From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 14 Jun 2026 17:35:43 +0000 (+0200)
Subject: Merge branch 'master' of gitolite.kernel.org:/pub/scm/linux/kernel/git/stable/stable... 
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e0527210f2811a4999fb7f81324350564fec734a;p=thirdparty%2Fkernel%2Fstable-queue.git

Merge branch 'master' of gitolite.kernel.org:/pub/scm/linux/kernel/git/stable/stable-queue
---

e0527210f2811a4999fb7f81324350564fec734a
diff --cc queue-5.10/series
index 077869718a,c1fe0bdd77..9c7b0d9ead
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@@ -127,4 -127,51 +127,52 @@@ hid-core-fix-size_t-specifier-in-hid_re
  usb-serial-mct_u232-fix-memory-corruption-with-small.patch
  compiler-clang.h-add-__diag-infrastructure-for-clang.patch
  disable-wattribute-alias-for-clang-23-and-newer.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
+ ext4-validate-p_idx-bounds-in-ext4_ext_correct_index.patch
+ bonding-limit-bond_mode_8023ad-to-ethernet-devices.patch
+ usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch
+ nfsd-don-t-ignore-the-return-code-of-svc_proc_regist.patch
+ wifi-mac80211-check-tdls-flag-in-ieee80211_tdls_oper.patch
+ spi-meson-spicc-fix-double-put-in-remove-path.patch
+ io_uring-prevent-opcode-speculation.patch
+ tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
+ tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
+ kvm-arm64-remove-vpipt-i-cache-handling.patch
+ arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
+ arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
diff --cc queue-5.15/series
index 75df757123,94674b2c8e..a0d78c6c99
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@@ -144,5 -144,57 +144,59 @@@ bpf-free-reuseport-cbpf-prog-after-rcu-
  usb-serial-mct_u232-fix-memory-corruption-with-small.patch
  compiler-clang.h-add-__diag-infrastructure-for-clang.patch
  disable-wattribute-alias-for-clang-23-and-newer.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
 +ipv6-mcast-fix-use-after-free-when-processing-mld-queries.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
+ bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
+ bluetooth-bnep-reject-short-frames-before-parsing.patch
+ bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ipv6-mcast-fix-use-after-free-when-processing-mld-qu.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ ext4-validate-p_idx-bounds-in-ext4_ext_correct_index.patch
+ fs-ntfs3-return-error-for-inconsistent-extended-attr.patch
+ nfsd-don-t-ignore-the-return-code-of-svc_proc_regist.patch
+ tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
+ tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
+ kvm-arm64-remove-vpipt-i-cache-handling.patch
+ arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
+ arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nf_log-validate-mac-header-was-set-before-.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
+ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
+ net-mvpp2-add-metadata-support-for-xdp-mode.patch
+ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
+ net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+ drm-vc4-fix-krealloc-memory-leak.patch
diff --cc queue-6.1/series
index ff4c8056e2,0dc0c5a8ed..693ba82b3b
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@@ -191,6 -191,75 +191,78 @@@ bpf-free-reuseport-cbpf-prog-after-rcu-
  usb-serial-mct_u232-fix-memory-corruption-with-small.patch
  dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch
  disable-wattribute-alias-for-clang-23-and-newer.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
 +ipv6-mcast-fix-use-after-free-when-processing-mld-queries.patch
 +net-smc-fix-sleep-inside-lock-in-__smc_setsockopt-causing-local-dos.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-annotate-sk-sk_write_space-for-udp-sockmap.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
+ bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
+ bluetooth-bnep-reject-short-frames-before-parsing.patch
+ bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
+ bluetooth-mgmt-fix-backward-compatibility-with-users.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ptp-vclock-switch-from-rcu-to-srcu.patch
+ octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
+ vxlan-vnifilter-send-notification-on-vni-add.patch
+ vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
+ ipv6-mcast-fix-use-after-free-when-processing-mld-qu.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ ipmi-fix-rcu_read_unlock-to-srcu_read_unlock-in-hand.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
+ fs-ntfs3-return-error-for-inconsistent-extended-attr.patch
+ usb-gadget-f_ncm-fix-net_device-lifecycle-with-devic.patch
+ usb-gadget-u_ether-fix-null-pointer-deref-in-eth_get.patch
+ net-skbuff-fix-missing-zerocopy-reference-in-pskb_ca.patch
+ tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
+ kvm-arm64-remove-vpipt-i-cache-handling.patch
+ arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
+ arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
+ iomap-don-t-revert-iov_iter-on-partially-completed-b.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
+ tcp-restrict-so_attach_filter-to-priv-users.patch
+ net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ r8152-reduce-the-control-transfer-of-rtl8152_get_ver.patch
+ r8152-block-future-register-access-if-register-acces.patch
+ r8152-handle-the-return-value-of-usb_reset_device.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nf_log-validate-mac-header-was-set-before-.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
+ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
+ net-mvpp2-add-metadata-support-for-xdp-mode.patch
+ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
+ net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+ netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
+ drm-vc4-fix-krealloc-memory-leak.patch
diff --cc queue-6.12/series
index 39bed0f510,b55217e52c..f255d28d3b
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@@ -6,6 -6,113 +6,116 @@@ arm-fix-hash_name-fault.patc
  arm-fix-branch-predictor-hardening.patch
  net-phy-micrel-fix-lan8814-qsgmii-soft-reset.patch
  wifi-remove-zero-length-arrays.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
 +ipv6-mcast-fix-use-after-free-when-processing-mld-queries.patch
 +net-smc-fix-sleep-inside-lock-in-__smc_setsockopt-causing-local-dos.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ soc-qcom-ice-return-enodev-if-the-ice-platform-devic.patch
+ erofs-add-sysfs-node-to-drop-internal-caches.patch
+ erofs-tidy-up-synchronous-decompression.patch
+ erofs-fix-use-after-free-on-sbi-sync_decompress.patch
+ ksmbd-fix-null-deref-of-opinfo-conn-in-oplock-lease-.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-nft_ct-bail-out-on-template-ct-in-get-eval.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ l2tp-pppol2tp-hold-reference-to-session-in-pppol2tp_.patch
+ devlink-release-nested-relation-on-devlink-free.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ wifi-mac80211-limit-injected-antenna-index-in-ieee80.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-annotate-sk-sk_write_space-for-udp-sockmap.patch
+ hsr-remove-warn_once-in-hsr_addr_is_self.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
+ bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
+ bluetooth-bnep-reject-short-frames-before-parsing.patch
+ bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
+ bluetooth-iso-fix-not-releasing-hdev-reference-on-is.patch
+ bluetooth-iso-fix-not-using-bc_sid-as-advertisement-.patch
+ bluetooth-iso-fix-data-race-on-iso_pi-fields-in-hci_.patch
+ bluetooth-mgmt-fix-backward-compatibility-with-users.patch
+ octeontx2-pf-fix-ndc-sync-operation-errors.patch
+ octeontx2-af-fix-initialization-of-mcam-s-entry2targ.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ptp-vclock-switch-from-rcu-to-srcu.patch
+ net-ethernet-mtk_eth_soc-fix-use-after-free-in-metad.patch
