Accepted linux 7.2.9-1~bpo13+1 (source) into stable-backports

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 13 Oct 2026 16:51:59 +0200
Source: linux
Architecture: source
Version: 7.2.9-1~bpo13+1
Distribution: trixie-backports
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 1108860 1144314 1146124
Changes:
 linux (7.2.9-1~bpo13+1) trixie-backports; urgency=medium
 .
   * Rebuild for trixie-backports
 .
 linux (7.2.9-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.9
     - drm/amd/display: Atomize IRQ register read/modify/write ops
     - ALSA: hda/realtek: Limit Star Labs internal mic boost
     - ALSA: hda/realtek: Add StarFighter HDA SSID
     - drm/amd/display: Remove sink usage from DPMS
     - [arm64] remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
     - [s390x] KVM: s390: Fix dirty marking in adapter_indicators_set*()
     - [s390x] KVM: s390: Fix _gaccess_shadow_fault()
     - [s390x] KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
     - [s390x] KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
     - [s390x] KVM: s390: Properly handle NULL pointer in
       dat_cond_set_storage_key()
     - [s390x] KVM: s390: Fix potential races in dat skey functions
     - [s390x] KVM: s390: Fix race in _destroy_pages_crste()
     - [s390x] uv: Fix loop condition in uv_find_secrets
     - [s390x] uv: Prevent potential out-of-bounds read
     - bpf: Fix bpf_skb_change_tail wrt csum partial skbs
     - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
     - bpf: Fix divide-by-zero in btf_struct_walk()
     - bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
     - tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
     - HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio
     - HID: winwing: fix use-after-free in force feedback teardown
     - HID: elecom: fix bus type for M-XGL20DLBK
     - [amd64] KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
     - bpf: Allow terminal gotox instructions
     - bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
     - bpf: Fix out-of-bounds read of rtt_min in sock_ops
     - bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
     - bpf, sockmap: Fix self-redirect copied_seq double-counting
     - bpf: Fix u32 overflow issue in map batch operations
     - [arm64] bpf, arm64: set up the frame pointer for the exception callback
     - [arm64] pinctrl: meson: Fix typo in s4 group name
     - [riscv64] pinctrl: generic: serialise pinctrl_generic_dt_node_to_map()
     - [amd64] HID: amd_sfh: Validate PCI BAR size before mapping
     - HID: bpf: fix __hid_bpf_hw_check_params report length
     - [riscv64] KVM: Fix the conversion between vsip and hvip
     - [riscv64] KVM: riscv: Fix NACL hfence entry update order
     - [riscv64] RISC-V: KVM: Preserve firmware counter value across stop/start
     - [riscv64] RISC-V: KVM: Report snapshot write failure to the guest
     - [riscv64] RISC-V: KVM: Fix perf-backed counter accounting across stop and
       read
     - [arm64] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
     - [arm64] KVM: arm64: vgic-its: Skip unreachable devices instead of failing
       the save
     - [arm64] KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
     - [arm64] KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
     - [arm64] KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
     - [arm64] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base
       0
     - [arm64] KVM: arm64: Match hyp text by physical address in
       fix_host_ownership()
     - [arm64] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
     - squashfs: Add dictionary size range check to prevent shift-out-of-bounds
     - scsi: block: Fix zones_cond out-of-bounds write on zone report
     - scsi: sd_zbc: Reject disks with too many zones
     - pinctrl: sunxi: A523: fix voltage withstand encoding
     - Bluetooth: SMP: reject Security Request over BR/EDR
     - Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
     - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
     - scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
     - [s390x] pci/docs: Fix sriov_numvfs attribute name
     - [s390x] cio: Fix cio_update_schib() to not cache invalid schib
     - [s390x] cio: Check pmcw.dnv before pmcw.ena in I/O entry points
     - [s390x] cio: Guard PMCW field accesses with dnv check
     - netfs: Fix netfs_read_gaps() to use separate sink folios
     - netfs, afs: Fix symlink reading
     - fs: avoid repeated scans in evict_inodes()
     - xsk: Use a 32-bit compare in xsk_map_gen_lookup
     - bpf: Skip unsettled links in link iterator
     - eth: fbnic: Fix payload page pool error cleanup
     - net/sched: cls_u32: fix manual hash table handle IDR aliasing
     - net: pcs: rzn1-miic: Fix config array initialization
     - octeontx2-af: use seq_file for rsrc_alloc debugfs
     - net/mlx5: devcom, Base component size on linked devices
     - net/mlx5: SD, unload reps on shared FDB create error path
     - net/mlx5: LAG, reload IB reps of LAG master before the rest
     - bpf: Make post-verification instruction rewrites killable
     - bpf: Preserve packet pointer class displacement in regsafe()
     - bpf: Restrict CO-RE poisoning to relocatable instructions
     - libbpf: Reject truncated ldimm64 CO-RE relocations
     - ipv4: fib: fix data-race and stale genid check around nh->nh_saddr
     - gpiolib: use of_node_name if line-name is missing
     - netfilter: flowtable: publish HW_DEAD after worker is done
     - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
     - netfilter: nft_synproxy: use the family-aware checksum helper
     - ipvs: revalidate ihl before icmp_send
     - netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
     - [arm64] io: Reject non-user protection in ioremap_prot()
     - ocfs2: make ocfs2_calc_xattr_init() return void
     - pinctrl: qcom: ipq5210: Publish the OF module alias
     - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
     - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
     - drm/nouveau/disp: don't reject HDMI config on cards without SCDC
     - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
     - net: gue: reject invalid REMCSUM offsets
     - net: ethernet: mtk_eth_soc: unregister net_devices in case of probe
       failure
     - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
     - net: ethtool: keep rtnl_lock for the ioctl self test
     - eth: fbnic: Handle maximum standalone channels
     - eth: fbnic: use the Rx queue napi pointer to find the napi vector
     - eth: fbnic: reset num_napi when the napi vectors are freed
     - eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
     - eth: fbnic: Handle FW mailbox completions flagged with an error
     - sctp: avoid livelock while updating retransmit path
     - net: allow IFLA_INET_CONF messages when NLA_F_NESTED unset
     - bpf: Bound ownership depth through local kptrs and graph roots
     - net: usb: catc: bound the RX packet length in catc_rx_done()
     - bpf: Check params size before reading reserved fields
     - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift
       budget
     - drm/virtio: fix object leak when drm_gem_handle_create() fails
     - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
     - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
     - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
     - Revert "drm/virtio: Allow importing prime buffers when 3D is enabled"
     - drm/virtio: sync shmem backing on guest-bound transfers
     - [arm64] pinctrl: tegra238: Fix register bank for AON pin groups
     - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
     - ovpn: preserve IPv6 scope id for netlink peer endpoints
     - ovpn: skip UDP source validation for unspecified addresses
     - ovpn: track UDP socket route key for peer dst cache
     - ovpn: validate peer state before caching UDP dst
     - ovpn: replace bind when learning local endpoint
     - ovpn: replace bind when clearing stale local source
     - ovpn: always unhash old VPN addresses before rehashing
     - ovpn: reject duplicate peer VPN addresses
     - ovpn: reject multipeer peers without VPN addresses
     - ovpn: reject invalid peer VPN addresses
     - drm/xe/gt_throttle: Report power brake as a throttle reason on CRI
     - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control
       fallthrough
     - Bluetooth: btintel_pcie: validate device-supplied DMA indices
     - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
     - bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
     - octeontx2-af: Fix memory scaling limitation in SR-IOV mode
     - ipv6: Prevent rt6_insert_exception() for dying fib6_info.
     - net: don't require the hwtstamp NDOs when a PHY provides timestamping
     - dpll: use exact lookup for reference sync pin id
     - net: usb: sr9700: include receive overhead in the length check
     - ipv6: Fix dst leak for uncached routes.
     - udp: relocate a connected socket in the 4-tuple hash table on re-connect
     - udp: remove a disconnected socket from the 4-tuple hash table
     - tg3: clean up PHYLIB resources on probe failure
     - [amd64] drm/i915/psr: Clear stale sel fetch enable bits on sel fetch
       disable
     - [s390x] debug: Do not register views for failed static debug areas
     - [s390x] debug: Fix NULL pointer dereference in debug_info_copy()
     - [riscv64] net: spacemit: clear TX descriptor on fragment mapping failure
     - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
     - genetlink: report the real command id for dump-only ops in policy dumps
     - net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
     - PM: hibernate: Freeze kernel threads after image preallocation
     - thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower
       bounds
     - bpf: Fix bounds check for skb-backed dynptrs
     - bpf: Fix bpf_sock context code generation
     - bpf: Reject pkt arguments in mutating subprogs
     - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
     - firewire: cdev: fix back-transition for iso_resource_auto client resource
     - net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
     - net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
     - sctp: hold asoc or transport before mod_timer() in timer handlers
     - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
     - net: stmmac: size the RX buffers from the frame length, not the MTU
     - net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo
       test
     - eth: fbnic: Avoid rounding zero ring sizes
     - net/sched: fix potential stack infoleak in em_text_dump()
     - bpf: Reject dev-bound-only programs on other devices
     - nfc: nfcmrvl: validate helper command length before pull
     - nfc: st21nfca: validate received frame size
     - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
     - nfc: llcp: Fix race condition in accept_queue lifecycle
     - nfc: virtual_ncidev: Add missing ioctl compat handler
     - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
     - nfc: st21nfca: validate ISO15693 inventory length
     - nfc: llcp: fix -ENOMEM on connect with zero-length service name
     - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
     - nfc: llcp: fix slab-out-of-bounds reads when logging service names
     - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
     - net/sched: act_gate: budget the per-entry list in get_fill_size
     - net: bcmgenet: stop Tx NAPI before disabling the queues
     - veth: manage XDP program pointers during channel resize
     - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
     - vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
     - net: dsa: mv88e6xxx: 88E6191X and 88E6193X have no PTP
     - net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection
     - bpf: Fix immediate JMP JEQ/JNE on MIPS32
     - bpf: Fix BSWAP 32 and 16 on MIPS64
     - tg3: use random MAC address when tg3_get_device_address fails
     - net: stmmac: clear stale buf->page after recycling on skb build failure
     - net: ipv6: keep room for the mac header in dst_dev_overhead()
     - net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
     - net: bcmgenet: initialize u64 stats seq counter for all queues
     - net: bcmgenet: do not skip WoL power up on GENET V1
     - net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
     - net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
     - ip_gre: Reject enabling collect metadata through changelink
     - vxlan: use one headroom snapshot for neighbour replies
     - net: xps: reject an out of range traffic class
     - drm/imagination: clamp freelist reconstruction requests
     - bonding: crypto offload enabled, non-offload slave failover, rekey failed
     - macsec: initialize SecY before registering the netdevice
     - net/sched: act_ife: validate metadata length before decoding
     - net: emac: move setting of netops to fix crash
     - bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element
     - net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
     - net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
     - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
     - net: phylink: record the PHY only once bringup cannot fail
     - net: wangxun: implement soft quiesce for PCIe error recovery
     - net: libwx: fix races in Tx timestamp handling
     - nfp: hold IPsec RX state under the XArray lock
     - net/rds: size a connection's path set by the transport it ends up with
     - net/smc: fix UAF on lgr list traversal in smcr_port_err()
     - tipc: Fix a data race on mon->peer_cnt in mon_timeout()
     - net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock
       fails
     - net: flush skb_defer_nodes in dev_cpu_dead()
     - gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
     - gve: fix TX drop when GSO MSS is too small for hw
     - gve: DQO: reject TSO packets with an out of range MSS
     - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
     - bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
     - net/sched: sch_teql: fix shadowed err in __teql_resolve()
     - vlan: ensure sufficient headroom in vlan_dev_hard_header()
     - ovl: fix UAF in ovl_do_mkdir() debug print
     - autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
     - [amd64] perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted
       PERF_GLOBAL_CTRL bits
     - [amd64] perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if
       CPU has PEBS isolation, to fix stuck PEBS_ENABLED
     - [amd64] perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS
       config) if PEBS is unused
     - [amd64] perf/x86/intel: Make @data a mandatory param for
       intel_guest_get_msrs()
     - [amd64] perf/x86/intel: Delete dead NVL PEBS data-source initcall
     - perf/core: Fix a refcount leak in attach_perf_ctx_data()
     - perf/core: Fill branch entries with a single assignment
     - sched/core: Account PSI IRQ time to the execution context, not the
