps_reset toggling from
      imx_pcie_{assert/deassert}_core_reset
    - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
    - ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume
      context
    - drm/amdgpu/discovery: fix fw based ip discovery
    - lib/string_choices: Add str_true_false()/str_false_true() helper
    - USB: typec: Use str_enable_disable-like helpers
    - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
    - btrfs: explicitly ref count block_group on new_bgs list
    - btrfs: codify pattern for adding block_group to bg_list
    - btrfs: zoned: requeue to unused block group list if zone finish failed
    - drm/vblank: Introduce drm_crtc_vblank_crtc()
    - drm/vblank: add dynamic per-crtc vblank configuration support
    - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
    - arch: consolidate existing CONFIG_PAGE_SIZE_*KB definitions
    - arch: simplify architecture specific page size configuration
    - [Config] update page size configuration
    - arch: define CONFIG_PAGE_SIZE_*KB on all architectures
    - [Config] update page size on all architectures
    - Mark xe driver as BROKEN if kernel page size is not 4kB
    - [Config] disable xe driver where page size is not 4kB
    - arm64: dts: ti: k3-am6*: Add boot phase flag to support MMC boot
    - arm64: dts: ti: k3-am62*: Add non-removable flag for eMMC
    - arm64: dts: ti: k3-am6*: Add bootph-all property in MMC node
    - arm64: dts: ti: k3-am6*: Remove DLL properties for soft PHYs
    - arm64: dts: ti: k3-am6*: Remove disable-wp for eMMC
    - arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file
    - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
    - drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
    - drm/i915/display: add intel_encoder_is_*() and _to_*() functions
    - drm/i915/icl+/tc: Cache the max lane count value
    - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
    - cgroup/cpuset: Fix a partition error with CPU hotplug
    - drm/tests: Fix endian warning
    - RDMA/bnxt_re: Fix a possible memory leak in the driver
    - RDMA/hns: Fix dip entries leak on devices newer than hip09
    - net: xilinx: axienet: Fix RX skb ring management in DMAengine mode
    - drm/hisilicon/hibmc: refactored struct hibmc_drm_private
    - drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init
      failed
    - drm/amd/display: Don't print errors for nonexistent connectors
    - net: dsa: microchip: Fix KSZ9477 HSR port setup issue
    - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
    - net/mlx5e: Extract checking of FEC support for a link mode
    - net/mlx5e: Support FEC settings for 100G/lane modes
    - net/mlx5: Add IFC bits and enums for buf_ownership
    - net/mlx5e: Query FW for buffer ownership
    - Upstream stable to v6.6.103, v6.12.43, v6.12.44
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39779
    - btrfs: subpage: keep TOWRITE tag until folio is cleaned
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39759
    - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39705
    - drm/amd/display: fix a Null pointer dereference vulnerability
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39707
    - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39712
    - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38686
    - userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38703
    - drm/xe: Make dma-fences compliant with the safe access rules
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39746
    - wifi: ath10k: shutdown driver when hardware is unreliable
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39747
    - drm/msm: Add error handling for krealloc in metadata setup
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38704
    - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39748
    - bpf: Forget ranges when refining tnum after JSET
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38705
    - drm/amd/pm: fix null pointer access
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38710
    - gfs2: Validate i_depth for exhash directories
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38722
    - habanalabs: fix UAF in export_dmabuf()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38732
    - netfilter: nf_reject: don't leak dst refcount for loopback packets
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39766
    - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38734
    - net/smc: fix UAF on smcsk after smc_listen_out()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38735
    - gve: prevent ethtool ops after shutdown
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39673
    - ppp: fix race conditions in ppp_fill_forward_path
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39770
    - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39675
    - drm/amd/display: Add null pointer check in
      mod_hdcp_hdcp1_create_session()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39772
    - drm/hisilicon/hibmc: fix the hibmc loaded failed bug
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38676
    - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39676
    - scsi: qla4xxx: Prevent a potential error pointer dereference
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39773
    - net: bridge: fix soft lockup in br_multicast_query_expired()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39679
    - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39681
    - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39687
    - iio: light: as73211: Ensure buffer holes are zeroed
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39683
    - tracing: Limit access to parser->buffer when trace_get_user failed
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39801
    - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39684
    - comedi: Fix use of uninitialized memory in do_insn_ioctl() and
      do_insnlist_ioctl()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39685
    - comedi: pcl726: Prevent invalid irq number
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39686
    - comedi: Make insn_rw_emulate_bits() do insn->n samples
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39689
    - ftrace: Also allocate and copy hash for reading of filter files
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39691
    - fs/buffer: fix use-after-free when call bh_read() helper
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39692
    - smb: server: split ksmbd_rdma_stop_listening() out of
      ksmbd_rdma_destroy()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39788
    - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39693
    - drm/amd/display: Avoid a NULL pointer dereference
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39694
    - s390/sclp: Fix SCCB present check
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39776
    - mm/debug_vm_pgtable: clear page table entries at destroy_args()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38681
    - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39800
    - btrfs: abort transaction on unexpected eb generation at
      btrfs_copy_root()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38684
    - net/sched: ets: use old 'nbands' while purging unused classes
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-21884
    - net: better track kernel sockets lifetime
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39701
    - ACPI: pfr_update: Fix the driver update version check
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39702
    - ipv6: sr: Fix MAC comparison to be constant-time
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39703
    - net, hsr: reject HSR frame if skb can't hold tag
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39706
    - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39709
    - media: venus: protect against spurious interrupts during probe
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39710
    - media: venus: Add a check for packet size after reading from shared
      memory
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39711
    - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
      calls
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39713
    - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39714
    - media: usbtv: Lock resolution while streaming
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39715
    - parisc: Revise gateway LWS calls to probe user read access
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39716
    - parisc: Revise __get_user() to probe user read access
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39781
    - parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39782
    - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38677
    - f2fs: fix to avoid out-of-boundary access in dnode page
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39718
    - vsock/virtio: Validate length in packet header before skb_put()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39783
    - PCI: endpoint: Fix configfs group list head handling
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39719
    - iio: imu: bno055: fix OOB access of hw_xlate array
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39787
    - soc: qcom: mdt_loader: Ensure we don't read past the ELF header
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39720
    - ksmbd: fix refcount leak causing resource not released
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39721
    - crypto: qat - flush misc workqueue during device shutdown
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39790
    - bus: mhi: host: Detect events pointing to unexpected TREs
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39724
    - serial: 8250: fix panic due to PSLVERR
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39758
    - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38679
    - media: venus: Fix OOB read due to missing payload bound check
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38680
    - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39736
    - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39737
    - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38683
    - hv_netvsc: Fix panic during namespace deletion with VF
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38685
    - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39738
    - btrfs: do not allow relocation of partially dropped subvolumes
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38687
    - comedi: fix race between polling and detaching
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39760
    - usb: core: config: Prevent OOB read in SS endpoint companion parsing
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38688
    - iommufd: Prevent ALIGN() overflow
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39739
    - iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38691
    - pNFS: Fix uninited ptr deref in block/scsi layout
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39795
    - block: avoid possible overflow for chunk_sectors check in
      blk_stack_limits()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38692
    - exfat: add cluster chain loop check for dir
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38693
    - media: dvb-frontends: w7090p: fix null-ptr-deref in
      w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38694
    - media: dvb-frontends: dib7090p: fix null-ptr-deref in
      dib7090p_rw_on_apb()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38695
    - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport
      structure
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39742
    - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38696
    - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38697
    - jfs: upper bound check of tree index in dbAllocAG
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38698
    - jfs: Regular file corruption check
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39743
    - jfs: truncate good inode pages when hard link is 0
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38699
    - scsi: bfa: Double-free fix
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38700
    - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is
      allocated
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38701
    - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38702
    - fbdev: fix potential buffer overflow in do_register_framebuffer()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39744
    - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39761
    - wifi: ath12k: Decrement TID on RX peer frag setup error handling
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39797
    - xfrm: Duplicate SPI Handling
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39749
    - rcu: Protect ->defer_qs_iw_pending from data race
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39750
    - wifi: ath12k: Correct tid cleanup when tid setup fails
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38706
    - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39794
    - ARM: tegra: Use I/O memcpy to write to IRAM
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39752
    - ARM: rockchip: fix kernel hang during smp initialization
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39763
    - ACPI: APEI: send SIGBUS to current task if synchronous memory error not
      recovered
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38707
    - fs/ntfs3: Add sanity check for file name
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38708
    - drbd: add missing kref_get in handle_write_conflicts
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39753
    - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38711
    - smb/server: avoid deadlock when linking with ReplaceIfExists
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38712
    - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38713
    - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38714
    - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38715
    - hfs: fix slab-out-of-bounds in hfs_bnode_read()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38716
    - hfs: fix general protection fault in hfs_find_init()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38718
    - sctp: linearize cloned gso packets in sctp_rcv
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38721
    - netfilter: ctnetlink: fix refcount leak on table dump
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38614
    - eventpoll: Fix semi-unbounded recursion
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39756
    - fs: Prevent file descriptor table allocations exceeding INT_MAX
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39798
    - NFS: Fix the setting of capabilities when automounting a new filesystem
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38724
    - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38730
    - io_uring/net: commit partial buffers on retry
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38725
    - net: usb: asix_devices: add phy_mask for ax88772 mdio bus
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38728
    - smb3: fix for slab out of bounds on mount to ksmbd
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-39757
    - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  * Noble update: upstream stable patchset 2026-01-06 (LP: #2137586) //
    CVE-2025-38729
    - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  * CVE-2025-40297
    - net: bridge: fix use-after-free due to MST port state bypass
  * CVE-2025-40256
    - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that
      were never added
  * CVE-2025-40215
    - xfrm: delete x->tunnel as we delete x
  * CVE-2025-40214
    - af_unix: Initialise scc_index in unix_add_edge().
  * CVE-2025-38248
    - bridge: mcast: Fix use-after-free during router port configuration
  * Enabling crypto selftests causes boot stall on 6.8 (LP: #2135716)
    - SAUCE: Revert "crypto: api - Fix boot-up self-test race"
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261)
    - ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
    - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
    - ASoC: cs35l56: probe() should fail if the device ID is not recognized
    - Bluetooth: hci_sync: Fix not disabling advertising instance
    - Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
    - pinctrl: amd: Clear GPIO debounce for suspend
    - fix proc_sys_compare() handling of in-lookup dentries
    - vsock: fix `vsock_proto` declaration
    - vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also
      `transport_local`
    - net: stmmac: Fix interrupt handling for level-triggered mode in
      DWC_XGMAC2
    - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
    - net: phy: smsc: Force predictable MDI-X state on LAN87xx
    - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
    - perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
    - x86/mce/amd: Add default names for MCA banks and blocks
    - x86/mce/amd: Fix threshold limit reset
    - x86/mce: Don't remove sysfs if thresholding sysfs init fails
    - x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
    - KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing
      table.
    - gre: Fix IPv6 multicast route creation.
    - md/md-bitmap: fix GPF in bitmap_get_stats()
    - drm/ttm: fix error handling in ttm_buffer_object_transfer
    - drm/gem: Fix race in drm_gem_handle_create_tail()
    - Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
    - drm/framebuffer: Acquire internal references on GEM handles
    - kallsyms: fix build without execinfo
    - maple_tree: fix mt_destroy_walk() on root leaf node
    - mm: fix the inaccurate memory statistics issue for users
    - scripts/gdb: fix interrupts display after MCP on x86
    - scripts/gdb: de-reference per-CPU MCE interrupts
    - scripts/gdb: fix interrupts.py after maple tree conversion
    - mm/vmalloc: leave lazy MMU mode on PTE mapping error
    - pwm: mediatek: Ensure to disable clocks in error path
    - x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
    - x86/mm: Disable hugetlb page table sharing on 32-bit
    - smb: server: make use of rdma_destroy_qp()
    - ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
    - erofs: fix to add missing tracepoint in erofs_read_folio()
    - netlink: Fix rmem check in netlink_broadcast_deliver().
    - netlink: make sure we allow at least one dump skb
    - smb: client: avoid unnecessary reconnects when refreshing referrals
    - smb: client: fix DFS interlink failover
    - cifs: all initializations for tcon should happen in tcon_info_alloc
    - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
    - net: phy: microchip: limit 100M workaround to link-down events on
      LAN88xx
    - can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
      debug level
    - net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
    - bnxt_en: Fix DCB ETS validation
    - ublk: sanity check add_dev input for underflow
    - atm: idt77252: Add missing `dma_map_error()`
    - um: vector: Reduce stack usage in vector_eth_configure()
    - io_uring: make fallocate be hashed work
    - ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
    - ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
    - net: usb: qmi_wwan: add SIMCom 8230C composition
    - HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
    - net: mana: Record doorbell physical address in PF mode
    - vt: add missing notification when switching back to text mode
    - bpf: Adjust free target to avoid global starvation of LRU map
    - HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
    - selftests/bpf: adapt one more case in test_lru_map to the new
      target_free
    - smb: client: fix potential race in cifs_put_tcon()
    - drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
    - drm/amdgpu/ip_discovery: add missing ip_discovery fw
    - x86/mce: Ensure user polling settings are honored when restarting timer
    - ASoC: fsl_sai: Force a software reset when starting in consumer mode
    - wifi: mt76: mt7921: prevent decap offload config before STA
      initialization
    - wifi: mt76: mt7925: fix the wrong config for tx interrupt
    - wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
      scan
    - drm/xe: Allocate PF queue size on pow2 boundary
    - clk: scmi: Handle case where child clocks are initialized before their
      parents
    - erofs: address D-cache aliasing
    - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
    - wifi: cfg80211: fix S1G beacon head validation in nl80211
    - wifi: mac80211: correctly identify S1G short beacon
    - wifi: mac80211: fix non-transmitted BSSID profile search
    - drm/nouveau/gsp: fix potential leak of memory used during acpi init
    - erofs: free pclusters if no cached folio is attached
    - erofs: get rid of `z_erofs_next_pcluster_t`
    - erofs: tidy up zdata.c
    - erofs: refine readahead tracepoint
    - erofs: fix to add missing tracepoint in erofs_readahead()
    - net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
    - selftests: net: lib: Move logging from forwarding/lib.sh here
    - selftests: net: lib: fix shift count out of range
    - net/mlx5e: Add new prio for promiscuous mode
    - ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
    - ALSA: hda/realtek: Add quirks for some Clevo laptops
    - riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
    - erofs: fix rare pcluster memory leak after unmounting
    - net: libwx: fix alloc msix vectors failed
    - net: wangxun: revert the adjustment of the IRQ vector sequence
    - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
    - KVM: SVM: Set synthesized TSA CPUID flags
    - Upstream stable to v6.6.98, v6.6.99, v6.12.38, v6.12.39
    - SAUCE: selftests: net: altnames.sh fix following upstream updates
  * vrf_route_leaking.sh in net from ubuntu_kernel_selftests linux ADT test
    failure with linux/5.11.0-18.19 (Ping received ICMP Packet too big)
    (LP: #1928890)
    - selftests: net: use slowwait to stabilize vrf_route_leaking test
  * ubuntu_bpf failed to build on Noble ( error: ‘struct prog_test_def’ has no
    member named ‘should_tmon’) (LP: #2112357)
    - selftests/bpf: Factor out get_xlated_program() helper
    - selftests/bpf: extract utility function for BPF disassembly
    - selftests/bpf: Add traffic monitor functions.
    - selftests/bpf: Add the traffic monitor option to test_progs.
  * ipsec_offload in rtnetlink.sh from ubunsu_kselftests_net fails on O/J
    (LP: #2096976)
    - netdevsim: fix rtnetlink.sh selftest
    - [SAUCE] Fix selftest/net/rtnetlink.sh for Big Endian
  * fib_tests.sh in ubuntu_kernel_selftests failed with IPv4 mangling tests
    Connection check - server side (LP: #2012859)
    - selftests: rtnetlink: correct error message in rtnetlink.sh fou test
  * net:rtnetlink.sh in ubuntu_kernel_selftests failed with FAIL: address
    proto IPv4 / IPv6 (LP: #2031531)
    - selftests: rtnetlink: skip tests if tools or feats are missing
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740)
    - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
    - ethernet: intel: fix building with large NR_CPUS
    - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
    - ASoC: Intel: fix SND_SOC_SOF dependencies
    - ASoC: amd: yc: add DMI quirk for ASUS M6501RM
    - audit,module: restore audit logging in load failure case
    - fs_context: fix parameter name in infofc() macro
    - ublk: use vmalloc for ublk_device's __queues
    - hfsplus: make splice write available again
    - hfs: make splice write available again
    - ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
    - ASoC: ops: dynamically allocate struct snd_ctl_elem_value
    - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
    - selftests: Fix errno checking in syscall_user_dispatch test
    - soc: qcom: QMI encoding/decoding for big endian
    - arm64: dts: qcom: sdm845: Expand IMEM region
    - arm64: dts: qcom: sc7180: Expand IMEM region
    - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
    - ARM: dts: vfxxx: Correctly use two tuples for timer address
    - usb: host: xhci-plat: fix incorrect type for of_match variable in
      xhci_plat_probe()
    - usb: misc: apple-mfi-fastcharge: Make power supply names unique
    - vmci: Prevent the dispatching of uninitialized payloads
    - pps: fix poll support
    - Revert "vmci: Prevent the dispatching of uninitialized payloads"
    - usb: early: xhci-dbc: Fix early_ioremap leak
    - arm: dts: ti: omap: Fixup pinheader typo
    - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
    - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
    - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
    - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
    - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
    - cpufreq: Initialize cpufreq-based frequency-invariance later
    - cpufreq: Init policy->rwsem before it may be possibly used
    - samples: mei: Fix building on musl libc
    - soc: qcom: pmic_glink: fix OF node leak
    - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
    - interconnect: qcom: sc8180x: specify num_nodes
    - staging: nvec: Fix incorrect null termination of battery manufacturer
    - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
    - bpf, sockmap: Fix psock incorrectly pointing to sk
    - selftests/bpf: fix signedness bug in redir_partial()
    - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
    - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
    - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
    - caif: reduce stack size, again
    - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
    - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
    - net: dst: annotate data-races around dst->input
    - net: dst: annotate data-races around dst->output
    - kselftest/arm64: Fix check for setting new VLs in sve-ptrace
    - drm/msm/dpu: Fill in min_prefill_lines for SC8180X
    - m68k: Don't unregister boot console needlessly
    - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
    - sched/psi: Optimize psi_group_change() cpu_clock() usage
    - fbcon: Fix outdated registered_fb reference in comment
    - netfilter: nf_tables: Drop dead code from fill_*_info routines
    - netfilter: nf_tables: adjust lockdep assertions handling
    - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
    - um: rtc: Avoid shadowing err in uml_rtc_start()
    - net_sched: act_ctinfo: use atomic64_t for three counters
    - xen/gntdev: remove struct gntdev_copy_batch from stack
    - tcp: call tcp_measure_rcv_mss() for ooo packets
    - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
    - mwl8k: Add missing check after DMA map
    - iommu/amd: Fix geometry.aperture_end for V2 tables
    - wifi: plfxlc: Fix error handling in usb driver probe
    - wifi: mac80211: Do not schedule stopped TXQs
    - wifi: mac80211: Don't call fq_flow_idx() for management frames
    - wifi: mac80211: Check 802.11 encaps offloading in
      ieee80211_tx_h_select_key()
    - Reapply "wifi: mac80211: Update skb's control block key in
      ieee80211_tx_dequeue()"
    - wifi: ath12k: fix endianness handling while accessing wmi service bit
    - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P
      IE
    - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
    - kcsan: test: Initialize dummy variable
    - Bluetooth: hci_event: Mask data status from LE ext adv reports
    - tools/rv: Do not skip idle in trace
    - can: peak_usb: fix USB FD devices potential malfunction
    - can: kvaser_pciefd: Store device channel index
    - can: kvaser_usb: Assign netdev.dev_port based on device channel index
    - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
    - selftests: rtnetlink.sh: remove esp4_offload after test
    - vrf: Drop existing dst reference in vrf_ip6_input_dst
    - ipv6: annotate data-races around rt->fib6_nsiblings
    - bpf/preload: Don't select USERMODE_DRIVER
    - PCI: rockchip-host: Fix "Unexpected Completion" log message
    - crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
    - crypto: qat - use unmanaged allocation for dc_data
    - crypto: marvell/cesa - Fix engine load inaccuracy
    - mtd: fix possible integer overflow in erase_xfer()
    - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
    - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
    - crypto: arm/aes-neonbs - work around gcc-15 warning
    - PCI: endpoint: pci-epf-vntb: Return -ENOENT if
      pci_epc_get_next_free_bar() fails
    - pinctrl: sunxi: Fix memory leak on krealloc failure
    - fanotify: sanitize handle_type values when reporting fid
    - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
    - Fix dma_unmap_sg() nents value
    - perf tools: Fix use-after-free in help_unknown_cmd()
    - perf sched: Free thread->priv using priv_destructor
    - perf sched: Fix memory leaks for evsel->priv in timehist
    - perf sched: Fix memory leaks in 'perf sched latency'
    - crypto: inside-secure - Fix `dma_unmap_sg()` nents value
    - RDMA/hns: Fix -Wframe-larger-than issue
    - kernel: trace: preemptirq_delay_test: use offstack cpu mask
    - perf tests bp_account: Fix leaked file descriptor
    - clk: sunxi-ng: v3s: Fix de clock definition
    - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
    - scsi: elx: efct: Fix dma_unmap_sg() nents value
    - scsi: mvsas: Fix dma_unmap_sg() nents value
    - scsi: isci: Fix dma_unmap_sg() nents value
    - watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
    - hwrng: mtk - handle devm_pm_runtime_enable errors
    - crypto: keembay - Fix dma_unmap_sg() nents value
    - crypto: img-hash - Fix dma_unmap_sg() nents value
    - soundwire: stream: restore params when prepare ports fail
    - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem
      attribute
    - fs/orangefs: Allow 2 more characters in do_c_string()
    - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
    - dmaengine: nbpfaxi: Add missing check after DMA map
    - ASoC: fsl_xcvr: get channel status data when PHY is not exists
    - sh: Do not use hyphen in exported variable name
    - perf tools: Remove libtraceevent in .gitignore
    - crypto: qat - fix DMA direction for compression on GEN2 devices
    - crypto: qat - fix seq_file position update in adf_ring_next()
    - jfs: fix metapage reference count leak in dbAllocCtl
    - mtd: rawnand: atmel: Fix dma_mapping_error() address
    - mtd: rawnand: rockchip: Add missing check after DMA map
    - mtd: rawnand: atmel: set pmecc data setup time
    - vhost-scsi: Fix log flooding with target does not exist errors
    - bpf: Check flow_dissector ctx accesses are aligned
    - bpf: Check netfilter ctx accesses are aligned
    - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
    - apparmor: fix loop detection used in conflicting attachment resolution
    - module: Restore the moduleparam prefix length check
    - ucount: fix atomic_long_inc_below() argument type
    - rtc: ds1307: fix incorrect maximum clock rate handling
    - rtc: hym8563: fix incorrect maximum clock rate handling
    - rtc: nct3018y: fix incorrect maximum clock rate handling
    - rtc: pcf85063: fix incorrect maximum clock rate handling
    - rtc: pcf8563: fix incorrect maximum clock rate handling
    - rtc: rv3028: fix incorrect maximum clock rate handling
    - f2fs: doc: fix wrong quota mount option description
    - f2fs: fix to update upper_p in __get_secs_required() correctly
    - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
    - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
    - vfio: Prevent open_count decrement to negative
    - vfio/pci: Separate SR-IOV VF dev_set
    - scsi: mpt3sas: Fix a fw_event memory leak
    - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
    - scsi: ufs: core: Use link recovery when h8 exit fails during runtime
      resume
    - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
    - kconfig: qconf: fix ConfigList::updateListAllforAll()
    - sched/psi: Fix psi_seq initialization
    - PCI: pnv_php: Work around switches with broken presence detection
    - powerpc/eeh: Export eeh_unfreeze_pe()
    - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
    - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
    - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
    - NFSv4.2: another fix for listxattr
    - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
    - md/md-cluster: handle REMOVE message earlier
    - netpoll: prevent hanging NAPI when netcons gets enabled
    - phy: mscc: Fix parsing of unicast frames
    - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
    - netlink: specs: ethtool: fix module EEPROM input/output arguments
    - net/mlx5: Correctly set gso_segs when LRO is used
    - net/sched: taprio: enforce minimum value for picos_per_byte
    - benet: fix BUG when creating VFs
    - irqchip: Build IMX_MU_MSI only on ARM
    - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
    - smb: server: remove separate empty_recvmsg_queue
    - smb: server: make sure we call ib_dma_unmap_single() only if we called
      ib_dma_map_single already
    - smb: server: let recv_done() consistently call
      put_recvmsg/smb_direct_disconnect_rdma_connection
    - smb: server: let recv_done() avoid touching data_transfer after
      cleanup/move
    - smb: client: Use min() macro
    - smb: client: Correct typos in multiple comments across various files
    - smb: smbdirect: add smbdirect_socket.h
    - smb: client: make use of common smbdirect_socket
    - smb: client: make sure we call ib_dma_unmap_single() only if we called
      ib_dma_map_single already
    - smb: client: let recv_done() cleanup before notifying the callers.