+ net_sched-act_pedit-use-rcu-in-tcf_pedit_dump.patch
+ net-sched-fix-pedit-partial-cow-leading-to-page-cach.patch
+ octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
+ vxlan-vnifilter-send-notification-on-vni-add.patch
+ vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
+ ipv6-mcast-fix-use-after-free-when-processing-mld-qu.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ ipmi-fix-rcu_read_unlock-to-srcu_read_unlock-in-hand.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
+ alsa-seq-dummy-fix-ump-event-stack-overread.patch
+ ima-kexec-skip-ima-segment-validation-after-kexec-so.patch
+ ima-kexec-move-ima-log-copy-from-kexec-load-to-execu.patch
+ spi-cadence-quadspi-fix-unclocked-access-on-unbind.patch
+ tools-rv-fix-cleanup-after-failed-trace-setup.patch
+ tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
+ arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
+ arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
+ iomap-don-t-revert-iov_iter-on-partially-completed-b.patch
+ dma-debug-fix-physical-address-retrieval-in-debug_dm.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ gpio-mvebu-fix-null-pointer-dereference-in-suspend-r.patch
+ asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
+ tcp-restrict-so_attach_filter-to-priv-users.patch
+ net-add-pskb_may_pull-to-skb_gro_receive_list.patch
+ net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
+ net-ibm-emac-fix-use-after-free-during-device-remova.patch
+ netdev-fix-double-free-in-netdev_nl_bind_rx_doit.patch
+ net-phy-clean-the-sfp-upstream-if-phy-probing-fails.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ net-mlx5-fix-slab-out-of-bounds-in-mlx5_query_nic_vp.patch
+ net-mlx5e-xsk-fix-dma-and-xdp_frame-leak-on-xdp_tx-x.patch
+ net-mlx5-use-effective-affinity-mask-for-irq-selecti.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ r8152-handle-the-return-value-of-usb_reset_device.patch
+ gpio-zynq-fix-runtime-pm-leak-on-remove.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ netfilter-revalidate-bridge-ports.patch
+ netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nf_log-validate-mac-header-was-set-before-.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
+ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
+ net-mvpp2-add-metadata-support-for-xdp-mode.patch
+ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
+ net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+ ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
+ netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
+ writeback-avoid-contention-on-wb-list_lock-when-swit.patch
+ writeback-fix-use-after-free-in-inode_switch_wbs_wor.patch
+ xfrm-hold-device-only-for-the-asynchronous-decryptio.patch
+ xfrm-hold-dev-ref-until-after-transport_finish-nf_ho.patch
+ kvm-vmx-update-svi-during-runtime-apicv-activation.patch
+ clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch
+ clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch
+ clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+ drm-virtio-fix-driver-removal-with-disabled-kms.patch
+ drm-vc4-fix-krealloc-memory-leak.patch
+ drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch
diff --cc queue-6.18/series
index 37bd07e510,9f74846abd..364dbbdc3c
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@@ -3,7 -3,143 +3,147 @@@ arm-group-is_permission_fault-with-is_t
  arm-allow-__do_kernel_fault-to-report-execution-of-m.patch
  arm-fix-hash_name-fault.patch
  arm-fix-branch-predictor-hardening.patch
 +kvm-arm64-take-the-srcu-lock-for-page-table-walks-in-fault-injection-and-at-emulation.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
 +ipv6-mcast-fix-use-after-free-when-processing-mld-queries.patch
 +net-smc-fix-sleep-inside-lock-in-__smc_setsockopt-causing-local-dos.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ soc-qcom-ice-allow-explicit-votes-on-iface-clock-for.patch
+ arm64-dts-qcom-x1-dell-thena-remove-i2c20-battery-sm.patch
+ arm-dts-microchip-sam9x7-fix-gmac-clock-configuratio.patch
