Plucky update: upstream stable patchset 2025-09-30

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2025-09-30

                Ported from the following upstream stable releases:
                        v6.12.42, v6.15.10

       from git://git.kernel.org/

ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
ethernet: intel: fix building with large NR_CPUS
ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
ASoC: Intel: fix SND_SOC_SOF dependencies
ASoC: amd: yc: add DMI quirk for ASUS M6501RM
audit,module: restore audit logging in load failure case
parse_longname(): strrchr() expects NUL-terminated string
fs_context: fix parameter name in infofc() macro
fs/ntfs3: cancle set bad inode after removing name fails
ublk: use vmalloc for ublk_device's __queues
hfsplus: make splice write available again
hfs: make splice write available again
hfsplus: remove mutex_lock check in hfsplus_free_extents
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
gfs2: No more self recovery
io_uring: fix breakage in EXPERT menu
ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
ASoC: mediatek: use reserved memory or enable buffer pre-allocation
arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV
selftests: Fix errno checking in syscall_user_dispatch test
soc: qcom: QMI encoding/decoding for big endian
arm64: dts: qcom: sdm845: Expand IMEM region
arm64: dts: qcom: sc7180: Expand IMEM region
arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc
arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
ARM: dts: vfxxx: Correctly use two tuples for timer address
usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
usb: misc: apple-mfi-fastcharge: Make power supply names unique
arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports
arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size
cpufreq: armada-8k: make both cpu masks static
firmware: arm_scmi: Fix up turbo frequencies selection
usb: typec: ucsi: yoga-c630: fix error and remove paths
mei: vsc: Destroy mutex after freeing the IRQ
mei: vsc: Event notifier fixes
mei: vsc: Unset the event callback on remove and probe errors
spi: stm32: Check for cfg availability in stm32_spi_probe
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
vmci: Prevent the dispatching of uninitialized payloads
pps: fix poll support
selftests: vDSO: chacha: Correctly skip test if necessary
Revert "vmci: Prevent the dispatching of uninitialized payloads"
powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
usb: early: xhci-dbc: Fix early_ioremap leak
arm: dts: ti: omap: Fixup pinheader typo
soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
arm64: dts: st: fix timer used for ticks
selftests: breakpoints: use suspend_stats to reliably check suspend success
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
PM / devfreq: Check governor before using governor->name
PM / devfreq: Fix a index typo in trans_stat
cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
cpufreq: Initialize cpufreq-based frequency-invariance later
cpufreq: Init policy->rwsem before it may be possibly used
staging: greybus: gbphy: fix up const issue with the match callback
samples: mei: Fix building on musl libc
soc: qcom: pmic_glink: fix OF node leak
interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
interconnect: qcom: sc8180x: specify num_nodes
bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640
staging: nvec: Fix incorrect null termination of battery manufacturer
selftests/tracing: Fix false failure of subsystem event test
drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
drm/panfrost: Fix panfrost device variable name in devfreq
drm/panthor: Add missing explicit padding in drm_panthor_gpu_info
bpf, sockmap: Fix psock incorrectly pointing to sk
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
selftests/bpf: fix signedness bug in redir_partial()
selftests/bpf: Fix unintentional switch case fall through
net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
drm/amdgpu: Remove nbiov7.9 replay count reporting
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
caif: reduce stack size, again
wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
wifi: rtl818x: Kill URBs before clearing tx status queue
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
iwlwifi: Add missing check for alloc_ordered_workqueue
wifi: ath11k: clear initialized flag for deinit-ed srng lists
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
net/mlx5: Check device memory pointer before usage