    - pptp: fix pptp_xmit() error path
    - smb: client: return an error if rdma_connect does not return within 5
      seconds
    - selftests/perf_events: Add a mmap() correctness test
    - ksmbd: fix corrupted mtime and ctime in smb2_open
    - smb: server: Fix extension string in ksmbd_extract_shortname()
    - USB: serial: option: add Foxconn T99W709
    - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
    - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
    - net: usbnet: Fix the wrong netif_carrier_on() call
    - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
    - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
    - x86/fpu: Delay instruction pointer fixup until after warning
    - MIPS: mm: tlb-r4k: Uniquify TLB entries on init
    - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
    - ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
    - arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
    - arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
    - mei: vsc: Destroy mutex after freeing the IRQ
    - mei: vsc: Event notifier fixes
    - mei: vsc: Unset the event callback on remove and probe errors
    - arm64: dts: st: fix timer used for ticks
    - selftests: breakpoints: use suspend_stats to reliably check suspend
      success
    - PM / devfreq: Fix a index typo in trans_stat
    - drm/panfrost: Fix panfrost device variable name in devfreq
    - selftests/bpf: Fix unintentional switch case fall through
    - drm/amdgpu: Remove nbiov7.9 replay count reporting
    - bpf: Ensure RCU lock is held around bpf_prog_ksym_find
    - refscale: Check that nreaders and loops multiplication doesn't overflow
    - iommu/amd: Enable PASID and ATS capabilities in the correct order
    - file: add take_fd() cleanup helper
    - file: fix typo in take_fd() comment
    - rcu: Fix delayed execution of hurry callbacks
    - ring-buffer: Remove ring_buffer_read_prepare_sync()
    - net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
    - stmmac: xsk: fix negative overflow of budget in zerocopy mode
    - pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state()
    - dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
    - phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
    - perf dso: Add missed dso__put to dso__load_kcore
    - mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
    - perf sched: Make sure it frees the usage string
    - perf sched: Fix memory leaks in 'perf sched map'
    - perf sched: Use RC_CHK_EQUAL() to compare pointers
    - RDMA/hns: Fix HW configurations not cleared in error flow
    - RDMA/hns: Get message length of ack_req from FW
    - RDMA/hns: Add mutex_destroy()
    - RDMA/hns: Fix accessing uninitialized resources
    - RDMA/hns: Drop GFP_NOWARN
    - crypto: qat - disable ZUC-256 capability for QAT GEN5
    - remoteproc: xlnx: Disable unsupported features
    - perf record: Cache build-ID of hit DSOs only
    - vdpa: Fix IDR memory leak in VDUSE module exit
    - vhost: Reintroduce kthread API and add mode selection
    - [Config] enable VHOST_ENABLE_FORK_OWNER_CONTROL
    - apparmor: Fix unaligned memory accesses in KUnit test
    - f2fs: turn off one_time when forcibly set to foreground GC
    - exfat: fdatasync flag should be same like generic_write_sync()
    - s390/ap: Unmask SLCF bit in card and queue ap functions sysfs
    - block: Fix default IO priority if there is no IO context
    - ASoC: tas2781: Fix the wrong step for TLV on tas2781
    - s390/mm: Allocate page table with PAGE_SIZE granularity
    - smb: client: remove separate empty_packet_queue
    - smb: client: let recv_done() avoid touching data_transfer after
      cleanup/move
    - drm/i915/ddi: change intel_ddi_init_{dp, hdmi}_connector() return type
    - drm/i915/hdmi: propagate errors from intel_hdmi_init_connector()
    - drm/i915/hdmi: add error handling in g4x_hdmi_init()
    - drm/i915/ddi: gracefully handle errors from
      intel_ddi_init_hdmi_connector()
    - drm/i915/display: add intel_encoder_is_hdmi()
    - drm/i915/ddi: only call shutdown hooks for valid encoders
    - PCI/ASPM: Save parent L1SS config in pci_save_aspm_l1ss_state()
    - PCI/ASPM: Fix L1SS saving
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
    - s390/mm: Remove possible false-positive warning in pte_free_defer()
    - Upstream stable to v6.6.102, v6.12.42
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38619
    - media: ti: j721e-csi2rx: fix list_del corruption
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38582
    - RDMA/hns: Fix double destruction of rsv_qp
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38585
    - staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38593
    - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-39732
    - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38595
    - xen: fix UAF in dmabuf_exp_from_pages()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38660
    - parse_longname(): strrchr() expects NUL-terminated string
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38555
    - usb: gadget : fix use-after-free in composite_dev_cleanup()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2024-36331 // CVE-2025-38560
    - x86/sev: Evict cache lines during SNP memory validation
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38501
    - ksmbd: limit repeated connections from clients with the same IP
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38562
    - ksmbd: fix null pointer dereference error in generate_encryptionkey
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38566
    - sunrpc: fix handling of server side tls alerts
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38568
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38571
    - sunrpc: fix client side handling of tls alerts
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38622
    - net: drop UFO packets in udp_rcv_segment()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38572
    - ipv6: reject malicious packets in ipv6_gso_segment()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38574
    - pptp: ensure minimal skb length in pptp_xmit()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-39730
    - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38623
    - PCI: pnv_php: Fix surprise plug detection and recovery
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38576
    - powerpc/eeh: Make EEH driver device hotplug safe
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38624
    - PCI: pnv_php: Clean up allocated IRQs on unplug
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38625
    - vfio/pds: Fix missing detach_ioas op
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38626
    - f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-39731
    - f2fs: vm_unmap_ram() may be called from an invalid context
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38652
    - f2fs: fix to avoid out-of-boundary access in devs.path
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38577
    - f2fs: fix to avoid panic in f2fs_evict_inode
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38578
    - f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38579
    - f2fs: fix KMSAN uninit-value in extent_info usage
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38630
    - fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38632
    - pinmux: fix race causing mux_owner NULL with active mux_usecount
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38653
    - proc: use the same treatment to check proc_lseek as ones for
      proc_read_iter et.al
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38581
    - crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38634
    - power: supply: cpcap-charger: Fix null check for
      power_supply_get_by_name
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38583
    - clk: xilinx: vcu: unregister pll_post only if registered correctly
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38635
    - clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38587
    - ipv6: fix possible infinite loop in fib6_info_uses_dev()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38588
    - ipv6: prevent infinite loop in rt6_nlmsg_size()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38590
    - net/mlx5e: Remove skb secpath if xfrm state is not found
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38639
    - netfilter: xt_nfacct: don't assume acct name is null-terminated
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38640
    - bpf: Disable migration in nf_hook_run_bpf().
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38644
    - wifi: mac80211: reject TDLS operations when station is not associated
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38553
    - net/sched: Restrict conditions for adding duplicating netems to qdisc
      tree
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38645
    - net/mlx5: Check device memory pointer before usage
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38601
    - wifi: ath11k: clear initialized flag for deinit-ed srng lists
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38602
    - iwlwifi: Add missing check for alloc_ordered_workqueue
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38604
    - wifi: rtl818x: Kill URBs before clearing tx status queue
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38646
    - wifi: rtw89: avoid NULL dereference when RX problematic packet on
      unsupported 6 GHz band
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38608
    - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38609
    - PM / devfreq: Check governor before using governor->name
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38610
    - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38612
    - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38648
    - spi: stm32: Check for cfg availability in stm32_spi_probe
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38659
    - gfs2: No more self recovery
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-39734
    - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38650
    - hfsplus: remove mutex_lock check in hfsplus_free_extents
  * Noble update: upstream stable patchset 2025-12-17 (LP: #2136740) //
    CVE-2025-38615
    - fs/ntfs3: cancle set bad inode after removing name fails
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361)
    - virtio_ring: Fix error reporting in virtqueue_resize
    - RDMA/core: Rate limit GID cache warning messages
    - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
    - iio: adc: ad7949: use spi_is_bpw_supported()
    - regmap: fix potential memory leak of regmap_bus
    - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
    - platform/x86: Fix initialization order for firmware_attributes_class
    - staging: vchiq_arm: Make vchiq_shutdown never fail
    - net/mlx5: Fix memory leak in cmd_exec()
    - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
    - i40e: report VF tx_dropped with tx_errors instead of tx_discards
    - i40e: When removing VF MAC filters, only check PF-set MAC
    - drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
    - net: hns3: fix concurrent setting vlan filter issue
    - net: hns3: disable interrupt when ptp init failed
    - net: hns3: fixed vf get max channels bug
    - net: hns3: default enable tx bounce buffer when smmu enabled
    - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among
      boots
    - i2c: tegra: Fix reset error handling with ACPI
    - i2c: virtio: Avoid hang by using interruptible completion wait
    - bus: fsl-mc: Fix potential double device reference in
      fsl_mc_get_endpoint()
    - sprintf.h requires stdarg.h
    - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
    - dpaa2-eth: Fix device reference count leak in MAC endpoint handling
    - dpaa2-switch: Fix device reference count leak in MAC endpoint handling
    - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
    - e1000e: ignore uninitialized checksum word on tgp
    - gve: Fix stuck TX queue for DQ queue format
    - kasan: use vmalloc_dump_obj() for vmalloc error reports
    - resource: fix false warning in __request_region()
    - selftests: mptcp: connect: also cover alt modes
    - selftests: mptcp: connect: also cover checksum
    - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
    - usb: typec: tcpm: allow to use sink in accessory mode
    - usb: typec: tcpm: allow switching to mode accessory to mux properly
    - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
    - comedi: comedi_test: Fix possible deletion of uninitialized timers
    - ALSA: hda/tegra: Add Tegra264 support
    - ALSA: hda: Add missing NVIDIA HDA codec IDs
    - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
    - mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
    - crypto: powerpc/poly1305 - add depends on BROKEN for now
    - [Config] disable CRYPTO_POLY1305_P10
    - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
    - iio: hid-sensor-prox: Restore lost scale assignments
    - mtd: rawnand: qcom: Fix last codeword read in
      qcom_param_page_type_exec()
    - ksmbd: add free_transport ops in ksmbd connection
    - arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1
      register
    - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
    - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid()
      test"
    - x86/traps: Initialize DR7 by writing its architectural reset value
    - virtio_net: Enforce minimum TX ring size for reliability
    - platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA
    - platform/mellanox: mlxbf-pmc: Remove newline char from event name input
    - platform/mellanox: mlxbf-pmc: Validate event/enable input
    - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input
    - xfrm: state: use a consistent pcpu_id in xfrm_state_find
    - xfrm: Set transport header to fix UDP GRO handling
    - ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
    - drm/sched: Remove optimization that causes hang when killing dependent
      jobs
    - mm/ksm: fix -Wsometimes-uninitialized from clang-21 in
      advisor_mode_show()
    - ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
    - rust: give Clippy the minimum supported Rust version
    - selftests/bpf: Add tests with stack ptr register in conditional jmp
    - spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
    - ext4: don't explicit update times in ext4_fallocate()
    - ext4: refactor ext4_punch_hole()
    - ext4: refactor ext4_zero_range()
    - ext4: refactor ext4_collapse_range()
    - ext4: refactor ext4_insert_range()
    - ext4: factor out ext4_do_fallocate()
    - ext4: move out inode_lock into ext4_fallocate()
    - fs: sort out the fallocate mode vs flag mess
    - ext4: move out common parts into ext4_fallocate()
    - ext4: fix incorrect punch max_end
    - ext4: correct the error handle in ext4_fallocate()
    - ext4: fix out of bounds punch offset
    - KVM: x86: drop x86.h include from cpuid.h
    - KVM: x86: Route non-canonical checks in emulator through emulate_ops
    - KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
      checks
    - KVM: x86: model canonical checks more precisely
    - x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
    - arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
    - Drivers: hv: Make the sysfs node size for the ring buffer dynamic
    - Upstream stable to v6.6.101, v6.12.41
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38351
    - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38675
    - xfrm: state: initialize state_ptrs earlier in xfrm_state_find
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38322
    - perf/x86/intel: Fix crash in icl_update_topdown_event()
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-37777
    - ksmbd: fix use-after-free in __smb2_lease_break_noti()
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-37925
    - jfs: reject on-disk inodes of an unsupported type
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38663
    - nilfs2: reject invalid file types when reading inodes
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38664
    - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38670
    - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38671
    - i2c: qup: jump out of the loop in case of timeout
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-39726
    - s390/ism: fix concurrency management in ism_cmd()
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38665
    - can: netlink: can_changelink(): fix NULL pointer deref of struct
      can_priv::do_set_mode
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38668
    - regulator: core: fix NULL dereference on unbind due to stale coupling
      data
  * Noble update: upstream stable patchset 2025-12-16 (LP: #2136361) //
    CVE-2025-38335
    - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221)
    - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
    - phy: tegra: xusb: Disable periodic tracking on Tegra234
    - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
    - USB: serial: option: add Foxconn T99W640
    - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
    - usb: musb: fix gadget state on disconnect
    - i2c: stm32: fix the device used for the DMA map
    - thunderbolt: Fix wake on connect at runtime
    - thunderbolt: Fix bit masking in tb_dp_port_set_hops()
    - nvmem: imx-ocotp: fix MAC address byte length
    - Input: xpad - set correct controller type for Acer NGR200
    - pch_uart: Fix dma_sync_sg_for_device() nents value
    - spi: Add check for 8-bit transfer with 8 IO mode support
    - HID: core: ensure __hid_request reserves the report ID as the first byte
    - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
    - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
    - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
    - io_uring/poll: fix POLLERR handling
    - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
      pep_sock_accept()
    - net/mlx5: Update the list of the PCI supported devices
    - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
    - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
    - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
    - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
    - af_packet: fix soft lockup issue caused by tpacket_snd()
    - isofs: Verify inode mode when loading from disk
    - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
    - mmc: bcm2835: Fix dma_unmap_sg() nents value
    - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
      Positivo models
    - mmc: sdhci_am654: Workaround for Errata i2312
    - pmdomain: governor: Consider CPU latency tolerance from
      pm_domain_cpu_gov
    - soc: aspeed: lpc-snoop: Cleanup resources in stack-order
    - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
    - iio: adc: max1363: Reorder mode_list[] entries
    - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
    - comedi: Fix some signed shift left operations
    - soundwire: amd: fix for handling slave alerts after link is down
    - soundwire: amd: fix for clearing command status register
    - cachefiles: Fix the incorrect return value in __cachefiles_write()
    - net: emaclite: Fix missing pointer increment in aligned_read()
    - block: fix kobject leak in blk_unregister_queue
    - nvme: fix inconsistent RCU list manipulation in
      nvme_ns_add_to_ctrl_list()
    - nvme: fix misaccounting of nvme-mpath inflight I/O
    - wifi: cfg80211: remove scan request n_channels counted_by
    - selftests: net: increase inter-packet timeout in udpgro.sh
    - Bluetooth: hci_sync: fix connectable extended advertising when using
      static random address
    - Bluetooth: SMP: If an unallowed command is received consider it a
      failure
    - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
    - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
      without board ID
    - net/mlx5: Correctly set gso_size when LRO is used
    - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
    - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent
      IPv6 addrconf
    - net: bridge: Do not offload IGMP/MLD messages
    - rxrpc: Fix transmission of an abort in response to an abort
    - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
    - sched: Change nr_uninterruptible type to unsigned long
    - ipv6: make addrconf_wq single threaded
    - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
    - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
      pm
    - usb: hub: Fix flushing of delayed work used for post resume purposes
    - usb: hub: Don't try to recover devices lost during warm reset.
    - usb: dwc3: qcom: Don't leave BCR asserted
    - i2c: omap: Add support for setting mux
    - [Config] make mux support built-in on arm
    - i2c: omap: Fix an error handling path in omap_i2c_probe()
    - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
    - Revert "selftests/bpf: adjust dummy_st_ops_success to detect additional
      error"
    - Revert "selftests/bpf: dummy_st_ops should reject 0 for non-nullable
      params"
    - i2c: omap: fix deprecated of_property_read_bool() use
    - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
    - i2c: stm32f7: unmap DMA mapped buffer
    - drm/amdgpu: Increase reset counter only on success
    - ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
    - mptcp: reset fallback status gracefully at disconnect() time
    - arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
    - arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
    - arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
    - arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
    - nvme: fix endianness of command word prints in nvme_log_err_passthru()
    - nvmet-tcp: fix callback lock for TLS handshake
    - can: tcan4x5x: add option for selecting nWKRQ voltage
    - can: tcan4x5x: fix reset gpio usage during probe
    - ice: check correct pointer in fwlog debugfs
    - riscv: Enable interrupt during exception handling
    - riscv: traps_misaligned: properly sign extend value in misaligned load
      handler
    - Bluetooth: hci_core: add missing braces when using macro parameters
    - drm/mediatek: Add wait_event_timeout when disabling plane
    - drm/mediatek: only announce AFBC if really supported
    - net: libwx: fix multicast packets received count
    - sched,freezer: Remove unnecessary warning in __thaw_task
    - drm/xe/mocs: Initialize MOCS index early
    - drm/xe: Move page fault init after topology init
    - smb: client: let smbd_post_send_iter() respect the peers max_send_size
      and transmit all data
    - Upstream stable to v6.6.100, v6.12.40
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-22115
    - btrfs: fix block group refcount race in
      btrfs_create_pending_block_groups()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38549
    - efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38551
    - virtio-net: fix recursived rtnl_lock() during probe()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38531
    - iio: common: st_sensors: Fix use of uninitialize device structs
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38552
    - mptcp: plug races between subflow fail and subflow creation
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38491
    - mptcp: make fallback action and fallback decision atomic
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38469
    - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
      hypercalls
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38499
    - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the
      right userns
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38524
    - rxrpc: Fix recv-recv race of completed call
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38468
    - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38470
    - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
      runtime
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38471
    - tls: always refresh the queue when reading sock
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38472
    - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38550
    - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38473
    - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38474
    - usb: net: sierra: check for no status endpoint
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38526
    - ice: add NULL check in eswitch lag check
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38548
    - hwmon: (corsair-cpro) Validate the size of the received input buffer
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38537
    - net: phy: Don't register LEDs for genphy
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38527
    - smb: client: fix use-after-free in cifs_oplock_break
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38476
    - rpl: Fix use-after-free in rpl_do_srh_inline().