+ soc-qcom-ice-return-enodev-if-the-ice-platform-devic.patch
+ tee-fix-tee_ioctl_object_invoke_arg-padding.patch
+ tee-qcomtee-add-missing-va_end-in-early-return-qcomt.patch
+ erofs-tidy-up-synchronous-decompression.patch
+ erofs-fix-use-after-free-on-sbi-sync_decompress.patch
+ wifi-iwlwifi-mvm-don-t-support-the-reset-handshake-f.patch
+ ksmbd-fix-null-deref-of-opinfo-conn-in-oplock-lease-.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-nft_ct-bail-out-on-template-ct-in-get-eval.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ l2tp-pppol2tp-hold-reference-to-session-in-pppol2tp_.patch
+ devlink-release-nested-relation-on-devlink-free.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ wifi-mac80211-limit-injected-antenna-index-in-ieee80.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-annotate-sk-sk_write_space-for-udp-sockmap.patch
+ hsr-remove-warn_once-in-hsr_addr_is_self.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
+ ipv6-anycast-insert-aca-into-global-hash-under-idev-.patch
+ wifi-fix-leak-if-split-6-ghz-scanning-fails.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
+ bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
+ bluetooth-bnep-reject-short-frames-before-parsing.patch
+ bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
+ bluetooth-iso-fix-not-releasing-hdev-reference-on-is.patch
+ bluetooth-iso-fix-data-race-on-iso_pi-fields-in-hci_.patch
+ bluetooth-sco-fix-data-race-on-sco_pi-fields-in-sco_.patch
+ bluetooth-mgmt-fix-backward-compatibility-with-users.patch
+ xsk-cache-csum_start-csum_offset-to-fix-toctou-in-xs.patch
+ octeontx2-pf-fix-ndc-sync-operation-errors.patch
+ octeontx2-af-fix-initialization-of-mcam-s-entry2targ.patch
+ af_unix-fix-inq_len-update-problem-in-partial-read.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ptp-vclock-switch-from-rcu-to-srcu.patch
+ net-airoha-fix-use-after-free-in-metadata-dst-teardo.patch
+ net-ethernet-mtk_eth_soc-fix-use-after-free-in-metad.patch
+ net-sched-fix-pedit-partial-cow-leading-to-page-cach.patch
+ sctp-validate-cached-peer-init-chunk-length-in-cooki.patch
+ octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
+ vxlan-vnifilter-send-notification-on-vni-add.patch
+ vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
+ ipv6-mcast-fix-use-after-free-when-processing-mld-qu.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ kvm-arm64-take-the-srcu-lock-for-page-table-walks-in.patch
+ drivers-hv-vmbus-protocol-version-6.0.patch
+ drivers-hv-vmbus-provide-option-to-skip-vmbus-unload.patch
+ drm-hyperv-during-panic-do-vmbus-unload-after-frame-.patch
+ selftests-harness-fix-pidfd-leak-in-__wait_for_test.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ hyperv-clean-up-and-fix-the-guest-id-comment-in-hvgd.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
+ alsa-seq-dummy-fix-ump-event-stack-overread.patch
+ spi-cadence-quadspi-fix-unclocked-access-on-unbind.patch
+ cpufreq-amd-pstate-drop-stale-epp_cached-kdoc.patch
+ tools-rv-ensure-monitor-name-and-desc-are-nul-termin.patch
+ tools-rv-fix-substring-match-bug-in-monitor-name-sea.patch
+ tools-rv-fix-substring-match-when-listing-container-.patch
+ tools-rv-fix-cleanup-after-failed-trace-setup.patch
+ verification-rvgen-fix-options-shared-among-commands.patch
+ verification-rvgen-fix-ltl2k-writing-true-as-a-liter.patch
+ tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
+ xfrm-iptfs-fix-use-after-free-on-first_skb-in-__inpu.patch
+ dma-mapping-direct-fix-missing-mapping-for-thru_host.patch
+ dma-debug-fix-physical-address-retrieval-in-debug_dm.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ ice-fix-missing-priority-callbacks-for-u.fl-dpll-pin.patch
+ idpf-fix-mailbox-capability-for-set-device-clock-tim.patch
+ net-ena-phc-add-missing-barrier.patch
+ bnge-fix-context-mem-iteration.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ gpio-mvebu-fix-null-pointer-dereference-in-suspend-r.patch
+ asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
