* Update to upstream stable Linux 5.10.270 (from 5.10.269). * Bump kernel ABI to 49: ship the ELS kernel as 5.10.0-49-*, distinct from the prior 5.10.0-48. * CVE-2022-48650 - scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650} * CVE-2023-52676 - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676} * CVE-2023-54237 - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() {CVE-2023-54237} * CVE-2024-41062 - bluetooth/l2cap: sync sock recv cb and release {CVE-2024-41062} * CVE-2025-21651 - net: hns3: don't auto enable misc vector {CVE-2025-21651} * CVE-2025-22103 - net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103} * CVE-2025-38097 - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097} * CVE-2025-40123 - bpf: Enforce expected_attach_type for tailcall compatibility {CVE-2025-40123} * CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} * CVE-2026-31420 - bridge: mrp: reject zero test interval to avoid OOM panic {CVE-2026-31420} * CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} * CVE-2026-43198 - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} * CVE-2026-46158 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount {CVE-2026-46158} * CVE-2026-46170 - mptcp: pm: ADD_ADDR rtx: free sk if last {CVE-2026-46170} * CVE-2026-53078 - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} * CVE-2026-72255 - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} * CVE-2026-74268 - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} * CVE-2026-74378 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe {CVE-2026-74378} * CVE-2026-74565 - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} * CVE-2026-80671 - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON {CVE-2026-80671} * CVE-2026-80689 - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions {CVE-2026-80689} * CVE-2026-80888 - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import {CVE-2026-80888} * CVE-2026-80912 - selinux: reject an unclaimed class value in security_get_classes() {CVE-2026-80912} * CVE-2026-80930 - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout {CVE-2026-80930} * CVE-2026-80931 - w1: ds28e17: reject an oversize length on an I2C block read {CVE-2026-80931} * CVE-2026-80932 - vsock/virtio: flush works in dependency order {CVE-2026-80932} * CVE-2026-80941 - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() {CVE-2026-80941} * CVE-2026-80944 - wifi: mwifiex: Detach sync cmd buffer on interrupted wait {CVE-2026-80944} * CVE-2026-80949 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() {CVE-2026-80949} * CVE-2026-80952 - i3c: master: Fix info leak and UAF in device unregister path {CVE-2026-80952} * CVE-2026-80963 - dm-stats: fix a crash if allocation of per-cpu data fails {CVE-2026-80963} * CVE-2026-80965 - ALSA: serial-u16550: Check card index validity at probe {CVE-2026-80965} * CVE-2026-80966 - ALSA: portman2x4: Check card index validity at probe {CVE-2026-80966} * CVE-2026-80968 - ALSA: mts64: Check card index validity at probe {CVE-2026-80968} * CVE-2026-80969 - ALSA: mpu401: Check card index validity at probe {CVE-2026-80969} * CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} * CVE-2026-80973 - ALSA: 6fire: bound the MIDI event length from the device {CVE-2026-80973} * CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} * CVE-2026-80977 - net: skbuff: don't touch shared zerocopy state in skb_tx_error() {CVE-2026-80977} * CVE-2026-80978 - net: cap advertised IP tunnel headroom {CVE-2026-80978} * CVE-2026-80987 - NTB: ntb_transport: Reject oversized TX buffers {CVE-2026-80987} * CVE-2026-80988 - NTB: ntb_transport: Fail TX enqueue when the QP link is down {CVE-2026-80988} * CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} * CVE-2026-81000 - net: tun: bound receive headroom {CVE-2026-81000} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-81002 - xdp: fix zero-copy frame layout {CVE-2026-81002} * CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003} * CVE-2026-81005 - ipmi: si: Fix NULL pointer dereference after failed registration {CVE-2026-81005} * CVE-2026-81007 - ipmi: ipmb: validate write message length {CVE-2026-81007} * CVE-2026-81008 - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() {CVE-2026-81008} * CVE-2026-81017 - platform/chrome: sensorhub: Bound the EC-reported sensor number {CVE-2026-81017} * CVE-2026-89440 - mmc: via-sdmmc: stop card-detect handling on probe failure {CVE-2026-89440} * CVE-2026-89456 - s390/dasd: Propagate partial completion length across ERP recovery {CVE-2026-89456} * CVE-2026-89457 - s390/dasd: Guard sysfs discipline callbacks against unallocated private data {CVE-2026-89457} * CVE-2026-89458 - s390/dasd: Do not complete a failed ESE read as successful {CVE-2026-89458} * CVE-2026-89461 - power: supply: max17040: synchronize work cancellation on suspend {CVE-2026-89461} * CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} * CVE-2026-89470 - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS {CVE-2026-89470} * CVE-2026-89471 - power: supply: cros_usbpd-charger: bound the EC-reported port count {CVE-2026-89471} * CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} * CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-89479 - sctp: stop processing a packet once its association is deleted {CVE-2026-89479} * CVE-2026-89482 - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482} * CVE-2026-89483 - nvme: zero the discard fallback page {CVE-2026-89483} * CVE-2026-89485 - lockd: pin next file across nlm_inspect_file lock-drop {CVE-2026-89485} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-89488 - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} * CVE-2026-89489 - openrisc: fix arbitrary kernel memory access via or1k_atomic syscall {CVE-2026-89489} * CVE-2026-89490 - ocfs2: fix readdir position truncation on 32-bit kernels {CVE-2026-89490} * CVE-2026-89491 - ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() {CVE-2026-89491} * CVE-2026-89493 - ocfs2: validate rl_used against rl_count in refcount block validator {CVE-2026-89493} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-89496 - ocfs2: always run deallocs on copy-on-write completion {CVE-2026-89496} * CVE-2026-89497 - orangefs: skip leading spaces before parsing client debug masks {CVE-2026-89497} * CVE-2026-89498 - orangefs: fix double-free of trailer_buf on readdir copy failure {CVE-2026-89498} * CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504} * CVE-2026-89508 - RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508} * CVE-2026-89510 - RDMA/cxgb4: Cancel reg_work before freeing device on remove {CVE-2026-89510} * CVE-2026-89511 - qede: Fix NULL pointer dereference in TPA fragment processing {CVE-2026-89511} * CVE-2026-89512 - remoteproc: scp: Fix device reference leak on failed lookup {CVE-2026-89512} * CVE-2026-89515 - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() {CVE-2026-89515} * CVE-2026-89524 - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets {CVE-2026-89524} * CVE-2026-89525 - udf: reject VAT indexes equal to the entry count {CVE-2026-89525} * CVE-2026-89538 - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field {CVE-2026-89538} * CVE-2026-89540 - sunrpc: init gssp_lock before publishing proc entry {CVE-2026-89540} * CVE-2026-89541 - SUNRPC: harden gss_unwrap_resp_priv length checks {CVE-2026-89541} * CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-89551 - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551} * CVE-2026-89554 - mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction {CVE-2026-89554} * CVE-2026-89555 - mpls: reload header after pskb_may_pull() {CVE-2026-89555} * CVE-2026-89557 - md: do overflow check for sb->bblog_shift in super_1_load() {CVE-2026-89557} * CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} * CVE-2026-89562 - ip6_gre: fix hardware header length for NBMA tunnels {CVE-2026-89562} * CVE-2026-89563 - ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() {CVE-2026-89563} * CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} * CVE-2026-89573 - dm array: reject an array block whose value size is not the caller's {CVE-2026-89573} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-89576 - dm-era: fix shadowed superblock leak on take-snap failure {CVE-2026-89576} * CVE-2026-89582 - bnx2x: fix double free in bnx2x_init_firmware() error path {CVE-2026-89582} * CVE-2026-89586 - ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes {CVE-2026-89586} * CVE-2026-89594 - hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device {CVE-2026-89594} * CVE-2026-89595 - fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595} * CVE-2026-89596 - forcedeth: fix off-by-one when saving/restoring non-PCI config space {CVE-2026-89596} * CVE-2026-89597 - fbdev: uvesafb: unregister connector callback on init failure {CVE-2026-89597} * CVE-2026-89599 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display {CVE-2026-89599} * CVE-2026-89603 - entry: Fix seccomp bypass after ptrace with TSYNC {CVE-2026-89603} * CVE-2026-89605 - ecryptfs: release message context on send failure {CVE-2026-89605} * CVE-2026-89606 - ecryptfs: reject too-small tag 70 packets {CVE-2026-89606} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-89608 - ecryptfs: pass packet set buffer size to parser {CVE-2026-89608} * CVE-2026-89609 - ecryptfs: hold msg ctx list lock when cleaning daemon queue {CVE-2026-89609} * CVE-2026-89621 - HID: mcp2221: validate report size in mcp2221_raw_event() {CVE-2026-89621} * CVE-2026-89626 - HID: sensor: custom: Fix field sysfs group cleanup on failure {CVE-2026-89626} * CVE-2026-89627 - HID: roccat: free buffered reports when destroying device {CVE-2026-89627} * CVE-2026-89628 - HID: picolcd: clamp eeprom debugfs read to bytes actually received {CVE-2026-89628} * CVE-2026-89643 - audit: avoid dropping live tree ref on fsnotify rule autoremove {CVE-2026-89643} * CVE-2026-89649 - ceph: bound xattr value length in __build_xattrs() {CVE-2026-89649} * CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} * CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} * CVE-2026-89662 - NFSD: Prevent lock owner use-after-free during client teardown {CVE-2026-89662} * CVE-2026-89663 - nfsd: revoke copy-notify stateids before dropping their reference {CVE-2026-89663} * CVE-2026-89665 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE {CVE-2026-89665} * CVE-2026-89669 - nfsd: initialize copy-notify stateid before publishing it {CVE-2026-89669} * CVE-2026-89673 - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo {CVE-2026-89673} * CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674} * CVE-2026-89684 - nfsd: fix cpntf publish race in nfs4_init_cp_state {CVE-2026-89684} * CVE-2026-89694 - nfsd: check client ownership when cancelling a copy-notify stateid {CVE-2026-89694} * CVE-2026-89696 - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref {CVE-2026-89696} * CVE-2026-89697 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() {CVE-2026-89697} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-89704 - nfsd: sample writeback error cursor before async COPY loop {CVE-2026-89704} * CVE-2026-89706 - nfsd: Reset write verifier when async COPY writeback fails {CVE-2026-89706} * CVE-2026-89711 - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check {CVE-2026-89711} * CVE-2026-89712 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock {CVE-2026-89712} * CVE-2026-89720 - ubifs: fix out-of-bounds read in signature length check {CVE-2026-89720} * CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation {CVE-2026-89723} * CVE-2026-89724 - media: vicodec: fix out-of-bounds write in FWHT encoder {CVE-2026-89724} * CVE-2026-89725 - media: cec: stm32: prevent out-of-bounds write on RX overflow {CVE-2026-89725} * CVE-2026-89726 - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() {CVE-2026-89726} * CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} * CVE-2026-89730 - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write {CVE-2026-89730} * CVE-2026-89732 - usb: gadget: f_fs: Prevent deadlock during ep0 read loop {CVE-2026-89732} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-89736 - usb: gadget: u_audio: Fix use-after-free on sound card disconnect {CVE-2026-89736} * CVE-2026-89741 - Revert "media: v4l2-dev: fix error handling in __video_register_device()" {CVE-2026-89741} * CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742} * CVE-2026-89749 - tracing: Fix crash passing ERR_PTR to kthread_stop() {CVE-2026-89749} * CVE-2026-89752 - mm: memcg: stop reclaim when a limit update is superseded {CVE-2026-89752} * CVE-2026-89753 - mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() {CVE-2026-89753} * CVE-2026-89765 - timers/itimer: Zero-init old itimerval before copy to userspace {CVE-2026-89765} * CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777} * CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780} * CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} * CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784} * CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789} * CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used {CVE-2026-89816} * CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() {CVE-2026-89821} * CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823} * CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843} * CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845} * CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} * CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} * CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down {CVE-2026-89850} * CVE-2026-89851 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs {CVE-2026-89851} * CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852} * CVE-2026-89853 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump {CVE-2026-89853} * CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} * CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler {CVE-2026-89855} * CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} * CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858} * CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} * CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864} * CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865} * CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure {CVE-2026-89871} * CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link {CVE-2026-89872} * CVE-2026-89876 - media: tda18250: fix possible integer overflow {CVE-2026-89876} * CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker {CVE-2026-89878} * CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer {CVE-2026-89879} * CVE-2026-89880 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure {CVE-2026-89880} * CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak {CVE-2026-89881} * CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove {CVE-2026-89887} * CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890} * CVE-2026-89891 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect {CVE-2026-89891} * CVE-2026-89892 - media: em28xx: defer audio-only extension registration {CVE-2026-89892} * CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} * CVE-2026-89894 - media: cx231xx: reject geometry changes while the VBI queue is busy {CVE-2026-89894} * CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895} * CVE-2026-89896 - media: cedrus: fix memory leak in cedrus_init_ctrls() {CVE-2026-89896} * CVE-2026-89897 - media: cec: Serialize exclusive follower delivery {CVE-2026-89897} * CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref {CVE-2026-89901} * CVE-2026-89923 - KVM: s390: Free guest debug data on vcpu destroy {CVE-2026-89923} * CVE-2026-89924 - KVM: s390: Fix old_data leak in guest debug error path {CVE-2026-89924} * CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling {CVE-2026-89925} * CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927} * CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936} * CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937} * CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945} * CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946} * CVE-2026-89947 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count {CVE-2026-89947} * CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948} * CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949} * CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951} * CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952} * CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953} * CVE-2026-89954 - mtd: afs: validate v2 image info bounds {CVE-2026-89954} * CVE-2026-89964 - parisc: eisa: Fix infinite loop when parsing invalid IRQ value {CVE-2026-89964} * CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} * CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs {CVE-2026-89968} * CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU {CVE-2026-89969} * CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU {CVE-2026-89973} * CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979} * CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982} * CVE-2026-89984 - perf/x86/intel: Fix kernel address leakages in LBR stack {CVE-2026-89984} * CVE-2026-89997 - dm: fix resume-vs-remove race {CVE-2026-89997} * CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq {CVE-2026-89999} * CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} * CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007} * CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} * CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015} * CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017} * CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019} * CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020} * CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index {CVE-2026-90025} * CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031} * CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032} * CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} * CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034} * CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} * CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit {CVE-2026-90054} * CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055} * CVE-2026-90056 - net: fec: only stop PTP if it was initialized {CVE-2026-90056} * CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058} * CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob {CVE-2026-90062} * CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068} * CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure {CVE-2026-90070} * CVE-2026-90071 - net/sched: sch_teql: restore skb->dev on the slave failure path {CVE-2026-90071} * CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup {CVE-2026-90072} * CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073} * CVE-2026-90074 - net/sched: fq_pie: clamp default quantum to avoid signed overflow {CVE-2026-90074} * CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu {CVE-2026-90075} * CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081} * CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088} * CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version {CVE-2026-90102} * CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} * CVE-2026-90107 - net/smc: free pending qentry in smc_llc_flow_stop() before memset {CVE-2026-90107} * CVE-2026-90114 - net: bridge: Reject descending VLAN tunnel ranges {CVE-2026-90114} * CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind {CVE-2026-90126} * CVE-2026-90128 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path {CVE-2026-90128} * CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141} * CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143} * CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151} * CVE-2026-90157 - bpf: Reject negative optlen in cgroup getsockopt hook {CVE-2026-90157} * CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program {CVE-2026-90160} * CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers {CVE-2026-90202} * CVE-2026-90203 - Squashfs: check block offset is not negative {CVE-2026-90203} * CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error {CVE-2026-90214} * CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216} * CVE-2026-90218 - RDMA/cma: Fix WARNING in res_to_rt {CVE-2026-90218} * CVE-2026-90219 - RDMA/cxgb4: Free debugfs on registration failure {CVE-2026-90219} * CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222} * CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223} * CVE-2026-90224 - nfc: nci: fix double completion race in nci_data_exchange_complete {CVE-2026-90224} * CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225} * CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226} * CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245} * CVE-2026-90249 - iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes {CVE-2026-90249} * CVE-2026-90251 - Bluetooth: MSFT: validate evt_prefix_len against the response length {CVE-2026-90251} * CVE-2026-90281 - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend {CVE-2026-90281} * CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure {CVE-2026-90283} * CVE-2026-90284 - firmware_loader: do not queue completed sysfs fallback requests {CVE-2026-90284} * CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path {CVE-2026-90285} * CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286} * CVE-2026-90290 - arm64: hibernate: Restore DAIF state on error {CVE-2026-90290} * CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} * CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293} * CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294} * CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once {CVE-2026-90295} * CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296} * CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error {CVE-2026-90297} * CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference {CVE-2026-90298} * CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302} * CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults {CVE-2026-90303} * CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} * CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() {CVE-2026-90314} * CVE-2026-90318 - fat: release buffer head after rebuilding parent {CVE-2026-90318} * CVE-2026-90319 - rapidio: clear mport->net when rio_add_net() fails {CVE-2026-90319} * CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327} * CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} * CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} * CVE-2026-90341 - firmware: coreboot: Validate table bounds {CVE-2026-90341} * CVE-2026-90348 - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump {CVE-2026-90348} * CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work {CVE-2026-90360} * CVE-2026-90361 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() {CVE-2026-90361} * CVE-2026-90362 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) {CVE-2026-90362} * CVE-2026-90372 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss {CVE-2026-90372} * CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} * CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices {CVE-2026-90386} * CVE-2026-90388 - iommu/dma: Check atomic pool allocation result directly {CVE-2026-90388} * CVE-2026-90391 - lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone {CVE-2026-90391} * CVE-2026-90393 - bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393} * CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove {CVE-2026-90394} * CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395} * CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403} * CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request {CVE-2026-90411} * CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} * CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} * CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} * CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416} * CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419} * CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420} * CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431} * CVE-2026-90434 - isofs: release zisofs block pointer buffer head {CVE-2026-90434} * CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} * CVE-2026-92496 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() {CVE-2026-92496} * CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers {CVE-2026-92498} * CVE-2026-92501 - ext4: drain in-flight DIO before buffered write fallback {CVE-2026-92501} * CVE-2026-92504 - thermal: intel: int3400: clean up ODVP on probe failures {CVE-2026-92504} * CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} * CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522} * CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() {CVE-2026-92524} * CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037} * CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure {CVE-2026-93039} * CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks {CVE-2026-93040} * CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates {CVE-2026-93041} * CVE-2026-93046 - software node: Fix software_node_get_reference_args() with index -1 {CVE-2026-93046} * CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} * CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice {CVE-2026-93049} * CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051} * CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053} * CVE-2026-93054 - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} * CVE-2026-93055 - UDF symlink pathComponent header OOB read {CVE-2026-93055} * CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056} * CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers {CVE-2026-93061} * CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request {CVE-2026-93067} * CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild {CVE-2026-93095} * CVE-2026-93098 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach {CVE-2026-93098} * CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103} * CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} * CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core {CVE-2026-93110} * CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120} * CVE-2026-93138 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux {CVE-2026-93138} * CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140} * CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141} * CVE-2026-93145 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() {CVE-2026-93145} * CVE-2026-93158 - crypto: sa2ul - stop probe if context pool creation fails {CVE-2026-93158} * CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure {CVE-2026-93159} * CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160} * CVE-2026-93165 - platform/chrome: sensorhub: Fix memory overread in ring handler {CVE-2026-93165} * CVE-2026-93167 - csky: Fix a4/a5 restoration in syscall trace path {CVE-2026-93167} * CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers {CVE-2026-93170} * CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177} * CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup {CVE-2026-93178} * CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range {CVE-2026-93183} * CVE-2026-93188 - HID: roccat: bound device-supplied profile index {CVE-2026-93188} * CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} * CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191} * CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203} * Miscellaneous upstream changes - Revert "USB: serial: keyspan_pda: fix information leak" - clocksource/drivers/timer-sun4i: Advertise a real minimum delta - include/linux/list.h: mark list_add and __list_add as __always_inline - tools/compiler: match glibc 2.42 definition of __attribute_const__ - x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() - powerpc/powermac: fix OF node refcount - staging: greybus: hid: fix SET_REPORT return value - USB: phy: fsl-usb: fix missing static keywords - usb: gadget: snps_udc_plat: clean up PHY on probe deferral - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() - of: fix out-of-bounds read in of_alias_scan() stem parser - NFSD: Encode only the status in NFS-ACL v2 GETACL error replies - NFSD: Fix off-by-one in DRC bucket pruning limit - nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types - nfsd: add filehandle match check to nfsd4_delegreturn() - nfsd: fix version mismatch loops in nfsd_acl_init_request() - nfsd: reject reclaim LOCK after RECLAIM_COMPLETE - eCryptfs: bound the packet-length peek to the user buffer - ecryptfs: fix tag 11 packet exact-fit size check - ecryptfs: show filename encryption options - fat: restore original value when fat_ent_write failed - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration - alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() - alpha: marvel: Fix irq_set_status_flags to use correct IRQ number - alpha: marvel: Fix lock ordering in init_io7_irqs() - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU - cpufreq: schedutil: Fix rate limit overflow - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative - ipv6: use RCU iterator to dump route exceptions - SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat - rpmsg: glink: smem: order FIFO read after availability check - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata - ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item - ocfs2: cluster: fix o2hb_dependent_users leak on pin failure - hwmon: (max6621) fix negative temperature offset and crit readings - hwmon: (max6621) fix temperature clamp range - nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path - sctp: distinguish sequence zero from wildcard in reconf lookup - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk - PCI: meson: Fix GPIO state while requesting PERST# - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Use file_ns_capable() when checking config space read access - iommu/vt-d: Fix no_iommu to disable platform opt-in - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition - net: openvswitch: fix nf_connlabels leak in ovs_ct_init - NTB: ntb_transport: Recycle TX entries before client callbacks - net: ntb_netdev: Avoid double-accounting netif_rx() drops - net: ntb_netdev: Count packets dropped on RX refill failure - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip - dm-switch: use WRITE_ONCE() in switch_region_table_write() - wifi: rtl818x: initialize eeprom_93cx6 struct to zero - signal: avoid shared siginfo namespace rewrites - timer: Keep debugobjects state consistent in migrate_timer_list() - udf: Fix i_lenExtents truncation on 32-bit kernels - platform/chrome: sensorhub: Fix dropped timestamp events and log spam - net: openvswitch: fix kernel-doc warnings in internal headers - RDMA/rxe: Fix over copying in get_srq_wqe - RDMA/rxe: Missing unlock on error in get_srq_wqe() - RDMA/rxe: Use the correct size of wqe when processing SRQ - selinux: avoid implicit conversions in services code - net: ntb_netdev: Fix TX busy and drop handling - tracing/mmiotrace: Remove reference to unused per CPU data pointer - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() - thermal/drivers/imx: Disable clock on runtime resume failure - thermal/drivers/qoriq: Disable clock on resume failure - dmaengine: dw-edma: Complete descriptors before pausing - ata: ahci: work around lost interrupts on Marvell 88SE61xx - Revert "irqchip/mbigen: Fix mbigen node address layout" - parisc: Fix alignment of asm statements in head.S - batman-adv: bla: prevent CRC corruptions after claim flush - clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure - AsoC: intel: sst: fix PCI device reference leak on probe failure - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get - iio: gyro: mpu3050: fix sign of raw angular