Accepted linux 6.16.12-1~bpo13+1 (source) into stable-backports

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 17 Nov 2025 19:52:25 +0100
Source: linux
Architecture: source
Version: 6.16.12-1~bpo13+1
Distribution: trixie-backports
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 1110703 1113681 1113765 1114806 1114898 1115002 1118100
Changes:
 linux (6.16.12-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports
   * d/salsa-ci.yml: Adjust filenames to allow source package name suffix
   * d/salsa-ci.yml: Fix cache configuration for build job
   * d/salsa-ci.yml: Move orig tarball generation to a separate job again
   * d/salsa-ci.yml: Restore lintian checking of source package
 .
 linux (6.16.12-2) unstable; urgency=medium
 .
   * docs: kdoc: handle the obsolescensce of docutils.ErrorString()
     (Closes: #1118100)
 .
 linux (6.16.12-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.12
     - ALSA: hda/tas2781: Fix the order of TAS2781 calibrated-data
     - drm/amdgpu: Enable MES lr_compute_wa by default
     - wifi: rtw89: mcc: stop TX during MCC prepare
     - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
     - USB: serial: option: add SIMCom 8230C compositions
     - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
     - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
     - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
     - gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05
     - [amd64] ASoC: rt712: avoid skipping the blind write
     - dm-integrity: limit MAX_TAG_SIZE to 255
     - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
       list
     - drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 GPUs
     - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
     - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
     - btrfs: ref-verify: handle damaged extent root tree
     - netfs: Prevent duplicate unlocking
     - iommufd: WARN if an object is aborted with an elevated refcount
     - can: hi311x: fix null pointer dereference when resuming from sleep before
       interface was enabled
     - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
       quirks list
     - hid: fix I2C read buffer overflow in raw_event() for mcp2221
     - nvmem: layouts: fix automatic module loading
     - binder: fix double-free in dbitmap
     - driver core: faux: Set power.no_pm for faux devices
     - driver core/PM: Set power.no_callbacks along with power.no_pm
     - crypto: rng - Ensure set_ent is always present
     - net/9p: fix double req put in p9_fd_cancelled
     - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
       I/O
     - ring buffer: Propagate __rb_map_vma return value to caller
 .
 linux (6.16.11-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.11
     - blk-mq: fix blk_mq_tags double free while nr_requests grown
     - scsi: target: target_core_configfs: Add length check to avoid buffer
       overflow
     - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
     - media: b2c2: Fix use-after-free causing by irq_check_work in
       flexcop_pci_remove
     - media: tuner: xc5000: Fix use-after-free in xc5000_release
     - media: rc: fix races with imon_disconnect()
     - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
     - mm: swap: check for stable address space before operating on the VMA
     - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
     - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
 .
 linux (6.16.10-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.10
     - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
     - firewire: core: fix overlooked update of subsystem ABI version
     - ALSA: usb-audio: Fix code alignment in mixer_quirks
     - ALSA: usb-audio: Fix whitespace & blank line issues in mixer_quirks
     - ALSA: usb-audio: Fix block comments in mixer_quirks
     - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
     - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
     - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
     - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
     - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
     - HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in
       case of Apple Touch Bar
     - HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in
       Apple Touch Bar
     - HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar
       even without a HID_DG_CONTACTMAX field
     - HID: multitouch: specify that Apple Touch Bar is direct
     - ALSA: usb-audio: Convert comma to semicolon
     - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
     - usb: core: Add 0x prefix to quirks debug output
     - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
       fec_imx6sx_info
     - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
     - [arm64,armhf] drm/panfrost: Drop duplicated Mediatek supplies arrays
     - [arm64,armhf] drm/panfrost: Commonize Mediatek power domain array
       definitions
     - [arm64,armhf] drm/panfrost: Add support for Mali on the MT8370 SoC
     - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
     - i2c: designware: Add quirk for Intel Xe
     - [amd64] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match
       table.
     - [amd64] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in
       PTL match table
     - [amd64] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support
       for PTL.
     - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
     - gpiolib: acpi: Add quirk for ASUS ProArt PX13
     - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
     - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
     - net: sfp: add quirk for FLYPRO copper SFP+ module
     - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
     - HID: cp2112: fix setter callbacks return value
     - [amd64] HID: amd_sfh: Add sync across amd sfh work functions
     - [arm64] dts: rockchip: Fix the headphone detection on the orangepi 5
     - firmware: imx: Add stub functions for SCMI MISC API
     - firmware: imx: Add stub functions for SCMI LMM API
     - firmware: imx: Add stub functions for SCMI CPU API
     - [arm64] dts: imx8mp: Correct thermal sensor index
     - cpufreq: Initialize cpufreq-based invariance before subsys
     - smb: server: don't use delayed_work for post_recv_credits_work
     - smb: server: use disable_work_sync in transport_rdma.c
     - bpf: Check the helper function is valid in get_helper_proto
     - btrfs: don't allow adding block device of less than 1 MB
     - NFS: Protect against 'eof page pollution'
     - NFSv4.2: Protect copy offload and clone against 'eof page pollution'
     - drm/amdkfd: fix p2p links bug in topology
     - amd/amdkfd: correct mem limit calculation for small APUs
     - wifi: virt_wifi: Fix page fault on connect
     - bpf: Reject bpf_timer for PREEMPT_RT
     - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
     - xfrm: fix offloading of cross-family tunnels
     - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
     - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
       overflow
     - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
     - can: peak_usb: fix shift-out-of-bounds issue
     - net: tun: Update napi->skb after XDP process
     - net/smc: fix warning in smc_rx_splice() when calling get_page()
     - [arm64] ethernet: rvu-af: Remove slash from the driver name
     - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
     - Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
     - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
     - vhost: Take a reference on the task in struct vhost_task.
     - Bluetooth: MGMT: Fix possible UAFs
     - broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
     - broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
     - bnxt_en: correct offset handling for IPv6 destination address
     - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
     - nexthop: Forbid FDB status change while nexthop is in a group
     - net/mlx5: fs, fix UAF in flow counter release
     - net/mlx5: HWS, remove unused create_dest_array parameter
     - net/mlx5: HWS, ignore flow level for multi-dest table
     - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
     - [arm64] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
     - [amd64] drm/gma500: Fix null dereference in hdmi teardown
     - futex: Prevent use-after-free during requeue-PI
     - gpio: regmap: fix memory leak of gpio_regmap structure
     - drm/xe/vf: Don't expose sysfs attributes not applicable for VFs
     - drm/xe: Fix build with CONFIG_MODULES=n
     - [amd64] drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER
     - drm/amd/display: remove output_tf_change flag
     - futex: Use correct exit on failure from futex_hash_allocate_default()
     - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
     - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
     - smb: client: fix wrong index reference in smb2_compound_op()
     - Revert "drm/xe/guc: Set RCS/CCS yield policy"
     - Revert "drm/xe/guc: Enable extended CAT error reporting"
     - tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()
     - HID: asus: add support for missing PX series fn keys
     - i40e: add validation for ring_len param
     - i40e: fix idx validation in i40e_validate_queue_map
     - i40e: fix idx validation in config queues msg
     - i40e: fix input validation logic for action_meta
     - i40e: fix validation of VF state in get resources
     - i40e: add max boundary check for VF filters
     - i40e: add mask to apply valid bits for itr_idx
     - i40e: improve VF MAC filters accounting
     - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
     - tracing: dynevent: Add a missing lockdown check on dynevent
     - tracing: fgraph: Protect return handler from recursion loop
     - tracing: fprobe: Fix to remove recorded module addresses from filter
     - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
     - [arm64] dts: marvell: cn913x-solidrun: fix sata ports status
     - drm/xe: Don't copy pinned kernel bos twice on suspend
     - drm/ast: Use msleep instead of mdelay for edid read
     - drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume
     - Revert "vhost/net: Defer TX queue re-enable until after sendmsg"
     - vhost-net: flush batched before enabling notifications
     - afs: Fix potential null pointer dereference in afs_put_server
     - fs/proc/task_mmu: check p->vec_buf for NULL
     - gpiolib: Extend software-node support to support secondary software-nodes
     - netfs: fix reference leak
     - [riscv64] Use an atomic xchg in pudp_huge_get_and_clear()
     - [amd64] x86/topology: Implement topology_is_core_online() to address SMT
       regression
     - mm/hugetlb: fix folio is still mapped when deleted
     - mm/damon/sysfs: do not ignore callback's return value in
       damon_sysfs_damon_call()
     - fbcon: fix integer overflow in fbcon_do_set_font
     - fbcon: Fix OOB access in font allocation
     - wifi: iwlwifi: fix byte count table for old devices
     - wifi: iwlwifi: pcie: fix byte count table for some devices
     - sched_ext: idle: Make local functions static in ext_idle.c
     - sched_ext: idle: Handle migration-disabled tasks in BPF code
     - spi: cadence-quadspi: Implement refcount to handle unbind during busy
     - spi: cadence-qspi: defer runtime support on socfpga if reset bit is
       enabled
     - iommufd: Fix race during abort for file descriptors
 .