       scheduling context
     - mptcp: return sk_wait_data() errors from recvmsg()
     - drm/pagemap: dma-unmap pages before handling migration errors
     - vlan: require the MAC header to be present in __vlan_insert_inner_tag()
     - [amd64] x86/mce: Fix hardware debug register corruption on task migration
     - [amd64] x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
     - [amd64] x86/sev: Make vTPM SVSM calls preemption-safe
     - vsock: ignore empty child namespace mode writes
     - virtio_net: copy zerocopy frags in start_xmit without NAPI
     - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers
       underflow
     - tcp: prevent collapsing skbs across boundary in rtx queue
     - sctp: discard the rest of the packet on a stale-cookie error
     - af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
     - [arm64] boot: Disable trapping of PMZR_EL0 writes to EL2
     - [arm64] errata: match the target implementation CPU's own MIDR
     - ata: libata-scsi: bound the ATA passthru sense descriptor writes
     - bna: prevent IOC timer rearm during teardown
     - bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
     - crypto: s390/hmac - Generate intermediate CV for API partial block
       handling
     - cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on
       subpartitions_cpus conflict
     - cgroup/pids: Restore pids.events notifications in local mode
     - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
     - fprobe: Terminate the fgraph_data list when the reservation is not filled
     - netfs: Fix missing alloc tagging of direct mempool allocations
     - writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
     - workqueue: Fix NULL current_pwq deref in flush dependency check
     - writeback: report a Tasks-RCU quiescent state per cgwb drain pass
     - fsl/fman: Fix clk reference leak in read_dts_node()
     - ipe: fix use-after-free when auditing a newly loaded policy
     - ipe: protect the dm-verity root hash with RCU
     - ipv6: do not let ipv6_find_hdr() return an offset past the packet end
     - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
     - kprobes: Fix permanent hang when flushing the kprobe optimizer
     - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
     - gpio: cdev: fix kernel stack leak to user-space in error path
     - gpio: zynq: fix runtime PM leak on request error path
     - llc: reserve device headroom for allocated frames
     - mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
     - rds: ib: Clear the sg list when mapping an MR fails
     - drm/client: fix restore of partially initialized client
     - drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
     - drm/imagination: Fix page count for page table for map() interface
     - [amd64] drm/i915: fix incorrect RCU teardown order
     - [amd64] drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1
     - [amd64] drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
     - [amd64] drm/i915/dp_mst: Fix configuring TUs for a disconnected stream
     - drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
     - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
     - drm/amd/display: Bump frame warning limit for clang builds of dml
     - drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout
     - drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait
     - drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait
     - drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
     - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
     - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
     - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
     - drm/amdgpu: move userq fence wait out of signalling section
     - drm/nouveau/dmem: pin VRAM for the whole registered range
     - drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
     - drm/nouveau: fix autosuspend cleanup during teardown
     - drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
     - drm/nouveau: fix double-free in nvif_vmm_dtor
     - drm/nouveau: Fix gem reference leak in validate_init()
     - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
     - drm/nouveau: RCU-free the scheduler-containing nouveau_sched
     - drm/nouveau: don't bump pin count on failed re-pin in
       nouveau_bo_pin_locked()
     - drm/xe/vm: nuke PTs only after unlinking contested VMAs
     - drm/xe: harden adjust_idledly() against divide-by-zero and overflow
     - drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
     - drm/xe: Keep walking on SVM eviction failure
     - drm/virtio: fix memory leak of fence event on execbuffer failure
     - drm/virtio: fix NULL pointer dereference on fence allocation failure
     - gpio: tps65219: Fix GPIO input value reads
     - gpio: tps65219: Use the variant-specific direction callback
     - gpio: tps65219: Fix TPS65214 GPIO direction programming
     - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma
       publish
     - mm/hugetlb: do not dissolve gigantic pages without runtime support
     - mm/hugetlb: preserve mremap address delta when skipping page tables
     - mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
     - mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
     - mm/damon/core: fix unconditionally skip last region
     - mm/damon/core: allow esz to be set to zero
     - mm/damon/core: reset invalid quota->charge_target_from
     - PCI: Fix BAR resize for devices on a root bus
     - PCI: of_property: Omit bus properties without a subordinate bus
     - packet: use ubuf_info completion for TX_RING packets
     - HID: alps: unregister DualPoint Stick input device on remove
     - HID: alps: fix use-after-free on input2 registration failure
     - HID: hid-oxp: use cancel_delayed_work_sync() in remove
     - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
     - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
     - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
     - net/mlx5e: advertise MACsec offload only when supported
     - net/mlx5e: fix swapped IPv6 IPsec policy masks
     - net/sched: reject IDR error pointers when deleting actions
     - net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
     - net: arp: terminate device name before lookup
     - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
     - net: hisilicon: hns_dsaf_mac: fix mdio device leak in
       hns_mac_register_phy()
     - net: ipconfig: bound DHCP option construction
     - net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
     - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
     - net: openvswitch: conntrack: remove 'add_helper' dead code
     - net: openvswitch: conntrack: fix helper UAF due to extensions realloc
     - net: atl1c: fix soft lockup on out-of-range tpd_cons read
     - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
     - net: bridge: mdb: restart port group walk after deletion
     - net: ena: fix PHC cleanup on probe failure
     - net: ena: fix MMIO read buffer leak on probe failure
     - net: phy: intel-xway: workaround 100BASE-TX Link-Up issue
     - net: phy: micrel: Advance register data pointer in write loop
     - net: txgbe: fix FDIR filter restore for VF rules
     - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
     - net: usb: lan78xx: Fix URB reference leak in
       lan78xx_submit_deferred_urbs()
     - netfilter: ip6t_rpfilter: reject routes without inet6_dev
     - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
     - netfilter: nf_tables: skip expired catchall elements on insert and delete
     - nfc: fix use-after-free in nfc_get_local_general_bytes
     - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
     - nfc: port100: reject frames whose declared length exceeds the received
       data
     - nfc: trf7970a: power down on startup RX gain failure
     - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
     - scsi: ufs: core: Keep internal commands dispatchable during error handling
     - scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction
     - perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
     - perf/core: Run sched_task() for PMUs with only CPU-wide events
     - [amd64] perf/x86/intel: Fix CMT PEBS load/store direction for latency
       events, to fix sample classification
     - [amd64] perf/x86/intel: Fix GRT PEBS load/store direction for latency
       events, to fix sample classification
     - [amd64] perf/x86/intel: Fix DKT PEBS load/store direction for latency
       events, to fix sample classification
     - [amd64] perf/x86/intel: Fix Panther Cove PEBS data-source snoop states
     - [amd64] perf/x86/intel: Remove incorrect LionCove PEBS data-source
       constraints
     - [amd64] perf/x86/intel: Remove incorrect Panther Cove PEBS data-source
       constraints
     - [amd64] perf/x86/intel: Constrain Panther Cove UOPS_DISPATCHED events to
       PMCs 0-3
     - [riscv64] pinctrl: mpfs-mssio: fix width of unused bank voltage setting
     - [riscv64] pinctrl: mpfs-mssio: use correct regmap function to set bank
       voltage
     - [arm64] pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions
     - [arm64,armhf] pinctrl: single: free the IRQ on domain creation failure
     - pinctrl: sunxi: keep a shadow copy of the data register output latches
     - [s390x] cio: Fix NULL pointer dereference in ccw_device_get_util_str()
     - [s390x] cmf: Fix virtual vs physical address confusion
     - [s390x] pci: Fix leak of struct pci_dev reference in zpci_report_status()
     - [s390x] pci: Fix missing device lock in zpci_report_status()
     - [s390x] pci: Report SCLP status on error events when no pdev is associated
     - [s390x] pci: Don't report recovery success on skipped recovery
     - [s390x] vfio-ap: fix KVM GISC and page leak when queue removed from host
       config
     - KVM: Ensure memory attributes xarray nodes are accounted to the caller's
       memcg
     - KVM: Don't treat reserved xarray entries as having memory attributes
     - [amd64] KVM: SEV: Free have_run_cpus during VM destruction even if VM is
       no longer SEV
     - [amd64] KVM: SEV: Do cache maintenance on the source VM during intra-host
       migration
     - [arm64] KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
     - [arm64] KVM: arm64: Fix AArch32 DBGBXVR<n> handling
     - [arm64] KVM: arm64: Fix spurious warning for benign stage 2 teardown race
     - [arm64] KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown
       race
     - [arm64] KVM: arm64: Transfer the hyp stack pages out of the host stage-2
     - [riscv64] KVM: Serialize IMSIC attributes with vCPU migration
     - [riscv64] KVM: Synchronize hrtimer callback during teardown
     - [riscv64] KVM: Release unused page after MMU invalidation
     - [riscv64] KVM: Propagate interrupted G-stage faults
     - [riscv64] KVM: Fix HSM hart status error propagation
     - sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
     - sched/cache: Decouple sched_cache_group from mm to fix UAF
     - sched/cache: Refresh LLC capacity across CPU hotplug, to fix capacity
       underestimation bug
     - Bluetooth: hci_conn: fix CIS hold ownership on reuse
     - Bluetooth: hci_sock: validate event length before filtering
     - Bluetooth: hci_sock: reject out-of-range OCF values
     - Bluetooth: ISO: balance the parent hold in hci_bind_bis()
     - Bluetooth: ISO: release unused CIS holds after channel attach
     - Bluetooth: L2CAP: validate frame length before control and FCS access
     - Bluetooth: mgmt: fix race in read_unconf_index_list()
     - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
     - smb: client: fix create context out-of-bounds reads
     - smb: client: close handle after create-context parsing failure
     - smb: client: clean up failed cached directory opens
     - smb: client: preserve create-context parsing errors
     - smb: client: use finish_no_open() for non-regular inodes
     - smb: client: validate POSIX create context length
     - smb: client: close completed creates on compound wait errors
     - smb: client: delete compound mids on send failure before unlock
     - xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
     - xfs: fix attr fork block count checks in xrep_inode_blockcounts
     - xfs: release orphanage dir inode if chown fails
     - xfs: use correct jiffies comparison function in xchk_maybe_relax
     - xfs: check padding field in xfs_ioc_commit_range
     - xfs: don't call xfs_exchange_range_finish for a dry run
     - xfs: only flag zero padding for dir3 data blocks, not dir3 block blocks
     - xfs: use the correct reservations for rtrmap/refcount recovery
     - xfs: check di_forkoff correctly in scrub
     - xfs: fix rtgroup repair estimations
     - xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
     - xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
     - xfs: don't let hidden_space go negative in xfs_metafile_resv_init
     - xfs: don't let memory failures leak blocks and kill repairs
     - xfs: don't merge different file IO error types
     - xfs: drop dquot flush lock when we can't find a buffer to flush
     - xfs: fix blockgc group quota scanning when usrquota isn't enforced
     - xfs: fix cursor and pointer handling when recovering iunlink buckets
     - drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms
     - landlock: Work around gcc-16 -Wuninitialized warning
     - [amd64] accel/ivpu: Use threaded IRQ for IPC callback processing
     - [amd64] accel/ivpu: Use separate flag for job timeout
     - [arm64] i2c: qcom-geni: Isolate serial engine setup
     - [arm64] i2c: qcom-geni: Move resource initialization to separate function
     - [arm64] i2c: qcom-geni: Store of_device_id data in driver private struct
     - [arm64] i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
     - super: convert s_count to refcount_t s_passive
     - super: take lock after last reference count
     - super: make iterate_supers_type() deletion-safe
     - drm/amd/display: Relax DML frame limit with UBSAN
     - net/sched: act_ct: fix helper UAF due to extensions realloc
     - net/sched: act_ct: avoid modifying shared unconfirmed ct entry
     - [arm64] KVM: arm64: nv: Fix life cycle of the nested_mmus array
     - [arm64] KVM: arm64: nv: Delay freeing of shadow S2 structures until VM
       destruction
     - [amd64] KVM: x86: Move IRQ-related helper declarations from kvm_host.h =>
       irq.h
     - [amd64] KVM: x86/mmu: Move kvm_arch_async_page_ready() below
       kvm_tdp_page_fault()
     - [amd64] KVM: x86/mmu: Move kvm_mmu_do_page_fault() from mmu_internal.h =>
       mmu.c
     - KVM: move TSS constants from kvm_host.h to tss.h
     - [amd64] KVM: x86: Reject nested CAP enablement if nested virtualization is
       disabled
     - [amd64] KVM: x86: Add static calls for nested virtualization ops
     - [amd64] accel/ivpu: Drop IRQF_ONESHOT to allow IPC IRQ threading on
       PREEMPT_RT
     - [arm64] i2c: qcom-geni: release DMA channels on probe error
 .
