Accepted linux 6.12.57-1~bpo12+1 (source) into oldstable-backports

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 17 Nov 2025 12:29:47 +0100
Source: linux
Architecture: source
Version: 6.12.57-1~bpo12+1
Distribution: bookworm-backports
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 919350 1109977 1114898 1116358 1118658 1118660
Changes:
 linux (6.12.57-1~bpo12+1) bookworm-backports; urgency=medium
 .
   * Rebuild for bookworm-backports
 .
 linux (6.12.57-1) trixie; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49
     - wifi: wilc1000: avoid buffer overflow in WID string configuration
     - nvme: fix PI insert on write
     - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
       supported
     - wifi: mac80211: increase scan_ies_len for S1G
     - wifi: mac80211: fix incorrect type for ret
     - cgroup: split cgroup_destroy_wq into 3 workqueues
     - btrfs: fix invalid extref key setup when replaying dentry
     - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
     - qed: Don't collect too many protection override GRC elements
     - bonding: set random address only when slaves already exist
     - mptcp: set remote_deny_join_id0 on SYN recv
     - mptcp: tfo: record 'deny join id0' info
     - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
     - ice: store max_frame and rx_buf_len only in ice_rx_ring
     - ice: fix Rx page leak on multi-buffer frames
     - i40e: remove redundant memory barrier when cleaning Tx descs
     - igc: don't fail igc_probe() on LED setup error
     - net/mlx5e: Harden uplink netdev access against device unbind
     - bonding: don't set oif to bond dev when getting NS target destination
     - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
     - tls: make sure to abort the stream if headers are bogus
     - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
     - net: liquidio: fix overflow in octeon_init_instr_queue()
     - cnic: Fix use-after-free bugs in cnic_delete_task
     - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
     - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event()
       (CVE-2025-38322)
     - ksmbd: smbdirect: validate data_offset and data_length field of
       smb_direct_data_transfer
     - ksmbd: smbdirect: verify remaining_data_length respects
       max_fragmented_recv_size
     - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
     - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
     - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
     - power: supply: bq27xxx: restrict no-battery detection to bq27000
     - dm-raid: don't set io_min and io_opt for raid1
     - dm-stripe: fix a possible integer overflow
     - gup: optimize longterm pin_user_pages() for large folio
     - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
     - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
       switch_to_super_page()
     - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
     - btrfs: tree-checker: fix the incorrect inode ref size check
     - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
       interface
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
       source graph failed
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
     - mmc: mvsdio: Fix dma_unmap_sg() nents value
     - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
       active
     - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
     - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
     - rds: ib: Increment i_fastreg_wrs before bailing out
     - mptcp: propagate shutdown to subflows when possible
     - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
     - io_uring/cmd: let cmds to know about dying task
     - io_uring: backport io_should_terminate_tw()
     - io_uring: include dying ring in task_work "should cancel" state
     - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
     - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check
       (CVE-2025-39816)
     - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
       message
     - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
     - drm/xe/tile: Release kobject for the failure path
     - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
     - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
     - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
     - smb: client: fix filename matching of deferred files
     - smb: client: let smbd_destroy() call
       disable_work_sync(&info->post_send_credits_work)
     - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
     - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
     - io_uring: fix incorrect io_kiocb reference in io_link_skb
     - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
       ASUS ROG Z13
     - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
     - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106)
     - mm: add folio_expected_ref_count() for reference count calculation
     - mm/gup: check ref_count instead of lru before migration
     - mptcp: pm: nl: announce deny-join-id0 flag
     - usb: xhci: introduce macro for ring segment list iteration
     - usb: xhci: remove option to change a default ring's TRB cycle bit
     - xhci: dbc: decouple endpoint allocation from initialization
     - xhci: dbc: Fix full DbC transfer ring after several reconnects
     - rtc: pcf2127: fix SPI command byte for PCF2131 backport
     - minmax.h: add whitespace around operators and after commas
     - minmax.h: update some comments
     - minmax.h: reduce the #define expansion of min(), max() and clamp()
     - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
     - minmax.h: move all the clamp() definitions after the min/max() ones
     - minmax.h: simplify the variants of clamp()
     - minmax.h: remove some #defines that are only expanded once
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50
     - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
     - firewire: core: fix overlooked update of subsystem ABI version
     - ALSA: usb-audio: Fix code alignment in mixer_quirks
     - ALSA: usb-audio: Fix block comments in mixer_quirks
     - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
     - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
     - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
     - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
     - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
     - ALSA: usb-audio: Convert comma to semicolon
     - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
     - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
     - usb: core: Add 0x prefix to quirks debug output
     - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
       fec_imx6sx_info
     - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
     - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
     - i2c: designware: Add quirk for Intel Xe
     - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
     - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
     - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
     - net: sfp: add quirk for FLYPRO copper SFP+ module
     - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
     - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
     - cpufreq: Initialize cpufreq-based invariance before subsys
     - smb: server: don't use delayed_work for post_recv_credits_work
     - smb: server: use disable_work_sync in transport_rdma.c
     - bpf: Check the helper function is valid in get_helper_proto
     - btrfs: don't allow adding block device of less than 1 MB
     - wifi: virt_wifi: Fix page fault on connect
     - bpf: Reject bpf_timer for PREEMPT_RT
     - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
     - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
     - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
       overflow
     - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
     - can: peak_usb: fix shift-out-of-bounds issue
     - net: tun: Update napi->skb after XDP process
     - net/smc: fix warning in smc_rx_splice() when calling get_page()
     - [arm64] ethernet: rvu-af: Remove slash from the driver name
     - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
     - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
     - vhost: Take a reference on the task in struct vhost_task.
     - bnxt_en: correct offset handling for IPv6 destination address
     - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
     - nexthop: Forbid FDB status change while nexthop is in a group
     - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
     - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
       batch"
     - mm: folio_may_be_lru_cached() unless folio_test_large()
     - [amd64] drm/gma500: Fix null dereference in hdmi teardown
     - futex: Prevent use-after-free during requeue-PI
     - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
     - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
     - smb: client: fix wrong index reference in smb2_compound_op()
     - HID: asus: add support for missing PX series fn keys
     - i40e: add validation for ring_len param
     - i40e: fix idx validation in i40e_validate_queue_map
     - i40e: fix idx validation in config queues msg
     - i40e: fix input validation logic for action_meta
     - i40e: fix validation of VF state in get resources
     - i40e: add max boundary check for VF filters
     - i40e: add mask to apply valid bits for itr_idx
     - i40e: improve VF MAC filters accounting
     - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
     - tracing: dynevent: Add a missing lockdown check on dynevent
     - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
     - drm/ast: Use msleep instead of mdelay for edid read
     - afs: Fix potential null pointer dereference in afs_put_server
     - fs/proc/task_mmu: check p->vec_buf for NULL
     - gpiolib: Extend software-node support to support secondary software-nodes
     - mm/hugetlb: fix folio is still mapped when deleted
     - fbcon: fix integer overflow in fbcon_do_set_font
     - fbcon: Fix OOB access in font allocation
     - iommufd: Fix race during abort for file descriptors
     - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit"
     - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid
       parameters
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51
     - crypto: sha256 - fix crash at kexec
     - scsi: target: target_core_configfs: Add length check to avoid buffer
       overflow
     - media: b2c2: Fix use-after-free causing by irq_check_work in
       flexcop_pci_remove
     - media: tuner: xc5000: Fix use-after-free in xc5000_release
     - media: rc: fix races with imon_disconnect()
     - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
     - mm: swap: check for stable address space before operating on the VMA
     - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
     - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52
     - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
     - USB: serial: option: add SIMCom 8230C compositions
     - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
     - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
     - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
     - dm-integrity: limit MAX_TAG_SIZE to 255
     - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
       list
     - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
     - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
     - btrfs: ref-verify: handle damaged extent root tree
     - netfs: Prevent duplicate unlocking
     - can: hi311x: fix null pointer dereference when resuming from sleep before
       interface was enabled
     - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
       quirks list
     - drm/amd : Update MES API header file for v11 & v12
     - drm/amd/include : MES v11 and v12 API header update
     - drm/amd/include : Update MES v12 API for fence update
     - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658)
     - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105)
     - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
     - hid: fix I2C read buffer overflow in raw_event() for mcp2221
     - nvmem: layouts: fix automatic module loading
     - binder: fix double-free in dbitmap
     - driver core/PM: Set power.no_callbacks along with power.no_pm
     - crypto: rng - Ensure set_ent is always present
     - net/9p: fix double req put in p9_fd_cancelled
     - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
       I/O
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53
     - filelock: add FL_RECLAIM to show_fl_flags() macro
     - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
     - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
     - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
     - [powerpc*] 8xx: Remove left-over instruction and comments in
       DataStoreTLBMiss handler
     - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs
     - uprobes: uprobe_warn should use passed task
     - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
     - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
     - smb: server: fix IRD/ORD negotiation with the client
     - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
     - [amd64] x86/vdso: Fix output operand size of RDPID
     - lsm: CONFIG_LSM can depend on CONFIG_SECURITY
     - btrfs: return any hit error from extent_writepage_io()
     - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in
       rzg3s_oen_read()
     - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
     - regmap: Remove superfluous check for !config in __regmap_init()
     - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
     - libbpf: Fix reuse of DEVMAP
     - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator
     - [arm64] dts: imx93-kontron: Fix USB port assignment
     - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid
     - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
     - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
     - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux
     - blk-mq: check kobject state_in_sysfs before deleting in
       blk_mq_unregister_hctx
     - block: use int to store blk_stack_limits() return value
     - PM: sleep: core: Clear power.must_resume in noirq suspend error path
     - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
     - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer
       property
     - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in
       probe()
     - [arm64] power: supply: cw2015: Fix a alignment coding style issue
     - [arm64] pinctrl: renesas: Use int type to store negative error codes
     - null_blk: Fix the description of the cache_size module argument
     - nbd: restrict sockets to TCP and UDP
     - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
     - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure
     - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
     - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
     - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
     - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
     - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible
     - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free()
     - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful
     - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle
       calculation
     - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation
     - ACPICA: Fix largest possible resource descriptor index
     - [riscv64] bpf: Sign extend struct ops return values properly
     - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
     - i3c: master: svc: Use manual response for IBI events
     - i3c: master: svc: Recycle unused IBI slot
     - bpf: Explicitly check accesses to bpf_sock_addr
     - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
     - smp: Fix up and expand the smp_call_function_many() kerneldoc
     - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host
       headers
     - spi: fix return code when spi device has too many chipselects
     - bpf: Mark kfuncs as __noclone
     - once: fix race by moving DO_ONCE to separate section
     - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes
     - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
     - i2c: designware: Fix clock issue when PM is disabled
     - i2c: designware: Add disabling clocks when probe fails
     - libbpf: Fix error when st-prefix_ops and ops from differ btf
     - bpf: Enforce expected_attach_type for tailcall compatibility
     - drm/radeon/r600_cs: clean up of dead code in r600_cs
     - f2fs: fix condition in __allow_reserved_blocks()
     - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
     - drm/amd/display: Remove redundant semicolons
     - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
     - scsi: myrs: Fix dma_alloc_coherent() error check
     - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
     - RDMA/mlx5: Fix vport loopback forcing for MPV device
     - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
     - ALSA: lx_core: use int type to store negative error codes
     - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
     - [arm64,armhf] coresight: Only register perf symlink for sinks with
       alloc_buffer
     - drm/amdgpu: Power up UVD 3 for FW validation (v2)
     - drm/amd/pm: Disable ULV even if unsupported (v3)
     - drm/amd/pm: Fix si_upload_smc_data (v3)
     - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
     - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
     - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
     - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
     - wifi: mwifiex: send world regulatory domain to driver
     - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys
       allocation
     - tcp: fix __tcp_close() to only send RST when required
     - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
     - [armhf] usb: phy: twl6030: Fix incorrect type for ret
     - usb: gadget: configfs: Correctly set use_os_string at bind
     - tty: n_gsm: Don't block input queue by waiting MSC
     - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error
     - pps: fix warning in pps_register_cdev when register device fail
     - wifi: iwlwifi: Remove redundant header files
     - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq
     - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
     - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
     - [arm64] drm/msm/dpu: fix incorrect type for ret
     - fs: ntfs3: Fix integer overflow in run_unpack()
     - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
     - iio: consumers: Fix handling of negative channel scale in
       iio_convert_raw_to_processed()
     - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
     - netfilter: ipset: Remove unused htable_bits in macro ahash_region
     - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
     - drivers/base/node: handle error properly in register_one_node()
     - RDMA/cm: Rate limit destroy CM ID timeout error message
     - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
     - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
     - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
     - wifi: mt76: mt7915: fix mt7981 pre-calibration
     - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
     - f2fs: fix to truncate first page in error path of f2fs_truncate()
     - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
     - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on
       PREEMPT_RT
     - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
     - scsi: qla2xxx: edif: Fix incorrect sign of error code
     - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
     - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
     - HID: hidraw: tighten ioctl command parsing
     - f2fs: fix zero-sized extent for precache extents
     - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems
       Running"
     - RDMA/core: Resolve MAC of next-hop device without ARP support
     - IB/sa: Fix sa_local_svc_timeout_ms read race
     - Documentation: trace: historgram-design: Separate sched_waking histogram
       section heading and the following diagram
     - wifi: ath12k: fix wrong logging ID used for CE
     - wifi: ath10k: avoid unnecessary wait for service ready message
     - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
     - wifi: mac80211: fix Rx packet handling when pubsta information is not
       available
     - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
     - RDMA/rxe: Fix race in do_task() when draining
     - wifi: rtw89: avoid circular locking dependency in ser_state_run()
     - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
     - dm vdo: return error on corrupted metadata in start_restoring_volume
       functions
     - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR
     - [arm64,armhf] coresight: tmc: Support atclk
     - [arm64,armhf] coresight: catu: Support atclk
     - [arm64,armhf] coresight: etm4x: Support atclk
     - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures
     - [arm64,armhf] coresight: tpda: fix the logic to setup the element size
     - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc
     - NFSv4.1: fix backchannel max_resp_sz verification check
     - ipvs: Defer ip_vs_ftp unregister during netns cleanup
     - netfilter: nfnetlink: reset nlh pointer during batch replay
     - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
     - usb: vhci-hcd: Prevent suspending virtually attached devices
     - iommu/vt-d: Disallow dirty tracking if incoherent page walk
     - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
     - ptp: Add a upper bound on max_vclocks
     - vhost: vringh: Fix copy_to_iter return value check
     - Bluetooth: MGMT: Fix not exposing debug UUID on
       MGMT_OP_READ_EXP_FEATURES_INFO
     - Bluetooth: ISO: Fix possible UAF on iso_conn_free
     - Bluetooth: ISO: free rx_skb if not consumed
     - Bluetooth: ISO: don't leak skb in ISO_CONT RX
     - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
     - KEYS: X.509: Fix Basic Constraints CA flag parsing
     - ocfs2: fix double free in user_cluster_connect()
     - drivers/base/node: fix double free in register_one_node()
     - [arm64] PCI: j721e: Fix incorrect error message in probe()
     - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent
     - nfp: fix RSS hash key size when RSS is not supported
     - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not
       configurable
     - net: dlink: handle copy_thresh allocation failure
     - net/mlx5: Stop polling for command response if interface goes down
     - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
     - net/mlx5: fw reset, add reset timeout work
     - smb: client: fix crypto buffers in non-linear memory
     - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
     - bpf: Reject negative offsets for ALU ops
     - tpm: Disable TPM2_TCG_HMAC by default
     - Squashfs: fix uninit-value in squashfs_get_parent
     - uio_hv_generic: Let userspace take care of interrupt mask
     - io_uring/waitid: always prune wait queue entry in io_waitid_wait()
     - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
     - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static
       pipelines tear down
     - fs: udf: fix OOB read in lengthAllocDescs handling
     - net: nfc: nci: Add parameter validation for packet data
     - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of
       devm_gpiochip_add_data()
     - dm: fix queue start/stop imbalance under suspend/load/resume races
     - dm: fix NULL pointer dereference in __dm_suspend()
     - ksmbd: Fix race condition in RPC handle list access
     - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
     - ksmbd: add max ip connections parameter
     - ext4: fix checks for orphan inodes
     - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't
       valid
     - fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
     - mm: hugetlb: avoid soft lockup when mprotect to large memory area
     - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
     - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure
     - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation
     - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args
     - [arm64] misc: fastrpc: Skip reference for DMA handles
     - Input: atmel_mxt_ts - allow reset GPIO to sleep
     - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
     - sunrpc: fix null pointer dereference on zero-length checksum
     - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in
       pru_rproc_set_ctable()
     - [amd64,arm64] tee: fix register_shm_helper()
     - pinctrl: check the return value of pinmux_ops::get_function_name()
     - bus: fsl-mc: Check return value of platform_get_resource()