 linux (6.16.9-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.9
     - cgroup: split cgroup_destroy_wq into 3 workqueues
     - btrfs: fix invalid extref key setup when replaying dentry
     - btrfs: zoned: fix incorrect ASSERT in btrfs_zoned_reserve_data_reloc_bg()
     - perf maps: Ensure kmap is set up for all inserts
     - wifi: wilc1000: avoid buffer overflow in WID string configuration
     - nvme: fix PI insert on write
     - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
       supported
     - wifi: mt76: do not add non-sta wcid entries to the poll list
     - wifi: mac80211: increase scan_ies_len for S1G
     - wifi: mac80211: fix incorrect type for ret
     - smb: server: let smb_direct_writev() respect SMB_DIRECT_MAX_SEND_SGES
     - net/mlx5: Not returning mlx5_link_info table when speed is unknown
     - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
     - dpll: fix clock quality level reporting
     - rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()
     - rxrpc: Fix untrusted unsigned subtract
     - qed: Don't collect too many protection override GRC elements
     - net: dst_metadata: fix IP_DF bit not extracted from tunnel headers
     - bonding: set random address only when slaves already exist
     - mptcp: set remote_deny_join_id0 on SYN recv
     - mptcp: tfo: record 'deny join id0' info
     - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
     - ice: fix Rx page leak on multi-buffer frames
     - i40e: remove redundant memory barrier when cleaning Tx descs
     - ixgbe: initialize aci.lock before it's used
     - ixgbe: destroy aci.lock later within ixgbe_remove path
     - igc: don't fail igc_probe() on LED setup error
     - doc/netlink: Fix typos in operation attributes
     - net/mlx5e: Harden uplink netdev access against device unbind
     - net/mlx5e: Add a miss level for ipsec crypto offload
     - bonding: don't set oif to bond dev when getting NS target destination
     - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
     - tls: make sure to abort the stream if headers are bogus
     - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
     - net: clear sk->sk_ino in sk_set_socket(sk, NULL)
     - net: liquidio: fix overflow in octeon_init_instr_queue()
     - cnic: Fix use-after-free bugs in cnic_delete_task
     - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
     - ksmbd: smbdirect: validate data_offset and data_length field of
       smb_direct_data_transfer
     - ksmbd: smbdirect: verify remaining_data_length respects
       max_fragmented_recv_size
     - zram: fix slot write race condition
     - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
     - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
     - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
     - power: supply: bq27xxx: restrict no-battery detection to bq27000
     - Revert "sched_ext: Skip per-CPU tasks in scx_bpf_reenqueue_local()"
     - btrfs: initialize inode::file_extent_tree after i_mode has been set
     - dm-raid: don't set io_min and io_opt for raid1
     - dm-stripe: fix a possible integer overflow
     - mm/gup: check ref_count instead of lru before migration
     - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
       batch"
     - gup: optimize longterm pin_user_pages() for large folio
     - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
     - mm: revert "mm: vmscan.c: fix OOM on swap stress test"
     - mm: folio_may_be_lru_cached() unless folio_test_large()
     - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
       switch_to_super_page()
     - [amd64] iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
     - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
     - [s390x] iommu/s390: Fix memory corruption when using identity domain
     - [s390x] iommu/s390: Make attach succeed when the device was surprise
       removed
     - btrfs: tree-checker: fix the incorrect inode ref size check
     - [amd64] ASoC: SDCA: Add quirk for incorrect function types for 3 systems
     - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
       interface
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
       source graph failed
     - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
     - [armhf] mmc: mvsdio: Fix dma_unmap_sg() nents value
     - mmc: sdhci: Move the code related to setting the clock from
       sdhci_set_ios_common() into sdhci_set_ios()
     - mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a
       power-on
     - mmc: sdhci-uhs2: Fix calling incorrect sdhci_set_clock() function
     - x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT
     - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
       active
     - drm/amdkfd: add proper handling for S0ix
     - drm/amdgpu: suspend KFD and KGD user queues for S0ix
     - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
     - drm/amd: Only restore cached manual clock settings in restore if OD
       enabled
     - io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow
     - io_uring: include dying ring in task_work "should cancel" state
     - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
     - gpiolib: acpi: initialize acpi_gpio_info struct
     - [amd64] crypto: ccp - Always pass in an error pointer to
       __sev_platform_shutdown_locked()
     - rds: ib: Increment i_fastreg_wrs before bailing out
     - mptcp: propagate shutdown to subflows when possible
     - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
     - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
       message
     - [amd64] ASoC: SDCA: Fix return value in sdca_regmap_mbq_size()
     - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
     - [amd64] iommu/amd: Fix alias device DTE setting
     - [amd64] ASoC: amd: acp: Fix incorrect retrival of acp_chip_info
     - drm/xe/tile: Release kobject for the failure path
     - drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation
     - [arm64] drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
     - [arm64] drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
     - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
     - ALSA: usb: qcom: Fix false-positive address space check
     - drm/xe: Fix error handling if PXP fails to start
     - drm/xe/guc: Enable extended CAT error reporting
     - drm/xe/guc: Set RCS/CCS yield policy
     - smb: smbdirect: introduce smbdirect_socket.recv_io.expected
     - smb: client: make use of smbdirect_socket->recv_io.expected
     - smb: smbdirect: introduce struct smbdirect_recv_io
     - smb: client: make use of struct smbdirect_recv_io
     - smb: client: let recv_done verify data_offset, data_length and
       remaining_data_length
     - smb: client: fix filename matching of deferred files
     - smb: client: use disable[_delayed]_work_sync in smbdirect.c
     - smb: client: let smbd_destroy() call
       disable_work_sync(&info->post_send_credits_work)
     - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
     - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
     - smb: client: fix file open check in __cifs_unlink()
     - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
     - io_uring: fix incorrect io_kiocb reference in io_link_skb
     - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
       ASUS ROG Z13
     - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
     - mptcp: pm: nl: announce deny-join-id0 flag
     - dt-bindings: serial: 8250: allow clock 'uartclk' and 'reg' for
       nxp,lpc1850-uart
     - dt-bindings: serial: 8250: spacemit: set clocks property as required
     - dt-bindings: serial: 8250: move a constraint
     - clk: sunxi-ng: mp: Fix dual-divider clock rate readback
 .