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38528
    - bpf: Reject %p% format string in bprintf-like helpers
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38478
    - comedi: Fix initialization of data for instructions that write to
      subdevice
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38480
    - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38481
    - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38482
    - comedi: das6402: Fix bit shift out of bounds
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38483
    - comedi: das16m1: Fix bit shift out of bounds
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38529
    - comedi: aio_iiro_16: Fix bit shift out of bounds
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38530
    - comedi: pcl812: Fix bit shift out of bounds
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38485
    - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38487
    - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2024-50047 fix. // CVE-2025-38488
    - smb: client: fix use-after-free in crypt_message when using async crypto
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38489
    - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38532
    - net: libwx: properly reset Rx ring descriptor
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38533
    - net: libwx: fix the using of Rx buffer DMA
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38490
    - net: libwx: remove duplicate page_pool_put_full_page()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38538
    - dmaengine: nbpfaxi: Fix memory corruption in probe()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38493
    - tracing/osnoise: Fix crash in timerlat_dump_stack()
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38539
    - tracing: Add down_write(trace_event_sem) when adding trace event
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38494
    - HID: core: do not bypass hid_hw_raw_request
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38495
    - HID: core: ensure the allocated report buffer can contain the reserved
      report ID
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38496
    - dm-bufio: fix sched in atomic context
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38497
    - usb: gadget: configfs: Fix OOB read on empty string write
  * Noble update: upstream stable patchset 2025-12-15 (LP: #2136221) //
    CVE-2025-38535
    - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382)
    - configfs: Do not override creating attribute file failure in
      populate_attrs()
    - crypto: marvell/cesa - Do not chain submitted requests
    - gfs2: move msleep to sleepable context
    - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
    - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
    - io_uring: account drain memory to cgroup
    - io_uring/kbuf: account ring io_buffer_list memory
    - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power
      states
    - regulator: max20086: Fix MAX200086 chip id
    - regulator: max20086: Change enable gpio to optional
    - net/mlx5_core: Add error handling
      inmlx5_query_nic_vport_qkey_viol_cntr()
    - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
    - wifi: ath11k: fix rx completion meta data corruption
    - wifi: ath11k: fix ring-buffer corruption
    - SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
    - wifi: ath12k: fix ring-buffer corruption
    - wifi: rtw88: usb: Reduce control message timeout to 500 ms
    - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
    - media: ov8856: suppress probe deferral errors
    - media: ov5675: suppress probe deferral errors
    - media: nxp: imx8-isi: better handle the m2m usage_count
    - media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
    - media: ccs-pll: Start VT pre-PLL multiplier search from correct value
    - media: ccs-pll: Start OP pre-PLL multiplier search from correct value
    - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
    - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
    - media: davinci: vpif: Fix memory leak in probe error path
    - media: gspca: Add error handling for stv06xx_read_sensor()
    - media: mediatek: vcodec: Correct vsi_core framebuffer size
    - media: omap3isp: use sgtable-based scatterlist wrappers
    - media: v4l2-dev: fix error handling in __video_register_device()
    - media: venus: Fix probe error handling
    - media: videobuf2: use sgtable-based scatterlist wrappers
    - media: imx-jpeg: Drop the first error frames
    - media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
    - media: imx-jpeg: Reset slot data pointers when freed
    - media: uvcvideo: Return the number of processed controls
    - media: uvcvideo: Send control events for partial succeeds
    - media: uvcvideo: Fix deferred probing error
    - arm64/mm: Close theoretical race where stale TLB entry remains valid
    - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
    - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
    - bus: mhi: host: Fix conflict between power_up and SYSERR
    - can: tcan4x5x: fix power regulator retrieval during probe
    - ceph: set superblock s_magic for IMA fsmagic matching
    - cgroup,freezer: fix incomplete freezing when attaching tasks
    - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
    - bus: fsl-mc: fix GET/SET_TAILDROP command ids
    - ext4: fix calculation of credits for extent tree modification
    - ext4: factor out ext4_get_maxbytes()
    - ext4: ensure i_size is smaller than maxbytes
    - Input: gpio-keys - fix possible concurrent access in
      gpio_keys_irq_timer()
    - net: ftgmac100: select FIXED_PHY
    - EDAC/altera: Use correct write width with the INTTEST register
    - parisc/unaligned: Fix hex output to show 8 hex chars
    - parisc: fix building with gcc-15
    - clk: meson-g12a: add missing fclk_div2 to spicc
    - watchdog: fix watchdog may detect false positive of softlockup
    - mm: fix ratelimit_pages update error in dirty_ratio_handler()
    - mtd: rawnand: sunxi: Add randomizer configuration in
      sunxi_nfc_hw_ecc_write_chunk
    - mtd: nand: sunxi: Add randomizer configuration before randomizer enable
    - KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
    - KVM: VMX: Flush shadow VMCS on emergency reboot
    - dm-mirror: fix a tiny race condition
    - dm-verity: fix a memory leak if some arguments are specified multiple
      times
    - mtd: rawnand: qcom: Fix read len for onfi param page
    - phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
    - KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
    - staging: iio: ad5933: Correct settling cycles encoding per datasheet
    - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
    - regulator: max14577: Add error check for max14577_read_reg()
    - cifs: reset connections for all channels when reconnect requested
    - cifs: update dstaddr whenever channel iface is updated
    - cifs: dns resolution is needed only for primary channel
    - Drivers: hv: Allocate interrupt and monitor pages aligned to system page
      boundary
    - uio_hv_generic: Use correct size for interrupt and monitor pages
    - PCI: cadence-ep: Correct PBA offset in .set_msix() callback
    - PCI: Add ACS quirk for Loongson PCIe
    - PCI: Fix lock symmetry in pci_slot_unlock()
    - PCI: dw-rockchip: Fix PHY function call sequence in
      rockchip_pcie_phy_deinit()
    - iio: accel: fxls8962af: Fix temperature scan element sign
    - iio: imu: inv_icm42600: Fix temperature calculation
    - iio: adc: ad7606_spi: fix reg write value mask
    - ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
    - clocksource: Fix the CPUs' choice in the watchdog per CPU verification
    - power: supply: collie: Fix wakeup source leaks on device unbind
    - mmc: Add quirk to disable DDR50 tuning
    - ACPICA: Avoid sequence overread in call to strncmp()
    - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
    - ACPI: bus: Bail out if acpi_kobj registration fails
    - ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
    - power: supply: bq27xxx: Retrieve again when busy
    - ACPICA: utilities: Fix overflow check in vsnprintf()
    - ASoC: tegra210_ahub: Add check to of_device_get_match_data()
    - gpiolib: of: Add polarity quirk for s5m8767
    - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
    - net: macb: Check return value of dma_set_mask_and_coherent()
    - tipc: use kfree_sensitive() for aead cleanup
    - f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
    - i2c: designware: Invoke runtime suspend on quick slave re-registration
    - emulex/benet: correct command version selection in be_cmd_get_stats()
    - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
    - wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
    - sctp: Do not wake readers in __sctp_write_space()
    - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
    - i2c: npcm: Add clock toggle recovery
    - net: dlink: add synchronization for stats update
    - wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
    - wifi: ath12k: fix a possible dead lock caused by ab->base_lock
    - wifi: ath11k: Fix QMI memory reuse logic
    - wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
    - tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
    - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
    - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
    - net: atlantic: generate software timestamp just before the doorbell
    - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
    - pinctrl: armada-37xx: propagate error from
      armada_37xx_gpio_get_direction()
    - pinctrl: armada-37xx: propagate error from
      armada_37xx_pmx_gpio_set_direction()
    - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
    - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
    - net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
    - wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
    - wifi: mac80211: do not offer a mesh path if forwarding is disabled
    - clk: rockchip: rk3036: mark ddrphy as critical
    - libbpf: Add identical pointer detection to btf_dedup_is_equiv()
    - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64
      commands
    - iommu/amd: Ensure GA log notifier callbacks finish running before module
      unload
    - wifi: iwlwifi: pcie: make sure to lock rxq->read
    - wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
    - wifi: mac80211: VLAN traffic in multicast path
    - wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
    - net: bridge: mcast: update multicast contex when vlan state is changed
    - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
      functions
    - vxlan: Do not treat dst cache initialization errors as fatal
    - net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
    - pinctrl: mcp23s08: Reset all pins to input at probe
    - wifi: ath12k: fix failed to set mhi state error during reboot with
      hardware grouping
    - sock: Correct error checking condition for (assign|release)_proto_idx()
    - ice: fix check for existing switch rule
    - usbnet: asix AX88772: leave the carrier control to phylink
    - f2fs: fix to set atomic write status more clear
    - bpf, sockmap: Fix data lost during EAGAIN retries
    - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
    - wifi: ath11k: determine PM policy based on machine model
    - wifi: ath12k: fix link valid field initialization in the monitor Rx
    - wifi: ath12k: fix incorrect CE addresses
    - wifi: ath12k: Pass correct values of center freq1 and center freq2 for
      160 MHz
    - watchdog: da9052_wdt: respect TWDMIN
    - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
    - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
    - tee: Prevent size calculation wraparound on 32-bit kernels
    - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
      first"
    - fs/xattr.c: fix simple_xattr_list()
    - platform/x86/amd: pmc: Clear metrics table at start of cycle
    - platform/x86: dell_rbu: Stop overwriting data buffer
    - powerpc/vdso: Fix build of VDSO32 with pcrel
    - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH
      recovery
    - io_uring: fix task leak issue in io_wq_create()
    - platform/loongarch: laptop: Get brightness setting from EC on probe
    - platform/loongarch: laptop: Unregister generic_sub_drivers on exit
    - LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
    - cifs: deal with the channel loading lag while picking channels
    - cifs: serialize other channels when query server interfaces is pending
    - cifs: do not disable interface polling on failure
    - smb: improve directory cache reuse for readdir operations
    - scsi: storvsc: Increase the timeouts to storvsc_timeout
    - scsi: s390: zfcp: Ensure synchronous unit_add
    - udmabuf: use sgtable-based scatterlist wrappers
    - selftests/x86: Add a test to detect infinite SIGTRAP handler loop
    - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
    - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
    - Input: sparcspkr - avoid unannotated fall-through
    - wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
    - arm64: Restrict pagetable teardown to avoid false warning
    - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound
      card
    - ALSA: hda/intel: Add Thinkpad E15 to PM deny list
    - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
    - iio: accel: fxls8962af: Fix temperature calculation
    - net: Fix checksum update for ILA adj-transport
    - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
    - erofs: remove unused trace event erofs_destroy_inode
    - smb: fix secondary channel creation issue with kerberos by populating
      hostname when adding channels
    - drm/msm/disp: Correct porch timing for SDM845
    - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
    - ionic: Prevent driver/fw getting out of sync on devcmd(s)
    - drm/nouveau/bl: increase buffer size to avoid truncate warning
    - drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
    - hwmon: (occ) Rework attribute registration for stack usage
    - hwmon: (occ) fix unaligned accesses
    - pldmfw: Select CRC32 when PLDMFW is selected
    - net: ice: Perform accurate aRFS flow match
    - ptp: fix breakage after ptp_vclock_in_use() rework
    - ptp: allow reading of currently dialed frequency to succeed on free-
      running clocks
    - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen()
      behavior
    - tcp: fix passive TFO socket having invalid NAPI ID
    - net: microchip: lan743x: Reduce PTP timeout on HW failure
    - EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
    - dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
    - net: make for_each_netdev_dump() a little more bug-proof
    - serial: sh-sci: Increment the runtime usage counter for the earlycon
      device
    - ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
    - ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
    - smb: client: fix first command failure during re-negotiation
    - platform/loongarch: laptop: Add backlight power control support
    - s390/pci: Fix __pcilg_mio_inuser() inline assembly
    - perf: Fix cgroup state vs ERROR
    - perf/core: Fix WARN in perf_cgroup_switch()
    - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
    - RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
    - RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
    - perf evsel: Missed close() when probing hybrid core PMUs
    - crypto: qat - add shutdown handler to qat_c3xxx
    - crypto: qat - add shutdown handler to qat_420xx
    - crypto: qat - add shutdown handler to qat_4xxx
    - crypto: qat - add shutdown handler to qat_c62x
    - crypto: qat - add shutdown handler to qat_dh895xcc
    - wifi: mt76: mt7925: fix host interrupt register initialization
    - wifi: rtw88: usb: Upload the firmware in bigger chunks
    - NFSD: unregister filesystem in case genl_register_family() fails
    - NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
    - media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
    - media: i2c: imx335: Fix frame size enumeration
    - soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
    - sysfb: Fix screen_info type check for VGA
    - ovl: Fix nested backing file paths
    - Drivers: hv: vmbus: Add utility function for querying ring size
    - uio_hv_generic: Query the ringbuffer size for device
    - uio_hv_generic: Align ring size to system page
    - PCI: dwc: ep: Correct PBA offset in .set_msix() callback
    - PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from
      rockchip_pcie_link_up()
    - accel/ivpu: Improve buffer object logging
    - accel/ivpu: Fix warning in ivpu_gem_bo_free()
    - tty: vt: make init parameter of consw::con_init() a bool
    - tty: vt: sanitize arguments of consw::con_clear()
    - tty: vt: make consw::con_switch() return a bool
    - dummycon: Trigger redraw when switching consoles with deferred takeover
    - ACPICA: Apply pack(1) to union aml_resource
    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios
      laptops
    - pmdomain: core: Reset genpd->states to avoid freeing invalid data
    - power: supply: max17040: adjust thermal channel scaling
    - Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
    - Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
    - wifi: mt76: mt7925: introduce thermal protection
    - libbpf/btf: Fix string handling to support multi-split BTF
    - clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
    - iommu/amd: Allow matching ACPI HID devices without matching UIDs
    - tcp: remove zero TCP TS samples for autotuning
    - tcp: add receive queue awareness in tcp_rcv_space_adjust()
    - bpf: Pass the same orig_call value to trampoline functions
    - net: stmmac: generate software timestamp just before the doorbell
    - hid-asus: check ROG Ally MCU version and warn
    - wifi: iwlwifi: mvm: fix beacon CCK flag
    - scsi: smartpqi: Add new PCI IDs
    - Revert "mac80211: Dynamically set CoDel parameters per station"
    - bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
    - wifi: ath12k: using msdu end descriptor to check for rx multicast
      packets
    - isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
    - ixgbe: Fix unreachable retry logic in combined and byte I2C write
      functions
    - RDMA/hns: initialize db in update_srq_db()
    - platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
    - LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
    - nvme: always punt polled uring_cmd end_io work to task_work
    - mm: close theoretical race where stale TLB entries could linger
    - x86/virt/tdx: Avoid indirect calls to TDX assembly functions
    - wifi: rtw89: phy: add dummy C2H event handler for report of TAS power
    - ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP
      Victus 15-fa1xxx
    - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
    - drm/amdgpu: read back register after written for VCN v4.0.5
    - Kunit to check the longest symbol length
    - x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
    - ipv6: remove leftover ip6 cookie initializer
    - ipv6: replace ipcm6_init calls with ipcm6_init_sk
    - drm/ssd130x: fix ssd132x_clear_screen() columns
    - workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
    - mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
    - gpio: pca953x: fix wrong error probe return value
    - bpftool: Fix cgroup command to only show cgroup bpf programs
    - Upstream stable to v6.6.95, v6.12.35
    - bpftool: Query only cgroup-related attach types
    - bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38507
    - HID: nintendo: avoid bluetooth suspend/resume stalls
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38511
    - drm/xe/pf: Clear all LMTT pages on alloc
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38520
    - drm/amdkfd: Don't call mmput from MMU notifier callback
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38521
    - drm/imagination: Fix kernel crash when hard resetting the GPU
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38506
    - KVM: Allow CPU to reschedule while setting per-page memory attributes
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38104
    - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to
      avoid Priority Inversion in SRIOV
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38067
    - rseq: Fix segfault on registration when rseq_cs is non-zero
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-37984
    - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38437
    - ksmbd: fix potential use-after-free in oplock/lease break ack
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38510
    - kasan: remove kasan_find_vm_area() to prevent possible deadlock
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38503
    - btrfs: fix assertion when building free space tree
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38439
    - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38542
    - net: appletalk: Fix device refcount leak in atrtr_create()
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38441
    - netfilter: flowtable: account for Ethernet header in
      nf_flow_pppoe_proto()
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38443
    - nbd: fix uaf in nbd_genl_connect() error path
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38444
    - raid10: cleanup memleak at raid10_make_request
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38445
    - md/raid1: Fix stack memory use after return in raid1_reshape
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38543
    - drm/tegra: nvdec: Fix dma_alloc_coherent error check
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38513
    - wifi: zd1211rw: Fix potential NULL pointer dereference in
      zd_mac_tx_to_dev()
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38448
    - usb: gadget: u_serial: Fix race condition in TTY wakeup
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38515
    - drm/sched: Increment job count before swapping tail spsc queue
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38449
    - drm/gem: Acquire references on GEM handles for framebuffers
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38512
    - wifi: prevent A-MSDU attacks in mesh networks
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38516
    - pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38455
    - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-
      flight
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38456
    - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38514
    - rxrpc: Fix oops due to non-existence of prealloc backlog struct
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38544
    - rxrpc: Fix bug due to prealloc collision
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38457
    - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38458
    - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38459
    - atm: clip: Fix infinite recursive call of clip_push().
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38546
    - atm: clip: Fix memory leak of struct clip_vcc.
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38460
    - atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38461
    - vsock: Fix transport_* TOCTOU
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38462
    - vsock: Fix transport_{g2h,h2g} TOCTOU
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38463
    - tcp: Correct signedness in skb remaining space calculation
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38464
    - tipc: Fix use-after-free in tipc_conn_close().
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38465
    - netlink: Fix wraparounds of sk->sk_rmem_alloc.
