Change log for linux-hwe-6.14 package in Ubuntu

110 of 10 results
Published in noble-proposed
linux-hwe-6.14 (6.14.0-34.34~24.04.1) noble; urgency=medium

  * noble/linux-hwe-6.14: 6.14.0-34.34~24.04.1 -proposed tracker (LP: #2123943)

  [ Ubuntu: 6.14.0-34.34 ]

  * plucky/linux: 6.14.0-34.34 -proposed tracker (LP: #2123945)
  * [25.04 FEAT] [post announcement] [KRN2304] CPU-MF Counters for new IBM Z
    hardware - perf part (LP: #2103415)
    - perf list: Add IBM z17 event descriptions
  * Kernel fails to build when coresight is enabled (LP: #2122527)
    - Coresight: Introduce a new struct coresight_path
    - Coresight: Change functions to accept the coresight_path
    - coresight: change coresight_device lock type to raw_spinlock_t
  * memory leaks when configuring a small rate limit in audit (LP: #2122554)
    - audit: fix skb leak when audit rate limit is exceeded
  * [UBUNTU 24.04] s390/pci: Don't abort recovery for user-space drivers
    (LP: #2121150)
    - s390/pci: Allow automatic recovery with minimal driver support
  * [AMDGPU] Call trace occurs when unplugging a HDMI/DP/VGA cable on Dell
    platforms (LP: #2116908)
    - drm/amd/display: limit clear_update_flags to dcn32 and above
    - drm/amd/display: Allow DCN301 to clear update flags
  * sources list generation using dwarfdump takes up to 0.5hr in build process
    (LP: #2104911)
    - [Packaging] Don't generate list of source files
  * [SRU] Apparmor: Unshifted uids for hardlinks and unix sockets in user
    namespaces (LP: #2121257)
    - apparmor: shift ouid when mediating hard links in userns
    - apparmor: shift uid when mediating af_unix in userns
  * Plucky update: upstream stable patchset 2025-09-04 (LP: #2122072)
    - rtc: pcf2127: add missing semicolon after statement
    - rtc: pcf2127: fix SPI command byte for PCF2131
    - rtc: cmos: use spin_lock_irqsave in cmos_interrupt
    - virtio-net: xsk: rx: fix the frame's length check
    - virtio-net: ensure the received length does not exceed allocated size
    - net: txgbe: request MISC IRQ in ndo_open
    - vsock/vmci: Clear the vmci transport packet properly when initializing
      it
    - net: libwx: fix the incorrect display of the queue number
    - mmc: sdhci: Add a helper function for dump register in dynamic debug
      mode
    - Revert "mmc: sdhci: Disable SD card clock before changing parameters"
    - mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
    - Bluetooth: HCI: Set extended advertising data synchronously
    - Bluetooth: hci_sync: revert some mesh modifications
    - Bluetooth: MGMT: set_mesh: update LE scan interval and window
    - Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
    - iommufd/selftest: Fix iommufd_dirty_tracking with large hugepage sizes
    - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
    - Input: cs40l50-vibra - fix potential NULL dereference in
      cs40l50_upload_owt()
    - usb: typec: altmodes/displayport: do not index invalid pin_assignments
    - mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
    - mtk-sd: Prevent memory corruption from DMA map failure
    - mtk-sd: reset host->mrq on prepare_data() error
    - drm/v3d: Disable interrupts before resetting the GPU
    - firmware: arm_ffa: Fix memory leak by freeing notifier callback node
    - firmware: arm_ffa: Move memory allocation outside the mutex locking
    - firmware: arm_ffa: Replace mutex with rwlock to avoid sleep in atomic
      context
    - arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
    - platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
    - RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling
    - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
    - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
    - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
    - scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
    - scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
    - scsi: sd: Fix VPD page 0xb7 length check
    - scsi: ufs: core: Fix spelling of a sysfs attribute name
    - RDMA/mlx5: Fix HW counters query for non-representor devices
    - RDMA/mlx5: Fix CC counters query for MPV
    - RDMA/mlx5: Fix vport loopback for MPV device
    - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1
    - platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
    - Bluetooth: Prevent unintended pause by checking if advertising is active
    - btrfs: fix missing error handling when searching for inode refs during