 linux (6.16.8-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.8
     - fs: add a FMODE_ flag to indicate IOCB_HAS_METADATA availability
     - block: don't silently ignore metadata for sync read/write
     - coredump: don't pointlessly check and spew warnings
     - fuse: Block access to folio overlimit
     - fhandle: use more consistent rules for decoding file handle from userns
     - dma-debug: don't enforce dma mapping check on noncoherent allocations
     - perf: Fix the POLL_HUP delivery breakage
     - [arm64] irqchip/mvebu-gicp: Fix an IS_ERR() vs NULL check in probe()
     - Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
     - [amd64] iommu/vt-d: Split intel_iommu_domain_alloc_paging_flags()
     - [amd64] iommu/vt-d: Create unique domain ops for each stage
     - [amd64] iommu/vt-d: Split paging_domain_compatible()
     - [amd64] iommu/vt-d: Make iotlb_sync_map a static property of dmar_domain
     - Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
     - Bluetooth: ISO: Fix getname not returning broadcast fields
     - Revert "drm/amdgpu: Add more checks to PSP mailbox" (Closes: #1114806)
     - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
     - SUNRPC: call xs_sock_process_cmsg for all cmsg
     - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
     - md: keep recovery_cp in mdp_superblock_s
     - trace/fgraph: Fix error handling
     - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
     - NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported
     - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
     - tracing: Fix tracing_marker may trigger page fault during preempt_disable
     - nfs/localio: restore creds before releasing pageio data
     - ftrace/samples: Fix function size computation
     - tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()
     - NFS: Serialise O_DIRECT i/o and truncate()
     - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
     - NFSv4.2: Serialise O_DIRECT i/o and clone range
     - NFSv4.2: Serialise O_DIRECT i/o and copy range
     - NFS: nfs_invalidate_folio() must observe the offset and size arguments
     - NFSv4/flexfiles: Fix layout merge mirror check.
     - tracing: Silence warning when chunk allocation fails in trace_pid_write
     - bpf, cpumap: Disable page_pool direct xdp_return need larger scope
     - [amd64] cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode
       for performance governor
     - [s390x] pai: Deny all events not handled by this PMU
     - [s390x] cpum_cf: Deny all sampling events by counter PMU
     - [amd64] cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume
     - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
     - xsk: Fix immature cq descriptor production
     - rqspinlock: Choose trylock fallback for NMI waiters
     - bpf: Allow fall back to interpreter for programs with stack size <= 512
     - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
     - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
       psock->cork.
     - proc: fix type confusion in pde_set_flags()
     - Revert "SUNRPC: Don't allow waiting for exiting tasks"
     - [arm64] kexec: initialize kexec_buf struct in load_other_segments()
     - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
     - doc: mptcp: net.mptcp.pm_type is deprecated
     - netlink: specs: mptcp: fix if-idx attribute type
     - ocfs2: fix recursive semaphore deadlock in fiemap call
     - btrfs: fix squota compressed stats leak
     - btrfs: fix subvolume deletion lockup caused by inodes xarray race
     - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
     - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
       wakeups
     - PM: EM: Add function for registering a PD without capacity update
     - PM: hibernate: Restrict GFP mask in hibernation_snapshot()
       (Closes: #1115002)
     - wifi: iwlwifi: fix 130/1030 configs
     - [s390x] kexec: initialize kexec_buf struct
     - smb: client: fix compound alignment with encryption
     - smb: client: fix data loss due to broken rename(2)
     - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
     - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
     - fuse: do not allow mapping a non-regular backing file
     - fuse: check if copy_file_range() returns larger than requested size
     - fuse: prevent overflow in copy_file_range return value
     - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
     - mm/khugepaged: fix the address passed to notifier on testing young
     - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
     - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
       memory
     - mm/memory-failure: fix redundant updates for already poisoned pages
     - mm/damon/core: set quota->charged_from to jiffies at first charge window
     - mm/damon/lru_sort: avoid divide-by-zero in
       damon_lru_sort_apply_parameters()
     - [arm64] drm/mediatek: fix potential OF node use-after-free
     - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
     - drm/xe: Attempt to bring bos back to VRAM after eviction
     - drm/xe: Allow the pm notifier to continue on failure
     - drm/xe: Block exec and rebind worker while evicting for suspend /
       hibernate
     - drm/amdgpu: fix a memory leak in fence cleanup when unloading
     - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
     - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
     - drm/amd/display: Correct sequences and delays for DCN35 PG & RCG
     - drm/amd/display: remove oem i2c adapter on finish
     - drm/edid: Define the quirks in an enum list
     - drm/edid: Add support for quirks visible to DRM core and drivers
     - drm/dp: Add an EDID quirk for the DPCD register access probe
     - drm/amd/display: Disable DPCD Probe Quirk
     - btrfs: use readahead_expand() on compressed extents
     - btrfs: fix corruption reading compressed range when block size is smaller
       than page size
     - kernfs: Fix UAF in polling when open file is released
     - libceph: fix invalid accesses to ceph_connection_v1_info
     - ceph: fix race condition validating r_parent before applying state
     - ceph: fix race condition where r_parent becomes stale before sending
       message
     - ceph: always call ceph_shift_unused_folios_left()
     - ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
     - [arm64] mtd: spinand: Add a ->configure_chip() hook
     - [arm64] mtd: spinand: winbond: Enable high-speed modes on w25n0xjw
     - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
     - mm/damon/sysfs: fix use-after-free in state_show()
     - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
     - drm/amd/display: Destroy cached state in complete() callback
     - drm/amd/display: Drop dm_prepare_suspend() and dm_complete()
     - drm/amd/amdgpu: Declare isp firmware binary file
     - hrtimers: Unconditionally update target CPU base after offline timer
       migration
     - fs/resctrl: Eliminate false positive lockdep warning when reading SNC
       counters
     - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
     - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
     - Input: xpad - add support for Flydigi Apex 5
     - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
       runtime PM wakeups"
     - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
     - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
     - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
     - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
     - [arm64] drm/panthor: validate group queue count
     - [arm64,armhf] net: fec: Fix possible NPD in
       fec_enet_phy_reset_after_clk_enable()
     - net: phylink: add lock for serializing concurrent pl->phydev writes with
       resolver
     - net: phy: transfer phy_config_inband() locking responsibility to phylink
     - wifi: ath12k: Fix missing station power save configuration
     - wifi: ath12k: add link support for multi-link in arsta
     - wifi: ath12k: Add support to enqueue management frame at MLD level
     - wifi: ath12k: fix WMI TLV header misalignment
     - [armhf] PCI: mvebu: Fix use of for_each_of_range() iterator
     - genetlink: fix genl_bind() invoking bind() after -EPERM
     - [armhf] net: dsa: b53: fix ageing time for BCM53101
     - net: bridge: Bounce invalid boolopts
     - tunnels: reset the GSO metadata before reusing the skb
     - docs: networking: can: change bcm_msg_head frames member to support
       flexible array
     - igb: Fix NULL pointer dereference in ethtool loopback test
     - igb: fix link test skipping when interface is admin down
     - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
     - drm/xe/configfs: Don't touch survivability_mode on fini
     - drm/amd/display: use udelay rather than fsleep
     - net: dev_ioctl: take ops lock in hwtstamp lower paths
     - macsec: sync features on RTM_NEWLINK
     - can: j1939: implement NETDEV_UNREGISTER notification handler
     - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
       j1939_local_ecu_get() failed
     - can: j1939: j1939_local_ecu_get(): undo increment when
       j1939_local_ecu_get() fails
     - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation
     - netfilter: nft_set_pipapo: remove unused arguments
     - netfilter: nft_set: remove one argument from lookup and update functions
     - netfilter: nft_set_pipapo: merge pipapo_get/lookup
     - netfilter: nft_set_pipapo: don't return bogus extension pointer
     - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
     - netfilter: nft_set_rbtree: continue traversal if element is inactive
     - netfilter: nf_tables: Reintroduce shortened deletion notifications
     - netfilter: nf_tables: place base_seq in struct net
     - netfilter: nf_tables: make nft_set_do_lookup available unconditionally
     - netfilter: nf_tables: restart set lookup on base_seq change
     - hsr: use rtnl lock when iterating over ports
     - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
     - hsr: hold rcu and dev lock for hsr_get_port_ndev
     - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
     - [amd64] dmaengine: idxd: Remove improper idxd_free
     - [amd64] dmaengine: idxd: Fix refcount underflow on module unload
     - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
     - erofs: get rid of {get,put}_page() for ztailpacking data
     - erofs: remove need_kmap in erofs_read_metabuf()
     - erofs: unify meta buffers in z_erofs_fill_inode()
     - erofs: fix invalid algorithm for encoded extents
     - [armhf] dmaengine: ti: edma: Fix memory allocation size for
       queue_priority_map
     - erofs: fix runtime warning on truncate_folio_batch_exceptionals()
     - xhci: fix memory leak regression when freeing xhci vdev devices depth
       first
     - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
     - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
       drivers
     - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
       num-channels/ees
     - [arm64] phy: qcom: qmp-pcie: Fix PHY initialization when powered down by
       firmware
     - [arm64] phy: tegra: xusb: fix device and OF node leak at probe
     - [armhf] phy: ti: omap-usb2: fix device leak at unbind
     - [armhf] phy: ti-pipe3: fix device leak at unbind
     - netfilter: nft_set_pipapo: fix null deref for empty set
 .