+ tcp-restrict-so_attach_filter-to-priv-users.patch
+ net-add-pskb_may_pull-to-skb_gro_receive_list.patch
+ net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
+ net-ibm-emac-fix-use-after-free-during-device-remova.patch
+ netdev-fix-double-free-in-netdev_nl_bind_rx_doit.patch
+ net-phy-clean-the-sfp-upstream-if-phy-probing-fails.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ net-mlx5-fix-slab-out-of-bounds-in-mlx5_query_nic_vp.patch
+ net-mlx5e-xsk-fix-dma-and-xdp_frame-leak-on-xdp_tx-x.patch
+ net-mlx5-use-effective-affinity-mask-for-irq-selecti.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ r8152-handle-the-return-value-of-usb_reset_device.patch
+ gpio-zynq-fix-runtime-pm-leak-on-remove.patch
+ gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch
+ net-mctp-usb-fix-race-between-urb-completion-and-rx_.patch
+ net-mctp-usb-don-t-fail-mctp_usb_rx_queue-on-a-defer.patch
+ asoc-sof-amd-fix-for-ipc-flags-check.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ ip6_vti-set-netns_immutable-on-the-fallback-device.patch
+ sctp-validate-embedded-init-chunk-and-address-list-l.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ tun-zero-the-whole-vnet-header-in-tun_put_user.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ spi-rzv2h-rspi-fix-spdr-read-access-width-for-16-bit.patch
+ netfilter-revalidate-bridge-ports.patch
+ netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nf_log-validate-mac-header-was-set-before-.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
+ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
+ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
+ net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+ net-txgbe-optimize-the-flow-to-setup-phy-for-aml-dev.patch
+ net-txgbe-support-cr-modules-for-aml-devices.patch
+ net-txgbe-rename-the-sfp-related.patch
+ net-txgbe-initialize-module-info-buffer.patch
+ ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
+ kvm-vmx-update-svi-during-runtime-apicv-activation.patch
+ clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch
+ clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch
+ clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+ drm-i915-edp-check-supported-link-rates-dpcd-read.patch
+ drm-virtio-fix-driver-removal-with-disabled-kms.patch
+ drm-vc4-fix-krealloc-memory-leak.patch
+ drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch
+ accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch
diff --cc queue-6.6/series
index 1262420380,cf8a894d62..47bfd088db
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@@ -207,6 -207,83 +207,86 @@@ bluetooth-hci_conn-fix-potential-uaf-in
  rdma-rxe-fix-trying-to-register-non-static-key-in-rx.patch
  hwmon-pmbus-core-protect-regulator-operations-with-m.patch
  disable-wattribute-alias-for-clang-23-and-newer.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
 +ipv6-mcast-fix-use-after-free-when-processing-mld-queries.patch
 +net-smc-fix-sleep-inside-lock-in-__smc_setsockopt-causing-local-dos.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ ksmbd-fix-null-deref-of-opinfo-conn-in-oplock-lease-.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-nft_ct-bail-out-on-template-ct-in-get-eval.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-annotate-sk-sk_write_space-for-udp-sockmap.patch
+ hsr-remove-warn_once-in-hsr_addr_is_self.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
+ bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
+ bluetooth-bnep-reject-short-frames-before-parsing.patch
+ bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
+ bluetooth-mgmt-fix-backward-compatibility-with-users.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ptp-vclock-switch-from-rcu-to-srcu.patch
+ net-ethernet-mtk_eth_soc-fix-use-after-free-in-metad.patch
+ octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
+ vxlan-vnifilter-send-notification-on-vni-add.patch
+ vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