      log replay
    - btrfs: fix iteration of extrefs during log replay
    - btrfs: return a btrfs_inode from btrfs_iget_logging()
    - btrfs: return a btrfs_inode from read_one_inode()
    - btrfs: fix invalid inode pointer dereferences during log replay
    - btrfs: fix inode lookup error handling during log replay
    - btrfs: record new subvolume in parent dir earlier to avoid dir logging
      races
    - btrfs: propagate last_unlink_trans earlier when doing a rmdir
    - btrfs: use btrfs_record_snapshot_destroy() during rmdir
    - ethernet: atl1: Add missing DMA mapping error checks and count errors
    - dpaa2-eth: fix xdp_rxq_info leak
    - drm/exynos: fimd: Guard display clock control with runtime PM calls
    - spi: spi-fsl-dspi: Clear completion counter before initiating transfer
    - drm/i915/selftests: Change mock_request() to return error pointers
    - nvme: Fix incorrect cdw15 value in passthru error logging
    - nvmet: fix memory leak of bio integrity
    - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs
      callbacks
    - platform/x86: hp-bioscfg: Fix class device unregistration
    - platform/x86: think-lmi: Fix class device unregistration
    - platform/x86: dell-wmi-sysman: Fix class device unregistration
    - platform/mellanox: mlxreg-lc: Fix logic error in power state check
    - drm/bridge: aux-hpd-bridge: fix assignment of the of_node
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
    - drm/i915/gt: Fix timeline left held on VMA alloc error
    - drm/i915/gsc: mei interrupt top half should be in irq disabled context
    - idpf: return 0 size for RSS key if not supported
    - idpf: convert control queue mutex to a spinlock
    - igc: disable L1.2 PCI-E link substate to avoid performance issue
    - smb: client: set missing retry flag in smb2_writev_callback()
    - smb: client: set missing retry flag in cifs_readv_callback()
    - smb: client: set missing retry flag in cifs_writev_callback()
    - netfs: Fix i_size updating
    - lib: test_objagg: Set error message in check_expect_hints_stats()
    - amd-xgbe: align CL37 AN sequence as per databook
    - enic: fix incorrect MTU comparison in enic_change_mtu()
    - rose: fix dangling neighbour pointers in rose_rt_device_down()
    - nui: Fix dma_mapping_error() check
    - amd-xgbe: do not double read link status
    - smb: client: fix race condition in negotiate timeout by using more
      precise timing
    - crypto: iaa - Remove dst_null support
    - crypto: iaa - Do not clobber req->base.data
    - kunit: qemu_configs: sparc: use Zilog console
    - kunit: qemu_configs: sparc: Explicitly enable CONFIG_SPARC32=y
    - kunit: qemu_configs: Disable faulting tests on 32-bit SPARC
    - gfs2: Decode missing glock flags in tracepoints
    - gfs2: Add GLF_PENDING_REPLY flag
    - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE
    - gfs2: deallocate inodes in gfs2_create_inode
    - btrfs: prepare btrfs_page_mkwrite() for large folios
    - btrfs: fix wrong start offset for delalloc space release during mmap
      write
    - ASoC: tas2764: Extend driver to SN012776
    - ASoC: tas2764: Reinit cache on part reset
    - ACPI: thermal: Fix stale comment regarding trip points
    - ACPI: thermal: Execute _SCP before reading trip points
    - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup"
      bug
    - sched_ext: Make scx_group_set_weight() always update tg->scx.weight
    - drm/msm: Fix a fence leak in submit error path
    - drm/msm: Fix another leak in the submit error path
    - ALSA: sb: Don't allow changing the DMA mode during operations
    - ALSA: sb: Force to disable DMAs once when DMA mode is changed
    - ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
    - ata: pata_cs5536: fix build on 32-bit UML
    - ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
    - platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks
      list
    - genirq/irq_sim: Initialize work context pointers properly
    - powerpc: Fix struct termio related ioctl macros
    - ASoC: amd: yc: update quirk data for HP Victus
    - regulator: fan53555: add enable_time support and soft-start times
    - scsi: target: Fix NULL pointer dereference in
      core_scsi3_decode_spec_i_port()
    - aoe: defer rexmit timer downdev work to workqueue
    - wifi: mac80211: drop invalid source address OCB frames
    - wifi: ath6kl: remove WARN on bad firmware input
    - ACPICA: Refuse to evaluate a method if arguments are missing