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38466
    - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38467
    - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  * Noble update: upstream stable patchset 2025-12-12 (LP: #2135261) //
    CVE-2025-38349
    - eventpoll: don't decrement ep refcount while still holding the ep mutex
  * [UBUNTU 24.04] KVM: s390: improve interrupt cpu for wakeup (LP: #2132317)
    - KVM: s390: improve interrupt cpu for wakeup
  * veth.sh from ubuntu_kselftests_net failed on J-5.15 / N-6.8 (with xdp
    attached - gro flag) (LP: #2065369)
    - selftests: net: veth: test the ability to independently manipulate GRO
      and XDP
  * ftrace:test.d--event--subsystem-enable.tc fails on some instances
    (LP: #2071861)
    - selftests/tracing: Fix false failure of subsystem event test
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640)
    - rtc: pcf2127: add missing semicolon after statement
    - rtc: pcf2127: fix SPI command byte for PCF2131
    - rtc: cmos: use spin_lock_irqsave in cmos_interrupt
    - mmc: sdhci: Add a helper function for dump register in dynamic debug
      mode
    - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
    - Bluetooth: hci_sync: revert some mesh modifications
    - Bluetooth: MGMT: set_mesh: update LE scan interval and window
    - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
    - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
    - mtk-sd: reset host->mrq on prepare_data() error
    - arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
    - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
    - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
    - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
    - scsi: ufs: core: Fix spelling of a sysfs attribute name
    - RDMA/mlx5: Fix HW counters query for non-representor devices
    - RDMA/mlx5: Fix CC counters query for MPV
    - RDMA/mlx5: Fix vport loopback for MPV device
    - platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
    - Bluetooth: Prevent unintended pause by checking if advertising is active
    - btrfs: fix missing error handling when searching for inode refs during
      log replay
    - btrfs: rename err to ret in btrfs_rmdir()
    - btrfs: propagate last_unlink_trans earlier when doing a rmdir
    - btrfs: use btrfs_record_snapshot_destroy() during rmdir
    - ethernet: atl1: Add missing DMA mapping error checks and count errors
    - dpaa2-eth: fix xdp_rxq_info leak
    - drm/exynos: fimd: Guard display clock control with runtime PM calls
    - spi: spi-fsl-dspi: Clear completion counter before initiating transfer
    - drm/i915/selftests: Change mock_request() to return error pointers
    - platform/x86: make fw_attr_class constant
    - platform/x86: firmware_attributes_class: Move include
      linux/device/class.h
    - platform/x86: firmware_attributes_class: Simplify API
    - platform/x86: think-lmi: Directly use firmware_attributes_class
    - platform/x86: think-lmi: Fix class device unregistration
    - platform/x86: dell-sysman: Directly use firmware_attributes_class
    - platform/x86: dell-wmi-sysman: Fix class device unregistration
    - platform/mellanox: mlxreg-lc: Fix logic error in power state check
    - smb: client: fix warning when reconnecting channel
    - drm/i915/gsc: mei interrupt top half should be in irq disabled context
    - igc: disable L1.2 PCI-E link substate to avoid performance issue
    - lib: test_objagg: Set error message in check_expect_hints_stats()
    - amd-xgbe: align CL37 AN sequence as per databook
    - enic: fix incorrect MTU comparison in enic_change_mtu()
    - nui: Fix dma_mapping_error() check
    - amd-xgbe: do not double read link status
    - smb: client: fix race condition in negotiate timeout by using more
      precise timing
    - wifi: mac80211: chan: chandef is non-NULL for reserved
    - f2fs: prevent writing without fallocate() for pinned files
    - f2fs: convert f2fs_vm_page_mkwrite() to use folio
    - f2fs: fix to zero post-eof page
    - drm/simpledrm: Do not upcast in release helpers
    - ALSA: sb: Don't allow changing the DMA mode during operations
    - ALSA: sb: Force to disable DMAs once when DMA mode is changed
    - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
    - ata: pata_cs5536: fix build on 32-bit UML
    - ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
    - platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks
      list
    - powerpc: Fix struct termio related ioctl macros
    - ASoC: amd: yc: update quirk data for HP Victus
    - regulator: fan53555: add enable_time support and soft-start times
    - aoe: defer rexmit timer downdev work to workqueue
    - wifi: mac80211: drop invalid source address OCB frames
    - rcu: Return early if callback is not specified
    - platform/x86: hp-bioscfg: Directly use firmware_attributes_class
    - platform/x86: hp-bioscfg: Fix class device unregistration
    - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
    - NFSv4/flexfiles: Fix handling of NFS level errors in I/O
    - usb: xhci: quirk for data loss in ISOC transfers
    - xhci: dbctty: disable ECHO flag by default
    - xhci: dbc: Flush queued requests before stopping dbc
    - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
    - Input: xpad - support Acer NGR 200 Controller
    - Input: iqs7222 - explicitly define number of external channels
    - usb: cdnsp: do not disable slot for disabled slot
    - dma-buf: fix timeout handling in dma_resv_wait_timeout v2
    - i2c/designware: Fix an initialization issue
    - Logitech C-270 even more broken
    - iommu/rockchip: prevent iommus dead loop when two masters share one
      IOMMU
    - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be
      changed
    - platform/x86: think-lmi: Create ksets consecutively
    - platform/x86: think-lmi: Fix kobject cleanup
    - platform/x86: think-lmi: Fix sysfs group cleanup
    - usb: typec: displayport: Fix potential deadlock
    - powerpc/kernel: Fix ppc_save_regs inclusion in build
    - [Config] enable Transient Scheduler Attacks mitigation
    - x86/CPU/AMD: Properly check the TSA microcode
    - x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
    - net: txgbe: request MISC IRQ in ndo_open
    - Bluetooth: HCI: Set extended advertising data synchronously
    - iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
    - firmware: arm_ffa: Move memory allocation outside the mutex locking
    - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
    - btrfs: return a btrfs_inode from btrfs_iget_logging()
    - btrfs: return a btrfs_inode from read_one_inode()
    - btrfs: fix invalid inode pointer dereferences during log replay
    - btrfs: fix inode lookup error handling during log replay
    - nvme: Fix incorrect cdw15 value in passthru error logging
    - drm/bridge: aux-hpd-bridge: fix assignment of the of_node
    - netfs: Fix i_size updating
    - arm64: dts: rockchip: fix internal USB hub instability on RK3399 Puma
    - crypto: iaa - Remove dst_null support
    - crypto: iaa - Do not clobber req->base.data
    - spinlock: extend guard with spinlock_bh variants
    - crypto: zynqmp-sha - Add locking
    - kunit: qemu_configs: sparc: use Zilog console
    - kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
    - kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
    - gfs2: Initialize gl_no_formal_ino earlier
    - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE
    - gfs2: Rename dinode_demise to evict_behavior
    - gfs2: Prevent inode creation race
    - gfs2: Rename GLF_FREEING to GLF_UNLOCKED
    - gfs2: Decode missing glock flags in tracepoints
    - gfs2: Add GLF_PENDING_REPLY flag
    - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
    - gfs2: Move gfs2_dinode_dealloc
    - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
    - gfs2: deallocate inodes in gfs2_create_inode
    - btrfs: fix wrong start offset for delalloc space release during mmap
      write
    - ASoC: tas2764: Extend driver to SN012776
    - ASoC: tas2764: Reinit cache on part reset
    - ACPI: thermal: Fix stale comment regarding trip points
    - ACPI: thermal: Execute _SCP before reading trip points
    - bonding: Mark active offloaded xfrm_states
    - wifi: ath12k: Handle error cases during extended skb allocation
    - wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
    - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup"
      bug
    - iommu: ipmmu-vmsa: avoid Wformat-security warning
    - f2fs: decrease spare area for pinned files for zoned devices
    - f2fs: zone: introduce first_zoned_segno in f2fs_sb_info
    - f2fs: introduce SEGS_TO_BLKS/BLKS_TO_SEGS for cleanup
    - f2fs: zone: fix to calculate first_zoned_segno correctly
    - scsi: lpfc: Remove NLP_RELEASE_RPI flag from nodelist structure
    - scsi: lpfc: Change lpfc_nodelist nlp_flag member into a bitmask
    - hisi_acc_vfio_pci: bugfix cache write-back issue
    - hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
    - bpf: use common instruction history across all states
    - arm64: dts: qcom: sm8650: change labels to lower-case
    - arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2
    - arm64: dts: qcom: sm8650: add the missing l2 cache node
    - remoteproc: k3: Call of_node_put(rmem_np) only once in three functions
    - remoteproc: k3-r5: Add devm action to release reserved memory
    - remoteproc: k3-r5: Use devm_kcalloc() helper
    - remoteproc: k3-r5: Use devm_ioremap_wc() helper
    - remoteproc: k3-r5: Use devm_rproc_alloc() helper
    - remoteproc: k3-r5: Use devm_rproc_add() helper
    - remoteproc: k3-r5: Refactor sequential core power up/down operations
    - mfd: exynos-lpass: Fix another error handling path in
      exynos_lpass_probe()
    - selinux: change security_compute_sid to return the ssid or tsid on match
    - drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
    - drm/xe/bmg: Add BMG platform definition
    - drm/i915/bmg: Define IS_BATTLEMAGE macro
    - drm/i915/dp_mst: Work around Thunderbolt sink disconnect after
      SINK_COUNT_ESI read
    - arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
    - scsi: lpfc: Restore clearing of NLP_UNREG_INP in ndlp->nlp_flag
    - RDMA/mlx5: Fix cache entry update on dereg error
    - drm/xe: Allow dropping kunit dependency as built-in
    - usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
    - Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
    - usb: cdnsp: Fix issue with CV Bad Descriptor test
    - usb: dwc3: Abort suspend on soft disconnect failure
    - Upstream stable to v6.6.97, v6.12.37
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38407
    - riscv: cpu_ops_sbi: Use static array for boot_data
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38374
    - optee: ffa: fix sleep in atomic context
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38373
    - IB/mlx5: Fix potential deadlock in MR deregistration
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38408
    - genirq/irq_sim: Initialize work context pointers properly
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38279
    - bpf: Do not include stack ptr register in precision backtracking
      bookkeeping
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38289
    - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38392
    - idpf: convert control queue mutex to a spinlock
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38402
    - idpf: return 0 size for RSS key if not supported
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38405
    - nvmet: fix memory leak of bio integrity
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38388
    - firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic
      context
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38390
    - firmware: arm_ffa: Fix memory leak by freeing notifier callback node
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2024-36350 // CVE-2024-36357
    - x86/bugs: Rename MDS machinery to something more generic
    - x86/bugs: Add a Transient Scheduler Attacks mitigation
    - KVM: SVM: Advertise TSA CPUID bits to guests
    - x86/microcode/AMD: Add TSA microcode SHAs
    - x86/process: Move the buffer clearing before MONITOR
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38376
    - usb: chipidea: udc: disconnect/reconnect from host when do
      suspend/resume
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38396
    - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38371
    - drm/v3d: Disable interrupts before resetting the GPU
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38384
    - mtd: spinand: fix memory leak of ECC engine conf
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38386
    - ACPICA: Refuse to evaluate a method if arguments are missing
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38406
    - wifi: ath6kl: remove WARN on bad firmware input
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38399
    - scsi: target: Fix NULL pointer dereference in
      core_scsi3_decode_spec_i_port()
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38409
    - drm/msm: Fix another leak in the submit error path
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38410
    - drm/msm: Fix a fence leak in submit error path
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38377
    - rose: fix dangling neighbour pointers in rose_rt_device_down()
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38389
    - drm/i915/gt: Fix timeline left held on VMA alloc error
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38385
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38412
    - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs
      callbacks
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38382
    - btrfs: fix iteration of extrefs during log replay
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38393
    - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38400
    - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38387
    - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38401
    - mtk-sd: Prevent memory corruption from DMA map failure
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38391
    - usb: typec: altmodes/displayport: do not index invalid pin_assignments
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38395
    - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38403
    - vsock/vmci: Clear the vmci transport packet properly when initializing
      it
  * Noble update: upstream stable patchset 2025-12-11 (LP: #2134640) //
    CVE-2025-38375
    - virtio-net: ensure the received length does not exceed allocated size
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499)
    - cifs: Correctly set SMB1 SessionKey field in Session Setup Request
    - cifs: Fix cifs_query_path_info() for Windows NT servers
    - cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE
      mode
    - NFSv4: Always set NLINK even if the server doesn't support it
    - NFSv4.2: fix listxattr to return selinux security label
    - mailbox: Not protect module_put with spin_lock_irqsave
    - mfd: max14577: Fix wakeup source leaks on device unbind
    - sunrpc: don't immediately retransmit on seqno miss
    - leds: multicolor: Fix intensity setting while SW blinking
    - fuse: fix race between concurrent setattrs from multiple nodes
    - cxl/region: Add a dev_err() on missing target list entries
    - NFSv4: xattr handlers should check for absent nfs filehandles
    - hwmon: (pmbus/max34440) Fix support for max34451
    - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
      extension
    - ksmbd: provide zero as a unique ID to the Mac client
    - rust: module: place cleanup_module() in .exit.text section
    - dmaengine: xilinx_dma: Set dma_device directions
    - PCI: dwc: Make link training more robust by setting
      PORT_LOGIC_LINK_WIDTH to one lane
    - PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
    - md/md-bitmap: fix dm-raid max_write_behind setting
    - amd/amdkfd: fix a kfd_process ref leak
    - iio: pressure: zpa2326: Use aligned_s64 for the timestamp
    - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
    - um: use proper care when taking mmap lock during segfault
    - coresight: Only check bottom two claim bits
    - usb: dwc2: also exit clock_gating when stopping udc while suspended
    - iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
    - usb: potential integer overflow in usbg_make_tpg()
    - usb: common: usb-conn-gpio: use a unique name for usb connector device
    - usb: Add checks for snprintf() calls in usb_alloc_dev()
    - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
    - usb: typec: displayport: Receive DP Status Update NAK request exit dp
      altmode
    - usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
    - ALSA: hda: Ignore unsol events for cards being shut down
    - ALSA: hda: Add new pci id for AMD GPU display HD audio controller
    - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
    - ceph: fix possible integer overflow in ceph_zero_objects()
    - scsi: ufs: core: Don't perform UFS clkscaling during host async scan
    - ovl: Check for NULL d_inode() in ovl_dentry_upper()
    - fs/jfs: consolidate sanity checking in dbMount
    - ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with
      dev_err_probe()
    - ASoC: codec: wcd9335: Convert to GPIO descriptors
    - f2fs: don't over-report free space or inodes in statvfs
    - PCI: apple: Use helper function for_each_child_of_node_scoped()
    - PCI: apple: Set only available ports up
    - platform/x86: ideapad-laptop: move ACPI helpers from header to source
      file
    - platform/x86: ideapad-laptop: use usleep_range() for EC polling
    - i2c: tiny-usb: disable zero-length read messages
    - i2c: robotfuzz-osif: disable zero-length read messages
    - ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
    - attach_recursive_mnt(): do not lock the covering tree when sliding
      something under it
    - libbpf: Fix null pointer dereference in btf_dump__free on allocation
      failure
    - wifi: mac80211: fix beacon interval calculation overflow
    - af_unix: Don't set -ECONNRESET for consumed OOB skb.
    - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
    - um: ubd: Add missing error check in start_io_thread()
    - libbpf: Fix possible use-after-free for externs
    - net: enetc: Correct endianness handling in _enetc_rd_reg64
    - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
    - net: selftests: fix TCP packet checksum
    - drm/i915: fix build error some more
    - drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
    - drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
    - EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
    - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
    - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
    - serial: imx: Restore original RXTL for console to fix data loss
    - Bluetooth: L2CAP: Fix L2CAP MTU negotiation
    - dm-raid: fix variable in journal device check
    - btrfs: update superblock's device bytes_used when dropping chunk
    - net: libwx: fix the creation of page_pool
    - HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
    - HID: wacom: fix memory leak on kobject creation failure
    - HID: wacom: fix memory leak on sysfs attribute creation failure
    - HID: wacom: fix kobject reference count leak
    - drm/ast: Fix comment on modeset lock
    - drm/cirrus-qemu: Fix pitch programming
    - drm/etnaviv: Protect the scheduler's pending list with its lock
    - drm/tegra: Assign plane type before registration
    - drm/udl: Unregister device before cleaning up on disconnect
    - drm/amdkfd: Fix race in GWS queue scheduling
    - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
    - drm/bridge: cdns-dsi: Fix phy de-init and flag it so
    - drm/bridge: cdns-dsi: Fix connecting to next bridge
    - drm/bridge: cdns-dsi: Check return value when getting default PHY config
    - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
    - drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
    - drm/amdgpu: Add kicker device detection
    - drm/amdgpu: switch job hw_fence to amdgpu_fence
    - ksmbd: Use unsafe_memcpy() for ntlm_negotiate
    - ksmbd: remove unsafe_memcpy use in session setup
    - media: uvcvideo: Rollback non processed entities on error
    - firmware: arm_scmi: Add a common helper to check if a message is
      supported
    - firmware: arm_scmi: Ensure that the message-id supports fastchannel
    - ARM: 9354/1: ptrace: Use bitfield helpers
    - nvme-tcp: fix I/O stalls on congested sockets
    - drm/amdgpu: seq64 memory unmap uses uninterruptible lock
    - 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0
      and later devices
    - usb: gadget: f_hid: wake up readers on disable/unbind
    - drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
    - Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
    - btrfs: fix qgroup reservation leak on failure to allocate ordered extent
    - smb: client: remove \t from TP_printk statements
    - fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
    - drm/xe/display: Add check for alloc_ordered_workqueue()
    - ethernet: ionic: Fix DMA mapping tests
    - wifi: mac80211: Add link iteration macro for link data
    - wifi: mac80211: Create separate links for VLAN interfaces
    - wifi: mac80211: finish link init before RCU publish
    - netlink: specs: tc: replace underscores with dashes in names
    - drm/amdgpu/discovery: optionally use fw based ip discovery
    - drm/amd: Adjust output for discovery error handling
    - x86/traps: Initialize DR6 by writing its architectural reset value
    - serial: core: restore of_node information in sysfs
    - spi: spi-cadence-quadspi: Fix pm runtime unbalance
    - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
    - scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
    - drm/amd/display: Correct non-OLED pre_T11_delay.
    - drm/xe/vm: move rebind_work init earlier
    - drm/xe/sched: stop re-submitting signalled jobs
    - drm/xe: Fix memset on iomem
    - drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
    - drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
    - drm/amd/display: Fix mpv playback corruption on weston
    - x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
    - io_uring: fix potential page leak in io_sqe_buffer_register()
    - iio: dac: ad3552r: changes to use FIELD_PREP
    - drm/xe: Carve out wopcm portion from the stolen memory
    - usb: typec: tcpm: PSSourceOffTimer timeout in PR_Swap enters
      ERROR_RECOVERY
    - drm/msm/dp: account for widebus and yuv420 during mode validation
    - arm64: dts: rockchip: Add avdd HDMI supplies to RockPro64 board dtsi
    - ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
    - spi: fsl-qspi: Fix double cleanup in probe error path
    - Upstream stable to v6.6.96, v6.12.36
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-37842
    - spi: fsl-qspi: use devm function instead of driver remove
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-23155
    - net: stmmac: Fix accessing freed irq affinity_hint
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-22101
    - net: libwx: fix Tx L4 checksum
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38361
    - drm/amd/display: Check dce_hwseq before dereferencing it
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38364
    - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38246
    - bnxt: properly flush XDP redirect lists
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38250
    - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38253
    - HID: wacom: fix crash in wacom_aes_battery_handler()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38264
    - nvme-tcp: sanitize request list handling
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38362
    - drm/amd/display: Add null pointer check for get_first_active_display()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38354
    - drm/msm/gpu: Fix crash when throttling GPU immediately during boot
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38363
    - drm/tegra: Fix a possible null pointer dereference
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38239
    - scsi: megaraid_sas: Fix invalid node index
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38365
    - btrfs: fix a race between renames and directory logging
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38244
    - smb: client: fix potential deadlock when reconnecting channels
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38245
    - atm: Release atm_dev_mutex after removing procfs in
      atm_dev_deregister().
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38249
    - ALSA: usb-audio: Fix out-of-bounds read in
      snd_usb_get_audioformat_uac3()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38251
    - atm: clip: prevent NULL deref in clip_push()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38255
    - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38257
    - s390/pkey: Prevent overflow in size calculation for memdup_user()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38258
    - mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path
      on write
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38259
    - ASoC: codecs: wcd9335: Fix missing free of regulator supplies
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38230
    - jfs: validate AG parameters in dbMount() to prevent crashes
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38260
    - btrfs: handle csum tree error with rescue=ibadroots correctly
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38262
    - tty: serial: uartlite: register uart driver in init
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38368
    - misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38436
    - drm/scheduler: signal scheduled fence when kill job
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38263
    - bcache: fix NULL pointer in cache_set_flush()
  * Noble update: upstream stable patchset 2025-12-09 (LP: #2134499) //
    CVE-2025-38369
    - dmaengine: idxd: Check availability of workqueue allocated by idxd wq
      driver before using
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-22128
    - wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq()
      in error path
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38333
    - f2fs: fix to bail out in get_new_segment()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38210
    - configfs-tsm-report: Fix NULL dereference of tsm_ops
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38232
    - NFSD: fix race between nfsd registration and exports_proc
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38320
    - arm64/ptrace: Fix stack-out-of-bounds read in
      regs_get_kernel_stack_nth()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38424
    - perf: Fix sample vs do_exit()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38321
    - smb: Log an error when close_all_cached_dirs fails
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38180
    - net: atm: fix /proc/net/atm/lec handling
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38323
    - net: atm: add lec_mutex
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38181
    - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38182
    - ublk: santizize the arguments from userspace when adding a device
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38183
    - net: lan743x: fix potential out-of-bounds write in
      lan743x_ptp_io_event_clock_get()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38184
    - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38185
    - atm: atmtcp: Free invalid length skb in atmtcp_c_send().
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38324
    - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38420
    - wifi: carl9170: do not ping device which has failed to load firmware
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38326
    - aoe: clean device rq_list in aoedev_downdev()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38089
    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38084
    - mm/hugetlb: unshare page tables during VMA split, not before
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38190
    - atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38191
    - ksmbd: fix null pointer dereference in destroy_previous_session
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38192
    - net: clear the dst when changing skb protocol
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38193
    - net_sched: sch_sfq: reject invalid perturb period
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38328
    - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38194
    - jffs2: check that raw node were preallocated before writing summary
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38090
    - drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38197
    - platform/x86: dell_rbu: Fix list usage
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38198
    - fbcon: Make sure modelist not set on unregistered console
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38331
    - net: ethernet: cortina: Use TOE/TSO on all TCP
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38200
    - i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38332
    - scsi: lpfc: Use memcpy() for BIOS version
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38342
    - software node: Correct a OOB check in software_node_get_reference_args()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38334
    - x86/sgx: Prevent attempts to reclaim poisoned pages
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38425
    - i2c: tegra: check msg length in SMBUS block read
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38343
    - wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38202
    - bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38422
    - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38344
    - ACPICA: fix acpi parse and parseext cache leaks
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38345
    - ACPICA: fix acpi operand cache leak in dswstate.c
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38085
    - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38208
    - smb: client: add NULL check in automount_fullpath
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38418
    - remoteproc: core: Release rproc->clean_table after rproc_attach() fails
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38419
    - remoteproc: core: Cleanup acquired resources when
      rproc_handle_resources() fails in rproc_attach()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38427
    - video: screen_info: Relocate framebuffers behind PCI bridges
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38086
    - net: ch9200: fix uninitialised access during mii_nway_restart
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38346
    - ftrace: Fix UAF when lookup kallsym after ftrace disabled
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38211
    - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38212
    - ipc: fix to protect IPCS lookups using RCU
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38214
    - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38215
    - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in
      fb_videomode_to_var
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38087
    - net/sched: fix use-after-free in taprio_dev_notifier
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38416
    - NFC: nci: uart: Set tty->disc_data only in success path
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38217
    - hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38218
    - f2fs: fix to do sanity check on sit_bitmap_size
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38219
    - f2fs: prevent kernel warning due to negative i_nlink from corrupted
      image
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38347
    - f2fs: fix to do sanity check on ino and xnid
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38428
    - Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38220
    - ext4: only dirty folios when data journaling regular files
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38222
    - ext4: inline: fix len overflow in ext4_prepare_inline_data
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38336
    - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38429
    - bus: mhi: ep: Update read pointer only after buffer is written
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38225
    - media: imx-jpeg: Cleanup after an allocation error
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38226
    - media: vivid: Change the siize of the composing
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38229
    - media: cxusb: no longer judge rbuf when the write fails
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38337
    - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38338
    - fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38231
    - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38430
    - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  * Noble update: upstream stable patchset 2025-12-08 (LP: #2134382) //
    CVE-2025-38348
    - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786)
    - tracing: Fix compilation warning on arm32
    - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
    - pinctrl: armada-37xx: set GPIO output value before setting direction
    - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
    - rtc: Make rtc_time64_to_tm() support dates before 1970
    - rtc: Fix offset calculation for .start_secs < 0
    - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
    - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
    - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
    - usb: typec: ucsi: fix Clang -Wsign-conversion warning
    - Bluetooth: hci_qca: move the SoC type check to the right place
    - usb: usbtmc: Fix timeout value in get_stb
    - dt-bindings: usb: cypress,hx3: Add support for all variants
    - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt
      property
    - tools/x86/kcpuid: Fix error handling
    - x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in
      mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
    - crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
    - gfs2: gfs2_create_inode error handling fix
    - perf/core: Fix broken throttling when max_samples_per_tick=1
    - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
    - powerpc: do not build ppc_save_regs.o always
    - powerpc/crash: Fix non-smp kexec preparation
    - x86/microcode/AMD: Do not return error when microcode update is not