     - net/9p: Fix buffer overflow in USB transport layer
     - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
     - usb: typec: tipd: Clear interrupts first
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54
     - fs: always return zero on success from replace_fd()
     - fscontext: do not consume log entries when returning -EMSGSIZE
     - [arm64] map [_text, _stext) virtual address range non-executable+read-only
     - rseq: Protect event mask against membarrier IPI
     - listmount: don't call path_put() under namespace semaphore
     - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches
     - dma-mapping: fix direction in dma_alloc direction traces
     - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2
     - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
     - media: v4l2-subdev: Fix alloc failure check in
       v4l2_subdev_call_state_try()
     - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
     - perf disasm: Avoid undefined behavior in incrementing NULL
     - perf test trace_btf_enum: Skip if permissions are insufficient
     - perf evsel: Avoid container_of on a NULL leader
     - libperf event: Ensure tracing data is multiple of 8 sized
     - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in
       qcom_cc_icc_register()
     - [arm64] clk: renesas: cpg-mssr: Fix memory leak in
       cpg_mssr_reserved_init()
     - perf util: Fix compression checks returning -1 as bool
     - perf arm_spe: Correct setting remote access
     - perf arm-spe: Rename the common data source encoding
     - perf arm_spe: Correct memory level for remote access
     - perf vendor events arm64 AmpereOneX: Fix typo - should be
       l1d_cache_access_prefetches
     - perf session: Fix handling when buffer exceeds 2 GiB
     - perf tools: Add fallback for exclude_guest
     - perf evsel: Ensure the fallback message is always written to
     - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
     - [arm64] clk: mediatek: clk-mux: Do not pass flags to
       clk_mux_determine_rate_flags()
     - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001)
     - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time
       instead of buffer time
     - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel
     - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
     - drm/xe/hw_engine_group: Fix double write lock release in error path
     - [s390x] cio: Update purge function to unregister the unused subchannels
     - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
     - drm/vmwgfx: Fix Use-after-free in validation
     - drm/vmwgfx: Fix copy-paste typo in validation
     - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
     - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
     - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed
       work (CVE-2025-40003)
     - ice: ice_adapter: release xa entry on adapter allocation failure
     - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
     - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister()
       call
     - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in
       zynqmp_ipi_free_mboxes
     - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup
       loop
     - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind
     - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
     - [arm64] mailbox: mtk-cmdq-mailbox: Switch to
       __pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend()
     - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from
       cmdq_mbox_send_data()
     - drm/amdgpu: Add additional DCE6 SCL registers
     - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
     - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
     - drm/amd/display: Properly disable scaling on DCE6
     - netfilter: nft_objref: validate objref and objrefmap expressions
     - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
     - crypto: essiv - Check ssize for decryption and in-place encryption
     - cifs: Fix copy_to_iter return value check
     - smb: client: fix missing timestamp updates after utime(2)
     - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
     - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
     - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping
     - bpf: Avoid RCU context warning when unpinning htab with internal structs
     - [s390x] vmlinux.lds.S: Reorder sections
     - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections
     - ACPI: property: Fix buffer properties extraction for subnodes
     - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
     - ACPI: debug: fix signedness issues in read/write helpers
     - [arm64] dts: qcom: msm8916: Add missing MDSS reset
     - [arm64] dts: qcom: msm8939: Add missing MDSS reset
     - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees
     - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default
     - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length
     - [arm64] kprobes: call set_memory_rox() for kprobe page
     - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on
       reset)
     - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in
       amx3_idle_init
     - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset
     - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
     - xen/events: Cleanup find_virq() return codes
     - xen/manage: Fix suspend error path
     - xen/events: Return -EEXIST for bound VIRQs
     - xen/events: Update virq_to_irq on migration
     - [arm64] firmware: meson_sm: fix device leak at probe
     - media: cx18: Add missing check after DMA map
     - media: mc: Fix MUST_CONNECT handling for pads with no links
     - media: pci: ivtv: Add missing check after DMA map
     - media: pci: mg4b: fix uninitialized iio scan data
     - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2
     - media: vivid: fix disappearing <Vendor Command With ID> messages
     - media: lirc: Fix error handling in lirc_register()
     - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create()
     - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
     - drm/xe/uapi: loosen used tracking restriction
     - drm/amd/display: Enable Dynamic DTBCLK Switch
     - blk-crypto: fix missing blktrace bio split events
     - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
     - bus: mhi: ep: Fix chained transfer handling in read path
     - bus: mhi: host: Do not use uninitialized 'dev' pointer in
       mhi_init_irq_setup()
     - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP
       refclk
     - copy_sighand: Handle architectures where sizeof(unsigned long) <
       sizeof(u64)
     - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in
       update_qos_request()
     - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value
     - eventpoll: Replace rwlock with spinlock
     - fbdev: Fix logic error in "offb" name match
     - fs/ntfs3: Fix a resource leak bug in wnd_extend()
     - fs: quota: create dedicated workqueue for quota_release_work
     - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify()
     - fuse: fix livelock in synchronous file put from fuseblk workers
     - iio: dac: ad5360: use int type to store negative error codes
     - iio: dac: ad5421: use int type to store negative error codes
     - iio: frequency: adf4350: Fix prescaler usage.
     - init: handle bootloader identifier in kernel parameters
     - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in
       resume
     - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported
     - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in
       sys_prlimit64() paths
     - KEYS: trusted_tpm1: Compare HMAC values in constant time
     - lib/genalloc: fix device leak in of_gen_pool_get()
     - loop: fix backing file reference leak on validation error
     - openat2: don't trigger automounts with RESOLVE_NO_XDEV
     - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
     - [powerpc*] powernv/pci: Fix underflow and leak issue
     - [powerpc*] pseries/msi: Fix potential underflow and leak issue
     - Revert "ipmi: fix msg stack when IPMI is disconnected"
     - sched/deadline: Fix race in push_dl_task()
     - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
     - scsi: sd: Fix build warning in sd_revalidate_disk()
     - sctp: Fix MAC comparison to be constant-time
     - xsk: Harden userspace-supplied xdp_desc validation
     - mmc: core: SPI mode remove cmd7
     - mmc: mmc_spi: multiple block read remove read crc ack
     - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in
       exynos_srom_probe
     - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
     - rtc: interface: Fix long-standing race when setting alarm
     - [arm64] PCI: xilinx-nwl: Fix ECAM programming
     - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw
       spinlock
     - PCI/sysfs: Ensure devices are powered for config reads
     - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
     - PCI/ERR: Fix uevent on failure to recover
     - PCI/AER: Fix missing uevent on recovery when a reset is requested
     - PCI/AER: Support errors introduced by PCIe r6.0
     - [arm64] PCI: j721e: Fix programming sequence of "strap" settings
     - spi: cadence-quadspi: Flush posted register writes before INDAC access
     - spi: cadence-quadspi: Flush posted register writes before DAC access
     - spi: cadence-quadspi: Fix cqspi_setup_flash()
     - [x86] fred: Remove ENDBR64 from FRED entry points
     - [x86] umip: Check that the instruction opcode is at least two bytes
     - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT
       aliases)
     - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation
     - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request
     - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR
     - slab: prevent warnings when slab obj_exts vector allocation fails
     - slab: mark slab->obj_exts allocation failures unconditionally
     - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
     - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000
     - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
     - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
     - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
     - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when
       max_huge_pages=0
     - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
     - mm/damon/lru_sort: use param_ctx for damon_attrs staging
     - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
     - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
     - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches()
     - ext4: verify orphan file size is not too big
     - ext4: increase i_disksize to offset + len in
       ext4_update_disksize_before_punch()
     - ext4: correctly handle queries for metadata mappings
     - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
     - ext4: fix an off-by-one issue during moving extents
     - ext4: guard against EA inode refcount underflow in xattr update
     - ext4: validate ea_ino and size in check_xattrs
     - ACPICA: Allow to skip Global Lock initialization
     - ext4: free orphan info with kvfree
     - media: mc: Clear minor number before put device
     - Squashfs: add additional inode sanity checking
     - Squashfs: reject negative file sizes in squashfs_read_inode()
     - tracing: Fix race condition in kprobe initialization causing NULL pointer
       dereference
     - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork
     - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams
     - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config
       max_register value
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for
       cache_type
     - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config
       flag
     - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
     - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency
     - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace
     - statmount: don't call path_put() under namespace semaphore
     - [arm64] mte: Do not flag the zero page as PG_mte_tagged
     - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state()
     - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP
     - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT
     - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock()
     - nfsd: refine and rename NFSD_MAY_LOCK
     - nfsd: don't use sv_nrthreads in connection limiting calculations.