    - mtd: spinand: fix memory leak of ECC engine conf
    - rcu: Return early if callback is not specified
    - module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
    - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
    - RDMA/mlx5: Fix cache entry update on dereg error
    - IB/mlx5: Fix potential deadlock in MR deregistration
    - NFSv4/flexfiles: Fix handling of NFS level errors in I/O
    - usb: xhci: Skip xhci_reset in xhci_resume if xhci is being removed
    - Revert "usb: xhci: Implement xhci_handshake_check_state() helper"
    - usb: xhci: quirk for data loss in ISOC transfers
    - xhci: dbctty: disable ECHO flag by default
    - xhci: dbc: Flush queued requests before stopping dbc
    - xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
    - Input: xpad - support Acer NGR 200 Controller
    - Input: iqs7222 - explicitly define number of external channels
    - usb: cdnsp: do not disable slot for disabled slot
    - usb: cdnsp: Fix issue with CV Bad Descriptor test
    - usb: dwc3: Abort suspend on soft disconnect failure
    - usb: chipidea: udc: disconnect/reconnect from host when do
      suspend/resume
    - usb: acpi: fix device link removal
    - smb: client: fix readdir returning wrong type with POSIX extensions
    - cifs: all initializations for tcon should happen in tcon_info_alloc
    - dma-buf: fix timeout handling in dma_resv_wait_timeout v2
    - i2c/designware: Fix an initialization issue
    - Logitech C-270 even more broken
    - optee: ffa: fix sleep in atomic context
    - iommu/rockchip: prevent iommus dead loop when two masters share one
      IOMMU
    - powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be
      changed
    - riscv: cpu_ops_sbi: Use static array for boot_data
    - platform/x86: think-lmi: Create ksets consecutively
    - platform/x86: think-lmi: Fix kobject cleanup
    - platform/x86: think-lmi: Fix sysfs group cleanup
    - mm/vmalloc: fix data race in show_numa_info()
    - x86/bugs: Rename MDS machinery to something more generic
    - x86/microcode/AMD: Add TSA microcode SHAs
    - x86/process: Move the buffer clearing before MONITOR
    - iommufd/selftest: Add missing close(mfd) in memfd_mmap()
    - iommufd/selftest: Add asserts testing global mfd
    - xfs: actually use the xfs_growfs_check_rtgeom tracepoint
    - mmc: sdhci-uhs2: Adjust some error messages and register dump for SD
      UHS-II card
    - mmc: core: Adjust some error messages for SD UHS-II cards
    - RDMA/mlx5: reduce stack usage in mlx5_ib_ufile_hw_cleanup
    - scsi: core: Enforce unlimited max_segment_size when virt_boundary_mask
      is set
    - btrfs: fix failure to rebuild free space tree using multiple
      transactions
    - nvme-pci: refresh visible attrs after being checked
    - drm/bridge: panel: move prepare_prev_first handling to
      drm_panel_bridge_add_typed
    - netfs: Fix hang due to missing case in final DIO read result collection
    - netfs: Fix looping in wait functions
    - netfs: Fix ref leak on inserted extra subreq in write retry
    - drm/xe/guc: Enable w/a 16026508708
    - drm/xe/guc_pc: Add _locked variant for min/max freq
    - drm/xe: Split xe_device_td_flush()
    - drm/xe/bmg: Update Wa_14022085890
    - drm/xe/bmg: Update Wa_22019338487
    - net: ipv4: fix stat increase when udp early demux drops the packet
    - smb: client: fix native SMB symlink traversal
    - netfs: Fix double put of request
    - drm/xe: Allow dropping kunit dependency as built-in
    - x86/platform/amd: move final timeout check to after final sleep
    - usb: dwc3: gadget: Fix TRB reclaim logic for short transfers and ZLPs
    - dt-bindings: i2c: realtek,rtl9301: Fix missing 'reg' constraint
    - x86/bugs: Add a Transient Scheduler Attacks mitigation
    - [Config] Enable MITIGATION_TSA
    - KVM: x86: Sort CPUID_8000_0021_EAX leaf bits properly
    - KVM: SVM: Advertise TSA CPUID bits to guests
    - Upstream stable to v6.12.37, v6.15.6
  * [UBUNTU 24.04] s390/pci: Fix stale function handles in error handling
    (LP: #2121149) // Plucky update: upstream stable patchset 2025-09-04
    (LP: #2122072)
    - s390/pci: Fix stale function handles in error handling
    - s390/pci: Do not try re-enabling load/store if device is disabled
  * Plucky update: upstream stable patchset 2025-08-22 (LP: #2121266)
    - cifs: Correctly set SMB1 SessionKey field in Session Setup Request
    - cifs: Fix cifs_query_path_info() for Windows NT servers
    - cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE
      mode
    - NFSv4: Always set NLINK even if the server doesn't support it
    - NFSv4.2: fix listxattr to return selinux security label
    - NFSv4.2: fix setattr caching of TIME_[MODIFY|ACCESS]_SET when timestamps
      are delegated
    - mailbox: Not protect module_put with spin_lock_irqsave
    - mfd: max14577: Fix wakeup source leaks on device unbind
    - sunrpc: don't immediately retransmit on seqno miss
    - dm vdo indexer: don't read request structure after enqueuing
    - leds: multicolor: Fix intensity setting while SW blinking
    - fuse: fix race between concurrent setattrs from multiple nodes
    - cxl/region: Add a dev_err() on missing target list entries
    - NFSv4: xattr handlers should check for absent nfs filehandles
    - hwmon: (pmbus/max34440) Fix support for max34451
    - ksmbd: allow a filename to contain special characters on SMB3.1.1 posix
      extension
    - ksmbd: provide zero as a unique ID to the Mac client
    - rust: module: place cleanup_module() in .exit.text section
    - rust: arm: fix unknown (to Clang) argument '-mno-fdpic'
    - dmaengine: idxd: Check availability of workqueue allocated by idxd wq
      driver before using
    - dmaengine: xilinx_dma: Set dma_device directions
    - PCI: dwc: Make link training more robust by setting
      PORT_LOGIC_LINK_WIDTH to one lane
    - PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
    - PCI: imx6: Add workaround for errata ERR051624
    - nvme-tcp: fix I/O stalls on congested sockets
    - nvme-tcp: sanitize request list handling
    - md/md-bitmap: fix dm-raid max_write_behind setting
    - amd/amdkfd: fix a kfd_process ref leak
    - bcache: fix NULL pointer in cache_set_flush()
    - drm/amdgpu: seq64 memory unmap uses uninterruptible lock
    - drm/scheduler: signal scheduled fence when kill job
    - iio: pressure: zpa2326: Use aligned_s64 for the timestamp
    - um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
    - um: use proper care when taking mmap lock during segfault
    - 8250: microchip: pci1xxxx: Add PCIe Hot reset disable support for Rev C0
      and later devices
    - coresight: Only check bottom two claim bits
    - usb: dwc2: also exit clock_gating when stopping udc while suspended
    - iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
    - misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
    - usb: potential integer overflow in usbg_make_tpg()
    - tty: serial: uartlite: register uart driver in init
    - usb: common: usb-conn-gpio: use a unique name for usb connector device
    - usb: Add checks for snprintf() calls in usb_alloc_dev()
    - usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
    - usb: gadget: f_hid: wake up readers on disable/unbind
    - usb: typec: displayport: Receive DP Status Update NAK request exit dp
      altmode
    - usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
    - riscv: add a data fence for CMODX in the kernel mode
    - ALSA: hda: Ignore unsol events for cards being shut down
    - ALSA: hda: Add new pci id for AMD GPU display HD audio controller
    - ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
    - ASoC: rt1320: fix speaker noise when volume bar is 100%
    - ceph: fix possible integer overflow in ceph_zero_objects()
    - scsi: ufs: core: Don't perform UFS clkscaling during host async scan
    - ovl: Check for NULL d_inode() in ovl_dentry_upper()
    - btrfs: handle csum tree error with rescue=ibadroots correctly
    - drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
    - Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
    - btrfs: factor out nocow ordered extent and extent map generation into a
      helper
    - btrfs: use unsigned types for constants defined as bit shifts
    - btrfs: fix qgroup reservation leak on failure to allocate ordered extent
    - fs/jfs: consolidate sanity checking in dbMount
    - jfs: validate AG parameters in dbMount() to prevent crashes
    - ASoC: codec: wcd9335: Convert to GPIO descriptors
    - ASoC: codecs: wcd9335: Fix missing free of regulator supplies
    - f2fs: don't over-report free space or inodes in statvfs
    - PCI: apple: Use helper function for_each_child_of_node_scoped()
    - PCI: apple: Set only available ports up
    - accel/ivpu: Add debugfs interface for setting HWS priority bands
    - accel/ivpu: Trigger device recovery on engine reset/resume failure
    - af_unix: Don't leave consecutive consumed OOB skbs.