net: dst: annotate data-races around dst->input
net: dst: annotate data-races around dst->output
kselftest/arm64: Fix check for setting new VLs in sve-ptrace
bpf: Ensure RCU lock is held around bpf_prog_ksym_find
drm/msm/dpu: Fill in min_prefill_lines for SC8180X
m68k: Don't unregister boot console needlessly
refscale: Check that nreaders and loops multiplication doesn't overflow
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
sched/psi: Optimize psi_group_change() cpu_clock() usage
fbcon: Fix outdated registered_fb reference in comment
netfilter: nf_tables: Drop dead code from fill_*_info routines
netfilter: nf_tables: adjust lockdep assertions handling
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
um: rtc: Avoid shadowing err in uml_rtc_start()
iommu/amd: Enable PASID and ATS capabilities in the correct order
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
net_sched: act_ctinfo: use atomic64_t for three counters
RDMA/mlx5: Fix UMR modifying of mkey page size
xen: fix UAF in dmabuf_exp_from_pages()
xen/gntdev: remove struct gntdev_copy_batch from stack
tcp: call tcp_measure_rcv_mss() for ooo packets
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
wifi: rtw88: Fix macid assigned to TDLS station
mwl8k: Add missing check after DMA map
wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
drm/amdgpu/gfx9: fix kiq locking in KCQ reset
drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset
drm/amdgpu/gfx10: fix kiq locking in KCQ reset
iommu/amd: Fix geometry.aperture_end for V2 tables
rcu: Fix delayed execution of hurry callbacks
wifi: mac80211: reject TDLS operations when station is not associated
wifi: plfxlc: Fix error handling in usb driver probe
wifi: mac80211: Do not schedule stopped TXQs
wifi: mac80211: Don't call fq_flow_idx() for management frames
wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
wifi: ath12k: fix endianness handling while accessing wmi service bit
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
wifi: nl80211: Set num_sub_specs before looping through sub_specs
ring-buffer: Remove ring_buffer_read_prepare_sync()
kcsan: test: Initialize dummy variable
memcg_slabinfo: Fix use of PG_slab
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
Bluetooth: hci_event: Mask data status from LE ext adv reports
bpf: Disable migration in nf_hook_run_bpf().
tools/rv: Do not skip idle in trace
selftests: drv-net: Fix remote command checking in require_cmd()
can: peak_usb: fix USB FD devices potential malfunction
can: kvaser_pciefd: Store device channel index
can: kvaser_usb: Assign netdev.dev_port based on device channel index
netfilter: xt_nfacct: don't assume acct name is null-terminated
net/mlx5e: Clear Read-Only port buffer size in PBMC before update
net/mlx5e: Remove skb secpath if xfrm state is not found
net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863
stmmac: xsk: fix negative overflow of budget in zerocopy mode
selftests: rtnetlink.sh: remove esp4_offload after test
vrf: Drop existing dst reference in vrf_ip6_input_dst
ipv6: prevent infinite loop in rt6_nlmsg_size()
ipv6: fix possible infinite loop in fib6_info_uses_dev()
ipv6: annotate data-races around rt->fib6_nsiblings
bpf/preload: Don't select USERMODE_DRIVER
bpf, arm64: Fix fp initialization for exception boundary
staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()
fortify: Fix incorrect reporting of read buffer size
PCI: rockchip-host: Fix "Unexpected Completion" log message
clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks
crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
crypto: qat - use unmanaged allocation for dc_data
crypto: marvell/cesa - Fix engine load inaccuracy
crypto: qat - allow enabling VFs in the absence of IOMMU
crypto: qat - fix state restore for banks with exceptions
mtd: fix possible integer overflow in erase_xfer()
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
clk: xilinx: vcu: unregister pll_post only if registered correctly
power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
crypto: arm/aes-neonbs - work around gcc-15 warning
PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
pinctrl: sunxi: Fix memory leak on krealloc failure
pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state()
dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning
phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers
fanotify: sanitize handle_type values when reporting fid
clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