+ ipv6-mcast-fix-use-after-free-when-processing-mld-qu.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ ipmi-fix-rcu_read_unlock-to-srcu_read_unlock-in-hand.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
+ usb-gadget-f_ncm-fix-net_device-lifecycle-with-devic.patch
+ usb-gadget-u_ether-fix-null-pointer-deref-in-eth_get.patch
+ tools-rv-fix-cleanup-after-failed-trace-setup.patch
+ net-skbuff-fix-missing-zerocopy-reference-in-pskb_ca.patch
+ tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
+ kvm-arm64-remove-vpipt-i-cache-handling.patch
+ arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
+ arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
+ iomap-don-t-revert-iov_iter-on-partially-completed-b.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ gpio-mvebu-fix-null-pointer-dereference-in-suspend-r.patch
+ asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
+ tcp-restrict-so_attach_filter-to-priv-users.patch
+ net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
+ net-phy-clean-the-sfp-upstream-if-phy-probing-fails.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ net-mlx5-fix-slab-out-of-bounds-in-mlx5_query_nic_vp.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ r8152-handle-the-return-value-of-usb_reset_device.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nf_log-validate-mac-header-was-set-before-.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
+ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
+ net-mvpp2-add-metadata-support-for-xdp-mode.patch
+ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
+ net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+ ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
+ netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
+ clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+ drm-virtio-fix-driver-removal-with-disabled-kms.patch
+ drm-vc4-fix-krealloc-memory-leak.patch
diff --cc queue-7.0/series
index d3411a3fef,0dc277c0ac..8fe7de11a1
--- a/queue-7.0/series
+++ b/queue-7.0/series
@@@ -1,6 -1,166 +1,171 @@@
  bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
 +kvm-arm64-take-the-srcu-lock-for-page-table-walks-in-fault-injection-and-at-emulation.patch
 +i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioctl.patch
 +bluetooth-iso-fix-a-use-after-free-of-the-hci_conn-pointer.patch
 +ipv6-mcast-fix-use-after-free-when-processing-mld-queries.patch
 +net-smc-fix-sleep-inside-lock-in-__smc_setsockopt-causing-local-dos.patch
+ tee-optee-prevent-use-after-free-when-the-client-exi.patch
+ soc-qcom-ice-allow-explicit-votes-on-iface-clock-for.patch
+ arm64-dts-qcom-x1-dell-thena-remove-i2c20-battery-sm.patch
+ arm-dts-microchip-sam9x7-fix-gmac-clock-configuratio.patch
+ soc-qcom-ice-return-enodev-if-the-ice-platform-devic.patch
+ tee-fix-tee_ioctl_object_invoke_arg-padding.patch
+ tee-qcomtee-add-missing-va_end-in-early-return-qcomt.patch
+ s390-bug-always-emit-format-word-in-__bug_entry.patch
+ arm-dts-gemini-fix-partition-offsets.patch
+ erofs-fix-use-after-free-on-sbi-sync_decompress.patch
+ wifi-iwlwifi-mvm-don-t-support-the-reset-handshake-f.patch
+ ksmbd-fix-null-deref-of-opinfo-conn-in-oplock-lease-.patch
+ netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
+ ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
+ netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
+ netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
+ netfilter-nft_ct-bail-out-on-template-ct-in-get-eval.patch
+ netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
+ dm-cache-policy-smq-check-allocation-under-invalidat.patch
+ net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
+ 6lowpan-fix-off-by-one-in-multicast-context-address-.patch
+ l2tp-pppol2tp-hold-reference-to-session-in-pppol2tp_.patch
+ devlink-release-nested-relation-on-devlink-free.patch
+ drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
+ wifi-mac80211-limit-injected-antenna-index-in-ieee80.patch
+ pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