   [ Santiago Ruano Rincón ]
   * d/salsa-ci.yml: Merge the extract-source job into the build's job script
   * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
     lintian tags.
   * d/salsa-ci.yml: Early move orig tarballs back where they can be cached
 .
 linux (6.16.7-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.7
     - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
       - x86/vmscape: Enumerate VMSCAPE bug
       - x86/vmscape: Add conditional IBPB mitigation
       - x86/vmscape: Enable the mitigation
       - x86/bugs: Move cpu_bugs_smt_update() down
       - x86/vmscape: Warn when STIBP is disabled with SMT
       - x86/vmscape: Add old Intel CPUs to affected list
 .
 linux (6.16.6-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.6
     - btrfs: fix race between logging inode and checking if it was logged before
     - btrfs: fix race between setting last_dir_index_offset and inode logging
     - btrfs: avoid load/store tearing races when checking if an inode was logged
     - ASoC: soc-core: care NULL dirver name on
       snd_soc_lookup_component_nolocked()
     - [amd64] ASoC: SOF: Intel: WCL: Add the sdw_process_wakeen op
     - ALSA: usb-audio: Allow Focusrite devices to use low samplerates
     - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
     - drm/amd/display: Don't warn when missing DCE encoder caps
     - cpupower: Fix a bug where the -t option of the set subcommand was not
       working.
     - Bluetooth: hci_sync: Avoid adding default advertising on startup
     - [arm64] drm/rockchip: vop2: make vp registers nonvolatile
     - btrfs: clear block dirty if submit_one_sector() failed
     - btrfs: zoned: skip ZONE FINISH of conventional zones
     - [amd64] platform/x86/amd: pmc: Drop SMU F/W match for Cezanne
     - fs: writeback: fix use-after-free in __mark_inode_dirty()
     - tee: fix NULL pointer dereference in tee_shm_put
     - tee: fix memory leak in tee_dyn_shm_alloc_helper
     - [arm64] dts: rockchip: mark eeprom as read-only for Radxa E52C
     - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
     - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
     - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
       i.MX8M Plus DHCOM
     - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
       Plus eDM SBC
     - [arm64] dts: rockchip: Fix the headphone detection on the orangepi 5 plus
     - [arm64] dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5
     - wifi: cfg80211: fix use-after-free in cmp_bss()
     - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
       work
     - wifi: mt76: mt7921: don't disconnect when CSA to DFS chan
     - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
     - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
     - wifi: mt76: mt7996: disable beacons when going offchannel
     - wifi: mt76: mt7996: use the correct vif link for scanning/roc
     - wifi: mt76: mt7996: add missing check for rx wcid entries
     - wifi: mt76: mt7915: fix list corruption after hardware restart
     - wifi: mt76: free pending offchannel tx frames on wcid cleanup
     - wifi: mt76: fix linked list corruption
     - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
       after confirm
     - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
     - wifi: iwlwifi: if scratch is ~0U, consider it a failure
     - wifi: iwlwifi: acpi: check DSM func validity
     - wifi: iwlwifi: uefi: check DSM item validity
     - wifi: iwlwifi: cfg: restore some 1000 series configs
     - wifi: iwlwifi: cfg: add back more lost PCI IDs
     - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
     - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
     - netfilter: nft_flowtable.sh: re-run with random mtu sizes
     - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
     - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
     - ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
     - mISDN: Fix memory leak in dsp_hwec_enable()
     - bnxt_en: fix incorrect page count in RX aggr ring log
     - icmp: fix icmp_ndo_send address translation for reply direction
     - eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring
     - net: macb: Fix tx_ptr_lock locking
     - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
     - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
     - net: mctp: mctp_fraq_queue should take ownership of passed skb
     - net: mctp: usb: initialise mac header in RX path
     - ice: fix NULL access of tx->in_use in ice_ptp_ts_irq
     - ice: fix NULL access of tx->in_use in ice_ll_ts_intr
     - idpf: set mac type when adding and removing MAC filters
     - i40e: remove read access to debugfs files
     - i40e: Fix potential invalid access when MAC list is empty
     - ixgbe: fix incorrect map used in eee linkmode
     - wifi: ath12k: Set EMLSR support flag in MLO flags for EML-capable stations
     - wifi: ath11k: fix group data packet drops during rekey
     - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
     - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
     - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
     - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
     - wifi: cw1200: cap SSID length in cw1200_do_join()
     - wifi: libertas: cap SSID len in lbs_associate()
     - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
     - net: remove sock_i_uid()
     - net: lockless sock_i_ino()
     - [arm64] net: thunder_bgx: add a missing of_node_put
     - [arm64] net: thunder_bgx: decrement cleanup index before use
     - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
     - net/smc: Remove validation of reserved bits in CLC Decline message
     - mctp: return -ENOPROTOOPT for unknown getsockopt options
     - ax25: properly unshare skbs in ax25_kiss_rcv()
     - netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX
     - net: atm: fix memory leak in atm_register_sysfs when device_register fail
     - net: xilinx: axienet: Add error handling for RX metadata pointer retrieval
     - ppp: fix memory leak in pad_compress_skb
     - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
     - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
     - [amd64] accel/ivpu: Prevent recovery work from being queued during device
       removal
     - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
     - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
       CONFIG_DYNAMIC_FTRACE
     - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
     - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
     - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
       arch_sync_kernel_mappings()
     - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
     - mm: fix accounting of memmap pages
     - mm: move page table sync declarations to linux/pgtable.h
     - mm: introduce and use {pgd,p4d}_populate_kernel()
     - mm: fix possible deadlock in kmemleak
     - mm: slub: avoid wake up kswapd in set_track_prepare
     - sched: Fix sched_numa_find_nth_cpu() if mask offline
     - ocfs2: prevent release journal inode after journal shutdown
     - of_numa: fix uninitialized memory nodes causing kernel panic
     - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
     - wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz
     - wifi: mwifiex: Initialize the chan_stats array to zero
     - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
     - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
     - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
     - wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state for
       sta_cmd
     - drm/xe: Fix incorrect migration of backed-up object to VRAM
     - drm/amdgpu: drop hw access in non-DC audio fini
     - drm/amdgpu/mes11: make MES_MISC_OP_CHANGE_CONFIG failure non-fatal
     - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
     - drm/amdgpu/sdma: bump firmware version checks for user queue support
     - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
       quirks list
     - scsi: lpfc: Fix buffer free/clear order in deferred receive path
     - nouveau: fix disabling the nonstall irq due to storm code
     - nouveau: Membar before between semaphore writes and the interrupt
     - audit: fix out-of-bounds read in audit_compare_dname_path()
     - batman-adv: fix OOB read/write in network-coding decode
     - cifs: prevent NULL pointer dereference in UTF16 conversion
     - e1000e: fix heap overflow in e1000_set_eeprom
     - [arm64,armhf] net: dsa: mv88e6xxx: Fix fwnode reference leaks in
       mv88e6xxx_port_setup_leds
     - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to
       TRAINING_PATTERN_SET
     - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
     - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
     - ALSA: hda: tas2781: fix tas2563 EFI data endianness
     - ALSA: hda: tas2781: reorder tas2563 calibration variables
     - pcmcia: omap: Add missing check for platform_get_resource
     - pcmcia: Add error handling for add_interval() in do_validate_mem()
     - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
       quirk
     - [amd64] platform/x86: asus-wmi: Fix racy registrations (Closes: #1110703)
     - [amd64] platform/x86: acer-wmi: Stop using ACPI bitmap for platform
       profile choices
     - [amd64] platform/x86/intel: power-domains: Use
       topology_logical_package_id() for package ID
     - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
     - hwmon: (ina238) Correctly clamp temperature
     - scsi: sr: Reinstate rotational media flag
     - hwmon: (ina238) Correctly clamp shunt voltage limit
     - hwmon: (ina238) Correctly clamp power limits
     - drm/bridge: ti-sn65dsi86: fix REFCLK setting
     - perf bpf-event: Fix use-after-free in synthesis
     - perf bpf-utils: Constify bpil_array_desc
     - perf bpf-utils: Harden get_bpf_prog_info_linear
     - spi: spi-qpic-snand: unregister ECC engine on probe error and device
       remove
     - drm/amd/amdgpu: Fix missing error return on kzalloc failure
     - md/raid1: fix data lost for writemostly rdev
     - md: prevent incorrect update of resync/recovery offset
     - [amd64] drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
     - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
     - [riscv64] Only allow LTO with CMODEL_MEDANY
     - [riscv64] uaccess: fix __put_user_nocheck for unaligned accesses
     - [riscv64] use lw when reading int cpu in new_vmalloc_check
     - [riscv64] use lw when reading int cpu in asm_per_cpu
     - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
     - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
     - [riscv64] kexec: Initialize kexec_buf struct
     - [riscv64] Fix sparse warning in __get_user_error()
     - [riscv64] Fix sparse warning about different address spaces
     - Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
 .