   [ Uwe Kleine-König ]
   * [armhf] Add axp20x_adc as a dependency for axp20x_usb_power to
     base-modules.udeb makeing USB work in the installer on sun7i-a20-bananapi
 .
 linux (7.2.8-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.8
     - sunvdc: fix -EIO issue due to lack of retries
     - xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
     - xfrm: add missing RCU read lock in xfrm_send_migrate_state()
     - xfrm: iptfs: fix runt reassembly panic from short inner tot_len
     - xfrm: fix compat ALLOCSPI request use-after-free
     - xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for
       xfrm_trans_reinject()
     - esp: downgrade zerocopy managed frags before mutating skb frags
     - [arm64] dts: amlogic: t7: use the real UART pclk
     - [arm64] dts: amlogic: t7: khadas-vim4: allow the SD card to be power
       cycled
     - [arm64] dts: amlogic: t7: fix the pin groups of two PWM outputs
     - [arm64] dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies
     - [arm64] dts: amlogic: t7: fix the pin groups of the vsync PWM
     - RDMA/siw: Clear association under lock if siw_qp_modify fails in
       siw_accept
     - RDMA/rxe: validate access flags before swapping the MR's PD
     - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
     - xfrm: hold net_device reference under RCU in bundle creation
     - [arm64] firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
     - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
     - clk: scpi: register scpi-cpufreq once and clear on failure
     - RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
     - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
     - RDMA/mlx5: Remove warn on missing representor in query_port_speed
     - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
     - RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
     - power: sequencing: Fix build issue with COMPILE_TEST
     - [arm64] dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR
     - [arm64] dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR
     - [arm64] dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR
     - [arm64] dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR
     - [arm64] dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR
     - IB/iser: reject a remote invalidation of an unregistered direction
     - IB/isert: wait for deferred control PDU completions before releasing the
       connection
     - RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
     - RDMA/rtrs: guard against null kobj name
     - RDMA/bnxt_re: Avoid exposing umdbr to userspace
     - RDMA/uverbs: Fix potential leak of resources->collection in
       flow_resources_alloc()
     - RDMA/mad: Fix receive buffer leak when PKey enforcement fails
     - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
     - RDMA/irdma: Enforce local fence for IB_WR_REG_MR
     - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
     - dmaengine: mmp_pdma: fix wrong extended DRCMR base for SpacemiT K3
     - dmaengine: sprd: Fix runtime PM reference leak in probe
     - wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic
     - wifi: virt_wifi: free skb when disconnected
     - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
     - wifi: brcmfmac: cyw: pass PMKID to firmware if present
     - wifi: libipw: reject too-short beacon and probe responses
     - wifi: libipw: reject too-short association responses
     - IB/IPoIB: Avoid restoring OPER_UP after multicast flush
     - wifi: cfg80211: don't get the radio mask for netdev-less wdevs
     - wifi: cfg80211: check IP header size in cfg80211_classify8021d()
     - soundwire: cadence_master: wait and cancel cdns->work before clock stop
     - dma-coherent: report a failed reserved memory assignment
     - dma-mapping: don't trace the DMA address when the allocation fails
     - dmaengine: Fix device kref underflow in dma_chan_put()
     - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
     - dmaengine: wait for RCU readers before releasing dma_device
     - wifi: cfg80211: don't free driver-owned scan requests
     - wifi: cfg80211: only group hidden BSSes with beacon entries
     - wifi: cfg80211: don't filter by BSS type when removing stale entries
     - wifi: cfg80211: ibss: ref BSS entry for joined event
     - wifi: cfg80211: fix NAN regulatory enforcement
     - wifi: mac80211: don't start a ROC while scanning
     - wifi: mac80211: don't warn when an IBSS has no channel to scan
     - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
     - wifi: mac80211: suppress chanctx warning for debugfs reset
     - wifi: mac80211: abort chanswitch when leaving a mesh
     - wifi: mac80211: reset state when starting AP fails
     - wifi: mac80211: reset the LED state when ifup fails
     - wifi: mac80211: only operate on TDLS peers in the TDLS code
     - wifi: cfg80211: restore netns_immutable on failures
     - wifi: cfg80211: undo netns switch if renaming the wiphy fails
     - wifi: mac80211: unlist vifs when their netdev is unregistered
     - wifi: cfg80211: get the wiphy out of a dying network namespace
     - wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
     - wifi: mac80211: don't allow injecting frames wider than the chanctx
     - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
     - wifi: mac80211: require a peer station for TDLS setup confirm
     - wifi: mac80211: don't allow link changes when iface is down
     - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
     - wifi: mac80211: don't access the TSF of a down interface
     - wifi: mac80211: add HE 6 GHz capability in the scan elems len
     - wifi: mac80211: mesh: reset the CSA state when leaving
     - wifi: mac80211: mesh: release the channel if start fails
     - wifi: mac80211: set up the TX info early to fix failure paths
     - mm: memblock: show all region flags in debugfs
     - scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter
       descriptions
     - scsi: qla2xxx: Fix the ql2xfc2target parameter description
     - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
     - dmaengine: pxa: fix double counting of the hw descriptors
     - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic
       DMA
     - RDMA/efa: Keep admin queues alive while IRQ is registered
     - RDMA/efa: Keep EQ resources alive while IRQ is registered
     - RDMA/siw: Bound fragmented header copies by the remaining length
     - [amd64] x86/div64: Fix addition of large constants in
       mul_u64_add_u64_div_u64()
     - drm/msm: Fix the separate_gpu_kms parameter description
     - drm/msm/adreno: Fix the skip_gpu parameter description
     - netfilter: nft_nat: fully initialise new_addr in netmap setup
     - netfilter: nf_tables: fix device name and prefix match in hook lookup
     - netfilter: nf_nat: unregister and release hooks on error
     - netfilter: flowtable: hold reference on ct until flow is released
     - perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
     - [arm64] hibernate: clone only the linear map that exists at runtime
     - [arm64] mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation
     - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
     - smb: client: validate absolute native symlink targets before NT fixups
     - keys: fix lost wakeup when reaping a dead key type
     - neighbour: Add missing RCU annotation for neightbl_dump_info().
     - neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
     - neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL.
     - neighbour: Skip default parms when resumed in neightbl_dump_info().
     - ALSA: bcd2000: Fix race between rawmidi and disconnect
     - ntfs: use dynamic MFT tail reservation
     - ntfs: repack $MFT/$ATTRIBUTE LIST
     - ntfs: account for MFT records added during allocation
     - ntfs: protect runlist updates with the runlist lock
     - ntfs: propagate folio errors
     - ntfs: ignore interrupted inode reads as corruption
     - phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
     - phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
     - ALSA: pcm: set timer->private_data before registering the PCM timer
     - drm/msm/dp: skip PUSH_IDLE when the link was never enabled
     - drm/msm/dp: fix link bandwidth check when wide bus is enabled
     - ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask
     - ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map
     - ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params
     - spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register
     - Input: trackpoint - fix the inertia attribute name in the ABI document
     - objtool: Validate disassembler headers in libopcodes probe
     - gpio: virtuser: skip free_irq when no IRQ is installed
     - ALSA: usb: 6fire: Avoid embedded URBs
     - ALSA: 6fire: fix OOB write from device-reported iso length
     - ksmbd: fix malformed procfs status output
     - ksmbd: extend procfs server statistics
     - ksmbd: follow SMB2 session expiration semantics
     - wifi: virt_wifi: don't transfer operstate before register
     - drm/xe/mmio_gem: forbid VMA split
     - drm/xe/mmio_gem: use write-back mapping for dummy page
     - drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy
     - drm/xe/shrinker: Return the freed page count through a parameter
     - drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory
     - drm/vc4: Use managed KMS polling to fix UAF on unbind
     - ALSA: hda: trace PCM open only after assigning a stream
     - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
     - btrfs: tree-checker: print dev extent offset in error message
     - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
     - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
     - net: dsa: mxl862xx: disable the stats poll on teardown
     - net: bcmgenet: restore the hardware filters on open
     - sysctl: Check range in proc_dointvec_ms_jiffies_minmax
     - ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
     - net: fddi: skfp: fix NULL deref when setting the MAC address while down
     - wifi: brcmfmac: fix lost 802.1x TX completion wakeup
     - net: bridge: mst: move switchdev call outside rcu
     - tcp: Don't call skb_clone_and_charge_r() for close()d listener in
       tcp_v6_do_rcv().