    - i2c: tiny-usb: disable zero-length read messages
    - i2c: robotfuzz-osif: disable zero-length read messages
    - smb: client: remove \t from TP_printk statements
    - mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path
      on write
    - ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
    - s390/pkey: Prevent overflow in size calculation for memdup_user()
    - fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio
    - lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
    - Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"
    - drm/xe/display: Add check for alloc_ordered_workqueue()
    - HID: wacom: fix crash in wacom_aes_battery_handler()
    - atm: clip: prevent NULL deref in clip_push()
    - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
    - ALSA: usb-audio: Fix out-of-bounds read in
      snd_usb_get_audioformat_uac3()
    - attach_recursive_mnt(): do not lock the covering tree when sliding
      something under it
    - libbpf: Fix null pointer dereference in btf_dump__free on allocation
      failure
    - ethernet: ionic: Fix DMA mapping tests
    - wifi: mac80211: fix beacon interval calculation overflow
    - af_unix: Don't set -ECONNRESET for consumed OOB skb.
    - wifi: mac80211: Add link iteration macro for link data
    - wifi: mac80211: Create separate links for VLAN interfaces
    - wifi: mac80211: finish link init before RCU publish
    - vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
    - bnxt: properly flush XDP redirect lists
    - um: ubd: Add missing error check in start_io_thread()
    - libbpf: Fix possible use-after-free for externs
    - net: enetc: Correct endianness handling in _enetc_rd_reg64
    - netlink: specs: tc: replace underscores with dashes in names
    - atm: Release atm_dev_mutex after removing procfs in
      atm_dev_deregister().
    - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
    - net: selftests: fix TCP packet checksum
    - drm/amdgpu/discovery: optionally use fw based ip discovery
    - drm/amd: Adjust output for discovery error handling
    - drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
    - drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
    - drm/xe: Process deferred GGTT node removals on device unwind
    - smb: client: fix potential deadlock when reconnecting channels
    - smb: smbdirect: add smbdirect_pdu.h with protocol definitions
    - smb: client: make use of common smbdirect_pdu.h
    - smb: smbdirect: add smbdirect.h with public structures
    - smb: smbdirect: add smbdirect_socket.h
    - smb: client: make use of common smbdirect_socket
    - smb: smbdirect: introduce smbdirect_socket_parameters
    - smb: client: make use of common smbdirect_socket_parameters
    - cifs: Fix the smbd_response slab to allow usercopy
    - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
    - EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
    - x86/traps: Initialize DR6 by writing its architectural reset value
    - staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
    - dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
    - serial: core: restore of_node information in sysfs
    - serial: imx: Restore original RXTL for console to fix data loss
    - Bluetooth: L2CAP: Fix L2CAP MTU negotiation
    - dm-raid: fix variable in journal device check
    - btrfs: fix a race between renames and directory logging
    - btrfs: update superblock's device bytes_used when dropping chunk
    - spi: spi-cadence-quadspi: Fix pm runtime unbalance
    - net: libwx: fix the creation of page_pool
    - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
    - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
    - f2fs: fix to zero post-eof page
    - HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
    - HID: wacom: fix memory leak on kobject creation failure
    - HID: wacom: fix memory leak on sysfs attribute creation failure
    - HID: wacom: fix kobject reference count leak
    - scsi: megaraid_sas: Fix invalid node index
    - scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
    - drm/ast: Fix comment on modeset lock
    - drm/etnaviv: Protect the scheduler's pending list with its lock
    - drm/tegra: Assign plane type before registration
    - drm/tegra: Fix a possible null pointer dereference
    - drm/udl: Unregister device before cleaning up on disconnect
    - drm/msm/gpu: Fix crash when throttling GPU immediately during boot
    - drm/amdkfd: Fix race in GWS queue scheduling
    - drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
    - drm/bridge: cdns-dsi: Fix phy de-init and flag it so
    - drm/bridge: cdns-dsi: Fix connecting to next bridge
    - drm/bridge: cdns-dsi: Check return value when getting default PHY config
    - drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
    - drm/amd/display: Add null pointer check for get_first_active_display()
    - drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
    - drm/amd/display: Correct non-OLED pre_T11_delay.