   [ Salvatore Bonaccorso ]
   * drivers/leds/trigger: Enable LEDS_TRIGGER_INPUT_EVENTS as module
     (Closes: #1113681)
 .
 linux (6.16.5-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.4
     - serial: 8250: fix panic due to PSLVERR
     - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
     - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
     - PM: runtime: Take active children into account in
       pm_runtime_get_if_in_use()
     - dm: dm-crypt: Do not partially accept write BIOs with zoned targets
     - dm: Check for forbidden splitting of zone write operations
     - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
     - usb: gadget: udc: renesas_usb3: fix device leak at unbind
     - usb: musb: omap2430: fix device leak at unbind
     - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
     - [arm64] usb: dwc3: imx8mp: fix device leak at unbind
     - bus: mhi: host: Fix endianness of BHI vector table
     - bus: mhi: host: Detect events pointing to unexpected TREs
     - vt: keyboard: Don't process Unicode characters in K_OFF mode
     - vt: defkeymap: Map keycodes above 127 to K_HOLE
     - netfs: Fix unbuffered write error handling
     - [armel,armhf] lib/crypto: arm/poly1305: Fix register corruption in no-SIMD
       contexts
     - [arm64] lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD
       contexts
     - [amd64] crypto: qat - lower priority for skcipher and aead algorithms
     - [amd64] crypto: ccp - Fix SNP panic notifier unregistration
     - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
       iMX8ULP
     - [amd64] crypto: qat - flush misc workqueue during device shutdown
     - [amd64] crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
     - [amd64] crypto: x86/aegis - Add missing error checks
     - crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390)
     - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
     - ksmbd: fix refcount leak causing resource not released
     - ksmbd: extend the connection limiting mechanism to support IPv6
     - tracing: fprobe-event: Sanitize wildcard for fprobe event name
     - ext4: preserve SB_I_VERSION on remount
     - ext4: check fast symlink for ea_inode correctly
     - ext4: fix fsmap end of range reporting with bigalloc
     - ext4: fix reserved gdt blocks handling in fsmap
     - ext4: use kmalloc_array() for array space allocation
     - ext4: fix hole length calculation overflow in non-extent inodes
     - btrfs: zoned: fix write time activation failure for metadata block group
     - btrfs: fix incorrect log message for nobarrier mount option
     - btrfs: restore mount option info messages during mount
     - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
     - [arm64] dts: apple: t8012-j132: Include touchbar framebuffer node
     - [arm64] dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
     - [arm64] dts: exynos7870-j6lte: reduce memory ranges to base amount
     - [arm64] dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
     - [arm64] dts: exynos7870: add quirk to disable USB2 LPM in gadget mode
     - [arm64] dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576
     - [arm64] dts: rockchip: Enable HDMI PHY clk provider on rk3576
     - [arm64] dts: exynos: gs101: ufs: add dma-coherent property
     - [arm64] dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
     - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
     - [arm64] dts: exynos7870-on7xelte: reduce memory ranges to base amount
     - [arm64] dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
     - [arm64] dts: rockchip: Remove workaround that prevented Turing RK1 GPU
       power regulator control
     - apparmor: Fix 8-byte alignment for initial dfa blob streams
     - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
     - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
       constraints
     - dt-bindings: display: vop2: Add optional PLL clock property for rk3576
     - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
     - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
     - scsi: mpi3mr: Fix race between config read submit and interrupt completion
     - ata: libata-scsi: Fix ata_to_sense_error() status handling
     - ata: libata-scsi: Return aborted command when missing sense and result TF
     - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
       controllers
     - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
     - ata: libata-scsi: Fix CDL control
     - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
     - iio: imu: bno055: fix OOB access of hw_xlate array
     - iio: adc: ad_sigma_delta: change to buffer predisable
     - iio: adc: ad7173: fix channels index for syscalib_mode
     - iio: adc: ad7173: fix calibration channel
     - iio: adc: ad7173: fix setting ODR in probe
     - wifi: brcmsmac: Remove const from tbl_ptr parameter in
       wlc_lcnphy_common_read_table()
     - wifi: ath12k: fix dest ring-buffer corruption
     - wifi: ath12k: fix source ring-buffer corruption
     - wifi: ath12k: fix dest ring-buffer corruption when ring is full
     - wifi: ath11k: fix dest ring-buffer corruption
     - wifi: ath11k: fix source ring-buffer corruption
     - wifi: ath11k: fix dest ring-buffer corruption when ring is full
     - pwm: mediatek: Handle hardware enable and clock enable separately
     - pwm: mediatek: Fix duty and period setting
     - mtd: spi-nor: Fix spi_nor_try_unlock_all()
     - [arm64] mtd: spinand: propagate spinand_wait() errors from
       spinand_write_page()
     - [arm64] mfd: mt6397: Do not use generic name for keypad sub-devices
     - readahead: fix return value of page_cache_next_miss() when no hole is
       found
     - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
     - PCI: Fix link speed calculation on retrain failure
     - PCI: endpoint: Fix configfs group list head handling
     - PCI: endpoint: Fix configfs group removal on driver teardown
     - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
     - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
       in epc_features
     - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
       imx_pcie_{assert/deassert}_core_reset
     - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
     - vsock/virtio: Validate length in packet header before skb_put()
     - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
     - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
     - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
       resume context
     - block: restore default wbt enablement
     - f2fs: fix to avoid out-of-boundary access in dnode page
     - [amd64] i2c: qcom-geni: fix I2C frequency table to achieve accurate bus
       rates
     - iomap: Fix broken data integrity guarantees for O_SYNC writes
     - jbd2: prevent softlockup in jbd2_log_do_checkpoint()
     - kbuild: userprogs: use correct linker when mixing clang and GNU ld
     - Mark xe driver as BROKEN if kernel page size is not 4kB
     - open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
     - proc: proc_maps_open allow proc_mem_open to return NULL
     - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
     - media: gspca: Add bounds checking to firmware parser
     - media: hi556: correct the test pattern configuration
     - [armhf] media: imx: fix a potential memory leak in
       imx_media_csc_scaler_device_init()
     - media: ipu6: isys: Use correct pads for xlate_streams()
     - media: vivid: fix wrong pixel_array control size
     - media: verisilicon: Fix AV1 decoder clock frequency
     - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
     - media: usbtv: Lock resolution while streaming
     - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
     - media: pisp_be: Fix pm_runtime underrun in probe
     - media: ov2659: Fix memory leaks in ov2659_probe()
     - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
     - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
       calls
     - [arm64] media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of
       SDM660/SDM670 phy init
     - [arm64] media: qcom: camss: cleanup media device allocated resource on
       error path
     - [arm64] media: qcom: camss: Remove extraneous -supply postfix on supply
       names
     - [arm64] media: venus: Add a check for packet size after reading from
       shared memory
     - [arm64] media: venus: Fix MSM8998 frequency table
     - [arm64] media: venus: hfi: explicitly release IRQ during teardown
     - [arm64] media: venus: protect against spurious interrupts during probe
     - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
       240.
     - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
       240
     - drm/xe/bmg: Add one additional PCI ID
     - drm/xe: Defer buffer object shrinker write-backs and GPU waits
     - drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access
     - drm/amdgpu/discovery: fix fw based ip discovery
     - drm/amd: Restore cached power limit during resume
     - drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14
     - drm/amdgpu: add missing vram lost check for LEGACY RESET
     - drm/amdgpu: Avoid extra evict-restore process.
     - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
     - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
     - drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job
     - drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop
     - drm/amdgpu: Update external revid for GC v9.5.0
     - drm/amdgpu: update mmhub 3.0.1 client id mappings
     - drm/amdgpu: update mmhub 3.3 client id mappings
     - drm/amdgpu: update mmhub 4.1.0 client id mappings
     - drm/amdgpu: Update supported modes for GC v9.5.0
     - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
     - drm/amdkfd: Fix checkpoint-restore on multi-xcc
     - drm/amd/display: Add primary plane to commits for correct VRR handling
     - drm/amd/display: fix a Null pointer dereference vulnerability
     - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
     - drm/amd/display: fix initial backlight brightness calculation
     - drm/amd/display: Pass up errors for reset GPU that fails to init HW
     - drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value"
     - drm/amd/display: Don't overwrite dce60_clk_mgr
     - net, hsr: reject HSR frame if skb can't hold tag
     - sched/ext: Fix invalid task state transitions on class switch
     - ipv6: sr: Fix MAC comparison to be constant-time
     - cgroup: avoid null de-ref in css_rstat_exit()
     - cpuidle: governors: menu: Avoid selecting states with too much latency
     - ACPI: pfr_update: Fix the driver update version check
     - ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text
     - mptcp: drop skb if MPTCP skb extension allocation fails
     - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
     - mptcp: remove duplicate sk_reset_timer call
     - mptcp: disable add_addr retransmission when timeout is 0
     - mm/damon/ops-common: ignore migration request to invalid nodes
     - btrfs: move transaction aborts to the error site in
       add_block_group_free_space()
     - btrfs: always abort transaction on failure to add block group to free
       space tree
     - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
     - btrfs: reorganize logic at free_extent_buffer() for better readability
     - btrfs: add comment for optimization in free_extent_buffer()
     - btrfs: use refcount_t type for the extent buffer reference counter
     - btrfs: fix subpage deadlock in try_release_subpage_extent_buffer()
     - btrfs: add comments on the extra btrfs specific subpage bitmaps
     - btrfs: rename btrfs_subpage structure
     - btrfs: subpage: keep TOWRITE tag until folio is cleaned
     - xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc
     - xfs: return the allocated transaction from xfs_trans_alloc_empty
     - xfs: improve the comments in xfs_select_zone_nowait
     - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
     - xfs: Remove unused label in xfs_dax_notify_dev_failure
     - erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
     - erofs: Do not select tristate symbols from bool symbols
     - crypto: acomp - Fix CFI failure due to type punning
     - [riscv64] iommu/riscv: prevent NULL deref in iova_to_phys
     - io_uring/futex: ensure io_futex_wait() cleans up properly on failure
     - iov_iter: iterate_folioq: fix handling of offset >= folio size
     - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
     - mm/damon/core: fix commit_ops_filters by using correct nth function
     - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
       power-up
     - mmc: sdhci-pci-gli: Add a new function to simplify the code
     - kho: init new_physxa->phys_bits to fix lockdep
     - kho: mm: don't allow deferred struct page with KHO
     - kho: warn if KHO is disabled due to an error
     - memstick: Fix deadlock by moving removing flag earlier
     - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
     - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
     - mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
     - NFS: Fix a race when updating an existing write
     - squashfs: fix memory leak in squashfs_fill_super
     - mm/damon/core: fix damos_commit_filter not changing allow
     - mm/debug_vm_pgtable: clear page table entries at destroy_args()
     - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
     - mm/mremap: fix WARN with uffd that has remap events disabled
     - ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
     - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
       830 G6
     - RDMA/rxe: Flush delayed SKBs while releasing RXE resources
     - [s390x] sclp: Fix SCCB present check
     - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
     - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
     - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
       kvcalloc()
     - drm/amdgpu/swm14: Update power limit logic
     - [amd64] drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access
     - drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()
     - [amd64] drm/i915/gt: Relocate compression repacking WA for JSL/EHL
     - [adm64] drm/i915/lnl+/tc: Fix handling of an enabled/disconnected dp-alt
       sink
     - [amd64] drm/i915/icl+/tc: Cache the max lane count value
     - [amd64] drm/i915/lnl+/tc: Fix max lane count HW readout
     - [amd64] drm/i915/lnl+/tc: Use the cached max lane count value
     - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
     - drm/amd/display: Avoid a NULL pointer dereference
     - drm/amd/display: Don't overclock DCE 6 by 15%
     - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
     - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
     - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
     - drm/amd/display: Find first CRTC and its line time in
       dce110_fill_display_configs
     - drm/amd/display: Fill display clock and vblank time in
       dce110_fill_display_configs
     - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
     - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
     - [arm64] PCI: rockchip: Use standard PCIe definitions
     - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
     - drm/amdgpu: fix task hang from failed job submission during process kill
     - [arm64] soc: qcom: mdt_loader: Fix error return values in
       mdt_header_valid()
     - xfs: fix frozen file system assert in xfs_trans_alloc
     - debugfs: fix mount options not being applied
     - fs: fix incorrect lflags value in the move_mount syscall
     - btrfs: zoned: fix data relocation block group reservation
     - fhandle: do_handle_open() should get FD with user flags
     - libfs: massage path_from_stashed() to allow custom stashing behavior
     - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
     - fs/buffer: fix use-after-free when call bh_read() helper
     - signal: Fix memory leak for PIDFD_SELF* sentinels
     - use uniform permission checks for all mount propagation changes
     - iommu: Remove ops.pgsize_bitmap from drivers that don't use it
     - iommu/virtio: Make instance lookup robust
     - drm/amd: Restore cached manual clock settings during resume
     - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
     - iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4
     - iio: accel: sca3300: fix uninitialized iio scan data
     - ftrace: Also allocate and copy hash for reading of filter files
     - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
     - iio: adc: ad7124: fix channel lookup in syscalib functions
     - iio: light: as73211: Ensure buffer holes are zeroed
     - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
     - iio: adc: rzg2l_adc: Set driver data before enabling runtime PM
     - iio: adc: bd79124: Add GPIOLIB dependency
     - iio: adc: ad7173: prevent scan if too many setups requested
     - iio: proximity: isl29501: fix buffered read on big-endian systems
     - iio: adc: rzg2l: Cleanup suspend/resume path
     - most: core: Drop device reference after usage in get_channel()
     - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
     - cdx: Fix off-by-one error in cdx_rpmsg_probe()
     - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
     - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
     - [amd64] comedi: pcl726: Prevent invalid irq number
     - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
       do_insnlist_ioctl()
     - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
       test
     - usb: renesas-xhci: Fix External ROM access timeouts
     - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
     - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
     - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
     - usb: typec: maxim_contaminant: disable low power mode when reading
       comparator values
     - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
       is clean
     - usb: xhci: Fix slot_id resource race conflict
     - usb: xhci: fix host not responding after suspend and resume
     - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
     - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
     - usb: dwc3: pci: add support for the Intel Wildcat Lake
     - tracing: Remove unneeded goto out logic
     - tracing: Limit access to parser->buffer when trace_get_user failed
     - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
     - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
     - tls: fix handling of zero-length records on the rx_list
     - [amd64] x86/CPU/AMD: Ignore invalid reset reason value
     - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
     - devlink: let driver opt out of automatic phys_port_name generation
     - ixgbe: prevent from unwanted interface name changes
     - iio: imu: inv_icm42600: use = { } instead of memset()
     - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
     - iio: imu: inv_icm42600: change invalid data error to -EBUSY
     - spi: spi-qpic-snand: use correct CW_PER_PAGE value for OOB write
     - spi: spi-fsl-lpspi: Clamp too high speed_hz
     - spi: spi-qpic-snand: fix calculating of ECC OOB regions' properties
     - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
     - cgroup/cpuset: Use static_branch_enable_cpuslocked() on
       cpusets_insane_config_key
     - cgroup/cpuset: Fix a partition error with CPU hotplug
     - iosys-map: Fix undefined behavior in iosys_map_clear()
     - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
