Accepted linux 6.12.113-1 (source) into stable-security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 15 Oct 2026 17:02:11 +0200
Source: linux
Architecture: source
Version: 6.12.113-1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1149499 1149564 1150891
Changes:
 linux (6.12.113-1) trixie-security; urgency=high
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.112
     - Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"
     - Revert "hwmon: (emc1403) Rely on subsystem locking"
     - landlock: Fix TCP Fast Open connection bypass
     - [s390x] boot: Add sized_strscpy() to enable strscpy() usage
     - [s390x] boot: Avoid IPL parameter append past command line
     - sunvdc: fix -EIO issue due to lack of retries
     - net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
     - net: cpsw: Execute ndo_set_rx_mode callback in a work queue
     - ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
     - ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.
     - ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and
       MCAST_LEAVE_GROUP.
     - ipv6: mcast: Don't hold RTNL for MCAST_ socket options.
     - ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
       (CVE-2026-98101)
     - media: video-i2c: fix buffer queue ordering
     - ipv6: Select best matching nexthop object in fib6_table_lookup()
     - ipv6: Honor oif when choosing nexthop for locally generated traffic
     - pidfd: hold exec_update_lock around namespace ioctl (CVE-2026-89766)
     - xfrm: avoid RCU warnings around the per-netns netlink socket
     - xfrm: fix compat ALLOCSPI request use-after-free
     - xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for
       xfrm_trans_reinject()
     - esp: downgrade zerocopy managed frags before mutating skb frags
     - RDMA/siw: Clear association under lock if siw_qp_modify fails in
       siw_accept
     - RDMA/rxe: validate access flags before swapping the MR's PD
     - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
     - [arm64] firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
     - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
     - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
     - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
     - IB/iser: reject a remote invalidation of an unregistered direction
     - IB/isert: wait for deferred control PDU completions before releasing the
       connection
     - RDMA/mad: Fix receive buffer leak when PKey enforcement fails
     - RDMA/irdma: Enforce local fence for IB_WR_REG_MR
     - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
     - dmaengine: sprd: Fix runtime PM reference leak in probe
     - wifi: virt_wifi: free skb when disconnected
     - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
     - wifi: libipw: reject too-short beacon and probe responses
     - wifi: libipw: reject too-short association responses
     - IB/IPoIB: Avoid restoring OPER_UP after multicast flush
     - wifi: cfg80211: don't get the radio mask for netdev-less wdevs
     - wifi: cfg80211: check IP header size in cfg80211_classify8021d()
     - soundwire: cadence_master: wait and cancel cdns->work before clock stop
     - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA
       mask
     - dma-coherent: report a failed reserved memory assignment
     - dmaengine: Fix device kref underflow in dma_chan_put()
     - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
     - dmaengine: wait for RCU readers before releasing dma_device
     - wifi: cfg80211: only group hidden BSSes with beacon entries
     - wifi: cfg80211: don't filter by BSS type when removing stale entries
     - wifi: mac80211: don't start a ROC while scanning
     - wifi: cfg80211: add option for vif allowed radios
     - wifi: mac80211: use vif radio mask to limit ibss scan frequencies
     - wifi: mac80211: don't warn when an IBSS has no channel to scan
     - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
     - wifi: mac80211: suppress chanctx warning for debugfs reset
     - wifi: mac80211: abort chanswitch when leaving a mesh
     - wifi: mac80211: reset state when starting AP fails
     - wifi: mac80211: unlist vifs when their netdev is unregistered
     - wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
     - wifi: cfg80211: skip regulatory for punctured subchannels
     - wifi: cfg80211: expose cfg80211_chandef_get_width()
     - wifi: mac80211: don't allow injecting frames wider than the chanctx
     - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
     - wifi: mac80211: require a peer station for TDLS setup confirm
     - wifi: mac80211: don't allow link changes when iface is down
     - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
     - wifi: mac80211: don't access the TSF of a down interface
     - wifi: mac80211: add HE 6 GHz capability in the scan elems len
     - wifi: mac80211: mesh: reset the CSA state when leaving
     - wifi: mac80211: mesh: release the channel if start fails
     - wifi: mac80211: set up the TX info early to fix failure paths
     - mm: memblock: show all region flags in debugfs
     - scsi: qla2xxx: Fix the ql2xfc2target parameter description
     - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
     - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic
       DMA
     - RDMA/efa: Keep admin queues alive while IRQ is registered
     - RDMA/efa: Keep EQ resources alive while IRQ is registered
     - RDMA/siw: Bound fragmented header copies by the remaining length
     - netfilter: nft_nat: fully initialise new_addr in netmap setup
     - netfilter: flowtable: hold reference on ct until flow is released
     - perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
     - [arm64] hibernate: clone only the linear map that exists at runtime
     - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
     - keys: fix lost wakeup when reaping a dead key type
     - ALSA: bcd2000: Fix race between rawmidi and disconnect
     - [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
     - [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
     - ALSA: pcm: set timer->private_data before registering the PCM timer
     - ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask
     - ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map
     - ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params
     - Input: trackpoint - fix the inertia attribute name in the ABI document
     - gpio: virtuser: skip free_irq when no IRQ is installed
     - ALSA: 6fire: Clean ups with guard()
     - ALSA: usb: 6fire: Avoid embedded URBs
     - ALSA: 6fire: fix OOB write from device-reported iso length
     - wifi: virt_wifi: don't transfer operstate before register
     - drm/vc4: Use managed KMS polling to fix UAF on unbind
     - ALSA: hda: trace PCM open only after assigning a stream
     - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
     - btrfs: tree-checker: print dev extent offset in error message
     - [arm64] drm/msm/dsi: round the byte clock rate after reparenting to the
       PHY PLL
     - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
     - ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
     - net: fddi: skfp: fix NULL deref when setting the MAC address while down
     - wifi: brcmfmac: fix lost 802.1x TX completion wakeup
     - net: bridge: mst: move switchdev call outside rcu
     - tcp: Don't call skb_clone_and_charge_r() for close()d listener in
       tcp_v6_do_rcv().
     - tcp: do not let tcp_rmem be set below 4096
     - ksmbd: return buffer overflow for partial filesystem info
     - ksmbd: fix partial file information responses
     - ksmbd: keep compound responses on query info errors
     - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
     - Bluetooth: hci_core: Print number of packets in conn->data_q
     - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
     - Bluetooth: coredump: Quiesce dump work on unregister
     - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
     - Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync
     - Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
     - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
     - Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
     - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
     - pppoatm: ensure a writable skb header and linear data
     - drop_monitor: synchronize tracepoint unregistration on error path
     - drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
     - net: stmmac: do not overwrite phc_index when no PTP clock is registered
     - [powerpc*] KVM: PPC: Book3S HV: fix use-after-free in
       kvmhv_emulate_tlbie_all_lpid()
     - [powerpc*] KVM: PPC: Book3S HV: fix secure device page leak on
       uv_page_in() failure
     - [powerpc*] iommu: Fix the overflow validation in iommu_tce_check_ioba
     - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
     - ASoC: hdmi-codec: Report a change when the channel status moves
     - net: netsec: fix device_node reference leak on phy_np
     - net: lock the socket in sock_gettstamp()
     - net: ethernet: cortina: Ack RX overrun interrupt correctly
     - net: stmmac: propagate FPE preemption-class mapping errors
     - net: macb: fix ordering around PTP timestamp read
     - net: mvpp2: prevent buffer overflow in page_pool allocation
     - net: skbuff: do not leave stale header offsets after pskb_carve()
     - drm/amdgpu: check ras and obj before dereference
     - btrfs: abort transaction on failure to update inode for hole punching and
       reflinking
     - [amd64] x86/fred: Reconstruct the #GP context for rejected INT
       instructions
     - mm/huge_memory: use folio's memcg inside __folio_split()
     - wifi: rtw88: TX QOS Null data the same way as Null data
     - wifi: rtw88: Fix the random "error beacon valid" messages for USB
     - Input: xpad - add support for Victrix Pro BFG Controller
     - Input: xpad - add support for Azeron devices
     - Input: xpad - fix PDP Marvel Xbox 360 controller
     - ALSA: core: Fix potential UAF after asynchronous card release
     - ALSA: virtio: reset device before deleting virtqueues
     - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
     - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
     - ata: libahci_platform: Fix device reference leak in
       ahci_platform_get_resources()
     - cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
     - exec: Cleanup POSIX timers right after de_thread()
     - rds: ib: use rds_conn_drop() on protocol version mismatch
     - [amd64] x86/microcode/intel: Reject problematic loading on Granite Rapids
       systems
     - tcp: exclude old ACKs from tcp fast path
     - RDMA/ucma: Serialize join and leave on copy_to_user failure
     - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
     - openvswitch: avoid reallocating confirmed conntrack labels
     - net: xfrm: reject unrepresentable espintcp transport headers
     - HID: logitech-hidpp: fix race condition when accessing stale stack pointer
     - [arm64] hibernate: pass HVC_SET_VECTORS args to the resume hvc
     - [arm64] dts: renesas: r8a779f0: Set UFS lane count
     - [arm64] percpu: Fix this_cpu_write() casting
     - [arm64] percpu: Fix this_cpu_and() mask generation
     - Bluetooth: btusb: fix NXP IW610 composite device handling
     - Bluetooth: eir: validate service data length before reading UUID
     - Bluetooth: hci_codec: validate vendor codec count length
     - Bluetooth: hci_sync: Serialize local codec list cleanup
     - dmaengine: sun6i: fix non-atomic read of DMA position registers
     - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
     - dmaengine: ti: k3-udma-glue: fix NULL dereference in
       k3_udma_glue_release_rx_chn()
     - ipv6: xfrm: use full sockets in local error paths