velocity readings - iio: light: cm32181: return zero after writing calibscale - iio: light: gp2ap002: Disable regulators on resume failure - iio: srf04: fix pm_runtime handling on probe error path - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() - KVM: s390: Zero initialize irq in reinject_machine_check - KVM: s390: Restore sigset on error path - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() - media: venus: fix payload size calculation in parse_raw_formats() - media: vimc: fix pixel format lookup in enum_framesizes - scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters - scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition - scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics - f2fs: return symlink writeback errors - f2fs: reject overlapping move range after len expansion - f2fs: fix i_size when pinned fallocate partially fails - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() - drm/hibmc: Fix list of formats on the primary plane - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT - Input: aiptek - validate raw macro indices before updating state - firmware: stratix10-svc: Add mutex in stratix10 memory management - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure - Smack: fix W=1 build warnings - smack: mark 'smack_enabled' global variable as __initdata - smack: simplify write handlers of sysfs entries - smack: deduplicate smackfs/{direct,mapped} file_operations - smack: restrict smackfs/{direct,mapped} values to 0-255 - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() - media: cec-pin: Fix event FIFO ordering - clk: moxart: remove unused variables, fix refcount leak - clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller - ARM: imx: fix device_node refcount leak in imx_src_init() - clk: imx: scu: Add A53 frequency scaling support - clk: imx: scu: Add A72 frequency scaling support - clk: imx: scu: drop redundant init.ops variable assignment - perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails - pinctrl: bcm2835: Don't remove an unregistered GPIO chip - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe - soundwire: add static port mapping support - soundwire: qcom: update port map allocation bit mask - soundwire: qcom: add static port map support - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure - selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check - crypto: ecdh - move curve_id of ECDH from the key to algorithm name - crypto: atmel-ecc - Struct headers need to start with keyword 'struct' - crypto: atmel-ecc - replace min_t with min - crypto: atmel-ecc - clean up and improve ECDH comments - crypto: sa2ul - Use the defined variable to clean code - nvmet-rdma: factor out response resource cleanup - bus: ti-sysc: Fix /chosen node reference leak - PM: sleep: Fix off-by-one in wakelocks number limit check - of: Add cleanup.h based auto release via __free(device_node) markings - staging: greybus: audio: correct sscanf() return value check - staging: sm750fb: gate dualview dataflow using g_dualview - greybus: audio: bound the topology section sizes against the fetched size - staging: fbtft: Use sysfs_emit_at() to print to sysfs file - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown - staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown - staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() - selftests/bpf: Fix memory leak in msg_alloc_iov error path - selftests/bpf: Fix memory leak in msg_alloc_iov - irqchip/gic-v3-its: Fix memleak in its_probe_one() - selftests: timers: leap-a-day: Fix -w option and update usage comment - clocksource: Unregister subsystem on device registration failure - y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 - timekeeping: Account for monotonicity adjustment in ntp_error - clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status - clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains - clk: qcom: gdsc: enable optional power domain support - clk: qcom: gdsc: Release pm subdomains in reverse add order - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code - iommu/msm: Return -ENOMEM on memory allocation failure in probe - iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors - iommu/amd: Add support for Hygon family 18h model 4h IOAPIC - iommu/amd: Fix false positive in SB IOAPIC IVRS validation - leds: pca9532: Fix inverted GPIO output polarity - hwspinlock: propagate errno when registering single lock - driver core: platform: reorder functions - driver core: platform: change logic implementing platform_driver_probe - driver core: platform: use bus_type functions - driver core: platform: Emit a warning if a remove callback returned non-zero - platform: Provide a remove callback that returns no value - usb: renesas_usbhs: Fix power-off ordering on unbind - drm/panel: samsung-s6d16d0: Power off on prepare failure - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE - RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage - hwrng: ks-sa - access private data via struct hwrng - hwrng: ks-sa - Fix runtime PM cleanup on registration failure - ALSA: hpi: Check transport errors during HPI6000 adapter initialization - pmdomain: bcm: bcm2835: handle genpd provider registration errors - misc: rtsx_usb: avoid USB I/O in runtime autosuspend - RDMA/hfi1: Remove redundant PCI device ID validation - RDMA/hfi1: Create workqueues before device initialization - RDMA/hfi1: Stop flushing the global IB workqueue - RDMA/hfi1: Initialize debugfs after probe completes - highmem: Provide generic variant of kmap_atomic* - iov_iter: lift memzero_page() to highmem.h - rpmsg: glink: Remove the rpmsg dev in close_ack - rpmsg: glink: remove duplicate code for rpmsg device remove - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate - libnvdimm/labels: Bound the on-media label size before the shift - cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() - irqdomain: Introduce irq_domain_instantiate() - irqdomain: Handle additional domain flags in irq_domain_instantiate() - cpufreq: intel_pstate: Simplify intel_cpufreq_update_pstate() - cpufreq: schedutil: Add util to struct sg_cpu - cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev - gpu: host1x: Fix offset calculation in trace_write_gather - media: ACPI / bus: Add acpi_dev_get_next_match_dev() and helper macro - ACPI: move from strlcpy() with unused retval to strscpy() - ACPI: processor: idle: Expand _LPI package