     - nfsd: unregister with rpcbind when deleting a transport
     - ACPI: battery: allocate driver data through devm_ APIs
     - ACPI: battery: initialize mutexes through devm_ APIs
     - ACPI: battery: Check for error code from devm_mutex_init() call
     - ACPI: battery: Add synchronization between interface updates
     - ACPI: property: Disregard references in data-only subnode lists
     - ACPI: property: Add code comments explaining what is going on
     - ACPI: property: Do not pass NULL handles to acpi_attach_data()
     - mptcp: pm: in-kernel: usable client side with C-flag
     - ipmi: Rework user message limit handling
     - ipmi: Fix handling of messages with provided receive message pointer
     - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled
       mTHP subpage to shared zeropage
     - [s390x] bpf: Centralize frame offset calculations
     - [s390x] bpf: Describe the frame using a struct instead of constants
     - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL
     - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
     - [riscv64] irqchip/sifive-plic: Make use of __assign_bit()
     - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during
       suspend/resume
     - copy_file_range: limit size if in compat mode
     - minixfs: Verify inode mode when loading from disk
     - pid: Add a judgment for ns null in pid_nr_ns
     - fs: Add 'initramfs_options' to set initramfs mount options
     - cramfs: Verify inode mode when loading from disk
     - writeback: Avoid softlockup when switching many inodes
     - writeback: Avoid excessively long inode switching times
     - sched/fair: Block delayed tasks on throttled hierarchy during dequeue
     - nfsd: fix __fh_verify for localio
     - nfsd: fix access checking for NLM under XPRTSEC policies
     - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA
     - mount: handle NULL values in mnt_ns_release()
     - nfsd: decouple the xprtsec policy check from check_nfsd_access()
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55
     - drm/xe/guc: Check GuC running state before deregistering exec queue
     - smb: client: Fix refcount leak for cifs_sb_tlink
     - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL
     - r8152: add error handling in rtl8152_driver_init
     - f2fs: fix wrong block mapping for multi-devices
     - jbd2: ensure that all ongoing I/O complete before freeing blocks
     - ext4: wait for ongoing I/O to complete before freeing blocks
     - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
     - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already
       running
     - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl
     - btrfs: fix incorrect readahead expansion length
     - btrfs: fix memory leaks when rejecting a non SINGLE data profile without
       an RST
     - btrfs: do not assert we found block group item when creating free space
       tree
     - can: gs_usb: gs_make_candev(): populate net_device->dev_port
     - can: gs_usb: increase max interface to U8_MAX
     - cifs: parse_dfs_referrals: prevent oob on malformed input
     - drm/sched: Fix potential double free in
       drm_sched_job_add_resv_dependencies
     - drm/amdgpu: use atomic functions with memory barriers for vm fault info
     - drm/amdgpu: fix gfx12 mes packet status return check
     - perf/core: Fix address filter match with backing files
     - perf/core: Fix MMAP event path names with backing files
     - perf/core: Fix MMAP2 event device with backing files
     - drm/amd: Check whether secure display TA loaded successfully
     - irqdomain: cdx: Switch to of_fwnode_handle()
     - [arm64] drm/msm/a6xx: Fix PDC sleep sequence
     - usb: gadget: Store endpoint pointer in usb_request
     - usb: gadget: Introduce free_usb_request helper
     - usb: gadget: f_ncm: Refactor bind path to use __free()
     - usb: gadget: f_acm: Refactor bind path to use __free()
     - usb: gadget: f_ecm: Refactor bind path to use __free()
     - usb: gadget: f_rndis: Refactor bind path to use __free()
     - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay
     - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()"
       (Closes: #1116358)
     - HID: multitouch: fix sticky fingers
     - dax: skip read lock assertion for read-only filesystems
     - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable()
     - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error
       Active
     - can: m_can: m_can_chip_config(): bring up interface in correct state
     - can: m_can: add deinit callback
     - can: m_can: call deinit/init callback when going into suspend/resume
     - can: m_can: fix CAN state in system PM
     - net: dlink: handle dma_map_single() failure properly
     - doc: fix seg6_flowlabel path
     - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H
     - net/ip6_tunnel: Prevent perpetual tunnel growth
     - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface
       toggle
     - tcp: fix tcp_tso_should_defer() vs large RTT
     - ksmbd: fix recursive locking in RPC handle list access
     - tg3: prevent use of uninitialized remote_adv and local_adv variables
     - tls: trim encrypted message to match the plaintext on short splice
     - tls: wait for async encrypt in case of error during latter iterations of
       sendmsg
     - tls: always set record_type in tls_process_cmsg
     - tls: wait for pending async decryptions if tls_strp_msg_hold fails
     - tls: don't rely on tx_work during send()
     - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address
     - net: usb: lan78xx: fix use of improperly initialized dev->chipid in
       lan78xx_reset
     - [arm64] drm/panthor: Ensure MCU is disabled on suspend
     - nvme-multipath: Skip nr_active increments in RETRY disposition
     - [riscv64] kprobes: Fix probe address validation
     - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection
     - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status
     - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit
     - [amd64] drm/i915/guc: Skip communication warning on reset in progress
     - drm/amdgpu: add ip offset support for cyan skillfish
     - drm/amdgpu: add support for cyan skillfish without IP discovery
     - drm/amdgpu: fix handling of harvesting for ip_discovery firmware
     - drm/amd/powerplay: Fix CIK shutdown temperature
     - [arm64] drm/rockchip: vop2: use correct destination rectangle height check
     - sched/fair: Fix pelt lost idle time detection
     - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
     - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
     - HID: hid-input: only ignore 0 battery events for digitizers
     - HID: multitouch: fix name of Stylus input devices
     - nvme/tcp: handle tls partially sent records in write_space()
     - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
     - xfs: rename the old_crc variable in xlog_recover_process
     - xfs: fix log CRC mismatches between i386 and other architectures
     - PM: runtime: Add new devm functions
     - iio: imu: inv_icm42600: Simplify pm_runtime setup
     - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended
     - nfsd: Use correct error code when decoding extents
     - nfsd: Drop dprintk in blocklayout xdr functions
     - NFSD: Rework encoding and decoding of nfsd4_deviceid
     - NFSD: Minor cleanup in layoutcommit processing
     - NFSD: Implement large extent array support in pNFS
     - NFSD: Fix last write offset handling in layoutcommit
     - wifi: rtw89: avoid possible TX wait initialization race
     - xfs: use deferred intent items for reaping crosslinked blocks
     - padata: Reset next CPU when reorder sequence wraps around
     - md/raid0: Handle bio_split() errors
     - md/raid1: Handle bio_split() errors
     - md/raid10: Handle bio_split() errors
     - md: fix mssing blktrace bio split events
     - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read()
     - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating
       previously unavailable RMID
     - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier
     - vfs: Don't leak disconnected dentries on umount
     - PCI: Add PCI_VDEVICE_SUB helper macro
     - ixgbevf: Add support for Intel(R) E610 device
     - ixgbevf: fix getting link speed data for E610 devices
     - ixgbevf: fix mailbox API compatibility by negotiating supported features
     - tcp: convert to dev_net_rcu()
     - tcp: cache RTAX_QUICKACK metric in a hot cache line
     - net: dst: add four helpers to annotate data-races around dst->dev
     - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
     - net: Add locking to protect skb->dev access in ip_output
     - mptcp: Call dst_release() in mptcp_active_enable().
     - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
     - mptcp: reset blackhole on success with non-loopback ifaces
     - NFSD: Define a proc_layoutcommit for the FlexFiles layout type
     - [arm64] cputype: Add Neoverse-V3AE definitions
     - [arm64] errata: Apply workarounds for Neoverse-V3AE
     - [amd64] dmaengine: Add missing cleanup on module unload
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56
     - exec: Fix incorrect type for ret
     - hfs: clear offset and space out of valid records in b-tree node
     - hfs: make proper initalization of struct hfs_find_data
     - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
     - hfs: validate record offset in hfsplus_bmap_alloc
     - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
     - dlm: check for defined force value in dlm_lockspace_release
     - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
     - hfsplus: return EIO when type of hidden directory mismatch in
       hfsplus_fill_super()
     - PCI: Test for bit underflow in pcie_set_readrq()
     - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock
     - drivers/perf: hisi: Relax the event ID check in the framework
     - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations
     - smb: server: let smb_direct_flush_send_list() invalidate a remote key
       first
     - PM: EM: Drop unused parameter from em_adjust_new_capacity()
     - PM: EM: Slightly reduce em_check_capacity_update() overhead
     - PM: EM: Move CPU capacity check to em_adjust_new_capacity()
     - PM: EM: Fix late boot with holes in CPU topology
     - net/mlx5e: Return 1 instead of 0 in invalid case in
       mlx5e_mpwrq_umr_entry_size()
     - rtnetlink: Allow deleting FDB entries in user namespace
     - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock
     - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE
     - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path
     - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ
     - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
     - net/smc: fix general protection fault in __smc_diag_dump
     - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race
       conditions
     - [arm64] mm: avoid always making PTE dirty in pte_mkwrite()
     - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
     - sctp: avoid NULL dereference when chunk data buffer is missing
     - net: phy: micrel: always set shared->phydev for LAN8814
     - net/mlx5: Fix IPsec cleanup over MPV device
     - fs/notify: call exportfs_encode_fid with s_umount
     - net: bonding: fix possible peer notify event loss or dup issue
     - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC
     - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
     - btrfs: directly free partially initialized fs_info in
       btrfs_check_leaked_roots()
     - gpio: pci-idio-16: Define maximum valid register address offset
     - gpio: 104-idio-16: Define maximum valid register address offset
     - xfs: fix locking in xchk_nlinks_collect_dir
     - Revert "cpuidle: menu: Avoid discarding useful information"
     - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts
     - slab: Fix obj_ext mistakenly considered NULL due to race condition
     - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
     - can: netlink: can_changelink(): allow disabling of automatic restart
     - cifs: Fix TCP_Server_Info::credits to be signed
     - ocfs2: clear extent cache after moving/defragmenting extents
     - vsock: fix lock inversion in vsock_assign_transport()
     - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection
     - net: usb: rtl8150: Fix frame padding
     - mm: prevent poison consumption when splitting THP
     - drm/amd/display: increase max link count and fix link->enc NULL pointer
       access
     - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked
     - [arm64] dts: broadcom: bcm2712: Add default GIC address cells
     - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt
     - [arm64] firmware: arm_scmi: Account for failed debug initialization
     - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing
       in raw mode
     - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region
     - [riscv64] Define pgprot_dmacoherent() for non-coherent devices
     - [riscv64] Don't print details of CPUs disabled in DT
     - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id()
     - hwmon: (sht3x) Fix error handling
     - nbd: override creds to kernel when calling sock_{send,recv}msg()
     - drm/panic: Fix drawing the logo on a small narrow screen
     - drm/panic: Fix qr_code, ensure vmargin is positive
     - [amd64] gpio: ljca: Fix duplicated IRQ mapping
     - io_uring: correct __must_hold annotation in io_install_fixed_file
     - sched: Remove never used code in mm_cid_get()
     - io_uring/sqpoll: switch away from getrusage() for CPU accounting
     - io_uring/sqpoll: be smarter on when to update the stime usage
     - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP
       (Closes: #1118660)
     - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL
       (CVE-2025-39678)
     - USB: serial: option: add UNISOC UIS7720
     - USB: serial: option: add Quectel RG255C
     - USB: serial: option: add Telit FN920C04 ECM compositions
     - usb/core/quirks: Add Huawei ME906S to wakeup quirk
     - usb: raw-gadget: do not limit transfer length
     - xhci: dbc: enable back DbC in resume if it was enabled before suspend
     - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall
       event
     - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples
     - [arm*] binder: remove "invalid inc weak" check
     - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106)
     - [amd64] mei: me: add wildcat lake P DID
     - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
     - [amd64,arm64] tcpm: switch check for role_sw device with fw_node
     - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp
     - serial: 8250_dw: handle reset control deassert error
     - serial: 8250_exar: add support for Advantech 2 port card with Device ID
       0x0018
     - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM
     - serial: sc16is7xx: remove useless enable of enhanced features
     - devcoredump: Fix circular locking dependency with devcd->mutex.