Fix dma_unmap_sg() nents value
perf tools: Fix use-after-free in help_unknown_cmd()
perf dso: Add missed dso__put to dso__load_kcore
mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER
perf sched: Make sure it frees the usage string
perf sched: Free thread->priv using priv_destructor
perf sched: Fix memory leaks in 'perf sched map'
perf sched: Fix memory leaks for evsel->priv in timehist
perf sched: Use RC_CHK_EQUAL() to compare pointers
perf sched: Fix memory leaks in 'perf sched latency'
RDMA/hns: Fix double destruction of rsv_qp
RDMA/hns: Fix HW configurations not cleared in error flow
crypto: ccp - Fix locking on alloc failure handling
crypto: inside-secure - Fix `dma_unmap_sg()` nents value
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
RDMA/hns: Get message length of ack_req from FW
RDMA/hns: Fix accessing uninitialized resources
RDMA/hns: Drop GFP_NOWARN
RDMA/hns: Fix -Wframe-larger-than issue
kernel: trace: preemptirq_delay_test: use offstack cpu mask
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
pinmux: fix race causing mux_owner NULL with active mux_usecount
perf tests bp_account: Fix leaked file descriptor
RDMA/mana_ib: Fix DSCP value in modify QP
clk: thead: th1520-ap: Correctly refer the parent of osc_12m
clk: sunxi-ng: v3s: Fix de clock definition
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
scsi: elx: efct: Fix dma_unmap_sg() nents value
scsi: mvsas: Fix dma_unmap_sg() nents value
scsi: isci: Fix dma_unmap_sg() nents value
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
ext4: Make sure BH_New bit is cleared in ->write_end handler
clk: at91: sam9x7: update pll clk ranges
hwrng: mtk - handle devm_pm_runtime_enable errors
crypto: keembay - Fix dma_unmap_sg() nents value
crypto: img-hash - Fix dma_unmap_sg() nents value
crypto: qat - disable ZUC-256 capability for QAT GEN5
soundwire: stream: restore params when prepare ports fail
PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
clk: imx95-blk-ctl: Fix synchronous abort
remoteproc: xlnx: Disable unsupported features
fs/orangefs: Allow 2 more characters in do_c_string()
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
dmaengine: nbpfaxi: Add missing check after DMA map
ASoC: fsl_xcvr: get channel status data when PHY is not exists
sh: Do not use hyphen in exported variable name
perf tools: Remove libtraceevent in .gitignore
crypto: qat - fix DMA direction for compression on GEN2 devices
crypto: qat - fix seq_file position update in adf_ring_next()
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
jfs: fix metapage reference count leak in dbAllocCtl
mtd: rawnand: atmel: Fix dma_mapping_error() address
mtd: rawnand: rockchip: Add missing check after DMA map
mtd: rawnand: atmel: set pmecc data setup time
drm/xe/vf: Disable CSC support on VF
selftests: ALSA: fix memory leak in utimer test
perf record: Cache build-ID of hit DSOs only
vdpa/mlx5: Fix needs_teardown flag calculation
vhost-scsi: Fix log flooding with target does not exist errors
vdpa/mlx5: Fix release of uninitialized resources on error path
vdpa: Fix IDR memory leak in VDUSE module exit
vhost: Reintroduce kthread API and add mode selection
UBUNTU: [Config] updateconfigs for VHOST_ENABLE_FORK_OWNER_CONTROL
bpf: Check flow_dissector ctx accesses are aligned
bpf: Check netfilter ctx accesses are aligned
apparmor: ensure WB_HISTORY_SIZE value is a power of 2
apparmor: fix loop detection used in conflicting attachment resolution
apparmor: Fix unaligned memory accesses in KUnit test
module: Restore the moduleparam prefix length check
ucount: fix atomic_long_inc_below() argument type
rtc: ds1307: fix incorrect maximum clock rate handling
rtc: hym8563: fix incorrect maximum clock rate handling
rtc: nct3018y: fix incorrect maximum clock rate handling
rtc: pcf85063: fix incorrect maximum clock rate handling
rtc: pcf8563: fix incorrect maximum clock rate handling
rtc: rv3028: fix incorrect maximum clock rate handling
f2fs: turn off one_time when forcibly set to foreground GC
f2fs: fix bio memleak when committing super block
f2fs: fix KMSAN uninit-value in extent_info usage
f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent
f2fs: fix to check upper boundary for gc_valid_thresh_ratio
f2fs: fix to check upper boundary for gc_no_zoned_gc_percent
f2fs: doc: fix wrong quota mount option description
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
f2fs: fix to avoid panic in f2fs_evict_inode
f2fs: fix to avoid out-of-boundary access in devs.path