     - tcp: do not let tcp_rmem be set below 4096
     - ksmbd: return buffer overflow for partial filesystem info
     - ksmbd: fix partial file information responses
     - ksmbd: keep compound responses on query info errors
     - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
     - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
     - Bluetooth: btintel_pcie: validate TX skb length in send_sync
     - Bluetooth: coredump: Quiesce dump work on unregister
     - Bluetooth: put the peer's on-air address on air when we cannot resolve
     - Bluetooth: hci_qca: Do not write to the serial port after it is closed
     - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
     - Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync
     - Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
     - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct
       access
     - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
     - Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
     - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
     - af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
     - net: stmmac: fix TSO header length truncation
     - pppoatm: ensure a writable skb header and linear data
     - drop_monitor: synchronize tracepoint unregistration on error path
     - drop_monitor: use timer_shutdown_sync() to prevent timer rearming during
       teardown
     - drop_monitor: use raw_cpu_ptr() in tracepoint probes
     - drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
     - net: stmmac: do not overwrite phc_index when no PTP clock is registered
     - net: bridge: vlan: fix bugs caused by switchdev deletion errors
     - netlink: do not free nlk->groups while lockless readers can use it
     - [powerpc*] KVM: PPC: Book3S HV: fix use-after-free in
       kvmhv_emulate_tlbie_all_lpid()
     - [powerpc*] KVM: PPC: Book3S HV: fix secure device page leak on
       uv_page_in() failure
     - [powerpc*] iommu: Fix the overflow validation in iommu_tce_check_ioba
     - Revert "drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable"
     - futex: Also allocate private hash on vfork()
     - drm/xe/i2c: Disable IRQ on unbind
     - btrfs: handle lack of space when cleaning up verity items
     - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
     - ASoC: hdmi-codec: Report a change when the channel status moves
     - ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length
     - ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers
     - ASoC: sdw_utils: tidyup .count_sidecar
     - ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints()
     - [amd64] ASoC: amd: acp: refactor codec config count in SOF SoundWire
       machine driver
     - [amd64] ASoC: amd: acp: fix ffs() operator precedence for SoundWire link
       ID
     - net/sched: codel: bound the dropping loop per dequeue call
     - net: do not advance stack index from dev_fwd_path()
     - net: pass dst via net_device_path in dev_fill_forward_path()
     - net: pass net_device_path_ctx to dev_fill_forward_path()
     - net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
     - net: netsec: fix device_node reference leak on phy_np
     - eth: fbnic: ring the doorbell if a burst ends in a drop
     - net: lock the socket in sock_gettstamp()
     - net: ethernet: cortina: Ack RX overrun interrupt correctly
     - net: stmmac: propagate FPE preemption-class mapping errors
     - net: prevent torn reads in netdev_tc_txq
     - net: stmmac: preserve real_num_tx_queues on mqprio setup failure
     - net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
     - [amd64] x86/kprobes: Fix crash when probing CS CALL instructions
     - net: macb: fix ordering around PTP timestamp read
     - net: mvpp2: prevent buffer overflow in page_pool allocation
     - net: skbuff: do not leave stale header offsets after pskb_carve()
     - drm/amdgpu: check ras and obj before dereference
     - drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates
     - btrfs: abort transaction on failure to update inode for hole punching and
       reflinking
     - btrfs: check if there is space for chunk item when validating sys chunk
       array
     - perf: Fix null pointer access in is_include_guest_event()
     - sched/core: Avoid false migration warning for proxy donors
     - [amd64] x86/fred: Reconstruct the #GP context for rejected INT
       instructions
     - Input: eeti_ts - publish the OF module alias
     - hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler
     - hwmon: (hp-wmi-sensors) Improve raw WMI string handling
     - watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog
     - Input: xpad - add support for Victrix Pro BFG Controller
     - Input: xpad - add support for Azeron devices
     - Input: xpad - fix PDP Marvel Xbox 360 controller
     - 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
     - ALSA: core: Fix potential UAF after asynchronous card release
     - ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
     - ALSA: virtio: reset device before deleting virtqueues
     - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
     - cgroup: Avoid iteration of dying tasks with zero refcount
       (Closes: #1144314) (CVE-2026-98163)
     - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
     - ata: libahci_platform: Fix device reference leak in
       ahci_platform_get_resources()
     - cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
     - exec: Cleanup POSIX timers right after de_thread()
     - fs/dax: check zero or empty entry before converting xarray entry
     - PCI: imx6: Move clock enable after core reset assertion
     - phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context
     - posix-cpu-timers: Prevent freeing a timer which is queued on the expiry
       list
     - rds: ib: use rds_conn_drop() on protocol version mismatch
     - signal: Prevent exec() race
     - rust: net: phy: fix off-by-one bit positions in device status accessors
     - Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware"
     - drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini()
     - drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr
     - drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP
     - [amd64] x86/build/64: Prevent native builds from generating EGPR use
     - [amd64] x86/microcode/intel: Reject problematic loading on Granite Rapids
       systems
     - tcp: exclude old ACKs from tcp fast path
     - swiotlb: use the adjusted address for the highmem page lookup
     - soundwire: dmi-quirks: Disable ghost Realtek on Asus GX651AX
     - spi: fsl-qspi: Reprogram the clock rate when the operation frequency
       changes
     - spi: spi-zynqmp-gqspi: stop the controller on shutdown
     - spi: virtio: Use the per-transfer bits per word
     - RDMA/ucma: Serialize join and leave on copy_to_user failure
     - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
     - openvswitch: avoid reallocating confirmed conntrack labels
     - nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
     - net: xfrm: reject unrepresentable espintcp transport headers
     - [arm64] hibernate: pass HVC_SET_VECTORS args to the resume hvc
     - [arm64] dts: renesas: r8a779f0: Set UFS lane count
     - [arm64] dts: socfpga: change access permission from 755 to 644
     - [arm64] percpu: Fix this_cpu_write() casting
     - [arm64] percpu: Fix this_cpu_and() mask generation
     - [arm64] percpu: Fix LSE operations on {8,16}-bit types
     - Bluetooth: btusb: fix NXP IW610 composite device handling
     - Bluetooth: eir: validate service data length before reading UUID
     - Bluetooth: hci_codec: validate vendor codec count length
     - Bluetooth: hci_sync: Serialize local codec list cleanup
     - Bluetooth: keep dst_type with dst when reusing an LE connection
     - btrfs: take commit root semaphore when iterating in
       mark_block_group_to_copy()
     - btrfs: fix creation of compressed inline extents that don't save space
     - btrfs: derive f_fsid with dev_t only when temp_fsid is active
     - btrfs: clear free space tree creation state on rebuild failure
     - gpiolib: Put fwnode reference on failure
     - gpiolib: of: don't mark hog nodes OF_POPULATED before a chip is found
     - dmaengine: sun6i: fix non-atomic read of DMA position registers
     - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
     - dmaengine: ti: k3-udma-glue: fix NULL dereference in
       k3_udma_glue_release_rx_chn()
     - dma-buf/dma-fence: fix checking signaling bit for timeline and driver name
       v3
     - dma-buf: Fix silent overflow for phys vec to sgt
     - dma-buf: Split sgl by largest page-aligned chunk
     - ipv6: xfrm: use full sockets in local error paths
     - net: ip_tunnel: initialize `options_len` before referencing options
     - net: lan743x: fix RX checksum use-after-free
     - net: phy: mediatek: do not report link and per-speed LED rules together
     - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
     - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
     - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
     - net/sched: act_api: release tail references on DELACTION failure
     - net/sched: hhf: cap hh_flows_limit at change time
     - net/packet: clear RX owner on VNET header error
     - net/packet: avoid truncating TPACKET_V3 private size
     - scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
     - xfrm: serialize state GC with device state flush
     - xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
     - xfrm: save input state data before secpath resets
     - soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
     - mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
     - memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
     - memstick: ms_block: destroy io_queue workqueue on removal
     - mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
     - mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
     - mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
     - mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP
     - mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
     - mm/vma: correctly unaccount on mmap_prepare() failure
     - mm: filemap: retain mapped dropbehind folios
     - KEYS: encrypted: fix integer overflow of datablob_len
     - keys: translate request_key_auth pid for the reading procfs instance
     - KEYS: trusted: Fix tpm2_load_cmd() boundary check
     - sched_ext: Fix NULL sched deref in kfunc sub-sched error paths
     - sched_ext: Close the pre-enable ops error claim window
     - i2c: at91: release DMA channels on remove and probe error
     - i2c: atr: fix dangling adapter pointer on add failure
     - i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()
     - i2c: imx: release DMA channels on probe error
     - i2c: imx: disable autosuspend on remove
     - IB/mlx4: Fix use-after-free on pkey sysfs registration failure
     - IB/hfi1: Resolve the credit-return buffer through the send context's node
     - IB/hfi1: Fix the PIO_CRED credit-return mmap
     - selinux: preserve user SID across nested backing files
     - selinux: recheck intermediate backing files on mprotect()
     - selinux: always fill AVC decision in avc_has_perm_noaudit()
     - power: sequencing: don't call .post_enable() if pwrseq_unit_enable()
       failed
     - power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
     - power: sequencing: fix NULL-pointer dereference in
       pwrseq_device_register()
     - mmc: core: Cancel SDIO IRQ work before freeing host
     - mmc: core: Fix OF node reference leak on card add failure
     - mmc: hsq: Fix use-after-free in retry work
     - mmc: mmci: Fix use-after-free in busy-timeout work
     - mmc: mxcmmc: cancel data work and watchdog on remove
     - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
     - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
     - mmc: sdio_uart: fix xmit_fifo leak when the port table is full
     - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
     - mmc: spi: reset bytes_xfered before retrying CRC failures
     - mmc: sdhci_am654: Move tuning_loop to local variable
     - mmc: sdhci_am654: Reset command and data lines on failed tuning
     - mmc: sdhci_am654: Clear ITAPDLY on tuning failure
     - mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning
       failure
     - Input: adp5588-keys - cache GPIO state before registering the gpiochip
     - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
     - Input: cyttsp5 - clamp the HID report size before memcpy
     - Input: evdev - zero absinfo before partial copy in EVIOCSABS
     - Input: hp_sdc - shut down kicker timer on module exit
     - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
     - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
     - Input: soc_button_array - fix MS Surface Pro 11 probe failure
     - Input: soc_button_array - check btns_desc->package.count
     - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
     - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
     - Input: zero ff_effect before compat copy in input_ff_effect_from_user
     - hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
     - hwmon: (pmbus/core) increase number of phases and add new mask
     - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
     - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
     - hwmon: (pwm-fan) Stop RPM timer before freeing tach data
     - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
     - hwmon: (w83793) release probe data through kref
     - hwmon: (cgbc-hwmon) Fix current sensors ID lookup
     - hwmon: (cgbc-hwmon) Add missing sensors
     - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
     - watchdog: digicolor: Avoid division by zero
     - watchdog: msc313e: Fix premature reset during timeout update
     - watchdog: msc313e: Propagate error code in resume()
     - watchdog: rtd119x: Avoid division by zero
     - watchdog: rzv2h: Avoid division by zero
     - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
     - watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
     - wifi: brcmsmac: fix UAF in brcms_free_timer()
     - wifi: iwlegacy: fix broadcast stations deallocation
     - wifi: libertas_tf: fix UAF in lbtf_free_adapter()
     - wifi: libipw: reject TKIP frames without a full MIC
     - wifi: rsi: fix heap OOB write on key removal
     - wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
     - wifi: wlcore: release runtime PM ref on regdomain config failure
     - wifi: wilc1000: fix out-of-bounds read in P2P public action frames
     - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
     - wifi: p54: validate curve data length in the calibration curve converters
     - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
     - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
     - wifi: mwifiex: validate scan response extents
     - wifi: mwifiex: prevent authentication frame length truncation
     - wifi: mwifiex: validate action frame fixed fields
     - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
     - wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
     - wifi: mac80211: refuse to make a monitor active when it has no queue
     - drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
     - drm/gud: Ignore damage clips in full update mode
     - drm/msm/adreno: fix autosuspend cleanup during teardown
     - drm/msm/dpu: clear pending peripheral flush state
     - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
     - drm/msm: RCU-free the scheduler-containing ring and VM objects
     - drm/sched: Fix virtual runtime race
     - drm/amdgpu: fix rmmio iounmap skipped on device removal
     - drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
     - drm/amdgpu: Skip KFD mapping clear before initialization
     - drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
     - drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
     - drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1
     - smb: client: cancel reconnect work in clean_demultiplex_info()
     - smb/client: send lease break ACKs thru correct session for multiuser
       mounts
     - smb: client: fix rlist race and missing initialization
     - smb: client: fix use-after-free of iface in cifs_try_adding_channels()
     - smb: client: reject short Next offsets in parse_server_interfaces()
     - smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
     - smb: client: fix unaligned access in WSL reparse point parser
     - smb: client: fix fattr leaking on wsl_to_fattr() failure
     - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
     - smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
     - smb: client: fix potential OOB read in smb3_enum_snapshots()
     - smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
     - smb: client: fix server->total_read for compound encrypted PDUs
     - smb: client: fix missing lower-bound check on DFS referral string offsets
     - smb: client: fix missing iov bounds check in parse_posix_sids()
     - fs/super: skip non-memcg-aware nr_cached_objects in memcg slab shrink
     - fs: fix missed removal of super_fs_objects_eligible()
     - scsi: fnic: Make debug logging protocol independent
     - scsi: fnic: Bump up version number
     - scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
     - drm/amdgpu: reduce early full GPU access during SR-IOV init
     - drm/amdgpu: Fix GPU PCIe link capability reporting
     - ntsync: reject wait ioctls with zero owner
     - drm/ttm: fix swapped-out resources never leaving their bulk_move range
     - drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only
     - ksmbd: fix partial normalized name responses
 .