      necessary
    - x86/cpu: Sanitize CPUID(0x80000000) output
    - crypto: marvell/cesa - Avoid empty transfer descriptor
    - btrfs: scrub: update device stats when an error is detected
    - btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
    - rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
    - crypto: lrw - Only add ecb if it is not already there
    - crypto: xts - Only add ecb if it is not already there
    - crypto: sun8i-ce - move fallback ahash_request to the end of the struct
    - kunit: Fix wrong parameter to kunit_deactivate_static_stub()
    - ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
    - ASoC: tas2764: Enable main IRQs
    - EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo
      channel 0
    - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
    - spi: tegra210-quad: remove redundant error handling code
    - spi: tegra210-quad: modify chip select (CS) deactivation
    - power: reset: at91-reset: Optimize at91_reset()
    - ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
    - PM: wakeup: Delete space in the end of string shown by
      pm_show_wakelocks()
    - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
    - PM: sleep: Print PM debug messages during hibernation
    - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
    - spi: sh-msiof: Fix maximum DMA transfer size
    - ASoC: apple: mca: Constrain channels according to TDM mask
    - drm/vmwgfx: Add seqno waiter for sync_files
    - drm/vc4: tests: Use return instead of assert
    - media: rkvdec: Fix frame size enumeration
    - arm64/fpsimd: Avoid RES0 bits in the SME trap handler
    - arm64/fpsimd: Fix merging of FPSIMD state during signal return
    - drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
    - watchdog: exar: Shorten identity name to fit correctly
    - m68k: mac: Fix macintosh_config for Mac II
    - firmware: psci: Fix refcount leak in psci_dt_init
    - arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
    - selftests/seccomp: fix syscall_restart test for arm compat
    - drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
    - drm/vkms: Adjust vkms_state->active_planes allocation type
    - drm/tegra: rgb: Fix the unbound reference count
    - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
    - arm64/fpsimd: Do not discard modified SVE state
    - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
    - drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
    - drm/mediatek: Fix kobject put for component sub-drivers
    - drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
    - xen/x86: fix initial memory balloon target
    - IB/cm: use rwlock for MAD agent lock
    - selftests/bpf: Fix bpf_nf selftest failure
    - bpf, sockmap: fix duplicated data transmission
    - wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
    - net: ncsi: Fix GCPS 64-bit member variables
    - libbpf: Fix buffer overflow in bpf_object__init_prog
    - xfrm: Use xdo.dev instead of xdo.real_dev
    - wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
    - wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
    - wifi: rtw88: do not ignore hardware read error during DPK
    - wifi: ath12k: Add MSDU length validation for TKIP MIC error
    - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
    - scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
    - libbpf: Remove sample_period init in perf_buffer
    - Use thread-safe function pointer in libbpf_print
    - iommu: Protect against overflow in iommu_pgsize()
    - bonding: assign random address if device address is same as bond
    - f2fs: clean up w/ fscrypt_is_bounce_page()
    - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
    - libbpf: Use proper errno value in linker
    - bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
    - netfilter: bridge: Move specific fragmented packet to slow_path instead
      of dropping it
    - netfilter: nft_quota: match correctly when the quota just depleted
    - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
    - tracing: Move histogram trigger variables from stack to per CPU
      structure
    - clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
    - clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
    - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
    - clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
    - efi/libstub: Describe missing 'out' parameter in efi_load_initrd
    - tracing: Rename event_trigger_alloc() to trigger_data_alloc()
    - tracing: Fix error handling in event_trigger_parse()
    - ktls, sockmap: Fix missing uncharge operation
    - libbpf: Use proper errno value in nlattr
    - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
    - s390/bpf: Store backchain even for leaf progs
    - iommu: remove duplicate selection of DMAR_TABLE
    - hisi_acc_vfio_pci: add eq and aeq interruption restore
    - scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
    - wifi: mt76: mt7996: set EHT max ampdu length capability
    - wifi: mt76: mt7996: fix RX buffer size of MCU event
    - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
    - vfio/type1: Fix error unwind in migration dirty bitmap allocation
    - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
    - netfilter: nft_tunnel: fix geneve_opt dump
    - RISC-V: KVM: lock the correct mp_state during reset
    - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
    - net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
    - net: phy: fix up const issues in to_mdio_device() and to_phy_device()
    - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
    - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
    - f2fs: use d_inode(dentry) cleanup dentry->d_inode
    - f2fs: fix to correct check conditions in f2fs_cross_rename
    - arm64: dts: qcom: sdm845-starqltechn: remove wifi
    - arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
    - arm64: dts: qcom: sdm845-starqltechn: refactor node order
    - arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
    - arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
    - arm64: dts: qcom: sm8250: Fix CPU7 opp table
    - arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
    - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
    - ARM: dts: at91: at91sam9263: fix NAND chip selects
    - arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
    - arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect
      GPIO
    - arm64: dts: imx8mm-beacon: Fix RTC capacitive load
    - arm64: dts: imx8mn-beacon: Fix RTC capacitive load
    - arm64: dts: imx8mp-beacon: Fix RTC capacitive load
    - arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI
      audio
    - arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI
      audio
    - arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
    - arm64: dts: mt6359: Add missing 'compatible' property to regulators node
    - arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
    - arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
    - arm64: dts: rockchip: Update eMMC for NanoPi R5 series
    - arm64: tegra: Drop remaining serial clock-names and reset-names
    - arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
    - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
    - nilfs2: add pointer check for nilfs_direct_propagate()
    - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
    - dt-bindings: vendor-prefixes: Add Liontron name
    - ARM: dts: qcom: apq8064: add missing clocks to the timer node
    - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon
      device
    - arm64: defconfig: mediatek: enable PHY drivers
    - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399
      Puma with Haikou
    - arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
    - arm64: dts: mt6359: Rename RTC node to match binding expectations
    - ARM: aspeed: Don't select SRAM
    - soc: aspeed: lpc: Fix impossible judgment condition
    - randstruct: gcc-plugin: Remove bogus void member
    - randstruct: gcc-plugin: Fix attribute addition
    - perf build: Warn when libdebuginfod devel files are not available
    - perf ui browser hists: Set actions->thread before calling
      do_zoom_thread()
    - dm: don't change md if dm_table_set_restrictions() fails
    - dm: free table mempools if not used in __bind
    - dm-flakey: error all IOs when num_features is absent
    - dm-flakey: make corrupting read bios work
    - perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
    - perf intel-pt: Fix PEBS-via-PT data_src
    - perf scripts python: exported-sql-viewer.py: Fix pattern matching with
      Python 3
    - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
    - remoteproc: k3-r5: Drop check performed in
      k3_r5_rproc_{mbox_callback/kick}
    - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
    - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in
      exynos_lpass_remove()
    - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
    - perf tests switch-tracking: Fix timestamp comparison
    - perf record: Fix incorrect --user-regs comments
    - perf trace: Always print return value for syscalls returning a pid
    - nfs: clear SB_RDONLY before getting superblock
    - nfs: ignore SB_RDONLY when remounting nfs
    - cifs: Fix validation of SMB1 query reparse point response
    - rtc: sh: assign correct interrupts with DT
    - PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
    - PCI: cadence: Fix runtime atomic count underflow
    - PCI: apple: Use gpiod_set_value_cansleep in probe flow
    - PCI/DPC: Initialize aer_err_info before using it
    - rtc: loongson: Add missing alarm notifications for ACPI RTC events
    - thunderbolt: Fix a logic error in wake on connect
    - iio: filter: admv8818: fix band 4, state 15
    - iio: filter: admv8818: fix integer overflow
    - iio: filter: admv8818: fix range calculation
    - iio: filter: admv8818: Support frequencies >= 2^32
    - iio: adc: ad7124: Fix 3dB filter frequency reading
    - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
    - counter: interrupt-cnt: Protect enable/disable OPs with mutex
    - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
    - net: stmmac: platform: guarantee uniqueness of bus_id
    - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
    - net: tipc: fix refcount warning in tipc_aead_encrypt
    - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
    - net/mlx4_en: Prevent potential integer overflow calculating Hz
    - net: lan966x: Make sure to insert the vlan tags also in host mode
    - spi: bcm63xx-spi: fix shared reset
    - spi: bcm63xx-hsspi: fix shared reset
    - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
    - ice: create new Tx scheduler nodes for new queues only
    - ice: fix rebuilding the Tx scheduler tree for large queue counts
    - net: dsa: tag_brcm: legacy: fix pskb_may_pull length
    - vmxnet3: correctly report gso type for UDP tunnels
    - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
    - netfilter: nf_nat: also check reverse tuple to obtain clashing entry
    - net: dsa: b53: do not enable RGMII delay on bcm63xx
    - net: dsa: b53: allow RGMII for bcm63xx RGMII ports
    - wireguard: device: enable threaded NAPI
    - scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
    - ASoC: codecs: hda: Fix RPM usage count underflow
    - ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
    - ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
    - path_overmount(): avoid false negatives
    - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
    - Input: synaptics-rmi - fix crash with unsupported versions of F34
    - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
    - serial: sh-sci: Move runtime PM enable to sci_probe_single()
    - serial: sh-sci: Clean sci_ports[0] after at earlycon exit
    - Bluetooth: hci_core: fix list_for_each_entry_rcu usage
    - Bluetooth: MGMT: Remove unused mgmt_pending_find_data
    - ath10k: snoc: fix unbalanced IRQ enable in crash recovery
    - wifi: ath11k: fix soc_dp_stats debugfs file permission
    - wifi: ath11k: convert timeouts to secs_to_jiffies()
    - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
    - wifi: ath11k: don't use static variables in
      ath11k_debugfs_fw_stats_process()
    - wifi: ath11k: don't wait when there is no vdev started
    - wifi: ath11k: validate ath11k_crypto_mode on top of
      ath11k_core_qmi_firmware_ready
    - regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
    - pinctrl: qcom: pinctrl-qcm2290: Add missing pins
    - scsi: iscsi: Fix incorrect error path labels for flashnode operations
    - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
    - drm/meson: use unsigned long long / Hz for frequency types
    - drm/meson: fix debug log statement when setting the HDMI clocks
    - drm/meson: use vclk_freq instead of pixel_freq in debug print
    - drm/meson: fix more rounding issues with 59.94Hz modes
    - i40e: return false from i40e_reset_vf if reset is in progress
    - i40e: retry VFLR handling if there is ongoing VF reset
    - macsec: MACsec SCI assignment for ES = 0
    - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
    - net/mlx5: Ensure fw pages are always allocated on same NUMA
    - net/mlx5: Fix return value when searching for existing flow group
    - net/mlx5e: Fix leak of Geneve TLV option object
    - net_sched: tbf: fix a race in tbf_change()
    - fs/filesystems: Fix potential unsigned integer underflow in fs_name()
    - nvmet-fcloop: access fcpreq only when holding reqlock
    - perf: Ensure bpf_perf_link path is properly serialized
    - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
    - block: Fix bvec_set_folio() for very large folios
    - tools/resolve_btfids: Fix build when cross compiling kernel with clang.
    - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
    - io_uring: expand main struct io_kiocb flags to 64-bits
    - io_uring: add io_file_can_poll() helper
    - io_uring/rw: allow pollable non-blocking attempts for !FMODE_NOWAIT
    - io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()
    - usb: usbtmc: Fix read_stb function and get_stb ioctl
    - usb: cdnsp: Fix issue with detecting command completion event
    - usb: cdnsp: Fix issue with detecting USB 3.2 speed
    - usb: Flush altsetting 0 endpoints before reinitializating them after
      reset.
    - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
    - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
    - calipso: unlock rcu before returning -EAFNOSUPPORT
    - regulator: dt-bindings: mt6357: Drop fixed compatible requirement
    - net: usb: aqc111: debug info before sanitation
    - drm/meson: Use 1000ULL when operating with mode->clock
    - Documentation: ACPI: Use all-string data node references
    - PCI/ASPM: Consolidate link state defines
    - PCI/ASPM: Disable L1 before disabling L1 PM Substates
    - perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member
    - perf/x86/amd/uncore: Prevent UMC counters from saturating
    - crypto: sun8i-ce - undo runtime PM changes during driver removal
    - erofs: fix file handle encoding for 64-bit NIDs
    - btrfs: fix invalid data space release when truncating block in NOCOW
      mode
    - ACPI: resource: fix a typo for MECHREVO in
      irq1_edge_low_force_override[]
    - thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
    - drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource
    - drm/vmwgfx: Fix dumb buffer leak
    - drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
    - drm/panel: samsung-sofef00: Drop s6e3fc2x01 support
    - kunit/usercopy: Disable u64 test on 32-bit SPARC
    - drm/msm/dpu: enable SmartDMA on SM8150
    - drm/msm/dpu: enable SmartDMA on SC8180X
    - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
    - drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
    - media: verisilicon: Free post processor buffers on error
    - wifi: ath12k: Fix memory leak during vdev_id mismatch
    - wifi: ath12k: Fix invalid memory access while forming 802.11 header
    - bpf: Check link_create.flags parameter for multi_kprobe
    - wifi: ath12k: fix cleanup path after mhi init
    - f2fs: clean up unnecessary indentation
    - f2fs: prevent the current section from being selected as a victim during
      GC
    - net/mlx5: Avoid using xso.real_dev unnecessarily
    - wifi: ath12k: Fix the QoS control field offset to build QoS header
    - libbpf: Fix event name too long error
    - wifi: iwlfiwi: mvm: Fix the rate reporting
    - selftests/bpf: Fix caps for __xlated/jited_unpriv
    - wifi: rtw89: pci: enlarge retry times of RX tag to 1000
    - wifi: mt76: mt7925: prevent multiple scan commands
    - wifi: mt76: mt7925: refine the sniffer commnad
    - wifi: mt76: mt7925: ensure all MCU commands wait for response
    - netfilter: nf_tables: nft_fib: consistent l3mdev handling
    - vsock/virtio: fix `rx_bytes` accounting for stream sockets
    - net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in
      dmaengine xmit
    - net: lan743x: Fix PHY reset handling during initialization and WOL
    - octeontx2-af: Sync NIX and NPA contexts from NDC to LLC/DRAM
    - octeontx2-pf: QOS: Perform cache sync on send queue teardown
    - arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the
      mdss node
    - arm64: dts: qcom: ipq9574: Fix USB vdd info
    - arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588
    - arm64: dts: mediatek: mt8183-kukui-jacuzzi: Simplify DSI endpoint
      replacement
    - arm64: dts: mt8183: Add port node to mt8183.dtsi
    - soc: qcom: smp2p: Fix fallback to qcom,ipc parse
    - ARM: dts: qcom: apq8064: move replicator out of soc node
    - arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects
    - perf symbol-minimal: Fix double free in filename__read_build_id
    - mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe()
    - mailbox: imx: Fix TXDB_V2 sending
    - mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
    - perf symbol: Fix use-after-free in filename__read_build_id
    - PCI/DPC: Log Error Source ID only when valid
    - coresight: catu: Introduce refcount and spinlock for enabling/disabling
    - mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()
    - iio: adc: mcp3911: fix device dependent mappings for conversion result
      registers
    - drm/xe: Make xe_gt_freq part of the Documentation
    - Fix sock_exceed_buf_limit not being triggered in
      __sk_mem_raise_allocated
    - idpf: fix netdev Tx queue stop/wake
    - idpf: fix a race in txq wakeup
    - nvme: fix command limits status code
    - drm/panel-simple: fix the warnings for the Evervision VGG644804
    - net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces.
    - net: dsa: b53: Introduce b53_adjust_531x5_rgmii()
    - net: dsa: b53: do not touch DLL_IQQD on bcm53115
    - ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3315
    - ALSA: hda/realtek: fix micmute LEDs on HP Laptops with ALC3247
    - ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA
    - ALSA: hda/realtek - Support mute led function for HP platform
    - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
    - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
    - dt-bindings: pinctrl: samsung: google,gs101-pinctrl needs a clock
    - pinctrl: samsung: support a bus clock
    - pinctrl: samsung: refactor drvdata suspend & resume callbacks
    - pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks
    - pinctrl: samsung: add gs101 specific eint suspend/resume callbacks
    - net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0
    - wifi: ath11k: move some firmware stats related functions outside of
      debugfs
    - wifi: ath12k: refactor ath12k_hw_regs structure
    - gfs2: pass through holder from the VFS for freeze/thaw
    - btrfs: exit after state split error at set_extent_bit()
    - block: use q->elevator with ->elevator_lock held in elv_iosched_show()
    - 9p: Add a migrate_folio method
    - overflow: Introduce __DEFINE_FLEX for having no initializer
    - thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit
    - Upstream stable to v6.6.94, v6.12.33, v6.12.34
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38101
    - ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38269
    - btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38303
    - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38414
    - wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38125
    - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38129
    - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38156
    - wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38162
    - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38292
    - wifi: ath12k: fix invalid access to memory
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38164
    - f2fs: zone: fix to avoid inconsistence in between SIT and SSA
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38169
    - arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38299
    - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38100
    - x86/iopl: Cure TIF_IO_BITMAP inconsistencies
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38102
    - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38103
    - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38107
    - net_sched: ets: fix a race in ets_qdisc_change()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38108
    - net_sched: red: fix a race in __red_change()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38109
    - net/mlx5: Fix ECVF vports unload on shutdown flow
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38304
    - Bluetooth: Fix NULL pointer deference on eir_get_service_data
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38110
    - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38111
    - net/mdiobus: Fix potential out-of-bounds read/write access
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38112
    - net: Fix TOCTOU issue in sk_is_readable()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38113
    - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38088
    - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38115
    - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38305
    - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38117
    - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38119
    - scsi: core: ufs: Fix a hang in the error handler
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38307
    - ASoC: Intel: avs: Verify content returned by parse_int_array()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38310
    - seg6: Fix validation of nexthop addresses
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38120
    - netfilter: nf_set_pipapo_avx2: fix initial map fill
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38122
    - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38123
    - net: wwan: t7xx: Fix napi rx poll issue
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38124
    - net: fix udp gso skb_segment after pull from frag_list
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38126
    - net: stmmac: make sure that ptp_rate is not 0 before configuring
      timestamping
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38127
    - ice: fix Tx scheduler error handling in XDP callback
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38131
    - coresight: prevent deactivate active config while enabling the config
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38274
    - fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38135
    - serial: Fix potential null-ptr-deref in mlb_usio_probe()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38136
    - usb: renesas_usbhs: Reorder clock handling and power management in probe
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38138
    - dmaengine: ti: Add NULL check in udma_probe()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38275
    - phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38142
    - hwmon: (asus-ec-sensors) check sensor index in read_string()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38277
    - mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38143
    - backlight: pm8941: Add NULL check in wled_configure()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38312
    - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38145
    - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38313
    - bus: fsl-mc: fix double-free on mc_dev
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38415
    - Squashfs: check return result of sb_min_blocksize
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38146
    - net: openvswitch: Fix the dead loop of MPLS parse
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38147
    - calipso: Don't call calipso functions for AF_INET sk.
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38278
    - octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38148
    - net: phy: mscc: Fix memory leak when using one step timestamping
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38149
    - net: phy: clear phydev->devlink when the link is deleted
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38280
    - bpf: Avoid __bpf_prog_ret0_warn when jit fails
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38153
    - net: usb: aqc111: fix error handling of usbnet read calls
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38154
    - bpf, sockmap: Avoid using sk_socket after free when sending
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38155
    - wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38282
    - kernfs: Relax constraint in draining guard
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38157
    - wifi: ath9k_htc: Abort software beacon handling if disabled
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38283
    - hisi_acc_vfio_pci: bugfix live migration function without VF device
      driver
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38158
    - hisi_acc_vfio_pci: fix XQE dma address error
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-39890
    - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38159
    - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38285
    - bpf: Fix WARN() in get_bpf_raw_tp_regs
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38286
    - pinctrl: at91: Fix possible out-of-boundary access
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38160
    - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38161
    - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38290
    - wifi: ath12k: fix node corruption in ar->arvifs list
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38163
    - f2fs: fix to do sanity check on sbi->total_valid_block_count
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38165
    - bpf, sockmap: Fix panic when calling skb_linearize
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38166
    - bpf: fix ktls panic with sockmap
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38293
    - wifi: ath11k: fix node corruption in ar->arvifs list
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38295
    - perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in
      meson_ddr_pmu_create()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38167
    - fs/ntfs3: handle hdr_first_de() return value
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38170
    - arm64/fpsimd: Discard stale CPU state when handling SME traps
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38319
    - drm/amd/pp: Fix potential NULL pointer dereference in
      atomctrl_initialize_mc_reg_table
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38298
    - EDAC/skx_common: Fix general protection fault
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38173
    - crypto: marvell/cesa - Handle zero-length skcipher requests
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38300
    - crypto: sun8i-ce-cipher - fix error handling in
      sun8i_ce_cipher_prepare()
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38174
    - thunderbolt: Do not double dequeue a configuration request
  * Noble update: upstream stable patchset 2025-12-03 (LP: #2133786) //
    CVE-2025-38265
    - serial: jsm: fix NPE during jsm_uart_port_init
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301)
    - i2c: designware: Uniform initialization flow for polling mode
    - i2c: designware: Remove ->disable() callback
    - i2c: designware: Use temporary variable for struct device
    - i2c: designware: Fix an error handling path in i2c_dw_pci_probe()
    - phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
    - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe
    - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver
      data
    - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off
    - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist
    - nvmem: rockchip-otp: Move read-offset into variant-data
    - nvmem: rockchip-otp: add rk3576 variant data
    - nvmem: core: verify cell's raw_len
    - nvmem: core: update raw_len if the bit reading is required
    - nvmem: qfprom: switch to 4-byte aligned reads
    - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices
    - intel_th: avoid using deprecated page->mapping, index fields
    - dma-mapping: avoid potential unused data compilation warning
    - cgroup: Fix compilation issue due to cgroup_mutex not being exported
    - scsi: mpi3mr: Add level check to control event logging
    - net: enetc: refactor bulk flipping of RX buffers to separate function
    - ima: process_measurement() needlessly takes inode_lock() on MAY_READ
    - drm/amdgpu: Allow P2P access through XGMI
    - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure
    - bpf: fix possible endless loop in BPF map iteration
    - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora
    - kconfig: merge_config: use an empty file as initfile
    - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel
      log
    - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES
    - cifs: Fix querying and creating MF symlinks over SMB1
    - cifs: Fix negotiate retry functionality
    - smb: client: Store original IO parameters and prevent zero IO sizes
    - fuse: Return EPERM rather than ENOSYS from link()
    - NFSv4: Check for delegation validity in
      nfs_start_delegation_return_locked()
    - NFS: Don't allow waiting for exiting tasks
    - arm64: Add support for HIP09 Spectre-BHB mitigation
    - tracing: Mark binary printing functions with __printf() attribute
    - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list
    - mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
    - mailbox: use error ret code of of_parse_phandle_with_args()
    - riscv: Allow NOMMU kernels to access all of RAM
    - fbdev: fsl-diu-fb: add missing device_remove_file()
    - fbcon: Use correct erase colour for clearing in fbcon
    - fbdev: core: tileblit: Implement missing margin clearing for tileblit
    - cifs: add validation check for the fields in smb_aces
    - cifs: Fix establishing NetBIOS session for SMB2+ connection
    - NFSv4: Treat ENETUNREACH errors as fatal for state recovery
    - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
    - SUNRPC: rpcbind should never reset the port to the value '0'
    - thermal/drivers/qoriq: Power down TMU on system suspend
    - dql: Fix dql->limit value when reset.
    - lockdep: Fix wait context check on softirq for PREEMPT_RT
    - objtool: Properly disable uaccess validation
    - PCI: dwc: ep: Ensure proper iteration over outbound map windows
    - tools/build: Don't pass test log files to linker
    - pNFS/flexfiles: Report ENETDOWN as a connection error
    - PCI: vmd: Disable MSI remapping bypass under Xen
    - ext4: on a remount, only log the ro or r/w state when it has changed
    - mmc: host: Wait for Vdd to settle on card power off
    - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2
    - wifi: mt76: mt7996: revise TXS size
    - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP
    - i2c: qup: Vote for interconnect bandwidth to DRAM
    - i2c: pxa: fix call balance of i2c->clk handling routines
    - btrfs: make btrfs_discard_workfn() block_group ref explicit
    - btrfs: avoid linker error in btrfs_find_create_tree_block()
    - btrfs: run btrfs_error_commit_super() early
    - btrfs: fix non-empty delayed iputs list on unmount due to async workers
    - btrfs: get zone unusable bytes while holding lock at
      btrfs_reclaim_bgs_work()
    - btrfs: send: return -ENAMETOOLONG when attempting a path that is too
      long
    - drm/amd/display: Guard against setting dispclk low for dcn31x
    - i3c: master: svc: Fix missing STOP for master request
    - dlm: make tcp still work in multi-link env
    - um: Store full CSGSFS and SS register from mcontext
    - um: Update min_low_pfn to match changes in uml_reserved
    - ext4: reorder capability check last
    - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure
    - scsi: st: Tighten the page format heuristics with MODE SELECT
    - scsi: st: ERASE does not change tape location
    - vfio/pci: Handle INTx IRQ_NOTCONNECTED
    - bpf: Return prog btf_id without capable check
    - jbd2: do not try to recover wiped journal
    - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered()
    - rtc: rv3032: fix EERD location
    - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for
      retimer
    - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect
    - bpf: Allow pre-ordering for bpf cgroup progs
    - kbuild: fix argument parsing in scripts/config
    - crypto: octeontx2 - suppress auth failure screaming due to negative
      tests
    - dm: restrict dm device size to 2^63-512 bytes
    - net/smc: use the correct ndev to find pnetid by pnetid table
    - xen: Add support for XenServer 6.1 platform device
    - pinctrl-tegra: Restore SFSEL bit when freeing pins
    - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check
    - drm/amdgpu: Update SRIOV video codec caps
    - ASoC: sun4i-codec: support hp-det-gpios property
    - ext4: reject the 'data_err=abort' option in nojournal mode
    - ext4: do not convert the unwritten extents if data writeback fails
    - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject()
    - posix-timers: Add cond_resched() to posix_timer_add() search loop
    - timer_list: Don't use %pK through printk()
    - netfilter: conntrack: Bound nf_conntrack sysctl writes
    - arm64/mm: Check PUD_TYPE_TABLE in pud_bad()
    - mmc: dw_mmc: add exynos7870 DW MMC support
    - usb: xhci: Don't change the status of stalled TDs on failed Stop EP
    - hwmon: (dell-smm) Increment the number of fans
    - printk: Check CON_SUSPEND when unblanking a console
    - drm/amd/display: remove minimum Dispclk and apply oem panel timing.