     - net: lan743x: fix RX checksum use-after-free
     - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
     - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
     - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
     - net/sched: act_api: release tail references on DELACTION failure
     - net/sched: hhf: cap hh_flows_limit at change time
     - net/packet: clear RX owner on VNET header error
     - net/packet: avoid truncating TPACKET_V3 private size
     - scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
     - xfrm: serialize state GC with device state flush
     - xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
     - memstick: ms_block: destroy io_queue workqueue on removal
     - mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
     - KEYS: encrypted: fix integer overflow of datablob_len
     - keys: translate request_key_auth pid for the reading procfs instance
     - KEYS: trusted: Fix tpm2_load_cmd() boundary check
     - i2c: at91: release DMA channels on remove and probe error
     - i2c: atr: fix dangling adapter pointer on add failure
     - i2c: imx: release DMA channels on probe error
     - i2c: imx: disable autosuspend on remove
     - IB/mlx4: Fix use-after-free on pkey sysfs registration failure
     - IB/hfi1: Resolve the credit-return buffer through the send context's node
     - IB/hfi1: Fix the PIO_CRED credit-return mmap
     - selinux: preserve user SID across nested backing files
     - selinux: recheck intermediate backing files on mprotect()
     - selinux: always fill AVC decision in avc_has_perm_noaudit()
     - power: sequencing: don't call .post_enable() if pwrseq_unit_enable()
       failed
     - power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
     - power: sequencing: fix NULL-pointer dereference in
       pwrseq_device_register()
     - mmc: core: Cancel SDIO IRQ work before freeing host
     - mmc: core: Fix OF node reference leak on card add failure
     - mmc: hsq: Fix use-after-free in retry work
     - mmc: mmci: Fix use-after-free in busy-timeout work
     - mmc: mxcmmc: cancel data work and watchdog on remove
     - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
     - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
     - mmc: sdio_uart: fix xmit_fifo leak when the port table is full
     - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
     - mmc: spi: reset bytes_xfered before retrying CRC failures
     - mmc: sdhci_am654: Move tuning_loop to local variable
     - mmc: sdhci_am654: Reset command and data lines on failed tuning
     - mmc: sdhci_am654: Clear ITAPDLY on tuning failure
     - mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning
       failure
     - Input: adp5588-keys - cache GPIO state before registering the gpiochip
     - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
     - Input: cyttsp5 - clamp the HID report size before memcpy
     - Input: evdev - zero absinfo before partial copy in EVIOCSABS
     - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
     - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
     - Input: soc_button_array - fix MS Surface Pro 11 probe failure
     - Input: soc_button_array - check btns_desc->package.count
     - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
     - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
     - Input: zero ff_effect before compat copy in input_ff_effect_from_user
     - hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
     - hwmon: (pmbus/core) increase number of phases and add new mask
     - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
     - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
     - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
     - hwmon: (w83793) release probe data through kref
     - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
     - watchdog: digicolor: Avoid division by zero
     - watchdog: msc313e: Fix premature reset during timeout update
     - watchdog: msc313e: Propagate error code in resume()
     - watchdog: rtd119x: Avoid division by zero
     - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
     - watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
     - wifi: brcmsmac: fix UAF in brcms_free_timer()
     - wifi: iwlegacy: fix broadcast stations deallocation
     - wifi: libertas_tf: fix UAF in lbtf_free_adapter()
     - wifi: rsi: fix heap OOB write on key removal
     - wifi: wlcore: release runtime PM ref on regdomain config failure
     - wifi: wilc1000: fix out-of-bounds read in P2P public action frames
     - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
     - wifi: p54: validate curve data length in the calibration curve converters
     - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
     - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
     - wifi: mwifiex: validate scan response extents
     - wifi: mwifiex: prevent authentication frame length truncation
     - wifi: mwifiex: validate action frame fixed fields
     - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
     - drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
     - [arm64] drm/msm/adreno: fix autosuspend cleanup during teardown
     - [arm64] drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
     - smb: client: cancel reconnect work in clean_demultiplex_info()
     - smb: client: fix rlist race and missing initialization
     - smb: client: reject short Next offsets in parse_server_interfaces()
     - smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
     - smb: client: fix unaligned access in WSL reparse point parser
     - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
     - smb: client: fix potential OOB read in smb3_enum_snapshots()
     - smb: client: fix server->total_read for compound encrypted PDUs
     - smb: client: fix missing lower-bound check on DFS referral string offsets
     - smb: client: fix missing iov bounds check in parse_posix_sids()
     - HID: asus: fortify keyboard handshake (Closes: #1149499)
     - ksmbd: fix partial normalized name responses
     - spi: spi-zynqmp-gqspi: stop the controller on shutdown
     - smb: client: fix busy dentry warning on unmount after DIO (CVE-2026-72315)
     - xfs: don't stash removename operations with unknown ftype
     - erofs: fix large folio race in erofs_fscache_req_complete
     - ALSA: hda/realtek: Limit Star Labs internal mic boost
     - ALSA: hda/realtek: Add StarFighter HDA SSID
     - netfilter: nf_tables: Tolerate chains with no remaining hooks
     - netfilter: nf_tables: Simplify chain netdev notifier
     - xfrm: Refactor xfrm_input lock to reduce contention with RSS
     - xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463)
       (Closes: #1150891)
     - xfrm: save input state data before secpath resets
     - remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
     - [s390x] KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
     - bpf: Fix bpf_skb_change_tail wrt csum partial skbs
     - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
     - bpf: Fix divide-by-zero in btf_struct_walk()
     - bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
     - tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
     - HID: elecom: fix bus type for M-XGL20DLBK
     - [amd64] KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
     - bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
     - bpf: Fix out-of-bounds read of rtt_min in sock_ops
     - bpf: Remove migrate_{disable|enable} in ->map_for_each_callback
     - bpf: Bail out early in __htab_map_lookup_and_delete_elem()
     - bpf: Factor out htab_elem_value helper()
     - bpf: Register dtor for freeing special fields
     - bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
     - bpf, sockmap: Fix self-redirect copied_seq double-counting
     - [arm64] bpf, arm64: set up the frame pointer for the exception callback
     - pinctrl: meson: Fix typo in s4 group name
     - [amd64] HID: amd_sfh: Validate PCI BAR size before mapping
     - HID: bpf: fix __hid_bpf_hw_check_params report length
     - [riscv64] KVM: Preserve firmware counter value across stop/start
     - [riscv64] KVM: Report snapshot write failure to the guest
     - [riscv64] KVM: Fix perf-backed counter accounting across stop and read
     - [arm64] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
     - [arm64] KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry
       sizes
     - [arm64] KVM: arm64: vgic-its: Skip unreachable devices instead of failing
       the save
     - [arm64] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base
       0
     - [arm64] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
     - squashfs: Add dictionary size range check to prevent shift-out-of-bounds
     - scsi: sd_zbc: Reject disks with too many zones
     - Bluetooth: SMP: reject Security Request over BR/EDR
     - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
     - cgroup: selftests: Move memcontrol specific helpers out of common
       cgroup_util.c
     - scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
     - docs: s390/pci: Improve and update PCI documentation
     - [s390x] pci/docs: Fix sriov_numvfs attribute name
     - [s390x] cio: Fix cio_update_schib() to not cache invalid schib
     - [s390x] cio: Check pmcw.dnv before pmcw.ena in I/O entry points
     - [s390x] cio: Guard PMCW field accesses with dnv check
     - xsk: Use a 32-bit compare in xsk_map_gen_lookup
     - bpf: Skip unsettled links in link iterator
     - net/sched: cls_u32: fix manual hash table handle IDR aliasing
     - net/mlx5: devcom, Base component size on linked devices
     - bpf: Restrict CO-RE poisoning to relocatable instructions
     - libbpf: Reject truncated ldimm64 CO-RE relocations
     - netfilter: flowtable: publish HW_DEAD after worker is done
     - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
     - netfilter: nft_synproxy: use the family-aware checksum helper
     - ipvs: revalidate ihl before icmp_send
     - netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
     - [arm64] io: Reject non-user protection in ioremap_prot()
     - ocfs2: make ocfs2_calc_xattr_init() return void
     - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
     - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
     - drm/nouveau/disp: don't reject HDMI config on cards without SCDC
     - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
     - net: gue: reject invalid REMCSUM offsets
     - net: ethernet: mtk_eth_soc: unregister net_devices in case of probe
       failure
     - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
     - eth: fbnic: Handle maximum standalone channels
     - eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
     - sctp: avoid livelock while updating retransmit path
     - bpf: Bound ownership depth through local kptrs and graph roots
     - net: usb: catc: bound the RX packet length in catc_rx_done()
     - bpf: Check params size before reading reserved fields
     - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift
       budget
     - drm/virtio: fix object leak when drm_gem_handle_create() fails
     - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
     - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
     - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
     - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
     - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control
       fallthrough
     - Bluetooth: btintel_pcie: validate device-supplied DMA indices
     - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
     - octeontx2-af: Fix memory scaling limitation in SR-IOV mode
     - dpll: use exact lookup for reference sync pin id
     - net: usb: sr9700: include receive overhead in the length check
     - ipv6: Fix dst leak for uncached routes.