 linux (7.2.7-1) unstable; urgency=medium
 .
   * New upstream stable update:
     https://www.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.7
     - [arm64] iommu/arm-smmu-v3: Disable implementations during devm teardown
     - wifi: mt76: mt7921: validate CLC firmware records
     - wifi: mt76: mt7921: skip unknown CLC firmware records
     - leds: st1202: Validate pattern input before stopping the sequence
     - ppp_async: drop the errored frame instead of resetting its headroom
     - RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed
     - EDAC/igen6: Fix interleave boundary condition
     - EDAC/igen6: Fix channel selection hash
     - EDAC/igen6: Fix channel address decode for non-hash mode
     - EDAC/igen6: Fix Raptor Lake-P logged error address
     - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
     - drm/virtio: Fix a NULL vs ERR_PTR() bug in
       virtio_gpu_user_framebuffer_create()
     - drm/virtio: use the DMA API for resource backing on Xen
     - accel/qaic: Address potential out-of-bounds read in resp_worker()
     - nvme-rdma: fix -EIO cleanup order in queue_rq
     - nvme: add context annotations for nvme_subsystem::lock
     - nvme: set ns->head in nvme_alloc_ns_head
     - nvme: fix racy access to FDP placement id array
     - nvmet-rdma: fix queue leak when connect backlog is exceeded
     - sched_ext: Fix nonexistent field in sched-ext.rst example
     - bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
     - bpf: Fix BPF_F_CPU validation for sparse CPU IDs
     - bpf: Fix percpu map update indexing with sparse CPU IDs
     - sched_ext: Fix spurious aborts in scx_bpf_dsq_move() on ownership change
       races
     - drm/gud: validate GUD_ROTATION_0 is present in supported rotations
     - printk: Don't WARN on kthread_run failure.
     - [amd64] accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
     - [amd64] accel/amdxdna: reject a command chain that carries no commands
     - [amd64] accel/amdxdna: put the chained BO when its mapping fails
     - cgroup/cpuset: Preserve boot-isolated CPUs on partition release
     - accel: ethosu: Don't read the U65 rounding mode as a storage mode
     - ufs: do not treat unreadable directory blocks as empty
     - drm/cirrus-qemu: Validate BAR0 size during probe
     - ntfs: return DT_UNKNOWN on inode lookup failure in readdir
     - ntfs: propagate reparse index insertion failure
     - ntfs: return -ERANGE for undersized xattr buffer
     - ntfs: preserve error code in ntfs_resident_attr_record_add()
     - ntfs: return real error from ntfs_non_resident_attr_record_add()
     - ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
     - ntfs: only count successfully cleared runs when freeing clusters
     - ntfs: skip free cluster decrement when rollback fails
     - ntfs: do not mark the volume clean in sync_fs when errors were recorded
     - ntfs: treat any nonzero dio zero-range return as an error
     - ntfs: bound $AttrDef table walk to the loaded table size
     - ntfs: reject invalid sectors_per_cluster in the boot sector
     - bpf: check_cond_jmp_op(): properly infer if register is null
     - ntfs: leave HasEA flag untouched on setxattr failure
     - bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
     - net: icmp: avoid invalid transport header access in icmp_send tracepoint
     - tcp: use GFP_ATOMIC in tcp_send_active_reset()
     - net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
     - net: iptunnel: fix stale transport header during tunnel decapsulation
     - net/sched: act_api: budget all shared attributes in notify skbs
     - net/sched: act_api: size the RTM_GETACTION reply from the actions
     - net/sched: act_api: fix skb sizing and action leak on reoffload delete
     - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
     - scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
     - scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
     - scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5
     - scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers
     - smb/client: validate new EOF for insert range
     - smb/client: validate new EOF for zero range
     - smb/client: mark file sparse before emulating insert range
     - smb/client: fix data corruption in emulated insert range
     - smb/client: fix integer truncation in collapse range
     - smb/client: fix stale page cache in insert/collapse range
     - smb/client: invalidate fscache for fallocate range operations
     - smb: client: transport: Fix debug printing in __release_mid()
     - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
     - raw: annotate disconnect-side IPv4 match writers
     - net: amd-xgbe: discard rx packets with bad FCS
     - vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
     - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
     - perf symbol: Do not use debug file as the binary type
     - OPP: of: Fix potential multiplication overflow when calculating freq
     - perf powerpc-vpadtl: Fix raw_size of DTL samples
     - netfs: Fix unbuffered/DIO write partial transfer error return
     - netfs: Fix error vs transferred passed to ->ki_complete()
     - netfs: Fix i_size update for partial transfer
     - netfs: Fix subreq ref leak
     - netfs: break unbuffered write when netfs_alloc_subrequest() fails
     - netfs: Fix readahead synchronisation issues by loading all folios upfront
     - netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs
     - netfs: Fix read progress reporting
     - cachefiles: Fix potential UAF/KASAN warning
     - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
     - dma-buf: fix some kernel-doc warnings
     - octeontx2-af: fix CN20K default MCAM rule removal on port cleanup
     - [amd64] drm/i915/dp_mst: Remove duplicate intel_pfit_compute_config() call
     - [amd64] drm/i915/cdclk: Fix dg2_power_well_count() return type
     - ovl: return EINVAL instead of EIO in case of mismatched user_ns
     - smb/server: cancel async requests when closing connection
     - ksmbd: safely drain sessions during logoff
     - ksmbd: propagate DACL parsing errors
     - ksmbd: rate limit unmapped SID errors
     - ksmbd: fix listener task lifetime on netdev events
     - [s390x] time: Use jiffies instead of jiffies_64
     - [s390x] ipl: Fix NULL deref in kdump without re-IPL parm block
     - [s390x] ipl: Fix NULL deref in dump_reipl without re-IPL parm block
     - [s390x] diag324: Preserve -EBUSY return code
     - [s390x] pai: Reduce excessive debug feature size
     - sched_ext: Fix timer pinning and return value in scx_central
     - sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration
     - Bluetooth: btintel_pcie: Clear automask on spurious interrupts
     - workqueue: reject watchdog thresholds that overflow jiffies
     - Bluetooth: btintel: validate version TLV value lengths
     - Bluetooth: btintel: bound firmware ID by TLV length
     - Bluetooth: hci_core: Fix race condition during device registration
     - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
     - Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
     - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
     - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
     - platform/x86: asus-laptop: Fix ACPI event handling (Closes: #1146124)
     - ASoC: ab8500: Reset the audio block before configuring it
     - ASoC: ab8500: Repair the DAPM capture graph
     - ASoC: ab8500: Correct digital interface format setup
     - ASoC: ab8500: Validate and program TDM slots correctly
     - ASoC: codecs: ab8500: Use guard() for mutex locks
     - ASoC: ab8500: Remove the nonfunctional sidetone apply control
     - ASoC: ab8500: Skip missing DMIC GPIOs on AB8505
     - drm/pagemap: Prevent double migration of device pages
     - drm/pagemap: Reset migration page count on eviction retry
     - net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode
     - net: ethernet: oa_tc6: Export standard defined registers
     - net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers
     - net: ethernet: oa_tc6: Protect skb pointer used by two different kernel
       instances
     - net: ethernet: oa_tc6: Improve the error recovery
     - net: ethernet: oa_tc6: Disable tx queues on fatal error
     - net: ethernet: oa_tc6: Fix for the wrong data type
     - net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
     - igmp: convert struct ip_sf_list to RCU
     - ppp: ppp_async: simplify tty disc_data access
     - ppp: ppp_synctty: simplify tty disc_data access
     - klp-build: Fix wrong index in funcs cleanup error path
     - objtool/klp: Fix checksums for constant pool references
     - ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
     - ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
     - ipv6: mcast: fix delay calculation in igmp6_join_group()
     - ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
     - ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show()
     - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
     - tipc: fix NULL deref in tipc_named_node_up() on empty publication list
     - tipc: Dont send random pad bytes in RESET/ACTIVATE messages
     - ipv6: sr: restore network header before routing and forwarding
     - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
     - staging: fbtft: make dirty_lock IRQ-safe
     - net: bonding: annotate lockless writes with WRITE_ONCE()
     - ALSA: hda: restore MFG widget enumeration after core split
     - [s390x] boot: Fix physical memory search range
     - [s390x] boot: Avoid IPL parameter append past command line
     - ASoC: fsl_micfil: balance mclk enable/disable
     - [amd64] ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
     - [amd64] ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
     - block: save page offset gaps in cloned bio
     - ASoC: cs35l56: Request IRQ in cs35l56_common_probe()
     - ASoC: cs35l56: Fix probe deadlock waiting for SoundWire enumeration
     - drm/xe/oa: Remove sysfs entry on idr_alloc failure in
       xe_oa_add_config_ioctl()
     - ALSA: dummy: Report a change when one capture switch channel moves
     - [amd64] accel/amdxdna: refuse to flush an imported BO
     - btrfs: detach failed sprout device from transaction update list
     - btrfs: restore active device pointers after failed sprout
     - bonding: alb: fix uninitialized transport header access in
       alb_determine_nd()
     - perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
     - scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in
       _base_assign_reply_queues()
     - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
     - sched/core: Skip rq->avg_idle update without a valid idle_stamp
     - [amd64] x86/itmt: Don't make ITMT enablement depend on debugfs
     - perf/core: Skip empty AUX records with only format flags
     - locking/lockdep: Invalidate stale class_cache entries for zapped classes
     - octeontx2-af: Fix limiting SRIOV VF count logic
     - ksmbd: fix sparc build with atomic work state
     - ALSA: ump: do not touch legacy_rmidi before it exists
     - printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY
     - [amd64] platform/x86: x86-android-tablets: hold device reference for
       secondary fwnode teardown
     - ASoC: ux500: Fix MSP stream lifecycle handling
     - ASoC: ux500: Propagate MSP setup errors
     - ASoC: ux500: Correct MSP frame and bit clock setup
     - ASoC: ux500: Validate MSP DAI configuration
     - mfd: db8500-prcmu: Fold dbx500 header into db8500
     - ASoC: ux500: Deassert the MSP reset during probe
     - ASoC: ux500: Request the MSP MMIO resource
     - ASoC: ux500: Remove obsolete PRCMU QoS calls
     - ASoC: ux500: Allow repeated MSP prepare calls
     - ASoC: ux500: Program the MSP FIFO watermarks
     - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
     - bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
     - btrfs: scrub: report the failing sector's address, not the stripe base
     - btrfs: fix transaction use-after-free in raid stripe insertion
     - btrfs: fix the possible bioc_list memory leak during error
     - btrfs: return proper negative error code for update_raid_extent_item()
     - btrfs: zoned: finish active block group cleanup if call_zone_finish()
       fails
     - btrfs: send: fix lost error return value in will_overwrite_ref()
     - btrfs: do not force reloc root creation during qgroup_account_snapshot()