     - RDMA/bnxt_re: Fix to do SRQ armena by default
     - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
     - RDMA/bnxt_re: Fix a possible memory leak in the driver
     - RDMA/bnxt_re: Fix to initialize the PBL array
     - RDMA/core: Free pfn_list with appropriate kvfree call
     - [arm64] RDMA/hns: Fix dip entries leak on devices newer than hip09
     - net: bridge: fix soft lockup in br_multicast_query_expired()
     - net/sched: Fix backlog accounting in qdisc_dequeue_internal
     - scsi: qla4xxx: Prevent a potential error pointer dereference
     - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
       (CVE-2025-38676)
     - Bluetooth: hci_sync: Fix scan state after PA Sync has been established
     - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
     - Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings
     - Bluetooth: hci_core: Fix using ll_privacy_capable for current settings
     - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
     - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
     - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
     - Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections
     - Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
     - drm: nova-drm: fix 32-bit arm build
     - md: rename recovery_cp to resync_offset
     - md: add helper rdev_needs_recovery()
     - md: fix sync_action incorrect display during resync
     - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
       init failed
     - [arm64] drm/hisilicon/hibmc: fix irq_request()'s irq name variable is
       local
     - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
     - [arm64] drm/hisilicon/hibmc: fix rare monitors cannot display problem
     - [arm64] drm/hisilicon/hibmc: fix dp and vga cannot show together
     - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
     - [arm64] regulator: pca9450: Use devm_register_sys_off_handler
     - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
     - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
     - drm/amd/display: Don't print errors for nonexistent connectors
     - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
     - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
     - bnxt_en: Fix lockdep warning during rmmod
     - scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock
     - scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl()
     - scsi: ufs: ufs-qcom: Update esi_vec_mask for HW major version >= 6
     - scsi: ufs: ufs-qcom: Fix ESI null pointer dereference
     - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
     - ppp: fix race conditions in ppp_fill_forward_path
     - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
       firwmare reload.
     - drm/xe: Assign ioctl xe file handler to vm in xe_vm_create
     - cifs: Fix oops due to uninitialised variable
     - phy: mscc: Fix timestamping for vsc8584
     - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
     - gve: prevent ethtool ops after shutdown
     - [riscv64] net: stmmac: thead: Enable TX clock before MAC initialization
     - net/smc: fix UAF on smcsk after smc_listen_out()
     - net/mlx5: HWS, fix bad parameter in CQ creation
     - net/mlx5: HWS, fix complex rules rehash error flow
     - net/mlx5: HWS, Fix table creation UID
     - net/mlx5: CT: Use the correct counter offset
     - ASoC: cs35l56: Update Firmware Addresses for CS35L63 for production
       silicon
     - ASoC: cs35l56: Handle new algorithms IDs for CS35L63
     - ASoC: cs35l56: Remove SoundWire Clock Divider workaround for CS35L63
     - [s390x] mm: Do not map lowcore with identity mapping
     - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
     - igc: fix disabling L1.2 PCI-E link substate on I226 on init
     - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
     - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
     - net/sched: Remove unnecessary WARNING condition for empty child qdisc in
       htb_activate
     - ALSA: timer: fix ida_free call while not allocated
     - bonding: update LACP activity flag after setting lacp_active
     - bonding: send LACPDUs periodically in passive mode after receiving
       partner's LACPDU
     - block: move elevator queue allocation logic into blk_mq_init_sched
     - block: fix lockdep warning caused by lock dependency in elv_iosched_store
     - block: fix potential deadlock while running nr_hw_queue update
     - blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues
     - block: decrement block_rq_qos static key in rq_qos_del()
     - block: skip q->rq_qos check in rq_qos_done_bio()
     - block: avoid cpu_hotplug_lock depedency on freeze_lock
     - [arm64] Octeontx2-af: Skip overlap check for SPI field
     - net/mlx5: Base ECVF devlink port attrs from 0
     - net/mlx5: Add IFC bits and enums for buf_ownership
     - net/mlx5e: Query FW for buffer ownership
     - net/mlx5e: Preserve shared buffer capacity during headroom updates
     - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
     - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
     - [s390x] hypfs: Enable limited access during lockdown
     - netfilter: nf_reject: don't leak dst refcount for loopback packets
     - drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create
     - drm/xe: Fix vm_bind_ioctl double free bug
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.5
     - perf: Avoid undefined behavior from stopping/starting inactive events
     - rtla: Check pkg-config install
     - trace/fgraph: Fix the warning caused by missing unregister notifier
     - of: dynamic: Fix memleak when of_pci_add_properties() failed
     - of: reserved_mem: Add missing IORESOURCE_MEM flag on resources
     - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
     - fgraph: Copy args in intermediate storage with entry
     - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
     - perf symbol-minimal: Fix ehdr reading in filename__read_build_id
     - Revert "virtio: reject shm region if length is zero"
     - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
     - scsi: core: sysfs: Correct sysfs attributes access rights
     - smb: client: fix race with concurrent opens in unlink(2)
     - smb: client: fix race with concurrent opens in rename(2)
     - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
     - [amd64] ASoC: rt721: fix FU33 Boost Volume control not working
     - [amd64] ASoC: rt1320: fix random cycle mute issue
     - erofs: Fallback to normal access if DAX is not supported on extra device
     - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
     - io_uring/io-wq: add check free worker before create new worker
     - [amd64] platform/x86: int3472: add hpd pin support
     - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
     - net: ipv4: fix regression in local-broadcast routes (Closes: #1113765)
     - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
     - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
     - HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
     - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C
       regs save
     - HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow
     - drm/msm/kms: move snapshot init earlier in KMS init
     - [arm64] drm/msm/dpu: correct dpu_plane_virtual_atomic_check()
     - [arm64] drm/msm: update the high bitfield of certain DSI registers
     - [arm64] drm/mediatek: Add error handling for old state CRTC in
       atomic_disable
     - [powerpc*] kvm: Fix ifdef to remove build warning
     - HID: input: rename hidinput_set_battery_charge_status()
     - HID: input: report battery status changes immediately
     - idpf: add support for Tx refillqs in flow scheduling mode
     - idpf: simplify and fix splitq Tx packet rollback error path
     - idpf: replace flow scheduling buffer ring with buffer pool
     - idpf: stop Tx if there are insufficient buffer resources
     - net: macb: fix unregister_netdev call order in macb_remove()
     - Bluetooth: hci_conn: Make unacked packet handling more robust
     - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
     - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
     - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
     - Bluetooth: hci_event: Disconnect device when BIG sync is lost
     - Bluetooth: hci_sync: fix set_local_name race condition
     - page_pool: fix incorrect mp_ops error handling
     - [arm64] Octeontx2-vf: Fix max packet length errors
     - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
     - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
     - drm/nouveau: remove unused memory target test
     - ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset
     - ice: don't leave device non-functional if Tx scheduler config fails
     - ice: use fixed adapter index for E825C embedded devices
     - ice: fix incorrect counter for buffer allocation failures
     - ixgbe: fix ixgbe_orom_civd_info struct layout
     - dt-bindings: display/msm: qcom,mdp5: drop lut clock
     - [arm64] drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
     - [arm64] octeontx2: Set appropriate PF, VF masks and shifts based on
       silicon
     - [arm64] Octeontx2-af: Fix NIX X2P calibration failures
     - mISDN: hfcpci: Fix warning when deleting uninitialized timer
     - net: dlink: fix multicast stats being counted incorrectly
     - drm/xe/xe_sync: avoid race during ufence signaling
     - drm/xe/vm: Don't pin the vm_resv during validation
     - drm/xe: Don't trigger rebind on initial dma-buf validation
     - block: validate QoS before calling __rq_qos_done_bio()
     - phy: mscc: Fix when PTP clock is register and unregister
     - net: macb: Fix offset error in gem_update_stats
     - bnxt_en: Fix memory corruption when FW resources change during ifdown
     - bnxt_en: Adjust TX rings if reservation is less than requested
     - bnxt_en: Fix stats context reservation logic
     - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
     - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
     - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error
       flow
     - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error
       path
     - net/mlx5: Reload auxiliary drivers on fw_activate
     - net/mlx5: Fix lockdep assertion on sync reset unload event
     - net/mlx5: Nack sync reset when SFs are present
     - net/mlx5: Prevent flow steering mode changes in switchdev mode
     - net/mlx5e: Update and set Xon/Xoff upon MTU set
     - net/mlx5e: Update and set Xon/Xoff upon port speed set
     - net/mlx5e: Set local Xoff after FW update
     - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
     - net: stmmac: xgmac: Correct supported speed modes
     - net: stmmac: Set CIC bit only for TX queues with COE
     - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
       during channel open.