    - drm/xe/vm: move rebind_work init earlier
    - drm/xe/guc_submit: add back fix
    - drm/amd/display: Fix RMCM programming seq errors
    - drm/amdgpu: Add kicker device detection
    - drm/amd/display: Check dce_hwseq before dereferencing it
    - drm/xe: Fix memset on iomem
    - drm/xe: Fix taking invalid lock on wedge
    - drm/xe: Fix early wedge on GuC load failure
    - drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL
    - drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences
    - drm/amdgpu: switch job hw_fence to amdgpu_fence
    - drm/amd/display: Fix mpv playback corruption on weston
    - media: uvcvideo: Rollback non processed entities on error
    - x86/fpu: Refactor xfeature bitmask update code for sigframe XSAVE
    - x86/pkeys: Simplify PKRU update in signal frame
    - io_uring: fix potential page leak in io_sqe_buffer_register()
    - io_uring/rsrc: fix folio unpinning
    - io_uring/net: mark iov as dynamically allocated even for single segments
    - mm/vma: reset VMA iterator on commit_merge() OOM failure
    - ALSA: hda/realtek: Bass speaker fixup for ASUS UM5606KA
    - mfd: max77541: Fix wakeup source leaks on device unbind
    - mfd: 88pm886: Fix wakeup source leaks on device unbind
    - mfd: sprd-sc27xx: Fix wakeup source leaks on device unbind
    - hwmon: (isl28022) Fix current reading calculation
    - cxl: core/region - ignore interleave granularity when ways=1
    - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support
    - iio: dac: adi-axi-dac: add cntrl chan check
    - iio: adc: ad7606_spi: check error in ad7606B_sw_mode_config()
    - iio: hid-sensor-prox: Add support for 16-bit report size
    - usb: typec: tcpci: Fix wakeup source leaks on device unbind
    - usb: typec: tipd: Fix wakeup source leaks on device unbind
    - s390/mm: Fix in_atomic() handling in do_secure_storage_access()
    - riscv: misaligned: declare misaligned_access_speed under
      CONFIG_RISCV_MISALIGNED
    - riscv: save the SR_SUM status over switches
    - media: uvcvideo: Keep streaming state in the file handle
    - media: uvcvideo: Create uvc_pm_(get|put) functions
    - media: uvcvideo: Increase/decrease the PM counter per IOCTL
    - drm/i915/display: Add check for alloc_ordered_workqueue() and
      alloc_workqueue()
    - i2c: imx: fix emulated smbus block read
    - LoongArch: KVM: Avoid overflow with array index
    - LoongArch: KVM: Check validity of "num_cpu" from user space
    - LoongArch: KVM: Disable updating of "num_cpu" and "feature"
    - LoongArch: KVM: Add address alignment check for IOCSR emulation
    - LoongArch: KVM: Fix interrupt route update with EIOINTC
    - LoongArch: KVM: Check interrupt route from physical CPU
    - scripts/gdb: fix dentry_name() lookup
    - smb: client: fix regression with native SMB symlinks
    - riscv: vector: Fix context save/restore with xtheadvector
    - riscv: export boot_cpu_hartid
    - io_uring/rsrc: don't rely on user vaddr alignment
    - drm/amd/display: Add sanity checks for drm_edid_raw()
    - drm/xe: Move DSB l2 flush to a more sensible place
    - drm/xe: move DPT l2 flush to a more sensible place
    - HID: Intel-thc-hid: Intel-quicki2c: Enhance QuickI2C reset flow
    - scsi: fnic: Fix missing DMA mapping error in fnic_send_frame()
    - nvme: refactor the atomic write unit detection
    - nvme: fix atomic write size validation
    - drm/xe/guc: Explicitly exit CT safe mode on unwind
    - bcache: remove unnecessary select MIN_HEAP
    - Revert "bcache: update min_heap_callbacks to use default builtin swap"
    - Revert "bcache: remove heap-related macros and switch to generic
      min_heap"
    - selinux: change security_compute_sid to return the ssid or tsid on match
    - mm: userfaultfd: fix race of userfaultfd_move and swap cache
    - mm/shmem, swap: fix softlockup with mTHP swapin
    - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out
    - scsi: fnic: Turn off FDMI ACTIVE flags on link down
    - drm/cirrus-qemu: Fix pitch programming
    - drm/panel: simple: Tianma TM070JDHG34-00: add delays
    - drm/simpledrm: Do not upcast in release helpers