f2fs: vm_unmap_ram() may be called from an invalid context
f2fs: fix to update upper_p in __get_secs_required() correctly
f2fs: fix to calculate dirty data during has_not_enough_free_secs()
f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
exfat: fdatasync flag should be same like generic_write_sync()
i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe()
vfio: Fix unbalanced vfio_df_close call in no-iommu mode
vfio: Prevent open_count decrement to negative
vfio/pds: Fix missing detach_ioas op
vfio/pci: Separate SR-IOV VF dev_set
scsi: mpt3sas: Fix a fw_event memory leak
scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
kconfig: qconf: fix ConfigList::updateListAllforAll()
sched/psi: Fix psi_seq initialization
PCI: pnv_php: Clean up allocated IRQs on unplug
PCI: pnv_php: Work around switches with broken presence detection
powerpc/eeh: Export eeh_unfreeze_pe()
powerpc/eeh: Make EEH driver device hotplug safe
PCI: pnv_php: Fix surprise plug detection and recovery
pNFS/flexfiles: don't attempt pnfs on fatal DS errors
NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
md/md-cluster: handle REMOVE message earlier
netpoll: prevent hanging NAPI when netcons gets enabled
phy: mscc: Fix parsing of unicast frames
net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
pptp: ensure minimal skb length in pptp_xmit()
nvmet: initialize discovery subsys after debugfs is initialized
s390/ap: Unmask SLCF bit in card and queue ap functions sysfs
netlink: specs: ethtool: fix module EEPROM input/output arguments
block: Fix default IO priority if there is no IO context
block: ensure discard_granularity is zero when discard is not supported
ASoC: tas2781: Fix the wrong step for TLV on tas2781
spi: cs42l43: Property entry should be a null-terminated array
net/mlx5: Correctly set gso_segs when LRO is used
ipv6: reject malicious packets in ipv6_gso_segment()
net: mdio: mdio-bcm-unimac: Correct rate fallback logic
net: drop UFO packets in udp_rcv_segment()
net/sched: taprio: enforce minimum value for picos_per_byte
sunrpc: fix client side handling of tls alerts
x86/irq: Plug vector setup race
benet: fix BUG when creating VFs
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
s390/mm: Allocate page table with PAGE_SIZE granularity
eth: fbnic: remove the debugging trick of super high page bias
irqchip: Build IMX_MU_MSI only on ARM
ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
smb: server: remove separate empty_recvmsg_queue
smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
smb: server: let recv_done() avoid touching data_transfer after cleanup/move
smb: client: remove separate empty_packet_queue
smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
smb: client: let recv_done() cleanup before notifying the callers.
smb: client: let recv_done() avoid touching data_transfer after cleanup/move
nvmet: exit debugfs after discovery subsystem exits
pptp: fix pptp_xmit() error path
smb: client: return an error if rdma_connect does not return within 5 seconds
sunrpc: fix handling of server side tls alerts
perf/core: Don't leak AUX buffer refcount on allocation failure
selftests/perf_events: Add a mmap() correctness test
ksmbd: fix null pointer dereference error in generate_encryptionkey
ksmbd: fix Preauh_HashValue race condition
ksmbd: fix corrupted mtime and ctime in smb2_open
ksmbd: limit repeated connections from clients with the same IP
smb: server: Fix extension string in ksmbd_extract_shortname()
USB: serial: option: add Foxconn T99W709
Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
net: usbnet: Fix the wrong netif_carrier_on() call
ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx
ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx
ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26)
platform/x86/intel/pmt: fix a crashlog NULL pointer access
x86/fpu: Delay instruction pointer fixup until after warning
s390/mm: Remove possible false-positive warning in pte_free_defer()
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop
mm: swap: fix potential buffer overflow in setup_clusters()
perf/arm-ni: Set initial IRQ affinity
media: ti: j721e-csi2rx: fix list_del corruption
HID: apple: validate feature-report field count to prevent NULL pointer dereference
USB: gadget: f_hid: Fix memory leak in hidg_bind error path
usb: gadget : fix use-after-free in composite_dev_cleanup()
drm/radeon: Do not hold console lock while suspending clients
ALSA: hda/realtek: Support mute LED for Yoga with ALC287