    - drm/amd/display: calculate the remain segments for all pipes
    - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch
    - gfs2: Check for empty queue in run_queue
    - auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct
      hd44780_common"
    - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup()
    - iommu/amd/pgtbl_v2: Improve error handling
    - watchdog: aspeed: Update bootstatus handling
    - drm/amdkfd: Set per-process flags only once cik/vi
    - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator
    - arm64: tegra: Resize aperture for the IGX PCIe C5 slot
    - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
    - ALSA: seq: Improve data consistency at polling
    - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc()
    - rtc: ds1307: stop disabling alarms on probe
    - ieee802154: ca8210: Use proper setters and getters for bitwise types
    - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
    - media: c8sectpfe: Call of_node_put(i2c_bus) only once in
      c8sectpfe_probe()
    - drm/gem: Test for imported GEM buffers with helper
    - net: phylink: use pl->link_interface in phylink_expects_phy()
    - remoteproc: qcom_wcnss: Handle platforms with only single power domain
    - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c
    - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination
    - pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
    - net: ethernet: ti: cpsw_new: populate netdev of_node
    - net: pktgen: fix mpls maximum labels list parsing
    - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type
    - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7
    - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config().
    - drm/rockchip: vop2: Add uv swap for cluster window
    - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map
    - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value
    - clk: imx8mp: inform CCF of maximum frequency of clocks
    - hwmon: (gpio-fan) Add missing mutex locks
    - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration
    - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
    - fpga: altera-cvp: Increase credit timeout
    - perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters
    - soc: apple: rtkit: Use high prio work queue
    - soc: apple: rtkit: Implement OSLog buffers properly
    - wifi: ath12k: Report proper tx completion status to mac80211
    - PCI: brcmstb: Expand inbound window size up to 64GB
    - PCI: brcmstb: Add a softdep to MIP MSI-X driver
    - net/mlx5: Avoid report two health errors on same syndrome
    - selftests/net: have `gro.sh -t` return a correct exit code
    - drm/amdkfd: KFD release_work possible circular locking
    - leds: pwm-multicolor: Add check for fwnode_property_read_u32
    - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only
    - net: xgene-v2: remove incorrect ACPI_PTR annotation
    - bonding: report duplicate MAC address in all situations
    - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band
    - soc: ti: k3-socinfo: Do not use syscon helper to build regmap
    - Octeontx2-af: RPM: Register driver with PCI subsys IDs
    - x86/build: Fix broken copy command in genimage.sh when making isoimage
    - drm/amd/display: handle max_downscale_src_width fail check
    - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile
    - ASoC: mediatek: mt8188: Add reference for dmic clocks
    - x86/nmi: Add an emergency handler in nmi_desc & use it in
      nmi_shootdown_cpus()
    - vhost-scsi: Return queue full for page alloc failures during copy
    - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines
    - media: adv7180: Disable test-pattern control on adv7180
    - media: tc358746: improve calculation of the D-PHY timing registers
    - libbpf: Fix out-of-bound read
    - net/mlx5: Change POOL_NEXT_SIZE define value and make it global
    - crypto: ahash - Set default reqsize from ahash_alg
    - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher
    - MIPS: Use arch specific syscall name match function
    - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
    - clocksource: mips-gic-timer: Enable counter when CPUs start
    - scsi: mpt3sas: Send a diag reset if target reset fails
    - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU
    - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
    - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31
    - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx()
    - EDAC/ie31200: work around false positive build warning
    - i3c: master: svc: Flush FIFO before sending Dynamic Address
      Assignment(DAA)
    - drm/amd/display: Add support for disconnected eDP streams
    - RDMA/core: Fix best page size finding when it can cross SG entries
    - pmdomain: imx: gpcv2: use proper helper for property detection
    - can: c_can: Use of_property_present() to test existence of DT property
    - bpf: don't do clean_live_states when state->loop_entry->branches > 0
    - eth: mlx4: don't try to complete XDP frames in netpoll
    - PCI: Fix old_size lower bound in calculate_iosize() too
    - ACPI: HED: Always initialize before evged
    - vxlan: Join / leave MC group after remote changes
    - media: test-drivers: vivid: don't call schedule in loop
    - net/mlx5: Modify LSB bitmask in temperature event to include only the
      first bit
    - net/mlx5: Apply rate-limiting to high temperature warning
    - firmware: arm_ffa: Reject higher major version as incompatible
    - ASoC: ops: Enforce platform maximum on initial value
    - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG
    - ASoC: tas2764: Mark SW_RESET as volatile
    - ASoC: tas2764: Power up/down amp on mute ops
    - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()
    - pinctrl: devicetree: do not goto err when probing hogs in
      pinctrl_dt_to_map
    - smack: recognize ipv4 CIPSO w/o categories
    - smack: Revert "smackfs: Added check catlen"
    - kunit: tool: Use qboot on QEMU x86_64
    - media: i2c: imx219: Correct the minimum vblanking value
    - media: v4l: Memset argument to 0 before calling get_mbus_config pad op
    - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
    - clk: qcom: ipq5018: allow it to be bulid on arm32
    - [Config] clk: qcom: ipq5018: enable module on armhf
    - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate
    - x86/traps: Cleanup and robustify decode_bug()
    - sched: Reduce the default slice to avoid tasks getting an extra tick
    - serial: sh-sci: Update the suspend/resume support
    - phy: core: don't require set_mode() callback for phy_get_mode() to work
    - soundwire: amd: change the soundwire wake enable/disable sequence
    - drm/amdgpu: Set snoop bit for SDMA for MI series
    - drm/amd/display: Don't try AUX transactions on disconnected link
    - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer
    - drm/amd/display: Update CR AUX RD interval interpretation
    - drm/amd/display: Initial psr_version with correct setting
    - drm/amdgpu: enlarge the VBIOS binary size limit
    - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer()
    - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr()
    - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
    - net/mlx5e: set the tx_queue_len for pfifo_fast
    - net/mlx5e: reduce rep rxq depth to 256 for ECPF
    - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps
    - drm/v3d: Add clock handling
    - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx()
    - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call
    - net: fec: Refactor MAC reset to function
    - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory
    - arch/powerpc/perf: Check the instruction type before creating sample
      with perf_mem_data_src
    - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
    - r8152: add vendor/device ID pair for Dell Alienware AW1022z
    - pstore: Change kmsg_bytes storage size to u32
    - ext4: don't write back data before punch hole in nojournal mode
    - ext4: remove writable userspace mappings before truncating page cache
    - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU
    - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU
    - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs
    - hwmon: (xgene-hwmon) use appropriate type for the latency value
    - f2fs: introduce f2fs_base_attr for global sysfs entries
    - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is
      available
    - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only
    - r8169: don't scan PHY addresses > 0
    - bridge: mdb: Allow replace of a host-joined group
    - ice: treat dyn_allowed only as suggestion
    - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
    - rcu: handle unstable rdp in rcu_read_unlock_strict()
    - rcu: fix header guard for rcu_all_qs()
    - perf: Avoid the read if the count is already updated
    - ice: count combined queues using Rx/Tx count
    - net/mana: fix warning in the writer of client oob
    - scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
    - scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when
      pci_irq_vector() fails
    - scsi: st: Restore some drive settings after reset
    - wifi: ath12k: Avoid napi_sync() before napi_enable()
    - HID: usbkbd: Fix the bit shift number for LED_KANA
    - arm64: zynqmp: add clock-output-names property in clock nodes
    - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode
    - ASoC: rt722-sdca: Add some missing readable registers
    - drm/ast: Find VBIOS mode from regular display size
    - bpftool: Fix readlink usage in get_fd_type
    - firmware: arm_scmi: Relax duplicate name constraint across protocol ids
    - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt
    - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU
    - wifi: rtl8xxxu: retry firmware download on error
    - wifi: rtw88: Don't use static local variable in
      rtw8822b_set_tx_power_index_by_rate
    - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet
    - spi: zynqmp-gqspi: Always acknowledge interrupts
    - regulator: ad5398: Add device tree support
    - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override
    - accel/qaic: Mask out SR-IOV PCI resources
    - wifi: ath9k: return by of_get_mac_address
    - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor
    - drm: bridge: adv7511: fill stream capabilities
    - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
    - drm/panel-edp: Add Starry 116KHD024006
    - drm: Add valid clones check
    - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of()
    - book3s64/radix: Fix compile errors when
      CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n
    - pinctrl: meson: define the pull up/down resistor value as 60 kOhm
    - ASoC: cs42l43: Disable headphone clamps during type detection
    - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
    - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx
    - nvme-pci: add quirks for device 126f:1001
    - nvme-pci: add quirks for WDC Blue SN550 15b7:5009
    - io_uring/fdinfo: annotate racy sq/cq head/tail reads
    - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info()
    - cifs: Fix changing times and read-only attr over SMB1
      smb_set_file_info() function
    - tools: ynl-gen: validate 0 len strings from kernel
    - wifi: iwlwifi: add support for Killer on MTL
    - xenbus: Allow PVH dom0 a non-local xenstore
    - soundwire: bus: Fix race on the creation of the IRQ domain
    - dmaengine: idxd: Fix allowing write() from different address spaces
    - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
    - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators
    - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks
    - xfrm: Sanitize marks before insert
    - dmaengine: idxd: Fix ->poll() return value
    - dmaengine: fsl-edma: Fix return code for unhandled interrupts
    - Bluetooth: L2CAP: Fix not checking l2cap_chan security level
    - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump
      handling
    - bridge: netfilter: Fix forwarding of fragmented packets
    - ice: fix vf->num_mac count with port representors
    - ice: Fix LACP bonds without SRIOV environment
    - pinctrl: qcom: switch to devm_register_sys_off_handler()
    - net: dwmac-sun8i: Use parsed internal PHY address instead of 1
    - net: lan743x: Restore SGMII CTRL register on resume
    - io_uring: fix overflow resched cqe reordering
    - octeontx2-pf: Add AF_XDP non-zero copy support
    - octeontx2-af: Set LMT_ENA bit for APR table entries
    - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG
    - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing
      ::hws[] in probe()
    - can: slcan: allow reception of short error messages
    - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
    - ASoc: SOF: topology: connect DAI to a single DAI link
    - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback
      direction
    - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
    - llc: fix data loss when reading from a socket in llc_ui_recvmsg()
    - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
    - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature
    - drm/edid: fixed the bug that hdr metadata was not reset
    - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs
    - smb: client: Reset all search buffer pointers when releasing buffer
    - Input: xpad - add more controllers
    - memcg: always call cond_resched() after fn()
    - mm/page_alloc.c: avoid infinite retries caused by cpuset race
    - Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection"
    - ksmbd: fix stream write failure
    - spi: spi-fsl-dspi: restrict register range for regmap access
    - spi: spi-fsl-dspi: Halt the module after a new message transfer
    - spi: spi-fsl-dspi: Reset SR flags before sending a new message
    - serial: sh-sci: Save and restore more registers
    - watchdog: aspeed: fix 64-bit division
    - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group()
    - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work()
    - drm/gem: Internally test import_attach for imported objects
    - can: kvaser_pciefd: Force IRQ edge in case of nested IRQ
    - af_unix: Return struct unix_sock from unix_get_socket().
    - af_unix: Run GC on only one CPU.
    - af_unix: Try to run GC async.
    - af_unix: Replace BUG_ON() with WARN_ON_ONCE().
    - af_unix: Remove io_uring code for GC.
    - af_unix: Remove CONFIG_UNIX_SCM.
    - [Config] af_unix: remove UNIX_SCM config option
    - af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd.
    - af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.
    - af_unix: Link struct unix_edge when queuing skb.
    - af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb.
    - af_unix: Iterate all vertices by DFS.
    - af_unix: Detect Strongly Connected Components.
    - af_unix: Save listener for embryo socket.
    - af_unix: Fix up unix_edge.successor for embryo socket.
    - af_unix: Save O(n) setup of Tarjan's algo.
    - af_unix: Skip GC if no cycle exists.
    - af_unix: Avoid Tarjan's algorithm if unnecessary.
    - af_unix: Assign a unique index to SCC.
    - af_unix: Detect dead SCC.
    - Revert "UBUNTU: SAUCE: af_unix: Fix GC compatibility with upstream OOB
      refcount changes"
    - af_unix: Replace garbage collection algorithm.
    - af_unix: Remove lock dance in unix_peek_fds().
    - af_unix: Try not to hold unix_gc_lock during accept().
    - af_unix: Don't access successor in unix_del_edges() during GC.
    - af_unix: Add dead flag to struct scm_fp_list.
    - af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS
    - af_unix: Fix uninit-value in __unix_walk_scc()
    - SAUCE: Revert "af_unix: Don't return OOB skb in manage_oob()."
    - SAUCE: Revert "af_unix: Move spin_lock() in manage_oob()."
    - SAUCE: Revert "af_unix: Rename unlinked_skb in manage_oob()."
    - SAUCE: Revert "af_unix: Remove single nest in manage_oob()."
    - SAUCE: Revert "af_unix: Don't call skb_get() for OOB skb."
    - af_unix: Define locking order for unix_table_double_lock().
    - af_unix: Define locking order for U_LOCK_SECOND in
      unix_state_double_lock().
    - af_unix: Define locking order for U_RECVQ_LOCK_EMBRYO in
      unix_collect_skb().
    - af_unix: Don't call skb_get() for OOB skb.
    - af_unix: Don't leave consecutive consumed OOB skbs.
    - af_unix: Remove single nest in manage_oob().
    - af_unix: Rename unlinked_skb in manage_oob().
    - af_unix: Move spin_lock() in manage_oob().
    - af_unix: Don't return OOB skb in manage_oob().
    - arm64: dts: qcom: ipq9574: Add missing properties for cryptobam
    - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
    - arm64: dts: qcom: sm8450: Add missing properties for cryptobam
    - arm64: dts: qcom: sm8550: Add missing properties for cryptobam
    - arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy
    - perf/arm-cmn: Fix REQ2/SNP2 mixup
    - perf/arm-cmn: Initialise cmn->cpu earlier
    - coredump: fix error handling for replace_fd()
    - dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open
    - HID: quirks: Add ADATA XPG alpha wireless mouse support
    - nfs: don't share pNFS DS connections between net namespaces
    - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
    - um: let 'make clean' properly clean underlying SUBARCH as well
    - drm/amd/display: fix link_set_dpms_off multi-display MST corner case
    - phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure
    - spi: spi-sun4i: fix early activation
    - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
    - NFS: Avoid flushing data while holding directory locks in nfs_rename()
    - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
    - platform/x86: thinkpad_acpi: Ignore battery threshold change event
      notification
    - net: ethernet: ti: am65-cpsw: Lower random mac address error print to
      info
    - dma/mapping.c: dev_dbg support for dma_addressing_limited
    - mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type
    - vhost_task: fix vhost_task_create() documentation
    - dma-mapping: Fix warning reported for missing prototype
    - fs/buffer: split locking for pagecache lookups
    - fs/buffer: introduce sleeping flavors for pagecache lookups
    - fs/buffer: use sleeping version of __find_get_block()
    - fs/ocfs2: use sleeping version of __find_get_block()
    - fs/jbd2: use sleeping version of __find_get_block()
    - fs/ext4: use sleeping version of sb_find_get_block()
    - drm/amd/display: Enable urgent latency adjustment on DCN35
    - iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability
    - cifs: Set default Netbios RFC1001 server name to hostname in UNC
    - ASoC: codecs: wsa884x: Correct VI sense channel mask
    - ASoC: codecs: wsa883x: Correct VI sense channel mask
    - thermal/drivers/mediatek/lvts: Start sensor interrupts disabled
    - Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler
      removal
    - drm/amdgpu/discovery: check ip_discovery fw file available
    - drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12
    - xen/pci: Do not register devices with segments >= 0x10000
    - drm/amdgpu: Skip pcie_replay_count sysfs creation for VF
    - cgroup/rstat: avoid disabling irqs for O(num_cpu)
    - wifi: mt76: mt7996: fix SER reset trigger on WED reset
    - wifi: mt76: mt7925: load the appropriate CLC data based on hardware type
    - wifi: mt76: mt7925: fix fails to enter low power mode in suspend state
    - x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers
    - x86/cpu/intel: Replace PAT erratum model/family magic numbers with
      symbolic IFM references
    - x86/smpboot: Fix INIT delay assignment for extended Intel Families
    - x86/microcode/intel: Switch to new Intel CPU model defines
    - x86/microcode: Update the Intel processor flag scan check
    - blk-cgroup: improve policy registration error handling
    - drm/amdgpu: release xcp_mgr on exit
    - drm/amdgpu: adjust drm_firmware_drivers_only() handling
    - s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste()
    - clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug
    - erofs: initialize decompression early
    - clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490
    - posix-timers: Ensure that timer initialization is fully visible
    - net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe
    - net: hsr: Fix PRP duplicate detection
    - PNP: Expand length of fixup id string
    - arm64/mm: Check pmd_table() in pmd_trans_huge()
    - wifi: iwlwifi: mark Br device not integrated
    - wifi: mac80211: fix warning on disconnect during failed ML reconf
    - wifi: mac80211_hwsim: Fix MLD address translation
    - badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable
      < 0
    - coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t
    - misc: pci_endpoint_test: Give disabled BARs a distinct error code
    - drm/amdkfd: Set per-process flags only once for gfx9/10/11/12
    - drm/xe: Retry BO allocation
    - soc: samsung: include linux/array_size.h where needed
    - usb: xhci: set page size to the xHCI-supported size
    - soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables
    - drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35
    - drm/amd/display: Fix p-state type when p-state is unsupported
    - perf/core: Clean up perf_try_init_event()
    - net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104
    - dpll: Add an assertion to check freq_supported_num
    - ublk: enforce ublks_max only for unprivileged devices
    - scsi: logging: Fix scsi_logging_level bounds
    - ublk: complete command synchronously on error
    - drm/xe: xe_gen_wa_oob: replace program_invocation_short_name
    - bpf: Search and add kfuncs in struct_ops prologue and epilogue
    - drm/amd/display: fix dcn4x init failed
    - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode
    - scsi: mpi3mr: Update timestamp only for supervisor IOCs
    - scsi: scsi_debug: First fixes for tapes
    - net: ipv6: Init tunnel link-netns before registering dev
    - drm/amdgpu: remove all KFD fences from the BO on release
    - eeprom: ee1004: Check chip before probing
    - drm/amd/pm: Fetch current power limit from PMFW
    - drm/amd/display: DCN35 set min dispclk to 50Mhz
    - drm/amd/display: Fix DCN35 set min dispclk logic
    - drm/amd/display: Guard against setting dispclk low when active
    - drm/amd/display: Fix BT2020 YCbCr limited/full range input
    - drm/amd/display: Read LTTPR ALPM caps during link cap retrieval
    - hrtimers: Replace hrtimer_clock_to_base_table with switch-case
    - firmware: arm_ffa: Handle the presence of host partition in the
      partition info
    - firmware: xilinx: Dont send linux address to get fpga config get status
    - drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init()
    - x86/ibt: Handle FineIBT in handle_cfi_failure()
    - soundwire: cadence_master: set frame shape and divider based on actual
      clk freq
    - net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
    - drm/amdkfd: fix missing L2 cache info in topology
    - drm/amd/display: pass calculated dram_speed_mts to dml2
    - drm/amd/pm: Skip P2S load for SMU v13.0.12
    - drm/amd/display: Support multiple options during psr entry.