     - [arm64] mte: Do not warn if the page is already tagged in copy_highpage()
     - xfs: always warn about deprecated mount options
     - ksmbd: transport_ipc: validate payload size before reading handle
       (CVE-2025-40084)
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57
     - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083)
     - audit: record fanotify event regardless of presence of rules
     - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into
       INTEL_FIXED_BITS_MASK
     - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of
       current->mm == NULL
     - perf: Have get_perf_callchain() return NULL if crosstask and user are set
     - perf: Skip user unwind if the task is a kernel thread
     - seccomp: passthrough uprobe systemcall without filtering
     - [amd64] x86/bugs: Report correct retbleed mitigation status
     - [amd64] x86/bugs: Fix reporting of LFENCE retpoline
     - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16
     - cpuset: Use new excpus for nocpu error check when enabling root partition
     - btrfs: abort transaction on specific error places when walking log tree
     - btrfs: abort transaction in the process_one_buffer() log tree walk
       callback
     - btrfs: zoned: return error from btrfs_zone_finish_endio()
     - btrfs: zoned: refine extent allocator hint selection
     - btrfs: scrub: replace max_t()/min_t() with clamp() in
       scrub_throttle_dev_io()
     - btrfs: always drop log root tree reference in btrfs_replay_log()
     - btrfs: use level argument in log tree walk callback replay_one_buffer()
     - btrfs: abort transaction if we fail to update inode in log replay dir
       fixup
     - btrfs: tree-checker: add inode extref checks
     - btrfs: use smp_mb__after_atomic() when forcing COW in
       create_pending_snapshot()
     - sched_ext: Make qmap dump operation non-destructive
     - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c
     - docs: kdoc: handle the obsolescensce of docutils.ErrorString()
     - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR
     - f2fs: fix to avoid panic once fallocation fails for pinfile
       (CVE-2025-23130)
     - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
       (CVE-2025-38643)
     - bonding: return detailed error when loading native XDP fails
     - bonding: check xdp prog when set bond mode (CVE-2025-22105)
     - bits: add comments and newlines to #if, #else and #endif directives
     - bits: introduce fixed-type GENMASK_U*()
     - gpio: regmap: Allow to allocate regmap-irq device
     - gpio: regmap: add the .fixed_direction_output configuration parameter
     - gpio: idio-16: Define fixed direction of the GPIO lines
     - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)
     - wifi: ath12k: fix read pointer after free in
       ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995)
     - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf
       creation (CVE-2025-37803)
     - sfc: fix NULL dereferences in ef100_process_design_param()
       (CVE-2025-37860)
     - btrfs: tree-checker: fix bounds check in check_inode_extref()
 .
   [ Salvatore Bonaccorso ]
   * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module
     (Closes: #1109977)
 .
   [ Ben Hutchings ]
   * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
   * tools/hv: Make the sample hv_get_dhcp_info script more useful
   * hyperv-daemons: Install the sample network info scripts (Closes: #919350)
   * d/salsa-ci.yml: Fix cache configuration for build job
   * d/salsa-ci.yml: Move orig tarball generation to a separate job again
   * d/salsa-ci.yml: Restore lintian checking of source package
 .
 linux (6.12.48-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44
     - serial: 8250: fix panic due to PSLVERR
     - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
     - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
     - PM: runtime: Take active children into account in
       pm_runtime_get_if_in_use()
     - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
     - dm: Check for forbidden splitting of zone write operations
     - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
     - usb: gadget: udc: renesas_usb3: fix device leak at unbind
     - usb: musb: omap2430: fix device leak at unbind
     - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
     - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
     - bus: mhi: host: Fix endianness of BHI vector table
     - bus: mhi: host: Detect events pointing to unexpected TREs
     - vt: keyboard: Don't process Unicode characters in K_OFF mode
     - vt: defkeymap: Map keycodes above 127 to K_HOLE
     - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
     - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
       iMX8ULP
     - [amd64] crypto: qat - flush misc workqueue during device shutdown
     - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
     - ksmbd: fix refcount leak causing resource not released
     - ksmbd: extend the connection limiting mechanism to support IPv6
     - tracing: fprobe-event: Sanitize wildcard for fprobe event name
     - ext4: check fast symlink for ea_inode correctly
     - ext4: fix fsmap end of range reporting with bigalloc
     - ext4: fix reserved gdt blocks handling in fsmap
     - ext4: use kmalloc_array() for array space allocation
     - ext4: fix hole length calculation overflow in non-extent inodes
     - btrfs: zoned: fix write time activation failure for metadata block group
     - btrfs: fix incorrect log message for nobarrier mount option
     - btrfs: restore mount option info messages during mount
     - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
     - apparmor: Fix 8-byte alignment for initial dfa blob streams
     - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
     - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
       constraints
     - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
     - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
     - scsi: mpi3mr: Fix race between config read submit and interrupt completion
     - ata: libata-scsi: Fix ata_to_sense_error() status handling
     - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
       controllers
     - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
     - ata: libata-scsi: Fix CDL control
     - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
     - iio: imu: bno055: fix OOB access of hw_xlate array
     - iio: adc: ad_sigma_delta: change to buffer predisable
     - wifi: brcmsmac: Remove const from tbl_ptr parameter in
       wlc_lcnphy_common_read_table()
     - wifi: ath12k: fix dest ring-buffer corruption
     - wifi: ath12k: fix source ring-buffer corruption
     - wifi: ath12k: fix dest ring-buffer corruption when ring is full
     - wifi: ath11k: fix dest ring-buffer corruption
     - wifi: ath11k: fix source ring-buffer corruption
     - wifi: ath11k: fix dest ring-buffer corruption when ring is full
     - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately
     - [arm64] pwm: mediatek: Fix duty and period setting
     - mtd: spi-nor: Fix spi_nor_try_unlock_all()
     - [arm64] mtd: spinand: propagate spinand_wait() errors from
       spinand_write_page()
     - readahead: fix return value of page_cache_next_miss() when no hole is
       found
     - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
     - PCI: endpoint: Fix configfs group list head handling
     - PCI: endpoint: Fix configfs group removal on driver teardown
     - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
       in epc_features
     - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
       imx_pcie_{assert/deassert}_core_reset
     - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
     - vsock/virtio: Validate length in packet header before skb_put()
     - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
     - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
     - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
       resume context
     - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677)
     - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
     - kbuild: userprogs: use correct linker when mixing clang and GNU ld
     - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
     - media: gspca: Add bounds checking to firmware parser
     - media: hi556: correct the test pattern configuration
     - [armhf] media: imx: fix a potential memory leak in
       imx_media_csc_scaler_device_init()
     - media: ipu6: isys: Use correct pads for xlate_streams()
     - media: vivid: fix wrong pixel_array control size
     - media: verisilicon: Fix AV1 decoder clock frequency
     - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
     - media: usbtv: Lock resolution while streaming
     - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
     - media: pisp_be: Fix pm_runtime underrun in probe
     - media: ov2659: Fix memory leaks in ov2659_probe()
     - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
     - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
       calls
     - [arm64] media: qcom: camss: cleanup media device allocated resource on
       error path
     - [arm64] media: venus: Add a check for packet size after reading from
       shared memory
     - [arm64] media: venus: Fix MSM8998 frequency table
     - [arm64] media: venus: hfi: explicitly release IRQ during teardown
     - [arm64] media: venus: protect against spurious interrupts during probe
     - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
       240.
     - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
       240
     - drm/amdgpu/discovery: fix fw based ip discovery
     - drm/amd: Restore cached power limit during resume
     - drm/amdgpu: Avoid extra evict-restore process.
     - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
     - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
     - drm/amdgpu: Update external revid for GC v9.5.0
     - drm/amdgpu: update mmhub 3.0.1 client id mappings
     - drm/amdgpu: update mmhub 4.1.0 client id mappings
     - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
     - drm/amd/display: Add primary plane to commits for correct VRR handling
     - drm/amd/display: fix a Null pointer dereference vulnerability
     - drm/amd/display: Don't overwrite dce60_clk_mgr
     - net, hsr: reject HSR frame if skb can't hold tag
     - sched/ext: Fix invalid task state transitions on class switch
     - ipv6: sr: Fix MAC comparison to be constant-time
     - ACPI: pfr_update: Fix the driver update version check
     - mptcp: drop skb if MPTCP skb extension allocation fails
     - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
     - mm/damon/ops-common: ignore migration request to invalid nodes
     - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry
       are initialized to zero
     - USB: typec: Use str_enable_disable-like helpers
     - usb: typec: fusb302: cache PD RX state
     - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb()
     - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
     - btrfs: move transaction aborts to the error site in
       add_block_group_free_space()
     - btrfs: always abort transaction on failure to add block group to free
       space tree
     - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
     - btrfs: explicitly ref count block_group on new_bgs list
     - btrfs: codify pattern for adding block_group to bg_list
     - btrfs: zoned: requeue to unused block group list if zone finish failed
     - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
     - btrfs: send: factor out common logic when sending xattrs
     - btrfs: send: only use boolean variables at process_recorded_refs()
     - btrfs: send: add and use helper to rename current inode when processing
       refs
     - btrfs: send: keep the current inode's path cached
     - btrfs: send: avoid path allocation for the current inode when issuing
       commands
     - btrfs: send: use fallocate for hole punching with send stream v2
     - btrfs: send: make fs_path_len() inline and constify its argument
     - netfs: Fix unbuffered write error handling
     - io_uring/net: commit partial buffers on retry
     - ata: libata-scsi: Return aborted command when missing sense and result TF
     - sched_ext: initialize built-in idle state before ops.init()
     - Revert "can: ti_hecc: fix -Woverflow compiler warning"
     - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
     - iov_iter: iterate_folioq: fix handling of offset >= folio size
     - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
     - mmc: sdhci-pci-gli: Add a new function to simplify the code
     - memstick: Fix deadlock by moving removing flag earlier
     - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
     - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
     - NFS: Fix a race when updating an existing write
     - squashfs: fix memory leak in squashfs_fill_super
     - mm/debug_vm_pgtable: clear page table entries at destroy_args()
     - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
     - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
       830 G6
     - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
     - [s390x] sclp: Fix SCCB present check
     - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
     - kvm: retry nx_huge_page_recovery_thread creation
     - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
       kvcalloc()
     - drm/amdgpu/swm14: Update power limit logic
     - drm/amd/display: Avoid a NULL pointer dereference
     - drm/amd/display: Don't overclock DCE 6 by 15%
     - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
     - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
     - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
     - drm/amd/display: Find first CRTC and its line time in
       dce110_fill_display_configs
     - drm/amd/display: Fill display clock and vblank time in
       dce110_fill_display_configs
     - scsi: core: Fix command pass through retry regression
     - [arm64] soc: qcom: mdt_loader: Fix error return values in
       mdt_header_valid()
     - mptcp: remove duplicate sk_reset_timer call
     - mptcp: disable add_addr retransmission when timeout is 0
     - Mark xe driver as BROKEN if kernel page size is not 4kB
     - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support
     - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
     - [arm64] PCI: rockchip: Use standard PCIe definitions
     - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
     - iio: adc: ad7173: fix setting ODR in probe
     - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
     - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
     - ext4: preserve SB_I_VERSION on remount
     - btrfs: subpage: keep TOWRITE tag until folio is cleaned
     - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot
     - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC
     - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC
     - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
     - debugfs: fix mount options not being applied
     - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
     - fs/buffer: fix use-after-free when call bh_read() helper
     - use uniform permission checks for all mount propagation changes
     - cpuidle: menu: Remove iowait influence
     - cpuidle: governors: menu: Avoid selecting states with too much latency
     - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
     - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
     - ftrace: Also allocate and copy hash for reading of filter files
     - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
     - iio: proximity: isl29501: fix buffered read on big-endian systems
     - most: core: Drop device reference after usage in get_channel()
     - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
     - cdx: Fix off-by-one error in cdx_rpmsg_probe()
     - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
     - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
     - [amd64] comedi: pcl726: Prevent invalid irq number
     - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
       do_insnlist_ioctl()
     - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
       test
     - usb: renesas-xhci: Fix External ROM access timeouts
     - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
     - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
     - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
     - usb: typec: maxim_contaminant: disable low power mode when reading
       comparator values
     - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
       is clean
     - usb: xhci: Fix slot_id resource race conflict
     - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
     - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
     - usb: dwc3: pci: add support for the Intel Wildcat Lake
     - iio: light: Use aligned_s64 instead of open coding alignment.
     - iio: light: as73211: Ensure buffer holes are zeroed
     - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
     - tracing: Remove unneeded goto out logic
     - tracing: Limit access to parser->buffer when trace_get_user failed
     - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
     - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
     - [amd64] drm/i915/icl+/tc: Cache the max lane count value
     - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
     - tls: fix handling of zero-length records on the rx_list
     - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to
       aligned_s64
     - iio: imu: inv_icm42600: use = { } instead of memset()
     - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
     - iio: imu: inv_icm42600: change invalid data error to -EBUSY
     - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
     - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
     - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
       cpusets_insane_config_key
     - cgroup/cpuset: Fix a partition error with CPU hotplug
     - drm/panic: Move drawing functions to drm_draw
     - drm/format-helper: Add conversion from XRGB8888 to BGR888
     - drm/format-helper: Move helpers for pixel conversion to header file
     - drm/format-helper: Add generic conversion to 32-bit formats
     - iosys-map: Fix undefined behavior in iosys_map_clear()
     - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
     - RDMA/bnxt_re: Fix to do SRQ armena by default
     - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
     - RDMA/bnxt_re: Fix a possible memory leak in the driver
     - RDMA/bnxt_re: Fix to initialize the PBL array
     - RDMA/hns: Fix dip entries leak on devices newer than hip09
     - net: bridge: fix soft lockup in br_multicast_query_expired()
     - scsi: qla4xxx: Prevent a potential error pointer dereference
     - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
       (CVE-2025-38676)
     - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
     - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
     - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
     - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
     - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
     - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private
     - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
       init failed
     - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
     - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
     - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
     - drm/amd/display: Don't print errors for nonexistent connectors
     - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
     - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
     - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
     - ppp: fix race conditions in ppp_fill_forward_path
     - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
       firwmare reload.
     - cifs: Fix oops due to uninitialised variable
     - phy: mscc: Fix timestamping for vsc8584
     - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
     - gve: prevent ethtool ops after shutdown
     - net/smc: fix UAF on smcsk after smc_listen_out()
     - [s390x] mm: Do not map lowcore with identity mapping
     - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
     - igc: fix disabling L1.2 PCI-E link substate on I226 on init
     - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
     - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
     - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
       htb_activate
     - ALSA: timer: fix ida_free call while not allocated
     - bonding: update LACP activity flag after setting lacp_active
     - bonding: send LACPDUs periodically in passive mode after receiving
       partner's LACPDU
     - [arm64] Octeontx2-af: Skip overlap check for SPI field
     - net/mlx5: Base ECVF devlink port attrs from 0
     - net/mlx5: Relocate function declarations from port.h to mlx5_core.h
     - net/mlx5: Add IFC bits and enums for buf_ownership
     - net/mlx5e: Query FW for buffer ownership
     - net/mlx5e: Preserve shared buffer capacity during headroom updates
     - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
     - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
     - [s390x] hypfs: Enable limited access during lockdown
     - netfilter: nf_reject: don't leak dst refcount for loopback packets
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45
     - rtla: Check pkg-config install
     - trace/fgraph: Fix the warning caused by missing unregister notifier
     - of: dynamic: Fix memleak when of_pci_add_properties() failed
     - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
     - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
     - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
     - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
     - scsi: core: sysfs: Correct sysfs attributes access rights
     - smb: client: fix race with concurrent opens in unlink(2)
     - smb: client: fix race with concurrent opens in rename(2)
     - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
     - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
     - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
     - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
     - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
     - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
     - [arm64] drm/msm/kms: move snapshot init earlier in KMS init
     - [arm64] drm/msm: update the high bitfield of certain DSI registers
     - [arm64] drm/mediatek: Add error handling for old state CRTC in
       atomic_disable
     - [powerpc*] kvm: Fix ifdef to remove build warning
     - HID: input: rename hidinput_set_battery_charge_status()
     - HID: input: report battery status changes immediately
     - net: macb: fix unregister_netdev call order in macb_remove()
     - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
     - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
     - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
     - Bluetooth: hci_sync: fix set_local_name race condition
     - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
     - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
     - drm/nouveau: remove unused memory target test
     - ice: don't leave device non-functional if Tx scheduler config fails
     - ice: use fixed adapter index for E825C embedded devices
     - ice: fix incorrect counter for buffer allocation failures
     - dt-bindings: display/msm: qcom,mdp5: drop lut clock
     - net: dlink: fix multicast stats being counted incorrectly
     - drm/xe/xe_sync: avoid race during ufence signaling
     - drm/xe: Don't trigger rebind on initial dma-buf validation
     - phy: mscc: Fix when PTP clock is register and unregister
     - bnxt_en: Fix memory corruption when FW resources change during ifdown
     - bnxt_en: Adjust TX rings if reservation is less than requested
     - bnxt_en: Fix stats context reservation logic
     - net/mlx5: Reload auxiliary drivers on fw_activate
     - net/mlx5: Fix lockdep assertion on sync reset unload event
     - net/mlx5: Nack sync reset when SFs are present
     - net/mlx5e: Update and set Xon/Xoff upon MTU set
     - net/mlx5e: Update and set Xon/Xoff upon port speed set
     - net/mlx5e: Set local Xoff after FW update
     - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
     - net: stmmac: xgmac: Correct supported speed modes
     - net: stmmac: Set CIC bit only for TX queues with COE
     - [amd64,arm64] hv_netvsc: Link queues to NAPIs
     - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
       during channel open.