     - tg3: clean up PHYLIB resources on probe failure
     - [amd64] drm/i915/psr: Add new SU area calculation helper to apply
       workarounds
     - [amd64] drm/i915/psr: Clear stale sel fetch enable bits on sel fetch
       disable
     - [s390x] debug: Do not register views for failed static debug areas
     - [s390x] debug: Fix NULL pointer dereference in debug_info_copy()
     - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
     - genetlink: report the real command id for dump-only ops in policy dumps
     - net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
     - thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower
       bounds
     - bpf: Fix bounds check for skb-backed dynptrs
     - bpf: Fix bpf_sock context code generation
     - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
     - net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
     - net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
     - sctp: hold asoc or transport before mod_timer() in timer handlers
     - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
     - bpf: Reject dev-bound-only programs on other devices
     - nfc: nfcmrvl: validate helper command length before pull
     - nfc: st21nfca: validate received frame size
     - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
     - nfc: llcp: Fix race condition in accept_queue lifecycle
     - nfc: virtual_ncidev: Add missing ioctl compat handler
     - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
     - nfc: st21nfca: validate ISO15693 inventory length
     - nfc: llcp: fix -ENOMEM on connect with zero-length service name
     - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
     - nfc: llcp: fix slab-out-of-bounds reads when logging service names
     - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
     - net/sched: act_gate: budget the per-entry list in get_fill_size
     - veth: manage XDP program pointers during channel resize
     - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
     - vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
     - bpf: Fix immediate JMP JEQ/JNE on MIPS32
     - bpf: Fix BSWAP 32 and 16 on MIPS64
     - driver core: Add device probe log helper dev_warn_probe()
     - tg3: use random MAC address when tg3_get_device_address fails
     - net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
     - net: bcmgenet: initialize u64 stats seq counter for all queues
     - net: bcmgenet: move bcmgenet_power_up into resume_noirq
     - net: bcmgenet: allow return of power up status
     - net: bcmgenet: do not skip WoL power up on GENET V1
     - net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
     - net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
     - ip_gre: Reject enabling collect metadata through changelink
     - vxlan: use one headroom snapshot for neighbour replies
     - net: xps: reject an out of range traffic class
     - drm/imagination: clamp freelist reconstruction requests
     - bonding: crypto offload enabled, non-offload slave failover, rekey failed
     - net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
     - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
     - nfp: hold IPsec RX state under the XArray lock
     - net/smc: fix UAF on lgr list traversal in smcr_port_err()
     - tipc: Fix a data race on mon->peer_cnt in mon_timeout()
     - net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock
       fails
     - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
     - bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
     - net/sched: sch_teql: fix shadowed err in __teql_resolve()
     - vlan: ensure sufficient headroom in vlan_dev_hard_header()
     - autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
     - [amd64] perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted
       PERF_GLOBAL_CTRL bits
     - [amd64] perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if
       CPU has PEBS isolation, to fix stuck PEBS_ENABLED
     - [amd64] perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS
       config) if PEBS is unused
     - [amd64] perf/x86/intel: Make @data a mandatory param for
       intel_guest_get_msrs()
     - mptcp: return sk_wait_data() errors from recvmsg()
     - rculist: add list_splice_rcu() for private lists
     - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
       (CVE-2026-52988)
     - [amd64] x86/mce: Fix hardware debug register corruption on task migration
     - [amd64] x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
     - virtio_net: copy zerocopy frags in start_xmit without NAPI
     - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers
       underflow
     - tcp: prevent collapsing skbs across boundary in rtx queue
     - sctp: discard the rest of the packet on a stale-cookie error
     - af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
     - ata: libata-scsi: bound the ATA passthru sense descriptor writes
     - cgroup/pids: Restore pids.events notifications in local mode
     - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
     - fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder
       syzbot's "WARNING in do_new_mount" saga
     - writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
     - workqueue: Fix NULL current_pwq deref in flush dependency check
     - writeback: report a Tasks-RCU quiescent state per cgwb drain pass
     - fsl/fman: Fix clk reference leak in read_dts_node()
     - ipe: protect the dm-verity root hash with RCU
     - ipv6: do not let ipv6_find_hdr() return an offset past the packet end
     - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
     - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
     - gpio: zynq: fix runtime PM leak on request error path
     - llc: reserve device headroom for allocated frames
     - mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
     - rds: ib: Clear the sg list when mapping an MR fails
     - [amd64] drm/i915: fix incorrect RCU teardown order
     - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
     - drm/amd/display: Bump frame warning limit for clang builds of dml
     - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
     - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
     - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
     - drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
     - drm/nouveau: fix autosuspend cleanup during teardown
     - drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
     - drm/nouveau: fix double-free in nvif_vmm_dtor
     - drm/nouveau: Fix gem reference leak in validate_init()
     - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
     - drm/nouveau: RCU-free the scheduler-containing nouveau_sched
     - drm/nouveau: don't bump pin count on failed re-pin in
       nouveau_bo_pin_locked()
     - drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
     - drm/virtio: fix memory leak of fence event on execbuffer failure
     - drm/virtio: fix NULL pointer dereference on fence allocation failure
     - gpio: tps65219: Fix GPIO input value reads
     - mm/hugetlb: preserve mremap address delta when skipping page tables
     - PCI: of_property: Omit bus properties without a subordinate bus
     - HID: alps: fix use-after-free on input2 registration failure
     - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
     - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
     - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
     - net/mlx5e: advertise MACsec offload only when supported
     - net/sched: reject IDR error pointers when deleting actions
     - net: arp: terminate device name before lookup
     - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
     - net: hisilicon: hns_dsaf_mac: fix mdio device leak in
       hns_mac_register_phy()
     - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
     - net: openvswitch: conntrack: remove 'add_helper' dead code
     - net: openvswitch: conntrack: fix helper UAF due to extensions realloc
     - net: atl1c: fix soft lockup on out-of-range tpd_cons read
     - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
     - net: bridge: mdb: restart port group walk after deletion
     - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
     - net: usb: lan78xx: Fix URB reference leak in
       lan78xx_submit_deferred_urbs()
     - netfilter: ip6t_rpfilter: reject routes without inet6_dev
     - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
     - netfilter: nf_tables: skip expired catchall elements on insert and delete
     - nfc: fix use-after-free in nfc_get_local_general_bytes
     - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
     - nfc: port100: reject frames whose declared length exceeds the received
       data
     - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
     - perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
     - perf/core: Run sched_task() for PMUs with only CPU-wide events
     - pinctrl: single: free the IRQ on domain creation failure
     - pinctrl: sunxi: keep a shadow copy of the data register output latches
     - [s390x] cio: Fix NULL pointer dereference in ccw_device_get_util_str()
     - [s390x] cmf: Fix virtual vs physical address confusion
     - [s390x] vfio-ap: fix KVM GISC and page leak when queue removed from host
       config
     - KVM: Ensure memory attributes xarray nodes are accounted to the caller's
       memcg
     - KVM: Don't treat reserved xarray entries as having memory attributes
     - [arm64] KVM: arm64: Fix spurious warning for benign stage 2 teardown race
     - [riscv64] KVM: Synchronize hrtimer callback during teardown
     - [riscv64] KVM: Fix HSM hart status error propagation
     - Bluetooth: hci_conn: fix CIS hold ownership on reuse
     - Bluetooth: hci_sock: validate event length before filtering
     - Bluetooth: hci_sock: reject out-of-range OCF values
     - Bluetooth: ISO: balance the parent hold in hci_bind_bis()
     - Bluetooth: L2CAP: validate frame length before control and FCS access
     - Bluetooth: mgmt: fix race in read_unconf_index_list()
     - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
     - smb: client: fix create context out-of-bounds reads
     - smb: client: clean up failed cached directory opens
     - smb: client: validate POSIX create context length
     - xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
     - xfs: fix attr fork block count checks in xrep_inode_blockcounts
     - xfs: release orphanage dir inode if chown fails
     - xfs: use correct jiffies comparison function in xchk_maybe_relax
     - xfs: check padding field in xfs_ioc_commit_range
     - xfs: don't call xfs_exchange_range_finish for a dry run
     - xfs: check di_forkoff correctly in scrub
     - xfs: fix blockgc group quota scanning when usrquota isn't enforced
     - net: tls: fix silent data drop under pipe back-pressure
     - ring-buffer: Add helper functions for allocations
     - ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
       (CVE-2026-89503)
     - sched: Rework prev_balance() to avoid stale prev references
     - sched/core: Make core-sched flips wait for in-flight selections
       (CVE-2026-89520)
     - ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
       (CVE-2026-89500)
     - dmaengine: Add devm_dma_request_chan()
     - i2c: mxs: fix DMA channel leak on probe error
     - lockd: fix swapped arguments in nlmsvc_match_ip() (CVE-2026-93231)
     - [arm64] firmware: qcom_scm: Rename peripheral as pas_id
     - remoteproc: pas: Replace metadata context with PAS context structure
     - remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
     - power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
     - power: supply: ab8500_fg: fix use-after-free on remove (CVE-2026-89797)
     - [riscv64] PCI: starfive: Use regulator APIs to control the 3v3 power
       supply of PCIe slots
     - [riscv64] PCI: starfive: Fix resource leaks on error paths in host_init()
     - iommu/msm: Use helper function devm_clk_get_prepared()
     - iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
     - iommufd: Pass @pasid through the device attach/replace path
     - iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445)
     - [amd64] platform/x86: ISST: Check for admin capability for write commands
     - [amd64] platform/x86: ISST: Validate max level for set feature
     - mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
     - PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
     - PCI: Allow per function PCI slots to fix slot reset on s390
       (CVE-2026-89795)
     - [amd64] platform/x86: think-lmi: Fix current password length check
     - [amd64] platform/x86: think-lmi: improve check if BIOS account security
       enabled
     - [amd64] platform/x86: think-lmi: Fix certificate thumbprint sysfs output
     - [amd64] platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
     - [amd64] platform/x86: int1092: Fix potential memory leak in sar_probe()
       (CVE-2026-89437)
     - [amd64] platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init()
     - [amd64] platform/x86/amd/pmc: Move STB functionality to a new file for
       better code organization
     - [amd64] platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add
       helper function
     - [amd64] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error
       paths
     - [amd64] platform/x86/amd/pmc: Propagate SMU errors and validate S2D
       address (CVE-2026-81016)
     - io_uring/waitid: have io_waitid_complete() remove wait queue entry
     - io_uring/waitid: avoid siginfo copy during ring teardown
     - power: supply: qcom_battmgr: fix use-after-free (CVE-2026-89467)
     - net/smc: Address spelling errors
     - net/smc: stop killed, freed and out_of_sync sharing a byte
       (CVE-2026-80980)
     - net/mlx5e: SHAMPO, Always calculate page size
     - net/mlx5e: do not HW-GRO coalesce small frames
     - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
     - hwrng: drivers - Switch back to struct platform_driver::remove()
     - hwrng: stm32 - Fix runtime PM cleanup on registration failure
     - i3c: master: Do not treat master device as a duplicate target
       (CVE-2026-93199)
     - wifi: mt76: mt7915: set correct background radar capability
     - wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
       (CVE-2026-80937)
     - i3c: master: Fix use-after-free of master->this (CVE-2026-93200)
     - udf: Move udf_map_block() up
     - udf: Fix data loss when converting inline inodes to out of line
     - usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior
     - usb: dwc3: clear forceRM when issuing EndTransfer (CVE-2026-90030)
     - wifi: rtw89: cleanup unused rtwdev::roc_work
     - wifi: rtw89: Hide some errors when the device is unplugged
     - wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
       (CVE-2026-80939)
     - usb: typec: tcpm: fix debug accessory mode detection for sink ports
     - usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
     - wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
       (CVE-2026-80935)
     - xhci: Cleanup Candence controller PCI device and vendor ID usage
     - usb: cdns3: rename hibernated argument of role->resume() to lost_power
     - usb: cdnsp: fix wakeup from S3 after controller context loss
     - usb: storage: realtek_cr: fix use-after-free on disconnect
       (CVE-2026-90029)
     - usb: gadget: f_mass_storage: fix null pointer dereference in
       fsg_common_set_num_buffers() (CVE-2026-90023)
     - staging: rtl8723bs: fix spacing around operators
     - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() (CVE-2026-90016)
     - staging: sm750fb: fix mono image source stride mismatch in
       lynxfb_ops_imageblit()
     - tracing/probes: Fix anon_stack check for unnamed bitfields in
       btf_find_struct_member
     - Documentation: tracing: Add documentation about eprobes
     - tracing/probes: Fix BTF kflag check for anonymous struct member access
     - tracing: Clean up use of trace_create_maxlat_file()
     - tracing: Take trace_array reference when opening options file
       (CVE-2026-90013)
     - ftrace: Take trace_array reference before accessing its ftrace_ops
       (CVE-2026-90002)
     - dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
       (CVE-2026-89996)
     - compiler_types: Move lock checking attributes to
       compiler-context-analysis.h
     - futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
     - rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
     - perf/aux: Allocate non-contiguous AUX pages by default
     - [amd64] perf/x86/intel: Remove anythread_deprecated bit from
       perf_capabilities
     - ring-buffer: Show persistent buffer dropped events in trace_pipe file
     - ring-buffer: Allow splice reads on static buffers
     - nvme: add missing SRCU grace period in error path (CVE-2026-89972)
     - nvme: all namespaces in a subsystem must adhere to a common atomic write
       size
     - nvme: refactor the atomic write unit detection
     - nvme: fix atomic write size validation
     - nvme: skip the zoned limits update if the zone info query failed
       (CVE-2026-89971)
     - [s390x] vfio-ap: Fix missing lock required to access list of
       ap_matrix_mdev objects (CVE-2026-89956)
     - mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
     - nvdimm: preserve flush callback -ENOMEM
     - nvdimm: pmem: keep PREFLUSH before data writes (CVE-2026-98161)
     - nvdimm: virtio_pmem: stop allocating child flush bio
     - nvdimm: virtio_pmem: always wake -ENOSPC waiters
     - nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
     - nvdimm: virtio_pmem: refcount requests for token lifetime (CVE-2026-93196)
     - mtd: rawnand: pl353: Add message about ECC mode
     - mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw
       accesses
     - clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
     - mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
     - [amd64] KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list
     - [amd64] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back"
       halves
     - [amd64] KVM: x86: Extract REGS and SREGS runtime sync code to helpers
     - [amd64] KVM: x86: Rename __{g,s}et_sregs2() =>
       kvm_vcpu_ioctl_x86_{g,s}et_sregs2()
     - [amd64] KVM: x86: Move the bulk of register specific code from x86.c to
       regs.c
     - [amd64] KVM: x86: Check EFER validity on KVM_SET_SREGS*
     - media: i2c: imx355: Replace client->dev usage
     - media: imx355: Avoid calling imx355_power_off twice in error path
     - media: rkvdec: Propagate platform_get_irq() errors
     - [s390x] KVM: s390: Zero initialize data structures for inject_pfault_token
       (CVE-2026-89921)
     - [amd64] KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not
       supported
     - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
       (CVE-2026-89859)
     - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
       (CVE-2026-97537)
     - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
       (CVE-2026-97536)
     - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
       (CVE-2026-97532)
     - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
       (CVE-2026-97535)
     - media: chips-media: wave5: Add timeout while stop_streaming
       (CVE-2026-89868)
     - scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
     - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
     - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
     - scsi: qla2xxx: Skip vport under deletion in report ID acquisition
       (CVE-2026-97531)
     - scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
       (CVE-2026-97530)
     - scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
     - scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
       (CVE-2026-97528)
     - scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
       (CVE-2026-97527)
     - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
       (CVE-2026-97529)
     - f2fs: validate MOVE_RANGE destination size (CVE-2026-89840)
     - f2fs: convert F2FS_I_SB to sbi in f2fs_setattr()
     - f2fs: don't allow unaligned truncation to smaller/equal size on pinned
       file
     - f2fs: fix to avoid potential section-unaligned pinfile
     - f2fs: dirty directory inodes on mtime/ctime update
     - f2fs: limit recovery filename logging to stored length (CVE-2026-89838)
     - f2fs: fix dentry folio leak in find_in_level (CVE-2026-89837)
     - f2fs: embed f2fs_gc_kthread in f2fs_sb_info (CVE-2026-93285)
     - f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty()
     - f2fs: fix to clear dirty flag on folio in error path (CVE-2026-89832)
     - f2fs: accurately adjust free_sections during free_segment_range
       (CVE-2026-97534)
     - drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path
     - drm/amdgpu: add a helper to calculate ring distance
     - drm/amdgpu: plumb timedout fence through to force completion
     - drm/amdgpu: avoid force-completing uninitialized UVD rings
       (CVE-2026-89827)
     - drm/nouveau/disp/r535: Add scanline position support + head state support
     - drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
     - drm/sysfb: simpledrm: Improve panel-size validation
     - drm/sysfb: simpledrm: Improve stride validation (CVE-2026-93244)
     - firmware: sysfb: Move bpp-depth calculation into screen_info helper
     - drm/sysfb: simpledrm: Improve framebuffer-size validation
     - drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
       (CVE-2026-89806)
     - drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
     - configfs:get_target() - release path as soon as we grab configfs_item
       reference
     - configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
       (CVE-2026-97950)
     - tracing: Fix memory corruption from a "STACKTRACE" histogram key
       (CVE-2026-97934)
     - ipmr: account multicast table and route memory (CVE-2026-97939)
     - sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
     - reboot: fix cad_pid use-after-free race (CVE-2026-97938)
     - configfs: unhash the dentry before dropping the item in rmdir
       (CVE-2026-97949)
     - tracing: Constify struct event_trigger_ops
     - tracing: Remove get_trigger_ops() and add count_func() from trigger ops
     - tracing: Merge struct event_trigger_ops into struct event_command
     - tracing: Set the trace clock before registering the histogram trigger
       (CVE-2026-97935)
     - virtio-mmio: Remove virtqueue list from mmio device
     - virtio_mmio: disable IRQ wake before free_irq
     - tools/bootconfig: Cleanup bootconfig footer size calculations
     - tools/bootconfig: Fix integer overflow and truncation in size checks
     - tracing: Take trace_array reference when opening a tracer options file
       (CVE-2026-97933)
     - tracing: Take the reference before publishing the named histogram trigger
       (CVE-2026-97919)
     - tracing: Undo the registration when enabling the histogram trigger fails
       (CVE-2026-97918)
     - EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
     - EDAC/altera: Use parent device for devres in altr_portb_setup()
     - genetlink: pin family module during policy dump (CVE-2026-97901)
     - drm/bridge: tc358768: Enforce input bus flags via atomic_check
     - io_uring/rw: end write accounting from ->ki_complete (CVE-2026-97619)
     - io_uring/net: don't overconsume buffers when using MSG_TRUNC
       (CVE-2026-97618)
     - bootconfig: Fix integer overflow in initrd size check (CVE-2026-97906)
     - net: bridge: use option bits for CFM/MRP frame handlers (CVE-2026-97615)
     - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
       (CVE-2026-97620)
     - netfilter: cttimeout: detach dataplane timeout policy and repurpose
       refcount (CVE-2026-74347)
     - netfilter: cttimeout: prevent UAF during module unload (CVE-2026-97609)
     - net: macb: Replace open-coded implementation with napi_schedule()
     - net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI
     - net: macb: unify device pointer naming convention
     - net: macb: initialize PTP state before registering clock
     - erofs: add sysfs feature entry for xattr prefixes
     - [amd64,arm64] idpf: Fix kernel-doc descriptions to avoid warnings
     - [amd64,arm64] idpf: introduce idpf_q_vec_rsrc struct and move vector
       resources to it
     - [amd64,arm64] idpf: disable DIM work before freeing q_vectors
       (CVE-2026-97603)
     - ipv6: make ipv6_pinfo.saddr_cache a boolean
     - ipv6: reorganise struct ipv6_pinfo
     - ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock.