    - drm/amdgpu: Use active umc info from discovery
    - net/mlx5: XDP, Enable TX side XDP multi-buffer support
    - wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV
    - wifi: iwlwifi: use correct IMR dump variable
    - wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx
    - powerpc/pseries/iommu: create DDW for devices with DMA mask less than
      64-bits
    - wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang
    - wifi: rtw89: fw: validate multi-firmware header before getting its size
    - wifi: rtw89: fw: validate multi-firmware header before accessing
    - wifi: rtw89: call power_on ahead before selecting firmware
    - net: page_pool: avoid false positive warning if NAPI was never added
    - media: qcom: camss: Add default case in vfe_src_pad_code
    - drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0
    - tools: ynl-gen: don't output external constants
    - ice: init flow director before RDMA
    - wifi: ath12k: Fetch regdb.bin file from board-2.bin
    - drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE
    - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
    - wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan
      event
    - drm/xe/sa: Always call drm_suballoc_manager_fini()
    - drm/xe: Reject BO eviction if BO is bound to current VM
    - smb: server: smb2pdu: check return value of xa_store()
    - ACPI: platform-profile: add platform_profile_cycle()
    - platform/x86: ideapad-laptop: add support for some new buttons
    - ALSA: usb-audio: Fix duplicated name in MIDI substream names
    - btrfs: handle empty eb->folios in num_extent_folios()
    - xfrm: Fix UDP GRO handling for some corner cases
    - idpf: fix idpf_vport_splitq_napi_poll()
    - net: dsa: microchip: update tag_ksz masks for KSZ9477 family
    - net: dsa: microchip: linearize skb for tail-tagging switches
    - vmxnet3: update MTU after device quiesce
    - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
    - highmem: add folio_test_partial_kmap()
    - mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled
    - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs()
    - Bluetooth: btmtksdio: Check function enabled before doing close
    - Bluetooth: btmtksdio: Do close if SDIO card removed without close
    - platform/x86: think-lmi: Fix attribute name usage for non-compliant
      items
    - err.h: move IOMEM_ERR_PTR() to err.h
    - gcc-15: make 'unterminated string initialization' just a warning
    - gcc-15: disable '-Wunterminated-string-initialization' entirely for now
    - Fix mis-uses of 'cc-option' for warning disablement
    - bpf: abort verification if env->cur_state->loop_entry != NULL
    - drm/amdkfd: Correct F8_MODE for gfx950
    - arm64: dts: qcom: sm8650: Add missing properties for cryptobam
    - arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage
    - arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on
    - arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default
    - arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to
      default
    - arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219
      overlay
    - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay
    - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay
    - arm64: dts: ti: k3-am65-main: Fix sdhci node properties
    - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
    - arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux
    - arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances
    - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
    - drm/xe: Save the gt pointer in lrc and drop the tile
    - Upstream stable to v6.6.93, v6.12.31, v6.12.32
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38053
    - idpf: fix null-ptr-deref in idpf_features_check
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38055
    - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38057
    - espintcp: fix skb leaks
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38060
    - bpf: copy_verifier_state() should copy 'loop_entry' field
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38098
    - drm/amd/display: Don't treat wb connector as physical in
      create_validate_stream_for_sink
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38099
    - Bluetooth: Disable SCO support if READ_VOICE_SETTING is
      unsupported/broken
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38073
    - block: fix race between set_blocksize and read paths
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38051
    - smb: client: Fix use-after-free in cifs_fill_dirent
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38077
    - platform/x86: dell-wmi-sysman: Avoid buffer overflow in
      current_password_store()
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38078
    - ALSA: pcm: Fix race of buffer access at PCM OSS layer
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38003
    - can: bcm: add missing rcu read protection for procfs content
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38004
    - can: bcm: add locking for bcm_op runtime updates
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38031
    - padata: do not leak refcount in reorder_work
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38079
    - crypto: algif_hash - fix double free in hash_accept
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38052
    - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38097
    - espintcp: remove encap socket caching to avoid reference leak
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38058
    - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38059
    - btrfs: avoid NULL pointer dereference if no valid csum tree
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38034
    - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38035
    - nvmet-tcp: don't restore null sk_state_change
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38037
    - vxlan: Annotate FDB data races
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38039
    - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload
      enabled
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38080
    - drm/amd/display: Increase block_sequence array size
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38040
    - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38061
    - net: pktgen: fix access outside of user given buffer in
      pktgen_thread_write()
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38062
    - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of
      iommu_cookie
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38063
    - dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38043
    - firmware: arm_ffa: Set dma_mask for ffa devices
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38044
    - media: cx231xx: set device_caps for 417
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38065
    - orangefs: Do not truncate file size
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38066
    - dm cache: prevent BUG_ON by blocking retries on failed device resumes
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38068
    - crypto: lzo - Fix compression buffer overrun
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38045
    - wifi: iwlwifi: fix debug actions order
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38071
    - x86/mm: Check return value from memblock_phys_alloc_range()
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38072
    - libnvdimm/labels: Fix divide error in nd_label_data_init()
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38081
    - spi-rockchip: Fix register out of bounds access
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38074
    - vhost-scsi: protect vq->log_used with vq->mutex
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38048
    - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
  * Noble update: upstream stable patchset 2025-11-28 (LP: #2133301) //
    CVE-2025-38075
    - scsi: target: iscsi: Fix timeout on deleted connection
  * CAP_PERFMON insufficient to get perf data (LP: #2131046)
    - SAUCE: perf/core: Allow CAP_PERFMON for paranoid level 4
  * Dell AIO backlight is not working, dell_uart_backlight module is missing
    (LP: #2083800)
    - SAUCE: Removed sauce dell-uart-backlight driver
    - Revert "UBUNTU: SAUCE: ACPI: video: Dell AIO UART backlight detection"
    - platform/x86: Add new Dell UART backlight driver
    - ACPI: video: Add Dell UART backlight controller detection
    - SAUCE: dell_uart_backlight: size_t -> ssize_t
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7760 AIO
    - ACPI: video: Add backlight=native quirk for Dell OptiPlex 5480 AIO
    - [Config] enable CONFIG_DELL_UART_BACKLIGHT
  * Ubuntu x86_64 6.8 kernels won't build if CONFIG_FB_HYPERV config option is
    enabled  (LP: #2127971)
    - fbdev: Introduce devm_register_framebuffer()
  * Run iio_info will be stucked forever (HID-
    SENSOR-200011.5.auto/iio:device1) (LP: #2102077)
    - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  * kernel: sysfs: cannot create duplicate filename
    '/bus/platform/devices/iTCO_wdt' (LP: #2121997)
    - i2c: i801: Hide Intel Birch Stream SoC TCO WDT
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344)
    - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
    - selftests/exec: load_address: conform test to TAP format output
    - binfmt_elf: Leave a gap between .bss and brk
    - selftests/exec: Build both static and non-static load_address tests
    - binfmt_elf: Calculate total_size earlier
    - binfmt_elf: Honor PT_LOAD alignment for static PIE
    - binfmt_elf: Move brk for static PIE even if ASLR disabled
    - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie
      14XA (GX4HRXL)
    - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
    - cgroup/cpuset: Extend kthread_is_per_cpu() check to all
      PF_NO_SETAFFINITY tasks
    - tracing: probes: Fix a possible race in trace_probe_log APIs
    - tpm: tis: Double the timeout B to 4s
    - firmware: arm_scmi: Add helper to trace bad messages
    - firmware: arm_scmi: Add message dump traces for bad and unexpected
      replies
    - firmware: arm_scmi: Add support for debug metrics at the interface
    - [Config] do not enable new support for SCMI debug metrics
    - firmware: arm_scmi: Track basic SCMI communication debug metrics
    - iio: adc: ad7266: Fix potential timestamp alignment issue.
    - iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
    - iio: chemical: sps30: use aligned_s64 for timestamp
    - HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
    - spi: loopback-test: Do not split 1024-byte hexdumps
    - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
    - tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get
      operation
    - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
    - mctp: no longer rely on net->dev_index_head[]
    - net: mctp: Ensure keys maintain only one ref to corresponding dev
    - ALSA: seq: Fix delivery of UMP events to group ports
    - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
    - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
    - nvme-pci: make nvme_pci_npages_prp() __always_inline
    - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
    - ALSA: sh: SND_AICA should depend on SH_DMA_API
    - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
    - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
    - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW
      capability
    - octeontx2-af: Fix CGX Receive counters
    - tsnep: fix timestamping with a stacked DSA driver
    - NFSv4/pnfs: Reset the layout state after a layoutreturn
    - udf: Make sure i_lenExtents is uptodate on inode eviction
    - LoongArch: Prevent cond_resched() occurring within kernel-fpu
    - LoongArch: Save and restore CSR.CNTC for hibernation
    - LoongArch: Fix MAX_REG_OFFSET calculation
    - LoongArch: uprobes: Remove user_{en,dis}able_single_step()
    - LoongArch: uprobes: Remove redundant code about resume_era
    - drm/amd/display: Correct the reply value when AUX write incomplete
    - drm/amd/display: Avoid flooding unnecessary info messages
    - ACPI: PPTT: Fix processor subtable walk
    - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
    - ALSA: usb-audio: Add sample rate quirk for Audioengine D1
    - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
    - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
    - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
    - hv_netvsc: Remove rmsg_pgcnt
    - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
    - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
    - ftrace: Fix preemption accounting for stacktrace trigger command
    - ftrace: Fix preemption accounting for stacktrace filter command
    - tracing: samples: Initialize trace_array_printk() with the correct
      function
    - phy: Fix error handling in tegra_xusb_port_init
    - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
    - phy: renesas: rcar-gen3-usb2: Set timing registers only once
    - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
    - smb: client: fix memory leak during error handling for POSIX mkdir
    - spi: tegra114: Use value to check for invalid delays
    - net: qede: Initialize qede_ll_ops with designated initializer
    - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure
      instead of a local copy
    - dmaengine: idxd: fix memory leak in error handling path of
      idxd_setup_wqs
    - dmaengine: idxd: fix memory leak in error handling path of
      idxd_setup_engines
    - dmaengine: idxd: fix memory leak in error handling path of
      idxd_setup_groups
    - dmaengine: idxd: Add missing cleanup for early error out in
      idxd_setup_internals
    - dmaengine: idxd: Add missing cleanups in cleanup internals
    - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove
      call
    - dmaengine: idxd: fix memory leak in error handling path of
      idxd_pci_probe
    - LoongArch: Explicitly specify code model in Makefile
    - SAUCE: Revert "memblock: Accept allocated memory before use in
      memblock_double_array()"
    - phy: tegra: xusb: remove a stray unlock
    - drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC
      Policies
    - drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies
    - uio_hv_generic: Fix sysfs creation path for ring buffer
    - KVM: Add member to struct kvm_gfn_range to indicate private/shared
    - KVM: x86/mmu: Prevent installing hugepages when mem attributes are
      changing
    - iio: chemical: pms7003: use aligned_s64 for timestamp
    - iio: pressure: mprls0025pa: use aligned_s64 for timestamp
    - net: dsa: b53: prevent standalone from trying to forward to other ports
    - netlink: specs: tc: fix a couple of attribute names
    - LoongArch: Move __arch_cpu_idle() to .cpuidle.text section
    - btrfs: fix discard worker infinite loop after disabling discard
    - btrfs: fix folio leak in submit_one_async_extent()
    - btrfs: add back warning for mount option commit values exceeding 300
    - drm/amdgpu: fix incorrect MALL size for GFX1151
    - gpio: pca953x: fix IRQ storm on system wake up
    - kbuild: Disable -Wdefault-const-init-unsafe
    - mm: userfaultfd: correct dirty flags set for both present and swap pte
    - accel/ivpu: Rename ivpu_log_level to fw_log_level
    - accel/ivpu: Reset fw log on cold boot
    - accel/ivpu: Refactor functions in ivpu_fw_log.c
    - drm/fbdev-dma: Support struct drm_driver.fbdev_probe
    - Upstream stable to v6.6.92, v6.12.30
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-37968
    - iio: light: opt3001: fix deadlock due to concurrent flag access
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38011
    - drm/amdgpu: csa unmap use uninterruptible lock
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-21931
    - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-37960
    - memblock: Accept allocated memory before use in memblock_double_array()
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-37967
    - usb: typec: ucsi: displayport: Fix deadlock
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-22102
    - Bluetooth: btnxpuart: Fix kernel panic during FW release
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38008
    - mm/page_alloc: fix race condition in unaccepted memory handling
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38014
    - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38015
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38005
    - dmaengine: ti: k3-udma: Add missing locking
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38009
    - wifi: mt76: disable napi on driver removal
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38010
    - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38095
    - dma-buf: insert memory barrier before updating num_fences
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38018
    - net/tls: fix kernel panic when alloc_page failed
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38019
    - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38013
    - wifi: mac80211: Set n_channels after allocating struct
      cfg80211_scan_request
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38027
    - regulator: max20086: fix invalid memory access
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38020
    - net/mlx5e: Disable MACsec offload for uplink representor profile
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38094
    - net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38006
    - net: mctp: Don't access ifa_index when missing
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-37992
    - net_sched: Flush gso_skb list too during ->change()
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38023
    - nfs: handle failure of nfs_get_lock_context in unlock path
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38007
    - HID: uclogic: Add NULL check in uclogic_input_configured()
  * Noble update: upstream stable patchset 2025-10-30 (LP: #2130344) //
    CVE-2025-38024
    - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277)
    - dm: add missing unlock on in dm_keyslot_evict()
    - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
    - can: mcan: m_can_class_unregister(): fix order of unregistration calls
    - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
    - ksmbd: fix memory leak in parse_lease_state()
    - SAUCE: Revert "sch_htb: make htb_deactivate() idempotent"
    - sch_htb: make htb_deactivate() idempotent
    - gre: Fix again IPv6 link-local address generation.
    - netdevice: add netdev_tx_reset_subqueue() shorthand
    - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
    - can: mcp251xfd: fix TDC setting for low data bit rates
    - can: gw: fix RCU/BH usage in cgw_create_job()
    - net: dsa: b53: allow leaky reserved multicast
    - net: dsa: b53: fix clearing PVID of a port
    - net: dsa: b53: fix flushing old pvid VLAN on pvid change
    - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
    - net: dsa: b53: always rejoin default untagged VLAN on bridge leave
    - net: dsa: b53: fix learning on VLAN unaware bridges
    - Input: cyttsp5 - ensure minimum reset pulse width
    - Input: cyttsp5 - fix power control issue on wakeup
    - Input: xpad - fix Share button on Xbox One controllers
    - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
    - Input: synaptics - enable InterTouch on Dynabook Portege X30-D
    - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
    - Input: synaptics - enable InterTouch on Dell Precision M3800
    - Input: synaptics - enable SMBus for HP Elitebook 850 G1
    - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
    - staging: iio: adc: ad7816: Correct conditional logic for store mode
    - staging: axis-fifo: Remove hardware resets for user errors
    - staging: axis-fifo: Correct handling of tx_fifo_depth for size
      validation
    - drm/amd/display: Shift DMUB AUX reply command if necessary
    - iio: adc: ad7606: fix serial register access
    - iio: adc: rockchip: Fix clock initialization sequence
    - iio: adis16201: Correct inclinometer channel resolution
    - drm/amd/display: Fix the checking condition in dmub aux handling
    - drm/amd/display: Remove incorrect checking in dmub aux handler
    - drm/amd/display: Fix wrong handling for AUX_DEFER case
    - drm/amd/display: Copy AUX read reply data whenever length > 0
    - usb: uhci-platform: Make the clock really optional
    - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
    - clocksource/i8253: Use raw_spinlock_irqsave() in
      clockevent_i8253_disable()
    - x86/microcode: Consolidate the loader enablement checking
    - ocfs2: switch osb->disable_recovery to enum
    - ocfs2: implement handshaking with ocfs2 recovery thread
    - ocfs2: stop quota recovery before disabling quotas
    - usb: cdnsp: Fix issue with resuming from L1
    - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
    - usb: gadget: f_ecm: Add get_status callback
    - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
    - usb: gadget: Use get_status callback to set remote wakeup capability
    - usb: host: tegra: Prevent host controller crash when OTG port is used
    - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
    - USB: usbtmc: use interruptible sleep in usbtmc_read
    - usb: usbtmc: Fix erroneous get_stb ioctl error returns
    - usb: usbtmc: Fix erroneous wait_srq ioctl return
    - usb: usbtmc: Fix erroneous generic_read ioctl return
    - iio: accel: adxl367: fix setting odr for activity time update
    - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
    - types: Complement the aligned types with signed 64-bit one
    - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
    - iio: adc: dln2: Use aligned_s64 for timestamp
    - MIPS: Fix MAX_REG_OFFSET
    - drm/panel: simple: Update timings for AUO G101EVN010
    - do_umount(): add missing barrier before refcount checks in sync case
    - io_uring: always arm linked timeouts prior to issue
    - arm64: insn: Add support for encoding DSB
    - arm64: proton-pack: Expose whether the platform is mitigated by firmware
    - arm64: proton-pack: Expose whether the branchy loop k value
    - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
    - x86/bpf: Call branch history clearing sequence on exit
    - x86/bpf: Add IBHF call at end of classic BPF
    - x86/bhi: Do not set BHI_DIS_S in 32-bit mode
    - x86/speculation: Simplify and make CALL_NOSPEC consistent
    - x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
    - x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
    - Documentation: x86/bugs/its: Add ITS documentation
    - x86/its: Enumerate Indirect Target Selection (ITS) bug
    - x86/its: Add support for ITS-safe indirect thunk
    - [Config] enable Indirect Target Selection mitigation
    - x86/its: Add support for ITS-safe return thunk
    - x86/its: Enable Indirect Target Selection mitigation
    - x86/its: Add "vmexit" option to skip mitigation on some CPUs
    - x86/its: Add support for RSB stuffing mitigation
    - x86/its: Align RETs in BHB clear sequence to avoid thunking
    - x86/ibt: Keep IBT disabled during alternative patching
    - x86/its: Use dynamic thunks for indirect branches
    - x86/its: Fix build errors when CONFIG_MODULES=n
    - x86/its: FineIBT-paranoid vs ITS
    - x86/its: Fix build error for its_static_thunk()
    - firmware: arm_scmi: Fix timeout checks on polling path
    - s390/entry: Fix last breaking event handling in case of stack corruption
    - erofs: ensure the extra temporary copy is valid for shortened bvecs
    - net: dsa: b53: keep CPU port always tagged again
    - net: dsa: b53: do not allow to configure VLAN 0
    - net: dsa: b53: do not program vlans when vlan filtering is off
    - net: dsa: b53: fix toggling vlan_filtering
    - net: dsa: b53: do not set learning and unicast/multicast on up
    - rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros`
      configuration
    - mm/userfaultfd: fix uninitialized output field for -EAGAIN race
    - selftests/mm: compaction_test: support platform with huge mount of
      memory
    - selftests/mm: fix a build failure on powerpc
    - io_uring: ensure deferred completions are flushed for multishot
    - iio: imu: inv_mpu6050: align buffer for timestamp
    - drm/xe: Add page queue multiplier
    - usb: dwc3: gadget: Make gadget_wakeup asynchronous
    - riscv: misaligned: Add handling for ZCB instructions
    - riscv: misaligned: factorize trap handling
    - riscv: misaligned: enable IRQs while handling misaligned accesses
    - selftest/x86/bugs: Add selftests for ITS
    - Upstream stable to v6.6.91, v6.12.29
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37960
    - memblock: Accept allocated memory before use in memblock_double_array()
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37957
    - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37963
    - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37948
    - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37994
    - usb: typec: ucsi: displayport: Fix NULL pointer access
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37995
    - module: ensure that kobject_put() is safe for module type kobjects
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37949
    - xenbus: Use kref to track req lifetime
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37954
    - smb: client: Avoid race in open_cached_dir with lease breaks
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37951
    - drm/v3d: Add job to pending list if the reset was skipped
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37969
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37970
    - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37972
    - Input: mtk-pmic-keys - fix possible null pointer dereference
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37959
    - bpf: Scrub packet on bpf_redirect_peer
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37961
    - ipvs: fix uninit-value for saddr in do_output_route4
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37998
    - openvswitch: Fix unsafe attribute parsing in output_userspace()
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37952
    - ksmbd: Fix UAF in __close_file_table_ids
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37947
    - ksmbd: prevent out-of-bounds stream writes by validating *pos
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37956
    - ksmbd: prevent rename with empty string
  * Noble update: upstream stable patchset 2025-10-29 (LP: #2130277) //
    CVE-2025-37973
    - wifi: cfg80211: fix out-of-bounds access during multi-link element
      defragmentation
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559)
    - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
    - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
    - btrfs: fix COW handling in run_delalloc_nocow()
    - drm/fdinfo: Protect against driver unbind
    - EDAC/altera: Test the correct error reg offset
    - EDAC/altera: Set DDR and SDMMC interrupt mask before registration
    - i2c: imx-lpi2c: Fix clock count when probe defers
    - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
    - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum
      offload
    - mm/memblock: pass size instead of end to memblock_set_node()
    - mm/memblock: repeat setting reserved region nid if array is doubled
    - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
    - spi: tegra114: Don't fail set_cs_timing when delays are zero
    - tracing: Do not take trace_event_sem in print_event_fields()
    - dm-integrity: fix a warning on invalid table line
    - dm: always update the array size in realloc_argv on success
    - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
    - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep
      cycles
    - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU
      hotplug
    - smb: client: fix zero length for mkdir POSIX create context
    - cpufreq: Avoid using inconsistent policy->min and policy->max
    - cpufreq: Fix setting policy limits when frequency tables are used
    - PCI: imx6: Skip controller_id generation logic for i.MX7D
    - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
    - powerpc/boot: Check for ld-option support
    - drm/i915/pxp: fix undefined reference to
      `intel_pxp_gsccs_is_ready_for_sessions'
    - powerpc/boot: Fix dash warning
    - net/mlx5: E-Switch, Initialize MAC Address for Default GID
    - net/mlx5: E-switch, Fix error handling for enabling roce
    - net: Rename mono_delivery_time to tstamp_type for scalabilty
    - Bluetooth: L2CAP: copy RX timestamp to new fragments
    - net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged
    - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
    - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when
      advised
    - pds_core: delete VF dev on reset
    - pds_core: make pdsc_auxbus_dev_del() void
    - pds_core: specify auxiliary_device to be created
    - nvme-pci: fix queue unquiesce check on slot_reset
    - net: dlink: Correct endianness handling of led_mode
    - net: mdio: mux-meson-gxl: set reversed bit when using internal phy
    - igc: fix lock order in igc_ptp_reset
    - net: dsa: felix: fix broken taprio gate states after clock jump
    - net: ipv6: fix UDPv6 GSO segmentation with NAT
    - bnxt_en: Fix coredump logic to free allocated buffer
    - bnxt_en: Fix ethtool -d byte order for 32-bit values
    - nvme-tcp: fix premature queue removal and I/O failover
    - net: fec: ERR007885 Workaround for conventional TX
    - net: hns3: store rx VLAN tag offload state for VF
    - net: hns3: fix an interrupt residual problem
    - net: hns3: fixed debugfs tm_qset size
    - net: hns3: defer calling ptp_clock_register()
    - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt
    - net: vertexcom: mse102x: Fix LEN_MASK
    - net: vertexcom: mse102x: Add range check for CMD_RTS
    - net: vertexcom: mse102x: Fix RX error handling
    - ASoC: Use of_property_read_bool()
    - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean
      properties
    - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
    - ARM: dts: opos6ul: add ksz8081 phy properties
    - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs
    - arm64: dts: st: Use 128kB size for aliased GIC400 register access on
      stm32mp25 SoCs
    - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
    - xhci: Add helper to set an interrupters interrupt moderation interval
    - xhci: support setting interrupt moderation IMOD for secondary
      interrupters
    - xhci: Limit time spent with xHC interrupts disabled during bus resume
    - kernel: param: rename locate_module_kobject
    - kernel: globalize lookup_or_create_module_kobject()
    - drivers: base: handle module_kobject creation
    - iommu/arm-smmu-v3: Use the new rb tree helpers
    - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream
      ids
    - drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp
    - dm: fix copying after src array boundaries
    - bpf: Fix BPF_INTERNAL namespace import
    - binder: fix offset calculation in debug log
    - perf/x86/intel: Only check the group flag for X86 leader
    - drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS
    - iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
    - pinctrl: imx: Return NULL if no group is matched and found
    - Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync
    - idpf: fix offloads support for encapsulated packets
    - drm/tests: shmem: Fix memleak
    - idpf: fix potential memory leak on kcalloc() failure
    - idpf: protect shutdown from reset
    - ALSA: hda/realtek: Fix built-mic regression on other ASUS models
    - bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan()
    - nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS
    - nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS
    - accel/ivpu: Fix a typo
    - drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change
    - Upstream stable to v6.6.90, v6.12.27, v6.12.28
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37920
    - xsk: Fix race condition in AF_XDP generic RX path
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37900
    - iommu: Fix two issues in iommu_copy_struct_from_user()
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37931
    - btrfs: adjust subpage bit start based on sectorsize
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37903
    - drm/amd/display: Fix slab-use-after-free in hdcp
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37905
    - firmware: arm_scmi: Balance device refcount when destroying devices
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37933
    - octeon_ep: Fix host hang issue during device reboot
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37909
    - net: lan743x: Fix memleak issue when GSO enabled
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37911
    - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37935
    - net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37891
    - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37912
    - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37913
    - net_sched: qfq: Fix double list add in class with netem as child qdisc
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37914
    - net_sched: ets: Fix double list add in class with netem as child qdisc
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37915
    - net_sched: drr: Fix double list add in class with netem as child qdisc
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37916
    - pds_core: remove write-after-free of client_id
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37917
    - net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx
      poll
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37918
    - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37921
    - vxlan: vnifilter: Fix unlocked deletion of default FDB entry
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37897
    - wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37922
    - book3s64/radix : Align section vmemmap start address to PAGE_SIZE
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37923
    - tracing: Fix oob write in trace_seq_to_buffer()
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37924
    - ksmbd: fix use-after-free in kerberos authentication
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37927
    - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37928
    - dm-bufio: don't schedule in atomic context
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37990
    - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37901
    - irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37936
    - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's
      value.