     - net: rose: split remove and free operations in rose_remove_neigh()
     - net: rose: convert 'use' field to refcount_t
     - net: rose: include node references in rose_neigh refcount
     - sctp: initialize more fields in sctp_v6_from_sk()
     - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
     - fbnic: Move phylink resume out of service_task and into open/close
     - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
     - net: macb: Disable clocks once
     - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
     - [riscv64] KVM: fix stack overrun when loading vlenb
     - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
     - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
       AMD/HYGON
     - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
     - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
     - HID: quirks: add support for Legion Go dual dinput modes
     - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
     - HID: wacom: Add a new Art Pen 2
     - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
     - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
     - blk-zoned: Fix a lockdep complaint about recursive locking
     - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
     - fs/smb: Fix inconsistent refcnt update
     - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
     - smb3 client: fix return code mapping of remap_file_range
     - xfs: do not propagate ENODATA disk errors into xattr code
     - drm/xe/vm: Clear the scratch_pt pointer on error
     - drm/nouveau/disp: Always accept linear modifier
     - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
     - drm/mediatek: Fix device/node reference count leaks in
       mtk_drm_get_all_drm_priv
     - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
     - net: rose: fix a typo in rose_clear_routes()
     - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS
     - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
     - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
       LANE0_1_STATUS"
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
       to static const
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
       sizes to driver data
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46
     - bpf: Add cookie object to bpf maps
     - bpf: Move bpf map owner out of common struct
     - bpf: Move cgroup iterator helpers to bpf.h
     - bpf: Fix oob access in cgroup local storage (CVE-2025-38502)
     - btrfs: fix race between logging inode and checking if it was logged before
     - btrfs: fix race between setting last_dir_index_offset and inode logging
     - btrfs: avoid load/store tearing races when checking if an inode was logged
     - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
     - drm/amd/display: Don't warn when missing DCE encoder caps
     - cpupower: Fix a bug where the -t option of the set subcommand was not
       working.
     - Bluetooth: hci_sync: Avoid adding default advertising on startup
     - btrfs: zoned: skip ZONE FINISH of conventional zones
     - fs: writeback: fix use-after-free in __mark_inode_dirty()
     - tee: fix NULL pointer dereference in tee_shm_put
     - tee: fix memory leak in tee_dyn_shm_alloc_helper
     - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
     - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
     - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
       i.MX8M Plus DHCOM
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
       Plus eDM SBC
     - HID: simplify snto32()
     - HID: stop exporting hid_snto32()
     - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
     - net: usb: qmi_wwan: fix Telit Cinterion FN990A name
     - net: usb: qmi_wwan: fix Telit Cinterion FE990A name
     - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition
     - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset
     - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
       power-up
     - wifi: cfg80211: fix use-after-free in cmp_bss()
     - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
       work
     - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
     - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
     - wifi: mt76: free pending offchannel tx frames on wcid cleanup
     - wifi: mt76: fix linked list corruption
     - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
       after confirm
     - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
     - wifi: iwlwifi: uefi: check DSM item validity
     - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
     - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
     - netfilter: nft_flowtable.sh: re-run with random mtu sizes
     - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
     - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
     - mISDN: Fix memory leak in dsp_hwec_enable()
     - bnxt_en: fix incorrect page count in RX aggr ring log
     - icmp: fix icmp_ndo_send address translation for reply direction
     - net: macb: Fix tx_ptr_lock locking
     - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
     - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
     - net: mctp: mctp_fraq_queue should take ownership of passed skb
     - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
     - [amd64,arm64] idpf: set mac type when adding and removing MAC filters
     - i40e: remove read access to debugfs files
     - i40e: Fix potential invalid access when MAC list is empty
     - ixgbe: fix incorrect map used in eee linkmode
     - wifi: ath11k: fix group data packet drops during rekey
     - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
     - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
     - net: skb: add pskb_network_may_pull_reason() helper
     - net: tunnel: add pskb_inet_may_pull_reason() helper
     - net: vxlan: add skb drop reasons to vxlan_rcv()
     - net: vxlan: make vxlan_snoop() return drop reasons
     - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
     - net: vxlan: make vxlan_set_mac() return drop reasons
     - net: vxlan: use kfree_skb_reason() in vxlan_xmit()
     - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit()
     - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE
     - vxlan: Refresh FDB 'updated' time upon 'NTF_USE'
     - vxlan: Avoid unnecessary updates to FDB 'used' time
     - vxlan: Add RCU read-side critical sections in the Tx path
     - vxlan: Rename FDB Tx lookup function
     - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
     - wifi: cw1200: cap SSID length in cw1200_do_join()
     - wifi: libertas: cap SSID len in lbs_associate()
     - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
     - [arm64] net: thunder_bgx: add a missing of_node_put
     - [arm64] net: thunder_bgx: decrement cleanup index before use
     - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
     - net/smc: Remove validation of reserved bits in CLC Decline message
     - mctp: return -ENOPROTOOPT for unknown getsockopt options
     - ax25: properly unshare skbs in ax25_kiss_rcv()
     - net: atm: fix memory leak in atm_register_sysfs when device_register fail
     - ppp: fix memory leak in pad_compress_skb
     - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
     - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
     - [amd64] accel/ivpu: Prevent recovery work from being queued during device
       removal
     - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
     - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
       CONFIG_DYNAMIC_FTRACE
     - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
     - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU
       (CVE-2025-38453)
     - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
       arch_sync_kernel_mappings()
     - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
     - mm: move page table sync declarations to linux/pgtable.h
     - mm: fix possible deadlock in kmemleak
     - mm: slub: avoid wake up kswapd in set_track_prepare
     - sched: Fix sched_numa_find_nth_cpu() if mask offline
     - ocfs2: prevent release journal inode after journal shutdown
     - of_numa: fix uninitialized memory nodes causing kernel panic
     - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
     - wifi: mwifiex: Initialize the chan_stats array to zero
     - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
     - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
     - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
     - net: ethernet: oa_tc6: Handle failure of spi_setup
     - drm/amdgpu: drop hw access in non-DC audio fini
     - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
     - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
       quirks list
     - scsi: lpfc: Fix buffer free/clear order in deferred receive path
     - batman-adv: fix OOB read/write in network-coding decode
     - cifs: prevent NULL pointer dereference in UTF16 conversion
     - e1000e: fix heap overflow in e1000_set_eeprom
     - net: pcs: rzn1-miic: Correct MODCTRL register offset
     - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306)
     - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported
     - [arm64,armhf] net: dsa: provide implementation of .support_eee()
     - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method
     - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272)
     - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125)
     - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
     - md/raid1,raid10: strip REQ_NOWAIT from member bios
     - ext4: define ext4_journal_destroy wrapper
     - ext4: avoid journaling sb update on error if journal is destroying
       (CVE-2025-22113)
     - wifi: ath11k: update channel list in reg notifier instead reg worker
       (CVE-2025-23133)
     - wifi: ath11k: update channel list in worker when wait flag is set
     - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
     - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
       (CVE-2025-22124)
     - mm: slub: Print the broken data before restoring them
     - mm: slub: call WARN() when detecting a slab corruption
     - mm, slab: cleanup slab_bug() parameters
     - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
     - nouveau: fix disabling the nonstall irq due to storm code
     - mm: fix accounting of memmap pages
     - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum
       threshold
     - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
     - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
     - Revert "drm/amdgpu: Avoid extra evict-restore process."
     - pcmcia: omap: Add missing check for platform_get_resource
     - pcmcia: Add error handling for add_interval() in do_validate_mem()
     - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
       quirk
     - [amd64] platform/x86/intel: power-domains: Use
       topology_logical_package_id() for package ID
     - block: add a queue_limits_commit_update_frozen helper
     - scsi: sr: Reinstate rotational media flag
     - drm/bridge: ti-sn65dsi86: fix REFCLK setting
     - perf bpf-event: Fix use-after-free in synthesis
     - perf bpf-utils: Constify bpil_array_desc
     - perf bpf-utils: Harden get_bpf_prog_info_linear
     - drm/amd/amdgpu: Fix missing error return on kzalloc failure
     - tools: gpio: remove the include directory on make clean
     - md: prevent incorrect update of resync/recovery offset
     - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
     - [riscv64] Only allow LTO with CMODEL_MEDANY
     - [riscv64] use lw when reading int cpu in new_vmalloc_check
     - [riscv64] use lw when reading int cpu in asm_per_cpu
     - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
     - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
     - md/raid1: fix data lost for writemostly rdev
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47
     - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
       - Documentation/hw-vuln: Add VMSCAPE documentation
       - x86/vmscape: Enumerate VMSCAPE bug
       - x86/vmscape: Add conditional IBPB mitigation
       - x86/vmscape: Enable the mitigation
       - x86/bugs: Move cpu_bugs_smt_update() down
       - x86/vmscape: Warn when STIBP is disabled with SMT
       - x86/vmscape: Add old Intel CPUs to affected list
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48
     - fhandle: use more consistent rules for decoding file handle from userns
     - dma-debug: store a phys_addr_t in struct dma_debug_entry
     - dma-mapping: trace dma_alloc/free direction
     - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using
       trace_dma_map
     - dma-mapping: trace more error paths
     - dma-debug: don't enforce dma mapping check on noncoherent allocations
     - net/mlx5: HWS, change error flow on matcher disconnect
     - mm: introduce and use {pgd,p4d}_populate_kernel()
     - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err
     - dma-debug: fix physical address calculation for struct dma_debug_entry
     - nvme-pci: skip nvme_write_sq_db on empty rqlist
     - Revert "udmabuf: fix vmap_udmabuf error page set"
     - ext4: introduce linear search for dentries
     - [amd64] drm/i915/pmu: Fix zero delta busyness issue
     - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed
     - Revert "drm/amd/display: Optimize cursor position updates"
     - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA
     - drm/amdgpu: Add back JPEG to video caps for carrizo and newer
     - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
     - SUNRPC: call xs_sock_process_cmsg for all cmsg
     - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
     - trace/fgraph: Fix error handling
     - tracing: Fix tracing_marker may trigger page fault during preempt_disable
     - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter
     - nfs/localio: add direct IO enablement with sync and async IO support
     - nfs/localio: restore creds before releasing pageio data
     - ftrace/samples: Fix function size computation
     - fs/nfs/io: make nfs_start_io_*() killable
     - NFS: Serialise O_DIRECT i/o and truncate()
     - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
     - NFSv4.2: Serialise O_DIRECT i/o and clone range
     - NFSv4.2: Serialise O_DIRECT i/o and copy range
     - NFS: nfs_invalidate_folio() must observe the offset and size arguments
     - NFSv4/flexfiles: Fix layout merge mirror check.