     - ipv6: flowlabel: cap duplicate leases per socket (CVE-2026-97597)
     - landlock: Clarify documentation for the IOCTL access right
     - landlock: Fix use-after-free of the source's parent directory
       (CVE-2026-97594)
     - netmem: add a couple of page helper wrappers
     - net: page_pool: rename page_pool_alloc_netmem to *_netmems
     - page_pool: disable sync for cpu for dmabuf memory provider
     - bnxt_en: Propagate TPA buffer allocation failures in
       bnxt_queue_mem_alloc() (CVE-2026-97571)
     - mptcp: pm: drop match in userspace_pm_append_new_local_addr
     - sock: add sock_kmemdup helper
     - mptcp: use sock_kmemdup for address entry
     - mptcp: pm: userspace: fix address ID overflow
     - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
     - eth: bnxt: store rx buffer size per queue
     - bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
     - bnxt_en: Don't free the live ring's TPA state on queue restart failure
       (CVE-2026-97574)
     - mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
     - mptcp: pm: use for_each_subflow helper
     - mptcp: pm: rename add_entry structure to add_addr
     - mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
       (CVE-2026-97566)
     - tcp: introduce icsk->icsk_keepalive_timer
     - mptcp: do not reschedule the RTX timer for fallback sockets
     - smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
     - smb/client: fix security flag calculation when setting security
       descriptors
     - smb: client: fail DACL rewrite when the new DACL exceeds 64K
       (CVE-2026-97559)
     - xfs: report healthy filesystem events in scrub stats
     - xfs: fix short ifork reaping computation in xreap_bmapi_binval
     - xfs: strengthen the "is cow staging" helpers in scrub
     - xfs: remove the i_ino field in struct xfs_inode
     - xfs: fix under-reservation of blocks when repairing sf directories
       (CVE-2026-97549)
     - xfs: fix backwards mergeability logic in refcount scrubber
     - cifs: Fix specification of function pointers
     - 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
     - [arm64] phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context
     - ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb
       handling
     - ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
     - swiotlb: use the adjusted address for the highmem page lookup
     - net: phy: mediatek: do not report link and per-speed LED rules together
     - btrfs: take commit root semaphore when iterating in
       mark_block_group_to_copy()
     - [arm64] Use load LSE atomics for the non-return per-CPU atomic operations
     - [arm64] percpu: Fix LSE operations on {8,16}-bit types
     - [arm64] i2c: qcom-cci: Stop complaining about DT set clock rate
     - [arm64] i2c: qcom-cci: Remove the unused variable cci_clk_rate
     - [arm64] i2c: qcom-cci: fix device_node refcount leak in
       cci_probe()/cci_remove()
     - scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
     - Input: hp_sdc - shut down kicker timer on module exit
     - wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
     - hwmon: (pwm-fan) Stop RPM timer before freeing tach data
     - drm/msm/dpu: clear pending peripheral flush state
     - wifi: libipw: reject TKIP frames without a full MIC
     - wifi: mac80211: track MU-MIMO configuration on disabled interfaces
     - wifi: mac80211: refuse to make a monitor active when it has no queue
     - smb: mark the new channel addition log as informational log with cifs_info
     - smb: client: fix use-after-free of iface in cifs_try_adding_channels()
     - drm/amdgpu: Failed to check various return code
     - drm/amdgpu/umsch: remove vpe test from umsch
     - drm/amdgpu: use GFP_NOWAIT for memory allocations
     - drm/amdgpu: fix rmmio iounmap skipped on device removal
     - smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
     - drm: add drm_memory_stats_is_zero
     - drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
     - smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
     - smb/client: send lease break ACKs thru correct session for multiuser
       mounts
     - [arm64] boot: Disable trapping of PMZR_EL0 writes to EL2
     - vlan: require the MAC header to be present in __vlan_insert_inner_tag()
     - gpio: cdev: fix kernel stack leak to user-space in error path
     - ipe: fix use-after-free when auditing a newly loaded policy
     - bna: prevent IOC timer rearm during teardown
     - i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
     - drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
     - drm/client: Pass force parameter to client restore
     - drm/client: fix restore of partially initialized client
     - [amd64] drm/i915/mst: add mst sub-struct to struct intel_dp
     - [amd64] drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
     - mm/rmap: allocate anon_vma_chain objects unlocked when possible
     - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma
       publish
     - drm/xe/vm: nuke PTs only after unlinking contested VMAs
     - mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
     - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
     - mm/hugetlb: create hstate_is_gigantic_no_runtime helper
     - mm/hugetlb: do not dissolve gigantic pages without runtime support
     - super: make iterate_supers_type() deletion-safe
     - PCI: Fix Resizable BAR restore order
     - PCI: Fix BAR resize for devices on a root bus
     - packet: use ubuf_info completion for TX_RING packets
     - HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
     - HID: alps: unregister DualPoint Stick input device on remove
     - net/sched: act_ct: fix helper UAF due to extensions realloc
     - net/sched: act_ct: avoid modifying shared unconfirmed ct entry
     - net: ipconfig: Remove outdated comment and indent code block
     - net: ipconfig: bound DHCP option construction
     - net: ena: Remove autopolling mode
     - net: ena: fix MMIO read buffer leak on probe failure
     - [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor
       LNL
     - [amd64] perf/x86/intel: Remove incorrect LionCove PEBS data-source
       constraints
     - [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor
       ADL
     - [amd64] perf/x86/intel: Fix GRT PEBS load/store direction for latency
       events, to fix sample classification
     - [riscv64] KVM: Fix null pointer dereference in
       kvm_riscv_aia_imsic_rw_attr()
     - [riscv64] KVM: Serialize IMSIC attributes with vCPU migration
     - rose: fix dev_put() leak in rose_loopback_timer()
     - rose: hold loopback neighbour reference across timer callback
     - rose: fix race between loopback timer and module removal
     - rose: clear neighbour pointer after rose_neigh_put() in state machines
     - rose: guard rose_neigh_put() against NULL in timer expiry
     - rose: fix netdev double-hold in rose_rx_call_request()
     - rose: fix notifier unregistered too early in rose_exit()
     - rose: fix netdev double-hold in rose_make_new()
     - rose: drop CALL_REQUEST in loopback timer when device is not running
     - rose: cancel neighbour timers in rose_neigh_put() before freeing
     - nvme: revert the cross-controller atomic write size validation
     - bootconfig: Fix negative seeks on 32-bit with LFS enabled
     - tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
     - mtd: rawnand: pl353: Fix debug prints
     - [amd64] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init
       fails
     - usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to
       race condition
     - bpf: Reject key-less BTF for hash maps
     - mm/hugetlb: keep max_huge_pages when dissolving surplus folios
     https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.113
     - smb: client: fix OOB read/write from unvalidated DataOffset in
       coalesce_t2() (CVE-2026-89633)
     - smb: client: fix cifsFileInfo reference leak in deferred close
       (CVE-2026-97558)
     - [arm64] KVM: arm64: nv: Fix life cycle of the nested_mmus array
     - [arm64] KVM: arm64: nv: Delay freeing of shadow S2 structures until VM
       destruction
     - smb: client: use finish_no_open() for non-regular inodes
     - xfs: don't let memory failures leak blocks and kill repairs
     - [riscv64] KVM: Fix null pointer dereference in
       kvm_riscv_aia_imsic_has_attr()
     - bpf, xdp: move offload check into dev_xdp_install() (CVE-2026-90146)
     - ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
     - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
     - ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of
       sof_ipc4_fw_data
     - ASoC: SOF: ipc4/Intel: Add support for library restore firmware
       functionality
     - smb/client: use stack-allocated smb2_file_all_info in
       smb3_query_mf_symlink()
     - smb/client: pass cifs_open_info_data to SMB2_open()
     - smb: client: close handle after create-context parsing failure
     - Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
     - Bluetooth: ISO: release unused CIS holds after channel attach
     - smb: client: close completed creates on compound wait errors
     - xfs: fix cursor and pointer handling when recovering iunlink buckets
     - neighbour: Skip default parms when resumed in neightbl_dump_info().
     - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
     - audit: fix exe mark UAF in kill_rules()
     - HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
     - kprobes: Skip disarmed probes when checking optkprobe overlap
     - of/irq: Fix remaining refcount leaks in of_irq_init()
     - of/overlay: put property on deadprops only after changeset add succeeds
     - of/overlay: only treat a positive changeset id as registered
     - net: fix checksum offsets in skb_splice_from_iter()
     - netfilter: nft_flow_offload: drop flowtable reference on init error path
     - net/packet: prevent TX_RING byte count overflow
     - rtc: ac100: Assign .num before accessing .hws
     - rtc: spear: initialize IRQ state before requesting alarm IRQ
     - sctp: check RCV_SHUTDOWN after the sendmsg connect wait
     - tpm: Disable TPM on null key name mismatch
     - virt: vmgenid: set driver_data before registering notification handlers
     - smb: client: clear setuid/setgid bit on write with
       cifsacl/modefromsid/posix extensions (CVE-2026-89638)
     - rds_tcp: close NULL deref window in rds_tcp_set_callbacks
     - vt: skip screen update for DEC alignment test on backgroup consoles
     - wifi: wlcore: Fix runtime PM leak in wlcore_remove()
     - ALSA: caiaq: unregister the input device when probe fails
     - ALSA: line6: reject oversized playback packets
     - mm/secretmem: properly account locked pages (CVE-2026-93243)
     - perf/core: Fix WARN in perf_sigtrap()
     - random: vDSO: avoid call to memset() when zeroing reserved parameter
     - mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
     - iio: accel: kionix-kx022a: Fix array boundary check
     - mtd: core: call _get_device() with the master MTD
     - nvmet: preserve device path on allocation failure
     - random: fix vgetrandom_opaque_params kernel-doc
     - of/overlay: don't leak fragment references when changeset init fails
     - of/overlay: don't create "//" paths for fragments targeting the root
     - ASoC: wm8903: Move the DRC QR threshold to the register that holds it
     - wifi: wfx: validate MIB read length before copying to caller
     - ASoC: tegra: Fix ASRC Stream6 input threshold control
     - wifi: ath11k: reset ar->num_stations on hardware start
     - wifi: ath9k: reject short WMI command responses
     - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
     - rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
     - rtc: Switch back to struct platform_driver::remove()
     - rtc: ac100: Fix clock provider use-after-free on probe failure
     - rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
     - wifi: cfg80211: preserve hidden-group beacon IE ownership
     - wifi: mac80211: Add multicast to unicast support for 802.3 path
     - wifi: mac80211: Add 802.3 multicast encapsulation offload support
     - wifi: mac80211: prevent AP VLAN tx from other interfaces
     - ASoC: codecs: rt286: Revert delay value for jack setup
     - ASoC: codecs: rt274: Fix format setting for 44100 rate
     - Bluetooth: hci_core: free the HCI ID if naming fails
     - Bluetooth: btintel: validate DDC record lengths
     - net/mctp: publish the mctp_dev only after it is initialised
     - net/sched: cls_api: reclaim an empty proto on the error path
     - ipv6: fix prefix route expiry in modify_prefix_route()
     - netfilter: ipset: do not update comments from kernel-side adds
     - Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
     - net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
     - net: systemport: Fix RUNT MIB counter register offset calculation
     - net/mlx5: LAG, Refactor lag logic
     - net/mlx5: Fix slab-out-of-bounds when handling team device events
     - octeontx2-af: mcs: Fix SC resource cleanup loop
     - tipc: prevent GCM nonce reuse on peer key changes
     - memcg: convert memcg->socket_pressure to u64
     - mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n.
     - net: Clean up __sk_mem_raise_allocated().
     - net-memcg: Introduce mem_cgroup_from_sk().
     - net-memcg: Introduce mem_cgroup_sk_enabled().
     - net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
     - net/sched: fq_codel: match the no-drop threshold to the packet size
     - net/sched: sch_codel: match the no-drop threshold to the packet size
     - virtio_blk: set the zone write granularity
     - net: bcmgenet: fix NULL dereference in set_coalesce before first open
     - net: cap skb->queue_mapping when the tx queue is picked
     - net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
     - tcp: refresh TS.Recent for accepted old ACKs
     - ipvs: fix missing counter decrement in lblc
     - ipvs: do not create invisible templates
     - ipvs: filter some flags received in the backup server
     - netfilter: bpf: reject invalid NAT manipulation types
     - netfilter: conntrack: remove skb argument from nf_ct_refresh
     - netfilter: conntrack: rework offload nf_conn timeout extension logic
     - netfilter: flowtable: generalize pending status bit
     - net: microchip: vcap: stop scanning after deleting key field
     - net: sparx5: make ports inherit the switch base mac address type
     - net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
     - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
     - xdp, xsk: constify read-only arguments of some static inline helpers
     - net: mvneta: clear XDP pfmemalloc flag between frames
     - i2c: at91: release DMA channels when probe defers
     - perf: Fix race between perf_event_exit_task() and perf_pending_task()
     - ALSA: core: Define auto-cleanup for snd_card_free()
     - ALSA: ice1712: Fix the error handling via auto-cleanup at probe
     - PCI: Accept AtomicOps already enabled by the hypervisor
     - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
     - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
     - drm/amd/pm/si: Fix updating clock limits on AC/DC
     - drm/amdgpu/gfx6: fix firmware leak on teardown
     - drm/radeon: Read the VRAM VBIOS signature with readb()
     - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
     - drm/mediatek: Fix ovl adaptor platform device leak
     - drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
     - drm/amdgpu: fix IP instance memory leak on kobject add failure
     - drm/amdgpu: fix ACP MFD device leak on init failure
     - binder: fix is_failure flag for superseded transaction cleanup
     - binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
     - kgdboc: Fix tty driver reference leak in configure_kgdboc()
     - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
     - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
     - Input: s6sy761 - fix resume ordering and restore sensing
     - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
     - Input: synaptics - limit T440p InterTouch quirk to LEN0036
     - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
     - [arm64] soc: qcom: geni-se: Correct QUP Core ICC vote constants
     - USB: cdc-acm: fix racy TIOCMIWAIT implementation
     - USB: cdc-acm: skip URB restart in port_shutdown if disconnected
     - USB: serial: fix port tear down use-after-free
     - usb: storage: sierra_ms: reject short SWoC info transfers
     - usb: hub: use shorter 120ms post resume hold for SS root hubs
     - usb: octeon-hcd: fix the FIFO-flush timeout computation
     - usb: ohci-da8xx: disable controller wakeup on cleanup
     - usb: ohci-s3c2410: disable controller wakeup on removal
     - usb: ohci-st: disable controller wakeup on removal
     - usb: gadget: midi2: Fix the jack descriptor array sizes
     - usb: gadget: f_uac1_legacy: validate bRequest index in
       generic_{set,get}_cmd
     - usb: typec: anx7411 - stop the IRQ before destroying the workqueue
     - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
     - usb: gadget: aspeed-vhub: cancel wake work on device removal
     - USB: gadget: dummy-hcd: Fix wait for outstanding request completions
     - usb: gadget: f_fs: Fix NULL pointer dereference in
       FUNCTIONFS_ENDPOINT_DESC
     - usb: chipidea: tegra: disable runtime PM on resume failure
     - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
     - usb: typec: tcpm: recover after failure to start the frs ams
     - usb: typec: tipd: don't send GAID when probe fails in APP mode
     - usb: typec: tipd: fix uninitialized typec_partner_desc in
       tps6598x_connect()
     - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
     - usb: typec: ucsi: Get the connector fwnode based on reg value
     - usb: typec: ucsi: displayport: Current CAM OOB index fixup
     - usb: cdns3: fix use-after-free in cdns3_gadget_exit()
     - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
     - tty: vt: fix memory leak in vc_allocate()
     - tty: amiserial: fix broken TIOCMIWAIT
     - tty: vcc: zero-initialize control packet in vcc_send_ctl()
     - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
     - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
     - tty: abort break signalling on hangup
     - tty: serial: max3100: shut down timer before freeing port
     - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
     - serial: fix TIOCMIWAIT race
     - serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
     - serial: tegra: don't clear the Tx FIFO on an Rx-only reset
     - serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
     - serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
     - serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
     - ASoC: codecs: max98363: fix uninitialized stream_config->type
     - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
     - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
     - ALSA: seq: Serialize compat port-info ioctls
     - ALSA: ua101: reject mismatched capture/playback packet sizes
     - EDAC/altera: Fix memory leak on dci allocation failure
     - i2c: xiic: don't clobber msg->len to signal block-read completion
     - Bluetooth: RFCOMM: Fix initial port reference race
     - Bluetooth: hci_sync: Fix inquiry cache use-after-free
     - Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
     - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
     - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
     - Bluetooth: hci_core: Serialize fragmented ISO packet queueing
     - Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
     - Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
     - Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
     - io_uring: fix task_work add use-after-free with SQPOLL
     - ipvs: bound LBLCR and LBLC cache growth
     - HID: multitouch: stop the release timer from being rearmed on remove
     - net: ext2end IPv6 exthdr detection of tunneled packets
     - tpm: fix off-by-four bounds check in tpm2_get_random()