+ net-annotate-sk-sk_write_space-for-udp-sockmap.patch
+ tcp-add-preempt_-disable-enable-_nested-in-reqsk_que.patch
+ hsr-remove-warn_once-in-hsr_addr_is_self.patch
+ net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
+ net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
+ net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
+ ipv6-anycast-insert-aca-into-global-hash-under-idev-.patch
+ wifi-fix-leak-if-split-6-ghz-scanning-fails.patch
+ wifi-cfg80211-add-support-to-handle-incumbent-signal.patch
+ wifi-nl80211-split-out-uhr-operation-information.patch
+ wifi-cfg80211-enforce-he-eht-cap-oper-consistency.patch
+ bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
+ bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
+ bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
+ bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
+ bluetooth-bnep-reject-short-frames-before-parsing.patch
+ bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
+ bluetooth-iso-fix-not-releasing-hdev-reference-on-is.patch
+ bluetooth-iso-fix-a-use-after-free-of-the-hci_conn-p.patch
+ bluetooth-iso-fix-data-race-on-iso_pi-fields-in-hci_.patch
+ bluetooth-sco-fix-data-race-on-sco_pi-fields-in-sco_.patch
+ bluetooth-mgmt-fix-backward-compatibility-with-users.patch
+ xsk-cache-csum_start-csum_offset-to-fix-toctou-in-xs.patch
+ octeontx2-pf-fix-ndc-sync-operation-errors.patch
+ octeontx2-af-fix-initialization-of-mcam-s-entry2targ.patch
+ af_unix-fix-inq_len-update-problem-in-partial-read.patch
+ ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
+ ptp-vclock-switch-from-rcu-to-srcu.patch
+ net-airoha-fix-use-after-free-in-metadata-dst-teardo.patch
+ net-ethernet-mtk_eth_soc-fix-use-after-free-in-metad.patch
+ geneve-fix-length-used-in-gro-hint-udp-checksum-adju.patch
+ net-sched-fix-pedit-partial-cow-leading-to-page-cach.patch
+ sctp-validate-cached-peer-init-chunk-length-in-cooki.patch
+ octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
+ vxlan-vnifilter-send-notification-on-vni-add.patch
+ vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
+ ipv6-mcast-fix-use-after-free-when-processing-mld-qu.patch
+ ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
+ net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
+ bonding-annotate-data-races-arcound-churn-variables.patch
+ sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
+ fwctl-bnxt_en-move-common-definitions-to-include-lin.patch
+ fwctl-bnxt_en-refactor-aux-bus-functions-to-be-more-.patch
+ reapply-bnxt_en-bring-back-rtnl_lock-in-the-bnxt_ope.patch
+ i2c-dev-prevent-integer-overflow-in-i2c_timeout-ioct.patch
+ kvm-arm64-take-the-srcu-lock-for-page-table-walks-in.patch
+ drivers-hv-vmbus-provide-option-to-skip-vmbus-unload.patch
+ drm-hyperv-during-panic-do-vmbus-unload-after-frame-.patch
+ selftests-harness-fix-pidfd-leak-in-__wait_for_test.patch
+ signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
+ regulator-mt6363-select-config_irq_domain.patch
+ hyperv-clean-up-and-fix-the-guest-id-comment-in-hvgd.patch
+ vfs-fix-possible-failure-to-unlock-in-nfsd4_create_f.patch
+ crypto-s390-add-select-crypto_aead-for-aes.patch
+ rseq-fix-using-an-uninitialized-stack-variable-in-rs.patch
+ time-fix-off-by-one-in-settimeofday-usec-validation.patch
+ alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
+ alsa-seq-dummy-fix-ump-event-stack-overread.patch
+ x86-resctrl-only-check-intel-systems-for-snc.patch
+ cpufreq-amd-pstate-drop-stale-epp_cached-kdoc.patch
+ rtla-fix-parsing-of-multi-character-short-options.patch
+ tools-rv-ensure-monitor-name-and-desc-are-nul-termin.patch
+ tools-rv-fix-substring-match-bug-in-monitor-name-sea.patch
+ tools-rv-fix-substring-match-when-listing-container-.patch
+ tools-rv-fix-cleanup-after-failed-trace-setup.patch
+ verification-rvgen-fix-options-shared-among-commands.patch
+ verification-rvgen-fix-ltl2k-writing-true-as-a-liter.patch
+ riscv-ptrace-use-user_regset_note_type-for-regset_cf.patch
+ riscv-cfi-reject-unknown-flags-in-pr_set_cfi.patch