block: mtip32xx: Fix usage of dma_map_sg()
md: allow removing faulty rdev during resync
block: sanitize chunk_sectors for atomic write limits
btrfs: remove unnecessary btrfs_key local variable in btrfs_search_forward()
btrfs: avoid redundant path slot assignment in btrfs_search_forward()
btrfs: remove partial support for lowest level from btrfs_search_forward()
arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight
arm64: dts: qcom: qcs615: disable the CTI device of the camera block
ARM: dts: microchip: sama7d65: Add clock name property
ARM: dts: microchip: sam9x7: Add clock name property
mei: vsc: Don't re-init VSC from mei_vsc_hw_reset() on stop
drivers: misc: sram: fix up some const issues with recent attribute changes
power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855
rust: miscdevice: clarify invariant for `MiscDeviceRegistration`
arm64: dts: imx8mp-venice-gw74xx: update name of M2SKT_WDIS2# gpio
staging: gpib: Fix error code in board_type_ioctl()
staging: gpib: Fix error handling paths in cb_gpib_probe()
drm/xe: Correct the rev value for the DVSEC entries
drm/xe: Correct BMG VSEC header sizing
drm/connector: hdmi: Evaluate limited range after computing format
wifi: rtw89: fix EHT 20MHz TX rate for non-AP STA
netconsole: Only register console drivers when targets are configured
slub: Fix a documentation build error for krealloc()
wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss
wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
wifi: ath12k: Clear auth flag only for actual association in security mode
wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
sched/deadline: Reset extra_bw to max_bw when clearing root domains
iommu/vt-d: Do not wipe out the page table NID when devices detach
iommu/arm-smmu: disable PRR on SM8250
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac()
PM: cpufreq: powernv/tracing: Move powernv_throttle trace event
wifi: mac80211: fix WARN_ON for monitor mode on some devices
arm64/gcs: task_gcs_el0_enable() should use passed task
neighbour: Fix null-ptr-deref in neigh_flush_dev().
igb: xsk: solve negative overflow of nb_pkts in zerocopy mode
RISC-V: KVM: Fix inclusion of Smnpm in the guest ISA bitmap
remoteproc: qcom: pas: Conclude the rename from adsp
padata: Fix pd UAF once and for all
perf parse-events: Set default GH modifier properly
power: supply: qcom_pmi8998_charger: fix wakeirq
power: supply: max1720x correct capacity computation
pinctrl: canaan: k230: add NULL check in DT parse
pinctrl: canaan: k230: Fix order of DT parse and pinctrl register
PCI: Adjust the position of reading the Link Control 2 register
soundwire: Correct some property names
perf sched: Fix thread leaks in 'perf sched timehist'
tracing: Use queue_rcu_work() to free filters
perf hwmon_pmu: Avoid shortening hwmon PMU name
tools subcmd: Tighten the filename size in check_if_command_finished
ASoC: fsl_xcvr: get channel status data with firmware exists
clk: clocking-wizard: Fix the round rate handling for versal
smb: client: allow parsing zero-length AV pairs
ALSA: usb: scarlett2: Fix missing NULL check
scripts: gdb: move MNT_* constants to gdb-parsed
f2fs: fix to avoid invalid wait context issue
vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD
padata: Remove comment for reorder_work
drm/xe/pf: Disable PF restart worker on device removal
eth: fbnic: unlink NAPIs from queues on error to open
NFS/localio: nfs_close_local_fh() fix check for file closed
NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh()
NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file
s390/boot: Fix startup debugging log
tools/power turbostat: Fix bogus SysWatt for forked program
nfsd: don't set the ctime on delegated atime updates
nfsd: avoid ref leak in nfsd_open_local_fh()
perf/core: Exit early on perf_mmap() fail
perf/core: Prevent VMA split of buffer mappings
smb: client: fix netns refcount leak after net_passive changes
smb: client: set symlink type as native for POSIX mounts
smb: client: default to nonativesocket under POSIX mounts
x86/sev: Evict cache lines during SNP memory validation
KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
mm: shmem: fix the shmem large folio allocation for the i915 driver
usb: gadget: uvc: Initialize frame-based format color matching descriptor
HID: core: Harden s32ton() against conversion to 0 bits
vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
ksmbd: extend the connection limiting mechanism to support IPv6
UBUNTU: Upstream stable to v6.12.42, v6.15.10