     - nvme-multipath: fix underflow in ANA log bounds checks
     - nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
     - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
     - mtd: block2mtd: Fix divide error when erase_size is zero
     - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
     - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
     - mtd: spinand: fix zero oobavail when no ECC engine is used
     - [amd64] KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are
       modified
     - [amd64] KVM: x86/mmu: Bail from shadow walks if the root is invalid or a
       dummy
     - wifi: cw1200: fix TX padding OOB read leaking heap data to device
     - wifi: iwlegacy: 3945: free EEPROM data on remove
     - wifi: mac80211: keep paired old chanctx alive
     - wifi: mac80211: drain PS delivery work during station teardown
     - wifi: mac80211: account proxy paths against the mesh path limit
     - wifi: mac80211: keep fallback association elements alive
     - wifi: mac80211: minstrel_ht: validate fixed rate index
     - wifi: mac80211: reject invalid 320 MHz CSA bandwidth
     - wifi: mac80211: release mesh path quota on failed additions
     - wifi: mac80211: fix mesh fast xmit path deletion UAF
     - wifi: mac80211: handle empty FILS association request payload
     - USB: serial: cp210x: add Corsair AX1500i Power Supply
     - USB: serial: quatech2: fix baud rate overflow
     - USB: serial: ssu100: fix baud rate overflow
     - USB: serial: fix dynamic id driver deregistration race
     - USB: serial: fix driver deregistration order
     - USB: serial: fix ioctl hangup race
     - USB: serial: option: add support for SIMCom SIM8260C
     - USB: serial: option: add Quectel EG060W
     - USB: serial: option: add Compal EXM-G1x support
     - USB: serial: option: add Quectel RG660QB
     - USB: serial: option: add Compal EXC-T1 support
     - [amd64] thunderbolt: Fix KASAN reported use-after-free when request is
       canceled
     - [amd64] thunderbolt: Disable CL states for the Anker Prime TB5 dock
     - [amd64] thunderbolt: Reject oversized XDomain properties responses
     - smb: client: discard post-EOF pagecache when extending a file via zero
       range
     - smb: client: discard post-EOF pagecache when extending a file via copy
       range
     - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
     - iio: accel: kxcjk-1013: reject duplicate event disable
     - iio: accel: sca3000: fix frequency divider condition check
     - iio: adc: pac1934: check ACPI label duplication
     - iio: adc: stm32-adc: fix check on internal channel availability
     - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
     - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
     - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on
       unbind
     - iio: admv1013: initialize callback mutex before registering notifier
     - iio: buffer: serialize buffer teardown with mode claims
     - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
     - iio: frequency: admv1013: fix wrong channel field used in
       admv1013_read_raw()
     - iio: gyro: adis16136: fix unprotected debugfs reads
     - iio: health: max30102: fix NULL dereference in interrupt handler
     - iio: imu: adis16400: fix unprotected debugfs reads
     - iio: imu: adis16480: fix unprotected debugfs reads
     - iio: light: gp2ap020a00f: drain irq_work after free_irq
     - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency
       lookup
     - iio: proximity: aw96103: validate firmware data length
     - iio: proximity: isl29501: Fix return type of isl29501_register_write
     - iio: proximity: pulsedlight: fix iio_device left registered on PM setup
       failure
     - iio: proximity: sx9324: Correct proximity channel resolution
     - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
     - iio: trigger: cancel reenable_work before freeing trigger
     - ipv6: use RCU in ip6_output() (CVE-2025-40158)
     - jfs: fix array-index-out-of-bounds read in add_missing_indices
       (CVE-2025-38204)
     - [arm64] KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT
       save (CVE-2026-89912)
     - svcrdma: Use svc_xprt_put to free listener on create failure
       (CVE-2026-89527)
     - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
       (CVE-2026-93179)
     - console: introduce console_lock guard()s
     - tty/vt: use guard()s
     - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
     - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
     - mptcp: prevent race between disconnect() and rtx (CVE-2026-97567)
     - pfcp: fix socket lifetime on netdevice registration failure
     - netfs: clear post-EOF pagecache when extending a file via write
     - mm: shmem: remove __shmem_huge_global_enabled()
     - mm: factor out the order calculation into a new helper
     - mm: shmem: change shmem_huge_global_enabled() to return huge order bitmap
     - mm: shmem: ignore sysfs configs for shmem forced collapse
     - [arm64] KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
     - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
     - net: usb: qmi_wwan: add Quectel EG120K-EA
     - xen/netfront: drop RX packets with a short Ethernet header
       (CVE-2026-98375)
     - fs,fsverity: reject size changes on fsverity files in setattr_prepare
     - fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
     - drm/amd/display: Fix fast updates on DCE 8.1
     - usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
     - tty: fix saved termios reset race
     - perf: Remove unnecessary parameter of security check
     - perf/core: Check kernel access when kernel callchains are requested
     - perf: Require kernel access for text poke events
     - [arm64] fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only
     - [arm64] fpsimd: signal: Mandate SVE payload for streaming-mode state
     - [arm64] fpsimd: signal: Consistently read FPSIMD context
     - [arm64] fpsimd: signal: Forbid non-streaming SVE payload on SME-only
       systems
     - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
     - Bluetooth: Serialize SMP remote OOB data access
     - [arm64] errata: Factor out broken AMU const counter cap
     - [arm64] errata: Add Cortex-A725 erratum 3821522 workaround
     - [arm64] KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
     - fsverity: add dependency on 64K or smaller pages
     - drm/amdgpu: reset VI ASIC on MacBookPro15,1
     - drm/amdgpu: reset VI ASIC on MacBookPro14,3
     - usb: ohci-spear: Remove unnecessary NULL check before
       clk_disable_unprepare()
     - usb: ohci-spear: disable controller wakeup on removal
     - USB: dwc2: shut down wakeup timer before freeing HCD state
     - drm/amd/display: Preserve eDP mode on initial ASSR failure
     - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
     - tty: introduce tty_port_tty guard()
     - tty: tty_port: use guard()s
     - tty: tty_port: restore TTY_IO_ERROR on activation failure
     - tty: n_gsm: fix missing modem controls after DLCI open in convergence
       layer type 2
     - perf: Replace perf_event_header__init_id with full header init
     - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
     - i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume
       to facilitate atomic mode
     - i2c: xiic: preserve PEC byte length in SMBus block read setup
     - drm/amd/display: Mark DCE 6.4 as not APU
     - mtd: spinand: fix NULL pointer dereference with no ECC engine
     - wifi: mac80211: shut down RX BA session timer on teardown
     - mtd: spinand: Enable QE on all dies
     - nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
     - [arm64] KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
     - ipv4: free inet_opt and ireq_opt after an RCU grace period
       (CVE-2026-98432)
     - bnxt_en: fix DMA mapping length for padded small packets
       (Closes: #1149564)
     - tty: port: fix tty_port_tty_vhangup() race
     - wifi: mac80211: count only matching reservations in reserved switch
     - fs: Free any excess xarray nodes in clear_inode()
     - net/mlx5e: Prevent stale XSK buffer release on refill retry
     - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
     - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
     - net: mana: Skip WQ object destruction for uninitialized RXQ
     - net: mana: remove double CQ cleanup in mana_create_rxq error path
     - [amd64] KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is
       intercepted
     - wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
     - wifi: mac80211: set info->band for 802.3 encap offload frames
     - iio: accel: kx022a: Use cleanup.h helpers
     - iio: accel: kionix-kx022a: Prevent memory leak and fix state
     - iio: adc: ad_sigma_delta: fix use-after-free on unbind
     - iio: adc: aspeed: Simplify with dev_err_probe
     - iio: adc: aspeed: propagate reset deassert errors
     - iio: adc: max1363: sign-extend bipolar differential channel reads
     - iio: adc: axp288: Add TS bias override for Haier HV103H
     - iio: adc: stm32-adc: fix possible division by zero in processed channel
     - smb: client: only require read lease for size-extending preallocate
     - iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
     - iio: cdc: ad7150: fix OF matching and publish module aliases
     - iio: bu27034: simplify using guard(mutex)
     - iio: light: rohm-bu27034: Fix infinite delay on error
     - iio: light: rohm-bu27034: Fix error return
     - tools: ynl-gen: use names of constants in generated limits
     - tools: ynl-gen: support limits using definitions
     - tools: ynl: add scope qualifier for definitions
     - doc/netlink: netlink-raw: Add max check
     - f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
     - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
     - f2fs: fix to reset all pinned status during fggc
     - mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
     - mm/damon/core: fix unconditionally skip last region
     - Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
     - wifi: ath12k: fix reusing m3 memory
     - crypto: drbg - Fix ineffective sanity check
     - ipv4: validate checksum_start before completing checksum (CVE-2026-99999)
     - ipv4: stop PMTU walk when nexthop group shrinks
     - ipv4: stop exception dump when nexthop group shrinks
     - ipv4: stop route notification sizing when nexthop group shrinks
     - ipv4: do not warn on route notification size race
     - ipv6: do not warn on route notification size race
     - Input: ati_remote2 - fix type confusion in device attribute handlers
     - Input: xpad - add support for Corsair Novablade Pro
     - arm64: irq: exclude the softirq stack switch from KCOV
     - [amd64] ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
     - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
     - cipso: adjust cached option offsets when removing CIPSO
     - dm ioctl: don't let data_start run past the buffer
     - usb: f81604: fix struct f81604_int_data size mismatch
     - vsock/virtio: account only unread bytes in read_skb()
     - wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
     - wireguard: queueing: preserve tstamp_type when encapsulating packet
     - wireguard: noise: reject response consumption after intermediate
       initiation
     - workqueue: Fix NULL current_pwq deref in chained work check
     - xen/netfront: don't leak the skb when xennet_fill_frags() fails
     - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
     - strparser: make sure __strp_recv isn't running before tearing down the
       parser
     - swiotlb: fix default_swiotlb_limit() for non-growable default pool
     - tcp: reject net_iov in zerocopy receive mapping hints
     - tipc: destroy topsrv workqueues before closing connections
     - tipc: hold a reference to nodes found by link name
     - Revert "wifi: libertas: reject short monitor TX frames"
     - selinux: fix data race on AVC latest_notif
     - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
     - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when
       !streamoute
     - [amd64] EDAC/amd64: Mask UMC chip select to the four implemented selects
     - gpio: xilinx: fix runtime PM leak on request error path
     - ibmveth: h_free logical LAN on open-fail after register
     - ibmveth: fix TX LTB and filter unwind on open-fail
     - ice: fix metadata_dst refcount handling on representor teardown
     - keys: finalize persistent keyring timeout after link attempt
     - KEYS: Fix add_key() race with keyring restriction
     - memstick: core: wait for request completion before freeing card
     - memstick: rtsx_usb_ms: complete requests after eject instead of dropping
       them
     - dm-crypt: reject the lmk IV mode with AEAD ciphers
     - dm-snap: reject the transient exception store for snapshot-merge
     - dm: fix reading free memory in do_resume
     - mmc: cavium-octeon: destroy slot platform devices on remove
     - mmc: cavium-thunderx: destroy slot platform devices on remove
     - mmc: mtk-sd: Cancel request timeout work on remove
     - mmc: sdhci-sprd: disable runtime PM on remove
     - net/packet: guard the ll header push in packet_rcv_spkt()
     - net/smc: protect clcsock lifetime in smc_getname
     - net: bridge: avoid recursive multicast port cleanup
     - net: dsa: microchip: fix KSZ8765 fiber detection
     - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
     - net: sparx5: free the matchall entry on destroy
     - net: usb: ax88179_178a: fix rx frame length for non-last packets
     - nvme: fix swapped ZRASF zone state values for full and read only
     - openvswitch: fix soft lockup in the netlink flow dump
     - optee: register TEE devices only once fully initialized
     - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
     - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
     - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
     - pmdomain: rockchip: don't ignore clock lookup errors on attach
     - pmdomain: rockchip: fix clock leak on domain probe failure
     - pmdomain: rockchip: propagate subdomain add errors
     - scsi: qedi: Initialize callback state before registration
     - [riscv64] entry: gate shadow call stack reload on sstatus.SPP, not tp
     - [riscv64] fix load_unaligned_zeropad() fixup for RV32
     - Bluetooth: btintel_pcie: use managed IRQ teardown
     - Bluetooth: hci_sock: Serialize dead-device detachment
     - Bluetooth: ISO: Reject concurrent BIS listener setup
     - Bluetooth: ISO: Serialize concurrent connect calls
     - Bluetooth: MGMT: Fix status of pending commands flushed on power off
     - Bluetooth: RFCOMM: free the skb when the DLC has no owner
     - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
     - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
     - drm/gud: don't keep a connector without a CRTC as connector_state
     - [amd64] drm/i915/gem: Prevent overstepping exec array boundary
     - [amd64] drm/i915/gt: Unmask interrupts only when ACTIVE is true
     - drm/imagination: Size page table preallocation by device address
     - drm/vc4: drain the hangcheck timer and works on V3D unbind
     - drm/amdkfd: align SDMA doorbell base for shader doorbell writes
     - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
     - drm/amdgpu: serialize vblank counter reads against GPU reset
     - drm/amdgpu: make Mac FB workaround generic
     - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
     - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
     - namespace: don't copy an unmounted mount tree
     - fs: refuse fspick() on internal superblocks
     - namespace: check a submount for references right before unmounting it
     - dcache: don't put a mountpoint on a dentry that's being removed
     - namespace: don't let a pseudo dentry become the root of a mount
     - namei: don't reveal overmounted entries in refwalk
     - namespace: refuse an automount below a mount that is in no namespace
     - [arm64] dts: lx2160a: fix incorrect pinmux
     - [arm64] dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
     - [arm64] dts: lx2160a: fix the iic5 spi3 pinmux offset and value
     - Bluetooth: btintel_pcie: fix TX descriptor bounds check
     - Bluetooth: btintel_pcie: Add recovery mechanism
     - Bluetooth: btintel_pcie: Add shared HW reset for clean start
     - drm/dp: don't mark the AUX backlight enabled when enabling failed
     - gpio: exar: initialize the ID before registering its cleanup
     - drm/aspeed: Balance the display clock enable on teardown
     - drm/vc4: Free the BO cache size list on teardown
     - net/sched: em_text: reject unterminated algo before autoload
     - amt: send the relay's General Query directly from the receive path
     - cxgb4/ch_ktls: disable softirqs around tid_list erases
     - optee: sync secure world ABI headers
     - [arm64] tee: optee: ffa: support shared memory offsets on large-page
       kernels
     - nvmet: use the local P2P device on metadata allocation failure
     - [arm64] boot: Don't set PMUv3p9 FGT2 bits without PMUv3
     - btrfs: fix xattr replace when multiple xattrs are packed in the same item
     - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
     - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
     - wifi: mt76: mt7915: disable rx napi when removing device
     - wifi: mt76: mt7925: don't put the band auto marker in TGID
     - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
     - wifi: mt76: mt792x: pick the SAR table layout from the table itself
     - ASoC: adau1372: allow sleepy powerdown GPIOs
     - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
     - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
     - cpuset: separate tmpmasks and cpuset allocation logic
     - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in
       cpuset_handle_hotplug()
     - flow_dissector: avoid u16 truncation of skb->len when computing thoff
     - devlink: fix devlink_rel reference leak when notify work is pending
     - net/sched: cls_route: reject change with no routing attribute
     - pfcp: make sure the SEID is linear before reading it
     - bnxt_en: Add bnxt_clear_bars() helper
     - bnxt_en: Fix driver init in kdump kernel
     - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
     - drm/imagination: Fix reference and vm_bo handling in remap()
     - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
     - net/mlx5e: Order ICOSQ cc update after CQ doorbell
     - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
     - ptp: ocp: fix PCIe delay estimation calculation
     - net: openvswitch: validate transport header presence in set_ipv6_addr
     - vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
     - drm/vc4: Make v3d paths unavailable on any generation newer than vc4
     - drm/vc4: Fix binner slot allocation failing on an idle GPU
     - drm/panthor: validate userspace queue count against initialized firmware
       slot count
     - io_uring/waitid: use io_waitid_remove_wq() consistently
     - io_uring/waitid: fix KCSAN warning on io_waitid->head
     - netfilter: conntrack: fix erronous removal of offload bit
     - netfilter: flowtable: fix offloaded ct timeout never being extended
     - wifi: mt76: mt7603: initialize global station WCID
     - can: fix unique skb identifier regression under RPS
     - drm/amd/display: Don't replace a sink mode that shares the native totals
     - sched_ext: Generate qseq from a per-task counter
     - HID: steam: Fully unregister controller when hidraw is opened
     - HID: steam: Rearrange teardown sequence
     - HID: steam: Refactor registration
     - HID: steam: Clean up locking
Checksums-Sha1:
 d679ca71370b2510c3f120ca452503d8d51a9967 290418 linux_6.12.113-1.dsc
 906275a30c7581f5f23681ae935dfa88fb1aa0a1 151589656 linux_6.12.113.orig.tar.xz
 5b62a04c2fd924f77eef7c497d8b4b4f7e4c9d73 1954984 linux_6.12.113-1.debian.tar.xz
 f387a6456c403e8ee95d2ffd983edba06865c59a 5884 linux_6.12.113-1_source.buildinfo
Checksums-Sha256:
 7785e2db803dc74912f2dd4861eb454404cf3b9a2c2120f0cc3efda1f2337fa6 290418 linux_6.12.113-1.dsc
 2efc477744741f5d580a199ee79c251abb01f899759c621d1af0c3d361380821 151589656 linux_6.12.113.orig.tar.xz
 e2d62aaf6d3771dce7116feea9c419b47d6bbf8cb957153896fbbc276f2a54f9 1954984 linux_6.12.113-1.debian.tar.xz
 1e8ac52ec78b76cbe8a732934e81ffaf23f19f32effe82471dbdaa984b99424c 5884 linux_6.12.113-1_source.buildinfo
Files:
 45df6d3b14bf56238e10cf8f4a980cc2 290418 kernel optional linux_6.12.113-1.dsc
 6455c13db94c8767c0d4f17ec98c8c9d 151589656 kernel optional linux_6.12.113.orig.tar.xz
 718d6afd37f0fbef1c50a451aa7717ba 1954984 kernel optional linux_6.12.113-1.debian.tar.xz
 4c1403f1ea9a45951b51a1b5f35ab69e 5884 kernel optional linux_6.12.113-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrQ68tfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E+vkP/RaBZxxLc7W/4gGaIX9V++T5huA2z6Fu
gpguVBeXuG/vudO9z95yEyG/xHpvIWRaQ5CLKvgFDFrb+dwaSZFdO2rFoL8263Z0
1mqk5NrY57E1vctun/Rldf6b/JmSvK73uZNxKveL+KBywz8eRlPqtn0wm2qEI/qf
/4OMYfbmKYlGBxbDrvP5qWOOTXbQ5ddktQH9f7wFAijfTi7OjNo01+NwAdRppGPt
R1HHeny5u9J533/i+vWbyyjfmkbBJW3YOLwb9gNo31JF1VC/panIb8hN5NOkonf0
Uie7fSHzY+bPcG0cRRNbE+InucIPhwOsD/W07C+tJCQs6pj6z3qQN1zViY60jTlN
0wH80pJAugq+/oidKSFrq8sWdedKlIG3iK45emAnEMFe+XJHAkiU87Uvcr1D4t+d
UdAtiUudUpToucVUEBVxoaBbE0LltKUD16xrmp93DC4VSmcQ8xfbLsVBVOLmnjms
8C5fIMVlFsd594xmCgvs53DBFeNr2hziW9AKAvKo/KDezRu7LbVdE+h7ea50BeHa
GIiIpGdP5OupkddGWQzY63SqEibBwQMkaFJ7ZNzXYU7EoG+XvFJo0f210Gl0Tm36
3ejysjdbxXcqp1OzxXZtbTBwhzDDigISG0IIDdZZ/cgUQPD/Lgw321n1MH4IDxNB
Y56jJh25bz2F
=WU5T
-----END PGP SIGNATURE-----