     - io_uring/kbuf: fix signedness in this_len calculation
     - net: rose: split remove and free operations in rose_remove_neigh()
     - net: rose: convert 'use' field to refcount_t
     - net: rose: include node references in rose_neigh refcount
     - sctp: initialize more fields in sctp_v6_from_sk()
     - l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
     - fbnic: Move phylink resume out of service_task and into open/close
     - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
     - net: macb: Disable clocks once
     - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
     - [arm64] drm/mediatek: mtk_hdmi: Fix inverted parameters in some
       regmap_update_bits calls
     - [amd64] KVM: x86: use array_index_nospec with indices that come from guest
     - [riscv64] KVM: fix stack overrun when loading vlenb
     - [amd64] x86/cpu/intel: Fix the constant_tsc model check for Pentium 4
     - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
     - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
       AMD/HYGON
     - HID: asus: fix UAF via HID_CLAIMED_INPUT validation
     - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
     - HID: elecom: add support for ELECOM M-DT2DRBK
     - HID: quirks: add support for Legion Go dual dinput modes
     - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
     - HID: wacom: Add a new Art Pen 2
     - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
     - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
     - [arm64] mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature
     - blk-zoned: Fix a lockdep complaint about recursive locking
     - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
     - fs/smb: Fix inconsistent refcnt update
     - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
     - smb3 client: fix return code mapping of remap_file_range
     - xfs: do not propagate ENODATA disk errors into xattr code
     - drm/xe/vm: Clear the scratch_pt pointer on error
     - drm/nouveau/disp: Always accept linear modifier
     - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
     - drm/msm/dpu: Initialize crtc_state to NULL in
       dpu_plane_virtual_atomic_check()
     - drm/mediatek: Fix device/node reference count leaks in
       mtk_drm_get_all_drm_priv
     - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
     - drm/amdgpu/userq: fix error handling of invalid doorbell
     - drm/amdgpu: update firmware version checks for user queue support
     - drm/amdgpu/gfx11: set MQD as appriopriate for queue types
     - drm/amdgpu/gfx12: set MQD as appriopriate for queue types
     - net: rose: fix a typo in rose_clear_routes()
     - [arm64] firmware: qcom: scm: remove unused arguments from SHM bridge
       routines
     - [arm64] firmware: qcom: scm: take struct device as argument in SHM bridge
       enable
     - [arm64] firmware: qcom: scm: initialize tzmem before marking SCM as
       available
     - [arm64] firmware: qcom: scm: request the waitqueue irq *after*
       initializing SCM
     - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
       LANE0_1_STATUS"
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
       to static const
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
       sizes to driver data
     - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
Checksums-Sha1:
 4af78493a254d594639af9b45fe56145b094d7aa 210689 linux_6.16.12-1~bpo13+1.dsc
 dd8730f24f2702110f9181581290f9faafd4c8b4 1552980 linux_6.16.12-1~bpo13+1.debian.tar.xz
 cf099e0162c64ca7bdffd82ca89f54bc2261db56 5968 linux_6.16.12-1~bpo13+1_source.buildinfo
Checksums-Sha256:
 5cadf7ed85cde4d7c435974ba1769c68555bccebc17cc6a9064c7ddec6d99ce6 210689 linux_6.16.12-1~bpo13+1.dsc
 30f9729f72e0eb85857248a24f41fa7542860ffe070661e2d1d3a6c45bf875e4 1552980 linux_6.16.12-1~bpo13+1.debian.tar.xz
 4fdfbd06c8b883be44608436c6c6654e7bfc9ab41605d58ed0c47a38b982f92b 5968 linux_6.16.12-1~bpo13+1_source.buildinfo
Files:
 8efed59b3ca3cbeda8058a875e1ee713 210689 kernel optional linux_6.16.12-1~bpo13+1.dsc
 c50adc5421caf61c5268664b370e47a0 1552980 kernel optional linux_6.16.12-1~bpo13+1.debian.tar.xz
 b84ccfb07f4b5929ceec4628ec9b449f 5968 kernel optional linux_6.16.12-1~bpo13+1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmkflT8ACgkQ57/I7JWG
EQn0kRAArlq8e77FZEDuXZtmRyW2aXNCslnVyeVaJ0p21p7uS7KYPZNVDqJitMHj
WrP17O/my9qYIyO49PWiIowOu+cLkqVsI4QIDjcySyskL7wLxkrm4LICi+TAsxwQ
DTdL44IYQwQyBBrD3MS2O70udNO2ml2W/O0XezE9grC0oHz2ixar70oZVUKIiYbo
mV5K0lSYvV0yDBUuU9VbX6Mu1FOKyPM1pp2Vg6/GnIU8+XQxpwSPfrPAYHr3fEBr
sq22tPQLfIVc2SLcyUoLKhpXdWNYeByjzTs/v6K2UsSY33lVrNCpwFXGQR7sLvAU
7wtFKcmEvTfHDMyoyPHgQLkfHMJNf58YiyjDnG0r9pPI5n+kmuTCq7hQ8JqYmvBN
h9LFGfs2y4UELqS4+4Q2gplIp5PNePmpx1zi3mTHODpaHzD4j+aDDnwAc6zen1so
Raw+Q4VNTtGZ49Sbfsambz+Y8v/l93YsEo/2D8ze7JVZAE3pkfZeWMvl8aXEtHaR
XLGGSqDIWGcqpJMtNWOgRW++5FxvnuUGt+xIoNnOz3ZzEei/X/OPT2oZnwUK4MWh
eBxZwYw4ORulA5pxCkuWjOm/WGFPEUK4PtzS4mXqgWW1mLmT58wJn4EjVl+iZpFm
zuqQdhzV8WmgFPBIIiCLarjrHlL83EobbY688ogWLAdOa7EiGa0=
=u26M
-----END PGP SIGNATURE-----