sanity checks - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() - misc: rtsx: add missing write register handling - misc: ad525x_dpot: Make ad_dpot_remove() return void - ppdev: prevent overflow when setting port timeout - char: xilinx_hwicap: unregister class on init errors - perf ui hists: Fix uninitialized stack memory free on pstack allocation failure - driver core: soc: remove layering violation for the soc_bus - driver core: soc: Unregister bus on early device registration failure - dmaengine: dw-edma: Clear stale requests on termination - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters - ext4: skip extra isize expansion during mount to prevent deadlock - scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG - scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG - scsi: qla2xxx: Move sess cmd list/lock to driver - scsi: target: core: Replace in_interrupt() usage in target_submit_cmd_map_sgls() - scsi: target: core: Rename transport_init_se_cmd() - scsi: target: core: Break up target_submit_cmd_map_sgls() - scsi: target: srpt: Convert to new submission API - RDMA/srpt: Pass the mapped task attribute to target_init_cmd() - RDMA/restrack: Fix typos in the comments - iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe - iommu/qcom: Remove sysfs device on probe failure path - iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() - thermal: int340x_thermal: Consolidate priv->data_vault checks - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request - ath11k: add trace log support - ARM: dts: allwinner: a10: Fix PMU interrupt - perf cs-etm: Flush thread stacks after decoder reset - perf cs-etm: Avoid truncating AUX buffer sizes to int - leds: pca9532: Fix phantom device registration on missing hardware - drm/tve200: add OF module alias for autoloading - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet - arm64: dts: rockchip: Add gru-scarlet-dumo board - arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru - arm64: dts: rockchip: Fix Gru WLAN sideband interrupt - ARM: lpc32xx: only run SoC init on LPC32xx hardware - power: supply: sbs-battery: cache constant string properties - power: supply: sbs-battery: Use a per-device serial number buffer - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() - remoteproc: Remove useless check in rproc_del() - remoteproc: Add new RPROC_ATTACHED state - remoteproc: use freezable workqueue for crash notifications - remoteproc: Use unbounded workqueue for recovery work - remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() - staging: rtl8723bs: use kfree_sensitive() for key material - RDMA/efa: Fix PBL chunk length computation - arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix - clk: tegra: tegra124-emc: put EMC node on register failure - clk: palmas: Manage external-control prepare with devm - clk/x86: pmc_atom: add kasprintf return value check - RDMA/mlx5: Send cong param changes to the resolved port mdev - md/raid5-ppl: fix use-after-free in ppl_do_flush() - selftests/zram: fix kernel_gte() for POSIX sh - power: supply: sc2731_charger: Convert to platform remove callback returning void - clk: qcom: Return expected ENOMEM error on dynamic allocation failure - i3c: master: Fix device_register() error path - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() - fanotify: report full event length for FIONREAD - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields - perf: arm_spe: Make wakeup range check overflow safe - perf machine: Guard against NULL strlist in machines__findnew() - perf machine: Use snprintf() for guestmount path construction - perf machine: Check snprintf truncation in machines__findnew() - perf machine: Don't abort guest map creation on first inaccessible dir - perf machine: Reset errno before strtol in guest kernel map creation - perf machine: Free scandir entries in guest kernel map creation - perf machine: Check snprintf truncation for guest kallsyms path - iommu/arm-smmu-v3: Convert to use atomic poll timeout - wifi: zd1211rw: reject secondary interfaces to prevent conflicts - mac80211: add ieee80211_is_tx_data helper function - firmware: coreboot: Check size of table entry and use flex-array - firmware: google: Add bounds checks in coreboot_table_populate() - powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL - serial: amba-pl011: unprepare console clock on unregister - HID: split apart hid_device_probe to make logic more apparent - HID: ensure timely release of driver-allocated resources - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails - HID: lg4ff: validate report length before fixed offsets - perf thread-stack: Fix heap buffer overflow on branch stack wrap copy - perf auxtrace: Fix queue grow overflow and old array leak - perf intel-pt: Fix off-by-one in auxtrace_info minimum size check - perf intel-bts: Fix off-by-one in auxtrace_info minimum size check - iio: light: tsl2772: fix ALS calibscale readback - iio: light: isl29028: return zero in write_raw() on success - iio: light: tsl2583: return zero in write_raw() on success - block/blk-stat: drain per-cpu callback stats over possible CPUs - block/blk-iocost: collect per-cpu latency stats over possible CPUs - block/kyber-iosched: flush per-cpu latency buckets over possible CPUs - lib/string: fix memchr_inv() for large ranges - pps: don't try to wait for negative timeouts in PPS_FETCH - PCI/sysfs: Add static PCI resource attribute macros - remoteproc: Add a rproc_set_firmware() API - remoteproc: Add new detach() remoteproc operation - remoteproc: Introduce function __rproc_detach() - remoteproc: Introduce function rproc_detach() - remoteproc: Fix various kernel-doc warnings - remoteproc: Move resource table data structure to its own header - remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() - scripts/tags.sh: improve compiled sources generation - scripts/tags.sh: Prevent binary files appearing in cscope.files - ocfs2: use bitmap API in fill_node_map - drm/sun4i: vi scaler: Fix coefficient selection - of: property: add missing kerneldoc for of_graph_get_endpoint_count() - of: property: use unsigned int return on of_graph_get_endpoint_count() - bitfield: Add less-checking __FIELD_{GET,PREP}() - bitfield: Add non-constant field_{prep,get}() helpers - drm/sun4i: tcon: Drop remote endpoint reference - drm/sun4i: dw-hdmi: Drop TCON TOP port reference - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz - RDMA/siw: Introduce siw_free_cm_id - arm64: hibernate: mask DAIF before restoring hibernated kernel - mfd: rave-sp: validate received frame payload lengths - mfd: iqs62x: Reject zero-length firmware records - drm/amdgpu/gfx6: Fixup emit_cntxcntl() - perf trace-event: Fix buffer overflow in read_string() - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets - firmware_loader: Check fw_state_is_done in loading_store - pinctrl: rockchip: Reset the pin count when recalculating SoC data - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling - sched/fair: Introduce a CPU capacity comparison helper - sched/fair: Check CPU capacity before comparing group types during load balance - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() - perf trace-event: Fix integer truncation in do_read() and skip() - iio: light: gp2ap002: re-enable irq if runtime suspend fails - arm64: dts: turris-mox: fix usb3 phys - ARM: dts: helios4: add vcc-supply to EEPROM - ARM: dts: helios4: add vcc-supply to GPIO expander - ARM: dts: helios4: add SATA regulator supplies - perf stat: Clear screen only if output file is a tty - perf stat: Fix evsel_list leak in cmd_stat - perf synthetic-events: Fix uninitialized pthread_join - perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads - iommu/vt-d: Fix UCTP context table slot when copying root entries - m68k: Fix backtraces for non-running tasks - powerpc/configs: enable CONFIG_RAS to fix EDAC support - spi: sprd-adi: Fix probe succeeding without registering the controller - nfc: digital: Do not dump a NULL response in command completion - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal - ASoC: pxa: Use devm_clk_get_optional() for extclk clock - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready - ubi: Fix repeated words in comments - ubi: fastmap: Use the bitmap API to allocate bitmaps - ubi: fastmap: Fix missed ec updating after erasing old fastmap data block - ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash - ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap - ubi: Replace erase_block() with sync_erase() - UBI: Preserve torture flag when rescheduling failed erasures - UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs - ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl - ubi: fastmap: Add fastmap control support for module parameter - ubi: Simplify bool conversion - ubi: fastmap: Wait until there are enough free PEBs before filling pools - ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs - ubi: fastmap: Add module parameter to control reserving filling pool PEBs - UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC - spi: img-spfi: don't disable runtime PM on DMA deferred probe - power: supply: bd99954: Drop bad register fields - power: supply: bq27xxx: bq27520g4: fix REG_TTES address - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address - xenbus: Unregister reboot notifier on init failure - clocksource/drivers/clps711x: Do not unmap clocksource MMIO - clocksource/drivers/armada: Unwind timer clock on init failure - x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported - bpftool: Fix double close in map dump - ocfs2: fix circular locking dependency in ocfs2_init_acl() - bpf: Fix pending_pos walk on 32-bit ring position wrap - perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() - perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() - mailbox: rockchip: disable pclk on probe failure and unbind - hwmon: (emc1403) Add support for EMC1442 - NFS: Always clear an invalid mapping when attempting a buffered write - nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper - NFSv4/pnfs: Clean up layout get on open - nfs: refactor pNFS functions using clear_and_wake_up_bit - pppox: drain queued packets on channel handoff - hsr: Use a single struct for self_node. - net: hsr: Use full string description when opening HSR network device - net: bridge: vlan: fix inverted default vlan notification - ALSA: hda: Fix connection list comparison in proc output - 8139cp: fix Rx and Tx not being disabled in cp_suspend - vsock: use sock_error() to consume sk_err after a failed connect - bonding: initialize err for empty target lists - virtio_balloon: disable indirect descriptors - prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator - RDMA/ucma: Allow path records to exactly fit the output buffer - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes - forcedeth: stop the tx_timeout register dump past the requested window - nfs: move the nfs4_data_server_cache into struct nfs_net - scsi: qla2xxx: Fix an loop timeout test - Bluetooth: compute LE flow credits based on recvbuf space - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX - cifs: fix clearing stats for fastest execution of each smb2 command - net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() - net_sched: sch_fq: struct sched_data reorg - net_sched: sch_fq: change how @inactive is tracked - net_sched: export pfifo_fast prio2band[] - net/sched: sch_codel: clamp default mtu to avoid disabling CoDel - tpm: st33zp24: Validate locality read result - apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init - apparmor: policy_int make sure list heads are initialized before fail path - net: ethernet: sun4i-emac: Fix IRQ error handling - netfilter: xt_cgroup: Make it independent from net_cls - netfilter: xt_HL: add pr_fmt and checkentry validation - netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() - selftests/arm64: Treat KSM merge_across_nodes as optional - net: stmmac: selftests: Check multiple MMC counters - net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering - net: stmmac: dwmac4: Account for the primary MAC address for UC filtering - net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering - net: stmmac: selftests: Account for the UC filter list for filtering tests - driver core: platform: don't oops in platform_shutdown() on unbound devices - crypto: ecdh - extend 'cra_driver_name' with curve name - crypto: ecdh - fix 'ecdh_init' - crypto: ecdh - fix ecdh-nist-p192's entry in testmgr - crypto: testmgr - fix initialization of 'secret_size' - clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled - mm/highmem: Take kmap_high_get() properly into account - ACPI: utils: Document for_each_acpi_dev_match() macro - HID: fix an error code in hid_check_device_match() - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Linux 5.10.270