    - drm/i915/ptl: Use everywhere the correct DDI port clock select mask
    - drm/i915/dp_mst: Work around Thunderbolt sink disconnect after
      SINK_COUNT_ESI read
    - drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause
    - drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13
    - drm/amd/display: Add more checks for DSC / HUBP ONO guarantees
    - drm/amd/display: Add dc cap for dp tunneling
    - Revert "UBUNTU: SAUCE: arm64: dts: qcom: x1e80100-crd: mark l12b and
      l15b always-on"
    - arm64: dts: qcom: x1e80100-crd: mark l12b and l15b always-on
    - Revert "UBUNTU: SAUCE: arm64: dts: qcom: x1e78100-t14s: mark l12b and
      l15b always-on"
    - arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
    - arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
    - crypto: powerpc/poly1305 - add depends on BROKEN for now
    - [Config] Disable CRYPTO_POLY1305_P10
    - drm/amdgpu/mes: add missing locking in helper functions
    - Revert "UBUNTU: SAUCE: arm64: dts: qcom: x1e78100-t14s: fix missing HID
      supplies"
    - arm64: dts: qcom: x1e78100-t14s: fix missing HID supplies
    - drm/amd/display: Add early 8b/10b channel equalization test pattern
      sequence
    - drm/amd/display: Get LTTPR IEEE OUI/Device ID From Closest LTTPR To Host
    - rust: completion: implement initial abstraction
    - rust: revocable: indicate whether `data` has been revoked already
    - rust: devres: fix race in Devres::drop()
    - rust: devres: do not dereference to the internal Revocable
    - io_uring/kbuf: flag partial buffer mappings
    - riscv: uaccess: Only restore the CSR_STATUS SUM bit
    - drm/amd/display: Add debugging message for brightness caps
    - drm/amd/display: Fix default DC and AC levels
    - drm/amd/display: Only read ACPI backlight caps once
    - usb: typec: displayport: Fix potential deadlock
    - NFSv4.2: another fix for listxattr
    - drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
    - nvme: revert the cross-controller atomic write size validation
    - scripts: gdb: vfs: support external dentry names
    - Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
    - Upstream stable to v6.12.36, v6.15.5
  * Plucky update: upstream stable patchset 2025-08-18 (LP: #2120812)
    - configfs: Do not override creating attribute file failure in
      populate_attrs()
    - crypto: marvell/cesa - Do not chain submitted requests
    - gfs2: move msleep to sleepable context
    - crypto: qat - add shutdown handler to qat_c3xxx
    - crypto: qat - add shutdown handler to qat_420xx
    - crypto: qat - add shutdown handler to qat_4xxx
    - crypto: qat - add shutdown handler to qat_c62x
    - crypto: qat - add shutdown handler to qat_dh895xcc
    - ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
    - ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
    - ASoC: amd: sof_amd_sdw: Fix unlikely uninitialized variable use in
      create_sdw_dailinks()
    - io_uring: account drain memory to cgroup
    - io_uring/kbuf: account ring io_buffer_list memory
    - powerpc/pseries/msi: Avoid reading PCI device registers in reduced power
      states
    - regulator: max20086: Fix MAX200086 chip id
    - regulator: max20086: Change enable gpio to optional
    - net/mlx5_core: Add error handling
      inmlx5_query_nic_vport_qkey_viol_cntr()
    - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
    - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
    - wifi: mt76: mt7925: fix host interrupt register initialization
    - wifi: ath11k: fix rx completion meta data corruption
    - wifi: rtw88: usb: Upload the firmware in bigger chunks
    - Revert "UBUNTU: SAUCE: wifi: ath11k: fix ring-buffer corruption"
    - wifi: ath11k: fix ring-buffer corruption
    - NFSD: unregister filesystem in case genl_register_family() fails
    - NFSD: fix race between nfsd registration and exports_proc
    - NFSD: Implement FATTR4_CLONE_BLKSIZE attribute
    - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
    - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
    - SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