     - btrfs: zstd: fix lost wakeup when waiting for a workspace
     - drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit
       compile
     - ipvs: fix reversed sequence option serialization
     - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
     - tracing/probes: Fix use-after-free on field name/type of events with
       multiple probes
     - bpf: reject BPF_PSEUDO_FUNC reference to the main program
     - bonding: do not clear curr_active_slave prematurely when releasing all
       slaves
     - net: Remove conflicting altnames for dying netns in
       __dev_change_net_namespace().
     - net: macb: unify device pointer naming convention
     - net: macb: exclude software FCS from TX byte statistics
     - net/rds: use wq_has_sleeper() in release_in_xmit()
     - net/rds: use clear_bit_unlock() in release_refill()
     - net/rds: clear cp_flags bits individually in rds_conn_path_reset()
     - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
     - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
     - net/rds: acquire the fastpath locks in rds_conn_shutdown()
     - net/rds: don't let rds_conn_shutdown() consume a concurrent drop
     - [powerpc*] Don't drop _TIF_RESTOREALL on syscall restart
     - [powerpc*] Do not restore KUAP in arch_exit_to_user_mode_prepare()
     - net: airoha: enable RX_DONE interrupt for RX queue 31
     - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after
       reset
     - net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()
     - [arm64] trans_pgd: clone only the linear map that exists at runtime
     - erofs: disable LZ4 rolling decompression for now
     - selftests/alsa: Fix the step check for INTEGER controls
     - ALSA: caiaq: Fix potential double-free at error path
     - drm/rockchip: dw_dp: Select DRM_BRIDGE_CONNECTOR
     - drm/rockchip: rk3066_hdmi: Add missing Kconfig selects
     - bpf: Reject key-less BTF for hash maps
     - bpf: Fix NULL-ptr-deref when showing a void BTF type
     - bpf: Fix NULL-ptr-deref in btf_var_show()
     - bpf: Mark signal tracepoint siginfo arguments as scalar
     - bpf: Reject tail calls directly from callback frames
     - bpf: Reject resilient lock operations in rbtree callbacks
     - bpf: Mark sched_process_wait argument as nullable
     - bpf: Mark syscall helpers as sleepable
     - ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
     - nvme: remove stale namespaces by NSID range during scan
     - nvme: print namespace IDs as unsigned 32bit value
     - nvmet: print namespace IDs as unsigned 32bit value
     - nvme-tcp: defer TLS inline send to io_work
     - [amd64] ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
     - [amd64] ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology
     - [amd64] ASoC: Intel: avs: Fix unbalanced module reference count
     - [amd64] ASoC: Intel: avs: Refactor and fix init_config access
     - net: bcmasp: clear txcb->last before writing each descriptor
     - net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
     - mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
     - bpf: zero extend the result of an arena 32-bit cmpxchg
     - bpf: don't rewrite bpf_fastcall patterns entered by a jump
     - bpf: Track verifier instruction stats for each subprogram
     - bpf: Check ancestor frames for rbtree callbacks
     - bpf: Mark bpf_btf_find_by_name_kind() as sleepable
     - bpf: Mark faultable stack helpers as sleepable
     - bpf: Reject legacy packet loads from callbacks
     - bpf: Don't infer non-NULL from a pointer with an unbounded offset
     - bpf: Don't resurrect a scalar id dropped by collect_linked_regs()
     - bpf: Don't predict JMP32 pointer vs zero comparisons
     - bpf: Mark the zero register precise for a register-form NULL check
     - thermal: sysfs: switch to use scnprintf() to suppress truncation warning
     - bpf: Require MEM_PERCPU for percpu kptr stores
     - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
     - bpf: Reject untrusted allocated-object pointers
     - tracing: Fix to avoid creating trace instances with duplicate names
     - bpf: Preserve special fields in recycled rhtab elements
     - bpf: Cancel special fields when recycling rhtab elements
     - bpf: Mark NULL kptr stores precise
     - bpf: Preserve inner map identity in callback frames
     - ring-buffer: Remove ring_buffer_per_cpu::mapped
     - tracing: Fix subbuf resize races with trace_pipe_raw readers
     - ring-buffer: Cap static ring buffer nr_pages
     - tracing: Fix comment in tracing_buffers_splice_read()
     - nexthop: Initialize extack in remove_nh_grp_entry()
     - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
     - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
     - eth: nfp: bound the ntuple rule dump by the caller's buffer size
     - eth: nfp: drop the replaced rule from the list when reprogramming fails
     - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer
       size
     - net: bridge: mcast: properly convert mglist to rcu
     - octeontx2-af: mcs: Clear stale X2P calibration state before calibration
     - ionic: use netif_txq_maybe_stop() in ionic_tx()
     - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent
       partial_data heap overflow
     - dibs: Unregister dibs_class after error
     - [s390x] ism: folio_put() after error
     - vxlan: reject dynamic fdb entries that reference a nexthop id
     - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
     - net: reject oversized tx_queue_len at netlink parse time
     - pds_core: fix cmd_regs access racing BAR unmap on reset
     - pds_core: don't release PCI regions for VFs on reset
     - bpf: mark a NULL call argument precise
     - bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
     - [powerpc*] kexec_file: Use inclusive range checks in add_usable_mem()
     - [powerpc*] kexec_file: Use inclusive range checks for excluded memory
     - net: mctp: i3c: serialize probe with bus removal
     - [powerpc*] entry: Fix irq_soft_mask corruption on replayed interrupt exit
     - net/sched: defer qdisc freeing after failed creation
     - net/mlx5e: Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD
     - net/mlx5e: Fix setting RS FEC after remapping
     - net/mlx5e: Fix reporting support for all RS FEC variants
     - net/mlx5: LAG, use local tracker to update active ports
     - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
     - net/mlx5e: Fix use-after-free race in sample_restore_put()
     - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
     - net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
     - net/mlx5e: Keep HW timestamp stats monotonic across reconfiguration
     - net/sched: fq_pie: clamp quantum in change path
     - net/sched: sfq: clamp quantum in change path
     - net/sched: hhf: clamp quantum in change and init paths
     - net/sched: dualpi2: clamp psched_mtu at all call sites
     - net/sched: pie: clamp psched_mtu in pie_drop_early
     - net/sched: drr: clamp quantum in change class
     - net/sched: ets: clamp quantum in parse and fallback paths
     - net: macb: fix NULL pointer dereference on unbind with fixed-link
     - bpf: Reject non-scalar bpf_loop iteration counts
     - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
     - erofs: delimit inode_share cache key components
     - [riscv64] iommu/riscv: Add command queue lock
     - [riscv64] iommu/riscv: Serialize command queue publishing
     - [riscv64] iommu/riscv: Avoid waiting on failed command enqueue
     - [amd64] iommu/amd: Do not reallocate GA log buffers on resume
     - [amd64] iommu/amd: Fix premature break in init_iommu_one() again
     - [amd64] iommu/amd: Fix ineffective error check in nested domain allocation
     - hwmon: (ltc4282) Make sure clk_init_data is fully initialized
     - Documentation/hwmon: Document hwmon_notify_event()
     - hwmon: Fix potential UAF in pec_store
     - hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show()
     - hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()
     - hwmon: (ina2xx) Replace masks with enum in alert functions
     - hwmon: (ina2xx) Decouple in0 and curr1 alarms
     - Documentation: hwmon: replace full-width colon by a standard ASCII colon
     - hwmon: (yogafan) fix non-kernel-doc comment
     - hwmon: (sht4x) Add missing locks
     - hwmon: (sht4x) Fix return value from heater_enable_store()
     - ASoC: bcm: bcm63xx: Publish the OF module aliases
     - [amd64] ASoC: Intel: SST: Publish the PCI module aliases
     - btrfs: fix unnecessary transaction commit fallback from
       btrfs_log_all_parents()
     - netfilter: nfnetlink_log: cope with concurrent instance destruction
     - netfilter: ip6_tables: set F_PROTO when proto value is nonzero
     - regulator: pf1550: fix which regulator is notified
     - ASoC: mt6351: Publish the OF module alias
     - irqchip/gic-v5: Preserve ICC_CR0_EL1 state
     - virtio_ring: fix stale descriptor flags after a failed packed add
     - virtio: fix use-after-free in unregister_virtio_device()
     - virtio_console: do not free control-out buffers on remove
     - vhost/vdpa: reject VRING_NUM larger than device max
     - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
     - vhost-vdpa: protect config_ctx from being freed under the config callback
     - vdpa_sim_blk: reject out-of-range sector starts
     - vdpa_sim_net: check TX pull result before RX copy
     - virtio-pci: return IRQ_HANDLED after non-zero ISR
     - vduse: validate virtqueue alignment
     - vhost: invalidate vring access on IOTLB transitions
     - virtio_input: reset device if input_register_device() fails
     - virtio_input: stop callbacks before unregistering input device
     - af_unix: Update last skb marker in manage_oob().
     - af_unix: Return immediately when manage_oob() returns NULL for 0-length
       buffer.
     - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
     - net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
     - net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
     - vduse: return compat ioctl results directly
     - net: macb: zero the link settings taprio reads back
     - net: macb: reject an unknown link speed in the taprio setup
     - net: ethernet: cortina: Fix budget accounting
     - net: ethernet: cortina: Finish RX updates before NAPI completion
     - net: ethernet: cortina: Count dropped frames as NAPI work
     - net: ethernet: cortina: Count RX drops once per frame
     - net: ethernet: cortina: Count RX descriptors for freeq refill
     - drm/adp: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
     - drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
     - [s390x] debug: Fix NULL pointer dereference in debug_set_level()
     - ALSA: hda: Report a change when only the channel status bytes move
     - platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not
       working
     - idpf: account for VLAN header when parsing RSC packet header
     - ice: add missing xa_destroy for sched_node_ids
     - eth: ice: don't dereference pointers from TP_printk()
     - Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen
       platform
     - Bluetooth: btusb: Fix UAF of btusb_data by rx_work
     - Bluetooth: btintel_pcie: validate packet_len before skb_put_data
     - Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
     - Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware
     - Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
     - Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset
     - Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset
     - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe()
     - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
     - net: macb: destroy the phylink instance on the probe error path
     - net: macb: put the "mdio" child node reference on success
     - nstree: check listing permission before taking a namespace reference
     - drm/xe: Guard page-fault worker with runtime PM check
     - mptcp: remove unneeded READ_ONCE() annotation
     - watchdog: fix hrtimer start when pretimeout is zero
     - watchdog: msc313e: Avoid division by zero
     - watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
     - watchdog: msc313e: Enable clock before accessing hardware registers
     - watchdog: msc313e: Fix spurious reset on suspend
     - watchdog: msc313e: Fix undefined behavior
     - watchdog: msc313e: Sync timeout value if WDT was running at boot
     - net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value
     - net: ks8851: Fix receiver error in 100BASE-TX mode following software
       power-down
     - hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
     - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
     - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
     - hwmon: (corsair-cpro) Remove debugfs entries when probe fails
     - hwmon: (nct6694) do not expose enable on DTIN temperature channels
     - octeontx2-pf: reset HTB scheduler topology before freeing queues
     - vxlan: initialize _md in vxlan_xmit_one()
     - ppp_synctty: ensure a writeable skb header
     - net: phylink: initialise link_state before a forced major config
     - net: stmmac: initialize ptp_lock at probe time
     - net/mlx5e: Move representor vnic reporter to eswitch devlink port
     - [powerpc*] entry: Fix double accounting of user time on interrupt entry
     - [amd64] drm/i915/dp: Gate UHBR SST SDP splitting on sink capability
     - perf/core: Allow list_del during perf_event_overflow()
     - [amd64] perf/x86/intel: Correct pt_regs->flags update for PEBS path
     - [amd64] perf/x86/intel: Prevent drain_pebs() reentry
     - sched/eevdf: Fix augmented max_slice
     - sched/eevdf: Fix rb augmented with multi fields
     - sched: Account cgroup CPU time to the execution context
     - sched/core: Call wq_worker_tick() for the execution context
     - net/sched: cls_route: free emptied bucket on filter move
     - net/sched: cls_route: Reject handle aliasing
     - net/sched: cls_route: Fix in-place replace
     - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
     - net: sun4i-emac: fix missing of_node_put() for phy_node
     - net: hinic: fix mailbox segment buffer overflow
     - net: dsa: mt7530: add EN7528 support
     - net: dsa: mt7530: populate lpi_interfaces to fix EEE support
     - net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support
     - net: phy: mediatek-ge: disable EEE on the MT7530 PHY
     - net: net_failover: Fix the deadlock in net_failover_slave_name_change()
     - octeontx2-af: fix PF/CGX debugfs PCI bus lookup
     - net: phy: dp83867: handle the active-high LED polarity mode
     - net: mana: restore the XDP program pointer when pre-allocation fails
     - net/rds: fix tcp stream corruption with large pages
     - net: stmmac: fix TX descriptor availability check for TSO traffic
     - net: hsr: enable promiscuous mode on interlink port with fwd offload
     - openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
     - block: Fix start and length check added to iov_iter_extract_bvecs()
     - sunvdc: unmap LDC cookies when the descriptor send fails
     - ublk: clear force_abort in ublk_queue_reset_io_flags()
     - erofs: add missing buf->off in erofs_bread()
     - tracing: Fix ring_buffer_read_page_size() kernel-doc
     - scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms
     - scripts/mksysmap: fix escape of '$' in the __pi_ pattern
     - tracing/remotes: Account for ring buffer page header in size calculation
     - tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
     - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
     - configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
     - configfs: unhash the dentry before dropping the item in rmdir
     - [powerpc*] ps3: Fix repository.c build failure
     - [powerpc*] eeh: Fix recursive locking on devices without EEH sensitive
       driver
     - [powerpc*] pci-ioda: Fix the stale irq chip reference
     - [amd64] x86/amd_node: Avoid divide by zero on virtualized systems
     - [amd64] x86/MCE/AMD: Fix inverted interrupt enablement during storm
       handling
     - [amd64] x86/amd_node: Fix potential NULL pointer dereference
     - [amd64] crypto: x86/aria - add missing vzeroupper in AVX2 code
     - [amd64] crypto: x86/aria - add missing vzeroupper in AVX-512 code
     - [amd64] x86/amd_node: Fix PCI device reference counting in amd_smn_init()
     - [amd64] x86/mm: Fix user-space data loss with MADV_FREE and THP
     - [amd64] x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
     - [amd64] x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
     - [amd64] x86/alternatives: Exclude text poking against change_page_attr()
     - mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
     - ipv6: fix fib6 walker UAF on seq stop
     - ipmr: account multicast table and route memory
     - reboot: fix cad_pid use-after-free race
     - ftrace: Use rcu_assign_pointer() for tmp_ops filter hash
     - ftrace: fork: Initialize function graph state before copy_exec_state()
     - tracing: Fix memory corruption from the histogram stacktrace modifier
     - tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event()
     - tracing: Set the trace clock before registering the histogram trigger
     - tracing: Fix memory corruption from a "STACKTRACE" histogram key
     - tracing: Take trace_array reference when opening a tracer options file
     - tracing: Don't dereference trace_event_file in deferred trigger free
     - rust: num: seal Integer
     - rust: pin-init: use irrefutable pattern for `stack_pin_init`
     - rust: allow `clippy::as_underscore` in the generated bindings
     - rust: allow `unknown_lints` in generated bindings for Rust < 1.88
     - drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0
     - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
     - ALSA: us122l: Prevent write upgrades for read mappings
     - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
     - ALSA: usbusx2y: validate URB actual_length in interrupt callback
     - Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
     - [riscv64] hwprobe: initialize pair->value in hwprobe_one_pair()
     - dm/amdgpu: fix malformed link_settings debugfs output
     - drm/amdgpu: skip gfx switch_power_profile during GPU reset
     - drm/amdgpu: skip the VMID 0 flush for VRAM
     - watchdog: sunxi_wdt: preserve boot-enabled watchdog
     - virtio_mmio: disable IRQ wake before free_irq
     - ufs: create the root dentry after loading cylinder metadata
     - ufs: validate cylinder group metadata before caching it
     - tunnels: Drop stale dst when building an ICMP error for PMTUD
       (Closes: #1108860)
     - tick/broadcast: Plug clockevents replacement race
     - tools/bootconfig: Fix integer overflow and truncation in size checks
     - tracing/user_events: Don't destroy fields when event removal fails
     - tracing: Free histogram the var ref when its initialization fails
     - tracing: Free histogram var refs regardless of how often they are
       referenced
     - tracing: Free histogram the field rejected for a bad modifier
     - tracing: Let histogram values keep the percent and graph modifiers
     - tracing: Keep the entry count when the histogram stats allocation fails
     - tracing: Take the reference before publishing the named histogram trigger
     - tracing: Undo the registration when enabling the histogram trigger fails
     - accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
     - accel/ivpu: Validate firmware log buffer metadata
     - accel/ivpu: Limit firmware log name prints to field size
     - accel: ethosu: Fix ethosu_job_open() return value
     - accel: ethosu: Drop IRQF_SHARED flag
     - accel: ethosu: Ensure cmd stream ends with a stop op
     - accel: ethosu: Ensure SRAM size is 0 on mapping failure
     - accel: ethosu: Ensure SRAM region size matches job
     - ata: pata_legacy: remove documentation for removed module parameters
     - ASoC: amd: acp-da7219-max98357a: don't bind on Raven/Picasso boards
     - ASoC: sprd: validate compress buffer sizes against fixed allocations
     - ASoC: sti: initialize IRQ lock before requesting IRQ
     - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
     - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
     - bootconfig: Fix integer overflow in initrd size check
     - cpufreq: zero-initialize policy cpumask before sysfs publication
     - cpufreq: initialize policy rwsem before sysfs publication
     - exec: do_close_on_exec() before taking exec_update_lock
     - exit: hold a reference to thread_pid across proc_flush_pid
     - fs: don't return -EINVAL for successful nested thaw
     - function_graph: Use the saved entry's size when reprinting it
     - genetlink: pin family module during policy dump
     - hrtimer: Use hard expiry when updating timers on the same base
     - drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7
     - drm/bridge: tc358768: Enforce input bus flags via atomic_check
     - drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()
     - drm/drm_exec: fix up contended obj when num_objects is 0
     - [amd64] drm/i915: Fix memory leak in query_perf_config_list()
     - drm/rockchip: analogix_dp: fix unchecked bound endpoint name length
     - drm/sched: Create a fake device for KUnit tests
     - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
     - drm/amd/display: Exit IPS before connector detection on resume
     - drm/amd/display: Rebuild InfoFrames on output color space changes
     - io_uring/rw: end write accounting from ->ki_complete
     - io_uring/net: let io_recv_buf_select return the length of the buffer
       region
     - io_uring/net: don't overconsume buffers when using MSG_TRUNC
     - ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
     - ring-buffer: Check resize_disabled before publishing the new subbuf order
     - net/sched: act_api: release all action references on NEWACTION failure
     - net: bridge: use option bits for CFM/MRP frame handlers
     - net: dsa: tag_brcm: legacy FCS: request needed tailroom
     - net: hso: fix TIOCMIWAIT race
     - net: macb: initialize PTP state before registering clock
     - net: mana: Reserve extra CQ slot for the fence completion CQE
     - net: mpls: clear inner_protocol when the last label is popped
     - net: openvswitch: fix use-after-free of the flow table mask array
     - net: phy: dp83td510: handle the active-high LED polarity mode
     - netfs: Fix uninitialized return value in netfs_unbuffered_write()
     - netfilter: cttimeout: prevent UAF during module unload
     - netfilter: nf_log: unregister loggers before per-net teardown
     - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
     - vdpa: ifcvf: Put device on unsupported feature error