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37991
    - parisc: Fix double SIGFPE crash
  * Noble update: upstream stable patchset 2025-10-22 (LP: #2129559) //
    CVE-2025-37930
    - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307)
    - module: sign with sha512 instead of sha1 by default
    - x86/extable: Remove unused fixup type EX_TYPE_COPY
    - tracing: Add __string_len() example
    - tracing: Add __print_dynamic_array() helper
    - soc: qcom: ice: introduce devm_of_qcom_ice_get
    - mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
    - auxdisplay: hd44780: Convert to platform remove callback returning void
    - auxdisplay: hd44780: Fix an API misuse in hd44780.c
    - net: dsa: mv88e6xxx: fix internal PHYs for 6320 family
    - net: dsa: mv88e6xxx: fix VTU methods for 6320 family
    - ASoC: qcom: q6apm-dai: drop unused 'q6apm_dai_rtd' fields
    - ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
    - ASoC: q6apm-dai: make use of q6apm_get_hw_pointer
    - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary
      return value check
    - iio: adc: ad7768-1: Fix conversion result sign
    - arm64: tegra: Remove the Orin NX/Nano suspend key
    - clk: renesas: r9a07g04[34]: Fix typo for sel_shdi variable
    - clk: renesas: r9a07g043: Fix HP clock source for RZ/Five
    - of: resolver: Simplify of_resolve_phandles() using __free()
    - of: resolver: Fix device node refcount leakage in of_resolve_phandles()
    - scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
    - cpufreq/sched: Explicitly synchronize limits_changed flag handling
    - ceph: Fix incorrect flush end position calculation
    - dma/contiguous: avoid warning about unused size_bytes
    - cpufreq: cppc: Fix invalid return value in .get() callback
    - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
    - scsi: core: Clear flags for scsi_cmnd that did not complete
    - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
    - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
    - pds_core: Remove unnecessary check in pds_client_adminq_cmd()
    - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
    - splice: remove duplicate noinline from pipe_clear_nowait
    - perf/x86: Fix non-sampling (counting) events on certain x86 platforms
    - LoongArch: Select ARCH_USE_MEMTEST
    - LoongArch: Make regs_irqs_disabled() more clear
    - LoongArch: Make do_xyz() exception handlers more robust
    - virtio_console: fix missing byte order handling for cols and rows
    - crypto: atmel-sha204a - Set hwrng quality to lowest possible
    - net: selftests: initialize TCP header and skb payload with zero
    - net: phy: microchip: force IRQ polling mode for lan88xx
    - drm/amd/display: Fix gpu reset in multidisplay config
    - LoongArch: Return NULL from huge_pte_offset() for invalid PMD
    - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
    - LoongArch: Remove a bogus reference to ZONE_DMA
    - io_uring: fix 'sync' handling of io_fallback_tw()
    - KVM: SVM: Allocate IR data using atomic allocation
    - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
    - ata: libata-scsi: Improve CDL control
    - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
    - ata: libata-scsi: Fix ata_msense_control_ata_feature()
    - USB: storage: quirk for ADATA Portable HDD CH94
    - scsi: Improve CDL control
    - mei: me: add panther lake H DID
    - KVM: x86: Explicitly treat routing entry type changes as changes
    - char: misc: register chrdev region with all possible minors
    - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack
    - serial: msm: Configure correct working mode before starting earlycon
    - serial: sifive: lock port in startup()/shutdown() callbacks
    - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
    - USB: serial: option: add Sierra Wireless EM9291
    - USB: serial: simple: add OWON HDS200 series oscilloscope support
    - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
    - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
    - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
    - usb: dwc3: xilinx: Prevent spike in reset signal
    - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
    - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
    - USB: VLI disk crashes if LPM is used
    - USB: wdm: handle IO errors in wdm_wwan_port_start
    - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
    - USB: wdm: add annotation
    - pinctrl: renesas: rza2: Fix potential NULL pointer dereference
    - MIPS: cm: Detect CM quirks from device tree
    - crypto: ccp - Add support for PCI device 0x1134
    - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
    - parisc: PDT: Fix missing prototype warning
    - s390/tty: Fix a potential memory leak bug
    - bpf: bpftool: Setting error code in do_loader()
    - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it
      creates storage
    - bpf: Reject attaching fexit/fmod_ret to __noreturn functions
    - mailbox: pcc: Fix the possible race in updation of chan_in_use flag
    - mailbox: pcc: Always clear the platform ack interrupt first
    - usb: host: max3421-hcd: Add missing spi_device_id table
    - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
    - usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
    - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
    - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
    - thunderbolt: Scan retimers after device router has been enumerated
    - objtool: Silence more KCOV warnings
    - objtool, panic: Disable SMAP in __stack_chk_fail()
    - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in
      wcd934x_slim_irq_handler()
    - objtool, regulator: rk808: Remove potential undefined behavior in
      rk806_set_mode_dcdc()
    - objtool, lkdtm: Obfuscate the do_nothing() pointer
    - ntb: reduce stack usage in idt_scan_mws
    - ntb_hw_amd: Add NTB PCI ID for new gen CPU
    - rtc: pcf85063: do a SW reset if POR failed
    - io_uring: always do atomic put from iowq
    - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
    - KVM: s390: Don't use %pK through tracepoints
    - KVM: s390: Don't use %pK through debug printing
    - selftests: ublk: fix test_stripe_04
    - xen: Change xen-acpi-processor dom0 dependency
    - ACPI: EC: Set ec_no_wakeup for Lenovo Go S
    - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
    - nvme: multipath: fix return value of nvme_available_path
    - objtool: Stop UNRET validation on UD2
    - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
    - selftests/mincore: Allow read-ahead pages to reach the end of the file
    - x86/bugs: Use SBPB in write_ibpb() if applicable
    - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
    - x86/bugs: Don't fill RSB on context switch with eIBRS
    - nvmet-fc: take tgtport reference only once
    - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE
      mode
    - timekeeping: Add a lockdep override in tick_freeze()
    - ext4: make block validity check resistent to sb bh corruption
    - scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
    - scsi: ufs: exynos: Ensure pre_link() executes before
      exynos_ufs_phy_init()
    - scsi: pm80xx: Set phy_attached to zero when device is gone
    - x86/i8253: Call clockevent_i8253_disable() with interrupts disabled
    - iomap: skip unnecessary ifs_block_is_uptodate check
    - riscv: Provide all alternative macros all the time
    - loop: aio inherit the ioprio of original request
    - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts
    - spi: tegra210-quad: add rate limiting and simplify timeout error message
    - ubsan: Fix panic from test_ubsan_out_of_bounds
    - x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove
      cores
    - x86/pvh: Call C code via the kernel virtual mapping
    - Revert "drivers: core: synchronize really_probe() and dev_uevent()"
    - driver core: introduce device_set_driver() helper
    - comedi: jr3_pci: Fix synchronous deletion of timer
    - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
    - net: dsa: mv88e6xxx: enable PVT for 6321 switch
    - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
    - net: dsa: mv88e6xxx: enable STU methods for 6320 family
    - MIPS: cm: Fix warning if MIPS_CM is disabled
    - objtool: Ignore end-of-section jumps for KCOV/GCOV
    - objtool: Silence more KCOV warnings, part 2
    - ALSA: hda/cirrus_scodec_test: Don't select dependencies
    - ALSA: hda: improve bass speaker support for ASUS Zenbook UM5606WA
    - ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
    - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue
    - net: ethernet: mtk_eth_soc: reapply mdc divider on reset
    - riscv: Use kvmalloc_array on relocation_hashtable
    - riscv: module: Allocate PLT entries for R_RISCV_PLT32
    - ASoC: fsl: fsl_qmc_audio: Reset audio data pointers on TRIGGER_START
      event
    - dma-buf/sw_sync: Decrement refcount on error in
      sw_sync_ioctl_get_deadline()
    - mm/compaction: fix bug in hugetlb handling pathway
    - platform/x86: amd: pmf: Fix STT limits
    - drm/amd/display: Add HP Elitebook 645 to the quirk list for eDP on DP1
    - drm/amd/display: Add HP Probook 445 and 465 to the quirk list for eDP on
      DP1
    - drm/xe/dma_buf: stop relying on placement in unmap
    - drm/amdgpu: fix warning of drm_mm_clean
    - arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1
    - arm64/sysreg: Add register fields for HDFGRTR2_EL2
    - arm64/sysreg: Add register fields for HDFGWTR2_EL2
    - arm64/sysreg: Add register fields for HFGITR2_EL2
    - arm64/sysreg: Add register fields for HFGRTR2_EL2
    - arm64/sysreg: Add register fields for HFGWTR2_EL2
    - kbuild: Add '-fno-builtin-wcslen'
    - drm/amd/display: Temporarily disable hostvm on DCN31
    - block: remove rq_list_move
    - bpf: add find_containing_subprog() utility function
    - selftests/bpf: test for changing packet data from global functions
    - selftests/bpf: freplace tests for tracking of changes_packet_data
    - selftests/bpf: validate that tail call invalidates packet pointers
    - selftests/bpf: extend changes_pkt_data with cases w/o subprograms
    - media: i2c: imx214: Use subdev active state
    - media: i2c: imx214: Simplify with dev_err_probe()
    - media: i2c: imx214: Convert to CCI register access helpers
    - media: i2c: imx214: Replace register addresses with macros
    - media: i2c: imx214: Check number of lanes from device tree
    - media: i2c: imx214: Fix link frequency validation
    - scsi: ufs: exynos: Move UFS shareability value to drvdata
    - cgroup/cpuset: Expose cpuset filesystem with cpuset v1 only
    - cgroup/cpuset-v1: Add missing support for cpuset_v2_mode
    - vhost-scsi: Add better resource allocation failure handling
    - vhost-scsi: Fix vhost_scsi_send_bad_target()
    - vhost-scsi: Fix vhost_scsi_send_status()
    - scsi: ufs: mcq: Use ufshcd_mcq_req_to_hwq() to simplify updating hwq
    - riscv: Replace function-like macro by static inline function
    - bpf: Add namespace to BPF internal symbols
    - netfilter: fib: avoid lookup if socket is available
    - drm: panel: jd9365da: fix reset signal polarity in unprepare
    - drm/amd/display: Force full update in gpu reset
    - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
    - firmware: stratix10-svc: Add of_platform_default_populate()
    - i3c: master: svc: Add support for Nuvoton npcm845 i3c
    - 9p/trans_fd: mark concurrent read and writes to p9_conn->err
    - x86/xen: disable CPU idle and frequency drivers for PVH dom0
    - nvmet-fc: put ref when assoc->del_work is already scheduled
    - scsi: ufs: exynos: Move phy calls to .exit() callback
    - ASoC: fsl_asrc_dma: get codec or cpu dai from backend
    - xfs: do not check NEEDSREPAIR if ro,norecovery mount.
    - xfs: Do not allow norecovery mount with quotacheck
    - xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
    - xfs: flush inodegc before swapon
    - selftests/bpf: fix bpf_map_redirect call for cpu map test
    - selftests/bpf: make xdp_cpumap_attach keep redirect prog attached
    - selftests/bpf: check program redirect in xdp_cpumap_attach
    - selftests/bpf: Adjust data size to have ETH_HLEN
    - Revert "net: dsa: mv88e6xxx: fix internal PHYs for 6320 family"
    - iommu: Handle race with default domain setup
    - media: i2c: imx214: Fix uninitialized variable in imx214_set_ctrl()
    - usb: typec: class: Unlocked on error in typec_register_partner()
    - Upstream stable to v6.6.89, v6.12.25, v6.12.26
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37986
    - usb: typec: class: Invalidate USB device pointers on partner
      unregistration
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37809
    - usb: typec: class: Fix NULL pointer access
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37816
    - mei: vsc: Fix fortify-panic caused by invalid counted_by() use
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37822
    - riscv: uprobes: Add missing fence.i after building the XOL buffer
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37987
    - pds_core: Prevent possible adminq overflow/stuck condition
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37826
    - scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37827
    - btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37977
    - scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37944
    - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37761
    - drm/xe: Fix an out-of-bounds shift when invalidating TLB
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37763
    - drm/imagination: take paired job reference
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37764
    - drm/imagination: fix firmware memory leaks
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37869
    - drm/xe: Use local fence in error path of xe_migrate_clear
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37978
    - block: integrity: Do not call set_page_dirty_lock()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37975
    - riscv: module: Fix out-of-bounds relocation access
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37872
    - net: txgbe: fix memory leak in txgbe_probe() error path
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37873
    - eth: bnxt: fix missing ring index trim on error path
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-22120
    - ext4: goto right label 'out_mmap_sem' in ext4_setattr()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37799
    - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37800
    - driver core: fix potential NULL pointer dereference in dev_uevent()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37878
    - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37803
    - udmabuf: fix a buf size overflow issue during udmabuf creation
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37879
    - 9p/net: fix improper handling of bogus negative read/write replies
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37983
    - qibfs: fix _another_ leak
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37881
    - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37805
    - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37883
    - s390/sclp: Add check for get_zeroed_page()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37884
    - bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37808
    - crypto: null - Use spin lock instead of mutex
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37985
    - USB: wdm: close race between wdm_open and wdm_wwan_port_stop
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37810
    - usb: dwc3: gadget: check that event count does not exceed event buffer
      length
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37811
    - usb: chipidea: ci_hdrc_imx: fix usbmisc handling
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37812
    - usb: cdns3: Fix deadlock when using NCM gadget
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37813
    - usb: xhci: Fix invalid pointer dereference in Etron workaround
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37815
    - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler
      registration
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37885
    - KVM: x86: Reset IRTE to host control if *new* route isn't postable
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37817
    - mcb: fix a double free bug in chameleon_parse_gdd()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37819
    - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37820
    - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37886
    - pds_core: make wait_context part of q_info
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37887
    - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37823
    - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37988
    - fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37824
    - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37989
    - net: phy: leds: fix memory leak
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37828
    - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37829
    - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37830
    - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37831
    - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-37938
    - tracing: Verify event formats that have "%*p.."
  * Noble update: upstream stable patchset 2025-10-21 (LP: #2129307) //
    CVE-2025-39989
    - x86/mce: use is_copy_from_user() to determine copy-from-user context
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-22026
    - nfsd: don't ignore the return code of svc_proc_register()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37836
    - PCI: Fix reference leak in pci_register_host_bridge()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37846
    - arm64: mops: Do not dereference src reg for a set operation
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37942
    - HID: pidff: Make sure to fetch pool before checking SIMULTANEOUS_MAX
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37856
    - btrfs: harden block_group::bg_list against list_del() races
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37861
    - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37744
    - wifi: ath12k: fix memory leak in ath12k_pci_remove()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37745
    - PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37945
    - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-
      controlled PHY
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37759
    - ublk: fix handling recovery & reissue in ublk_abort_queue()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23140
    - misc: pci_endpoint_test: Avoid issue of interrupts remaining after
      request_irq error
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-22126
    - md: fix mddev uaf while iterating all_mddevs list
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37765
    - drm/nouveau: prime: fix ttm_bo_delayed_delete oops
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37766
    - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37767
    - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37768
    - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37769
    - drm/amd/pm/smu11: Prevent division by zero
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37770
    - drm/amd/pm/powerplay: Prevent division by zero
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37768 // CVE-2025-37771
    - drm/amd/pm: Prevent division by zero
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37772
    - RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37773
    - virtiofs: add filesystem context source name check
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37775
    - ksmbd: fix the warning from __kernel_write_iter
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37778
    - ksmbd: Fix dangling pointer in krb_authenticate
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37863
    - ovl: don't allow datadir only
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37780
    - isofs: Prevent the use of too small fid
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37781
    - i2c: cros-ec-tunnel: defer probe if parent EC is not present
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37979
    - ASoC: qcom: Fix sc7280 lpass potential buffer overflow
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37784
    - net: ti: icss-iep: Fix possible NULL pointer dereference for perout
      request
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37786
    - net: dsa: free routing table on probe failure
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37864
    - net: dsa: clean up FDB, MDB, VLAN entries on unbind
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37865
    - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is
      unsupported
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37787
    - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were
      never registered
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37788
    - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37874
    - net: ngbe: fix memory leak in ngbe_probe() error path
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37789
    - net: openvswitch: fix nested key length validation in the set() action
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37980
    - block: fix resource leak in blk_register_queue() error path
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37790
    - net: mctp: Set SOCK_RCU_FREE
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37875
    - igc: fix PTM cycle trigger logic
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37792
    - Bluetooth: btrtl: Prevent potential NULL dereference
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37867
    - RDMA/core: Silence oversized kvmalloc() warning
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37793
    - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37982
    - wifi: wl1251: fix memory leak in wl1251_tx_work
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37794
    - wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37796
    - wifi: at76c50x: fix use after free access in at76_disconnect
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23141
    - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory
      accesses
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37940
    - ftrace: Add cond_resched() to ftrace_graph_set_hash()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37844
    - cifs: avoid NULL pointer dereference in dbg call
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23142
    - sctp: detect and prevent references to a freed transport in sendmsg
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23144
    - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37892
    - mtd: inftlcore: Add error check for inftl_read_oob()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23145
    - mptcp: fix NULL pointer in can_accept_new_subflow
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23146
    - mfd: ene-kb3930: Fix a potential NULL pointer dereference
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37839
    - jbd2: remove wrong sb->s_sequence check
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23147
    - i3c: Add NULL pointer check in i3c_master_queue_ibi()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23148
    - soc: samsung: exynos-chipid: Add NULL pointer check in
      exynos_chipid_probe()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23149
    - tpm: do not start chip while suspended
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23150
    - ext4: fix off-by-one error in do_split
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23151
    - bus: mhi: host: Fix race between unprepare and queue_buf
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23156
    - media: venus: hfi_parser: refactor hfi packet parsing logic
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23157
    - media: venus: hfi_parser: add check to avoid out of bound access
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37840
    - mtd: rawnand: brcmnand: fix PM resume warning
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37849
    - KVM: arm64: Tear down vGIC on failed vCPU creation
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23158
    - media: venus: hfi: add check to handle incorrect queue size
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23159
    - media: venus: hfi: add a check to handle OOB in sfr region
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23160
    - media: mediatek: vcodec: Fix a resource leak related to the scp device
      in FW initialization
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37850
    - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37851
    - fbdev: omapfb: Add 'plane' value check
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23161
    - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37852
    - drm/amdgpu: handle amdgpu_cgs_create_device() errors in
      amd_powerplay_create()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37853
    - drm/amdkfd: debugfs hang_hws skip GPU with MES
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37854
    - drm/amdkfd: Fix mode1 reset crash issue
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-23163
    - net: vlan: don't propagate flags on open
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37857
    - scsi: st: Fix array overflow in st_setup()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37738
    - ext4: ignore xattrs past end
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37739
    - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37943
    - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37740
    - jfs: add sanity check for agwidth in dbMount
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37741
    - jfs: Prevent copying of nlink with value 0 from disk inode
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37858
    - fs/jfs: Prevent integer overflow in AG size calculation
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37742
    - jfs: Fix uninit-value access of imap allocated in the diMount() function
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37859
    - page_pool: avoid infinite loop to schedule delayed worker
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37862
    - HID: pidff: Fix null pointer dereference in pidff_find_fields
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37841
    - pm: cpupower: bench: Prevent NULL dereference on malloc failure
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37748
    - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37749
    - net: ppp: Add bound checking for skb data on ppp_sync_txmung
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37754
    - drm/i915/huc: Fix fence not released on early probe errors
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37755
    - net: libwx: handle page_pool_dev_alloc_pages error
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37757
    - tipc: fix memory leak in tipc_link_xmit
  * Noble update: upstream stable patchset 2025-10-17 (LP: #2128722) //
    CVE-2025-37758
    - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
  * CVE-2025-37801
    - spi: spi-imx: Add check for spi_imx_setupxfer()
  * CVE-2025-39946
    - tls: make sure to abort the stream if headers are bogus
  * CVE-2025-38584
    - padata: Fix pd UAF once and for all
    - padata: Remove comment for reorder_work
  * CVE-2025-40019
    - crypto: essiv - Check ssize for decryption and in-place encryption
  * CVE-2025-38561
    - ksmbd: fix Preauh_HashValue race condition
  * CVE-2025-39698
    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure

linux-azure-6.8 (6.8.0-1045.51~22.04.1) jammy; urgency=medium

  * jammy/linux-azure-6.8: 6.8.0-1045.51~22.04.1 -proposed tracker (LP: #2138055)

  [ Ubuntu-azure: 6.8.0-1045.51 ]

  * noble/linux-azure: 6.8.0-1045.51 -proposed tracker (LP: #2138056)
  [ Ubuntu: 6.8.0-94.96 ]
  * noble/linux: 6.8.0-94.96 -proposed tracker (LP: #2138092)
  * CVE-2025-40019
    - crypto: essiv - Check ssize for decryption and in-place encryption
  * CVE-2025-38561
    - ksmbd: fix Preauh_HashValue race condition
  * CVE-2025-39698
    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure

Date: 2026-03-08 09:14:11.766199+00:00
Changed-By: Mehmet Basaran <mehmet.basaran at canonical.com>
Signed-By: Andy Whitcroft <apw at canonical.com>
https://launchpad.net/ubuntu/+source/linux-azure-6.8/6.8.0-1051.57~22.04.1
-------------- next part --------------
Sorry, changesfile not available.


More information about the jammy-changes mailing list