+ xfrm-iptfs-fix-use-after-free-on-first_skb-in-__inpu.patch
+ dma-mapping-direct-fix-missing-mapping-for-thru_host.patch
+ dma-debug-fix-physical-address-retrieval-in-debug_dm.patch
+ xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
+ ice-fix-missing-priority-callbacks-for-u.fl-dpll-pin.patch
+ idpf-fix-mailbox-capability-for-set-device-clock-tim.patch
+ net-ena-phc-add-missing-barrier.patch
+ bnge-fix-context-mem-iteration.patch
+ netlabel-validate-unlabeled-address-and-mask-attribu.patch
+ gpio-mvebu-fix-null-pointer-dereference-in-suspend-r.patch
+ asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
+ tcp-restrict-so_attach_filter-to-priv-users.patch
+ net-add-pskb_may_pull-to-skb_gro_receive_list.patch
+ net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
+ net-ibm-emac-fix-use-after-free-during-device-remova.patch
+ netdev-fix-double-free-in-netdev_nl_bind_rx_doit.patch
+ net-phy-clean-the-sfp-upstream-if-phy-probing-fails.patch
+ net-phy-remove-phy-ports-upon-probe-failure.patch
+ net-phy-clean-the-phy_ports-after-unregistering-the-.patch
+ net-phy-don-t-try-to-setup-phy-driven-sfp-cages-when.patch
+ net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
+ net-mlx5-fix-slab-out-of-bounds-in-mlx5_query_nic_vp.patch
+ net-mlx5e-xsk-fix-dma-and-xdp_frame-leak-on-xdp_tx-x.patch
+ net-mlx5-use-effective-affinity-mask-for-irq-selecti.patch
+ ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
+ net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
+ r8152-handle-the-return-value-of-usb_reset_device.patch
+ gpio-zynq-fix-runtime-pm-leak-on-remove.patch
+ gpio-rockchip-fix-generic-irq-chip-leak-on-remove.patch
+ net-mctp-usb-fix-race-between-urb-completion-and-rx_.patch
+ net-mctp-usb-don-t-fail-mctp_usb_rx_queue-on-a-defer.patch
+ esp-fix-page-frag-reference-leak-on-skb_to_sgvec-fai.patch
+ asoc-sof-amd-fix-for-ipc-flags-check.patch
+ sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
+ ip6_vti-set-netns_immutable-on-the-fallback-device.patch
+ sctp-validate-embedded-init-chunk-and-address-list-l.patch
+ net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
+ net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
+ tun-zero-the-whole-vnet-header-in-tun_put_user.patch
+ ptp-ocp-fix-resource-freeing-order.patch
+ ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
+ rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
+ spi-rzv2h-rspi-fix-spdr-read-access-width-for-16-bit.patch
+ netfilter-revalidate-bridge-ports.patch
+ netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
+ netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
+ netfilter-nf_log-validate-mac-header-was-set-before-.patch
+ netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
+ net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
+ net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
+ net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
+ net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
+ net-txgbe-initialize-module-info-buffer.patch
+ net-txgbe-distinguish-module-types-by-checking-ident.patch
+ net-txgbe-initialize-phy-interface-to-0.patch
+ ipv6-fix-a-potential-npd-in-cleanup_prefix_route.patch
+ asoc-sdca-fix-null-pointer-dereference-in-sdca_dev_u.patch
+ clk-qcom-x1e80100-dispcc-stop-disp_cc_mdss_mdp_clk_s.patch
+ clk-samsung-gs101-fix-missing-usi7_usi-div-clock-in-.patch
+ clk-qcom-dispcc-sc8280xp-don-t-park-mdp_clk_src-at-r.patch
+ drm-i915-edp-check-supported-link-rates-dpcd-read.patch
+ drm-virtio-fix-driver-removal-with-disabled-kms.patch
+ drm-vc4-fix-krealloc-memory-leak.patch
+ drm-colorop-remove-read-only-comments-from-interpola.patch
+ drm-colorop-make-lut-1-3-d_interpolation-props-corre.patch
+ drm-atomic-track-individual-colorop-updates.patch
+ drm-amd-display-use-plane-color_mgmt_changed-to-trac.patch
+ drm-xe-fix-refcount-leak-in-xe_range_fence_insert.patch
+ drm-xe-fix-job-timeout-recovery-for-unstarted-jobs-a.patch
+ accel-amdxdna-fix-mm_struct-reference-leak-in-aie2_p.patch