     - vdpa: solidrun: Free IRQs after request failure
     - scripts/sorttable: Mark long_size as __maybe_unused
     - fs: autofs: fix memory leak in autofs_fill_super()
     - erofs: add sysfs feature entry for xattr prefixes
     - erofs: preserve LZMA decoders on resize failure
     - fbdev: vfb: defer cleanup until the last reference
     - idpf: disable DIM work before freeing q_vectors
     - inet: frags: invalidate queues before flushing them
     - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
     - ieee802154: cc2520: fix FIFOP work use-after-free
     - ieee802154: hwsim: serialize pib updates to fix double-free
     - ipv4: fib: bound automatic table ID allocation
     - ipv6: flowlabel: cap duplicate leases per socket
     - ipvs: reject invalid states in connection template sync records
     - mac802154: fix use-after-free of sdata via queued RX frames
     - [powerpc*] KVM: PPC: Book3S HV: Set irqfd->producer only on success
     - landlock: Fix use-after-free of the source's parent directory
     - [s390x] iommu/s390: Fix NULL dereference in iova_to_phys() with
       ZPCI_TABLE_TYPE_RFX
     - [s390x] qeth: allow bridgeport queries despite OS_MISMATCH
     - [s390x] crypto: Fix skcipher_walk return code handling in aes_s390
     - [s390x] crypto: Fix use of mutex in atomic context
     - [s390x] crypto: Fix missing scrub of temp buffers with AES ctr and gcm
       algorithm
     - [s390x] crypto: Fix missing cra_flags in paes_s390
     - [s390x] crypto: Fix handling of EBUSY in PHMAC when req is pushed to
       crypto engine
     - [s390x] crypto: Fix missing scrub of temp buffers with PAES algorithm
     - [s390x] crypto: Fix wrong return code to engine in asynch callbacks
     - [s390x] crypto: Map EBUSY to EIO when key conversion fails repeatedly
     - [riscv64] perf: RISC-V: store available counter mask as bitmap
     - [riscv64] perf: RISC-V: use BIT_ULL for u64 overflow masks
     - afs: Fix missing kunmap in afs_dir_search_bucket()
     - afs: Fix double-unmap of directory block
     - afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
     - afs: Clear stale peer app data after address list changes
     - hwmon: (applesmc) fix key backlight workqueue leak on register failure
     - hwmon: (chipcap2) fix channels in humidity alarm notifications
     - hwmon: (gpio-fan) Fix use-after-free in alarm work
     - hwmon: (mcp9982) Propagate one-shot polling errors
     - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
     - media: hevc: add bounded tile-count helpers
     - media: ipu-bridge: do not use the CVS device lookup for IVSC
     - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
     - media: rkvdec: bound HEVC tile loops and PPS id to the array capacity
     - media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
     - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
     - media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
     - media: verisilicon: rockchip: reject AV1 frames exceeding the tile
       capacity
     - media: v4l2-ctrls: validate HEVC tile counts
     - media: v4l2-ctrls: validate AV1 tile counts
     - bnxt_en: Only restore LRO if the device supports TPA
     - bnxt_en: Don't free the live ring's TPA state on queue restart failure
     - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
     - bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
     - bnxt_en: Propagate TPA buffer allocation failures in
       bnxt_queue_mem_alloc()
     - bnxt_en: Bound SW TPA IDs to prevent crashes
     - bnxt_en: Prevent queue stop with deferred completions
     - mptcp: do not reschedule the RTX timer for fallback sockets
     - mptcp: options: handle MPC data + csum reqd + no csum
     - mptcp: subflow: no need to copy thmac during ulp_clone
     - mptcp: syncookies: remember the request backup flag
     - mptcp: options: fix uninit-value in mptcp_write_data_fin
     - mptcp: prevent race between disconnect() and rtx
     - mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
     - mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
     - mptcp: pm: userspace: fix address ID overflow
     - smb: client: reject short READ responses in CIFSSMBRead()
     - smb: client: reject userspace cifs.idmap descriptions
     - smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
     - smb: client: pin DFS superblock in iterator callback
     - smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
     - smb: client: fix WSL reparse point uid/gid override
     - smb: client: fix uid/gid override in getattr with posix extensions
     - smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
     - smb: client: fail DACL rewrite when the new DACL exceeds 64K
     - smb: client: fix cifsFileInfo reference leak in deferred close
     - smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
     - smb: client: fix file type corruption in posix_reparse_to_fattr()
     - smb: client: fix file type corruption in wsl_to_fattr()
     - smb: client: avoid leaking refcount in cifs_queue_oplock_break()
     - smb: client: avoid leaking refcount when cifs_sb_tlink() fails
     - smb: client: fix heap overflow in DACL owner/group rewrite
     - smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
     - xfs: use the rtgroup extent count to find rtrefcount gaps
     - xfs: truncate quota file correctly when repairing quota file
     - xfs: strengthen the "is cow staging" helpers in scrub
     - xfs: snapshot scrub stats when rendering them
     - xfs: snapshot old AGFL before rewriting it
     - xfs: signal inode btree xref error if get_rec returns an error
     - xfs: reset parent pointer args before each dir tree unlink repair
     - xfs: report nonexistent parents as a filesystem corruption
     - xfs: report healthy filesystem events in scrub stats
     - xfs: release alleged child inode on metapath unlink error
     - xfs: preserve owner on in-memory btree creation
     - xfs: make the rtsummary repair fix the file size too
     - xfs: log the tempip after we convert it to extents format
     - xfs: lock the healthmon when inserting unmount event
     - xfs: initialise error in xfs_defer_finish_one()
     - xfs: initialise args->total for parent pointer updates
     - xfs: fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems
     - xfs: fix unit conversions in per_binval computation
     - xfs: fix under-reservation of blocks when repairing sf directories
     - xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
     - xfs: fix short ifork reaping computation in xreap_bmapi_binval
     - xfs: fix rtrmap cross-referencing elision logic
     - xfs: fix rtrefcount btree block counting in scrub
     - xfs: fix replaying dirent removals into the temporary directory
     - xfs: fix reclaimed page accounting in xfs_buf_free
     - xfs: fix parent rec lookup initialization in xrep_metapath_unlink
     - xfs: fix name string recording in slowpath pptr tracepoints
     - xfs: fix media verification ioctl for internal rt volumes
     - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
     - xfs: fix bnobt repair space reservation disposal failure
     - xfs: fix backwards skipping logic in xrep_quota_block
     - xfs: fix backwards mergeability logic in refcount scrubber
     - xfs: don't stash removename operations with unknown ftype
     - xfs: don't spin forever on zero-length dirents when salvaging them
     - xfs: don't modify file attributes or poke fsnotify for dry runs
     - xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
     - xfs: don't leak dqacct if rhashtable insertion fails
     - xfs: destroy seen inode bitmap when we fail to add a dirpath
     - xfs: cross-reference the rtgroup superblock extent, not block
     - xfs: count escaped corruption errors in scrub stats
     - xfs: compute dquot checksum after resetting dd_lsn in repair
     - xfs: check healthmon outbuffer space correctly
     - xfs: bump lost_prev_errors if we lose even the healthmon lost event
     - xfs: bail out on bitmap errors in xrep_agfl_fill
     - xfs: always set xfs_healthmon::first_event when inserting at front of list
     - xfs: advance the findparent inode scan cursor while holding ILOCK
     - xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent
     - xfs: actually check internal-rtdev fields in the superblock
     - ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()
     - wifi: ath9k_htc: don't store usb_device_id
     - media: as102: do not rely on id table address comparison
     - usb: serial: spcp8x5: don't store usb_device_id
     - net: usb: pegasus: don't rely on id table pointer arithmetic
     - usb: xusbatm: don't rely on id table pointer arithmetic
     - usb: usbtmc: don't store usb_device_id
     - hwmon: (asus_rog_ryujin) Add per-device configuration
     - hwmon: (asus_rog_ryujin) Validate HID report lengths
     - hwmon: (asus_rog_ryujin) Synchronize HID command and report handling
     - media: remove conditional return with no effect
     - media: qcom: iris: fix runtime PM reference leaks
     - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
     - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
     - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
     - scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
     - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
     - f2fs: accurately adjust free_sections during free_segment_range
     - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
     - f2fs: fix to reset all pinned status during fggc
     - [amd64] drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+
     - [amd64] accel/amdxdna: Disable device buffer exporting
     - i2c: designware: Global register definitions
     - drm/xe/i2c: Fix the interrupt handling
     - [amd64] platform/x86: hp-wmi: Introduce board-specific feature data
     - [amd64] platform/x86: hp-wmi: Fix board_params typo for 8DD6 board
     - [amd64] x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()
     - [amd64] x86/mm/pat: Acquire init_mm read lock on attribute changes to
       avoid UAF
     - EDAC/altera: Use parent device for devres in altr_portb_setup()
     - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
     - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
     - scsi: qla2xxx: Skip vport under deletion in report ID acquisition
     - scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
     - scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
     - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
     - scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
     - scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
     - drm/amd/display: Propagate HDMI RGB quantization selectability
     - drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output
     - [s390x] pai: Use PAI PMU index as parameter replacing event
     - [s390x] pai: Move locking to event init and delete
     - [s390x] pai: Support CPU hotplug for PMU PAI
     - [amd64] x86/mm/pat: Allocate split page tables as kernel page tables
     - misc: amd-sbi: Add null check for devm_kasprintf()
     - [amd64] x86/mm: Fix and document DEBUG_PAGEALLOC
     - mptcp: move the stale logic out of retrans scheduler
     - mptcp: avoid unneeded actions on subflow reset
     - mptcp: close race between scheduler and state change
     - mptcp: fix bad accounting in __mptcp_subflow_push_pending()
Checksums-Sha1:
 975696316f91619371cd6986bb624cff32753730 143262 linux_7.2.9-1~bpo13+1.dsc
 080f156f4a2c33a18773ffe2b2fccae84640c589 1496456 linux_7.2.9-1~bpo13+1.debian.tar.xz
 883b31b194c8386047aeb31a5968c39d21a6ae61 6189 linux_7.2.9-1~bpo13+1_source.buildinfo
Checksums-Sha256:
 2c5e603261c7a33a5d069fdbb36638618f1246a61acc03c6b167b8af4dfd2ff9 143262 linux_7.2.9-1~bpo13+1.dsc
 12617f6c507319252e7dc5d68d36d880bcb8e32dd44e26260ce2b06fb898f8df 1496456 linux_7.2.9-1~bpo13+1.debian.tar.xz
 bbf71c8f78e6598e24400eaae77e8c706b1546a358f1574f6f30dd7ce03ff61d 6189 linux_7.2.9-1~bpo13+1_source.buildinfo
Files:
 0c0322d0edd4831261c571f1f22cd623 143262 kernel optional linux_7.2.9-1~bpo13+1.dsc
 f5155c742fe2df84f0ffcc92a4555d80 1496456 kernel optional linux_7.2.9-1~bpo13+1.debian.tar.xz
 d65a003f5500c8b1bcf4ff04a2afed09 6189 kernel optional linux_7.2.9-1~bpo13+1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmrSctcACgkQ57/I7JWG
EQnrLw/9EyHpJu7spSHjekWm/7cjYzKSe2IVZ/3Q8FJLoyu4q9hdt/D+1RKPtPhS
5KE4S0GU2tFZDLzCN5t6dCYBjNEOZ4LAow9qpuCeTZ6Wx3vjy5v+CiXFiRHpe/yP
sg+9mVh5T/Z0alkdNnvJvklvZYh2jMnGTkO6EChRh9/m5kW8vq5n8YpglV6QBvo/
tkYCEOu0rB7EzA6+juPMbpHTfXiLLoetB9o2e0K5GPz0hHVmTDCzouq7yDQTmXI3
ygOwHnp5YiZg6UYQOkKXFJN5HtnELpidZCj6E7pTi13o9NOswlXrhh8pz3b1k/1w
wLqYIi12ILbEVE9dec15ejy5MDvEhJogG2/AMILiKgSy/B2iCHz5W8HUfdArLlpD
wu7OjUCPPFH743d7iGv3X9MSImbxGbxJWS9Ct/K3KYlmc78fLXv7x3h2D3dEcn6U
D+2oanoj9v8pf1GzkkV9UZIQizdADxtIaR2UALVgSI+f93B7Zg3EbuluO/RCMUpe
mXzF4JCd01KS79l2SEED5JftBm1MICrVdrUsRprlTXA9syxEnvGUyldNCWuxIG/H
zg+tNpHVmE5mbIKASVAq/S9K6ZKevAJrcjlw7KdXJ57re6a4cPAvT5BQzOLItTiY
rgcV7UQs14zprK7tQ0n1zg4l/iQgKLgNorxabx8QcySuXPM9XAg=
=2u+Z
-----END PGP SIGNATURE-----