     - tracing: Silence warning when chunk allocation fails in trace_pid_write
     - [s390x] pai: Deny all events not handled by this PMU
     - [s390x] cpum_cf: Deny all sampling events by counter PMU
     - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
     - bpf: Allow fall back to interpreter for programs with stack size <= 512
     - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
     - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
       psock->cork.
     - proc: fix type confusion in pde_set_flags()
     - Revert "SUNRPC: Don't allow waiting for exiting tasks"
     - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
     - ocfs2: fix recursive semaphore deadlock in fiemap call
     - btrfs: fix squota compressed stats leak
     - btrfs: fix subvolume deletion lockup caused by inodes xarray race
     - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
     - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
       wakeups
     - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
     - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
     - fuse: do not allow mapping a non-regular backing file
     - fuse: check if copy_file_range() returns larger than requested size
     - fuse: prevent overflow in copy_file_range return value
     - mm/khugepaged: fix the address passed to notifier on testing young
     - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
       memory
     - mm/memory-failure: fix redundant updates for already poisoned pages
     - mm/damon/core: set quota->charged_from to jiffies at first charge window
     - mm/damon/lru_sort: avoid divide-by-zero in
       damon_lru_sort_apply_parameters()
     - [arm64] drm/mediatek: fix potential OF node use-after-free
     - drm/xe: Attempt to bring bos back to VRAM after eviction
     - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
     - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
     - netlink: specs: mptcp: add missing 'server-side' attr
     - netlink: specs: mptcp: clearly mention attributes
     - netlink: specs: mptcp: replace underscores with dashes in names
     - netlink: specs: mptcp: fix if-idx attribute type
     - kernfs: Fix UAF in polling when open file is released
     - libceph: fix invalid accesses to ceph_connection_v1_info
     - ceph: fix race condition validating r_parent before applying state
     - ceph: fix race condition where r_parent becomes stale before sending
       message
     - mm/damon/sysfs: fix use-after-free in state_show()
     - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
     - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
     - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
     - btrfs: use readahead_expand() on compressed extents
     - btrfs: fix corruption reading compressed range when block size is smaller
       than page size
     - hrtimers: Unconditionally update target CPU base after offline timer
       migration
     - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
     - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
       runtime PM wakeups"
     - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
     - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
     - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
     - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
     - [arm64] drm/panthor: validate group queue count
     - [arm64,armhf] net: fec: Fix possible NPD in
       fec_enet_phy_reset_after_clk_enable()
     - genetlink: fix genl_bind() invoking bind() after -EPERM
     - net: bridge: Bounce invalid boolopts
     - tunnels: reset the GSO metadata before reusing the skb
     - docs: networking: can: change bcm_msg_head frames member to support
       flexible array
     - igb: fix link test skipping when interface is admin down
     - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
     - drm/amd/display: use udelay rather than fsleep
     - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
       j1939_local_ecu_get() failed
     - can: j1939: j1939_local_ecu_get(): undo increment when
       j1939_local_ecu_get() fails
     - netfilter: nft_set_pipapo: remove unused arguments
     - netfilter: nft_set: remove one argument from lookup and update functions
     - netfilter: nft_set_pipapo: merge pipapo_get/lookup
     - netfilter: nft_set_pipapo: don't return bogus extension pointer
     - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
     - netfilter: nft_set_rbtree: continue traversal if element is inactive
     - netfilter: nf_tables: Reintroduce shortened deletion notifications
     - netfilter: nf_tables: place base_seq in struct net
     - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
     - netfilter: nf_tables: restart set lookup on base_seq change
     - net: hsr: Add VLAN CTAG filter support
     - hsr: use rtnl lock when iterating over ports
     - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
     - [amd64] dmaengine: idxd: Remove improper idxd_free
     - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
     - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
     - [amd64] dmaengine: ti: edma: Fix memory allocation size for
       queue_priority_map
     - xhci: fix memory leak regression when freeing xhci vdev devices depth
       first
     - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
     - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
       drivers
     - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
       num-channels/ees
     - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
     - [armhf] phy: ti: omap-usb2: fix device leak at unbind
     - [armhf] phy: ti-pipe3: fix device leak at unbind
     - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
     - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
     - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
     - drm/amdgpu: fix a memory leak in fence cleanup when unloading
     - netfilter: nft_set_pipapo: fix null deref for empty set
 .
   [ Santiago Ruano Rincón ]
   * d/salsa-ci.yml: Merge the extract-source job into the build's job script
   * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
     lintian tags.
   * d/salsa-ci.yml: Early move orig tarballs back where they can be cached
 .
   [ Salvatore Bonaccorso ]
   * [rt] Add new signing key for Daniel Wagner
   * [rt] Update to 6.12.43-rt12
   * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support
   * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX
   * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count
     transitions
Checksums-Sha1:
 f1bd9fed974b724a92319884ee894f4106436969 219284 linux_6.12.57-1~bpo12+1.dsc
 dcc8bab0a40565ace3e0e5199108ef7820fb15b4 1733052 linux_6.12.57-1~bpo12+1.debian.tar.xz
 e32c8cbeed6d6ba9058c1f53a74dc33a0861f0b4 6485 linux_6.12.57-1~bpo12+1_source.buildinfo
Checksums-Sha256:
 16fe45f145c8167a39cce476632c6d08d40265413383b3822a2c0e45a310e739 219284 linux_6.12.57-1~bpo12+1.dsc
 2230c422c56ad4321007010846d8bed855f21f01bacc2c0ad6b8cc21afdeca41 1733052 linux_6.12.57-1~bpo12+1.debian.tar.xz
 d24234bcb7e3c8434996af15a6fb22c108f9127a25db05bef887ca5531139edf 6485 linux_6.12.57-1~bpo12+1_source.buildinfo
Files:
 a331bf069f0a7a70a872724576a18c6f 219284 kernel optional linux_6.12.57-1~bpo12+1.dsc
 b9aa610ceeb7bf86e14eab0c97541511 1733052 kernel optional linux_6.12.57-1~bpo12+1.debian.tar.xz
 15dd0fc370917b08df37d345007718cf 6485 kernel optional linux_6.12.57-1~bpo12+1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmkbawAACgkQ57/I7JWG
EQnanBAAphP+V8BrbXtgqFSVq0DTM88Umn1wNKy1k8S0Oanb4XtHdt1QcZjwrE7X
ugS+/78pNp1AEWT7TZ8lPGT3p1ADFAsUdw8Qt7NKLNoECZqeY2A9w44Qa+GrpKrq
6IF2Sw8Mg9b4D/WkdLmDac9PE4M6vc12Cb5FJ46w8Sc+JdJnhTbCWGJE1ewPtUiK
8MyoHhNlbFQ1uDRCF1fPIcwK1spOzivn/01VXQ9eeDje0yGfFSbnBRQqgu6wVZrm
LNCxg0Qa0GiB/MA/JFDJD5c/55VvpcGL8NeWVbJQaaP4HEbMqpo/x1hVFgdj0cSP
dRIvTRSZuyiLInMGETiCfJnzcxkoBgNzhzIBfV+97Z66WcqEoT5sAoKnutpoyTGf
pPV5pKEHfwPafikwjZgtyDcy1lK8eBDboXe2iOyQ26nnrZ7DTaSPH3Wz8F6SZQnq
jOqV5f3e6fmLAiwxy3tVvWGr9dAo6WzipDHxTfbeH5fuXBYfsjjUNZaotSlGeHFz
dQY+CjIW1ncxu+nGJbFkm7/k/U5/FfdHrMOudNOUXfqKn2V4atDqwrhKJubcG2Ad
euohUm0qmOHrzmMz6T0zxHbFsQ1NMQVWo9egOQyQvCbUqhfseXmYspK1WLzu13oE
+L7SBQpzcqYm62CrrjfJSkmfLGZs5N93gK9ZnUjYDJSkBpWz9HE=
=mb3U
-----END PGP SIGNATURE-----