    - NFSv4: Don't check for OPEN feature support in v4.1
    - fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
    - Revert "UBUNTU: SAUCE: wifi: ath12k: fix ring-buffer corruption"
    - wifi: ath12k: fix ring-buffer corruption
    - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
    - svcrdma: Unregister the device if svc_rdma_accept() fails
    - wifi: rtw88: usb: Reduce control message timeout to 500 ms
    - wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
    - media: ov8856: suppress probe deferral errors
    - media: ov5675: suppress probe deferral errors
    - media: imx335: Use correct register width for HNUM
    - media: nxp: imx8-isi: better handle the m2m usage_count
    - media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
    - media: ccs-pll: Start VT pre-PLL multiplier search from correct value
    - media: ov2740: Move pm-runtime cleanup on probe-errors to proper place
    - media: ccs-pll: Start OP pre-PLL multiplier search from correct value
    - media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
    - media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
    - media: cxusb: no longer judge rbuf when the write fails
    - media: davinci: vpif: Fix memory leak in probe error path
    - media: gspca: Add error handling for stv06xx_read_sensor()
    - media: i2c: imx335: Fix frame size enumeration
    - media: imagination: fix a potential memory leak in e5010_probe()
    - media: intel/ipu6: Fix dma mask for non-secure mode
    - media: ipu6: Remove workaround for Meteor Lake ES2
    - media: mediatek: vcodec: Correct vsi_core framebuffer size
    - media: omap3isp: use sgtable-based scatterlist wrappers
    - media: v4l2-dev: fix error handling in __video_register_device()
    - media: venus: Fix probe error handling
    - media: videobuf2: use sgtable-based scatterlist wrappers
    - media: vidtv: Terminating the subsequent process of initialization
      failure
    - media: vivid: Change the siize of the composing
    - media: imx-jpeg: Drop the first error frames
    - media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
    - media: imx-jpeg: Reset slot data pointers when freed
    - media: imx-jpeg: Cleanup after an allocation error
    - media: uvcvideo: Return the number of processed controls
    - media: uvcvideo: Send control events for partial succeeds
    - media: uvcvideo: Fix deferred probing error
    - arm64/mm: Close theoretical race where stale TLB entry remains valid
    - ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
    - ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
    - ASoC: codecs: wcd9375: Fix double free of regulator supplies
    - ASoC: codecs: wcd937x: Drop unused buck_supply
    - block: use plug request list tail for one-shot backmerge attempt
    - block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion
    - bus: mhi: ep: Update read pointer only after buffer is written
    - bus: mhi: host: Fix conflict between power_up and SYSERR
    - can: kvaser_pciefd: refine error prone echo_skb_max handling logic
    - can: tcan4x5x: fix power regulator retrieval during probe
    - ceph: avoid kernel BUG for encrypted inode with unaligned file size
    - ceph: set superblock s_magic for IMA fsmagic matching
    - cgroup,freezer: fix incomplete freezing when attaching tasks
    - bus: firewall: Fix missing static inline annotations for stubs
    - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
    - ata: ahci: Disallow LPM for ASUSPRO-D840SA motherboard
    - ata: ahci: Disallow LPM for Asus B550-F motherboard
    - bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
    - bus: fsl-mc: fix GET/SET_TAILDROP command ids
    - ext4: inline: fix len overflow in ext4_prepare_inline_data
    - ext4: fix calculation of credits for extent tree modification
    - ext4: factor out ext4_get_maxbytes()
    - ext4: ensure i_size is smaller than maxbytes
    - ext4: only dirty folios when data journaling regular files
    - Input: ims-pcu - check record size in ims_pcu_flash_firmware()
    - Input: gpio-keys - fix possible concurrent access in
      gpio_keys_irq_timer()
    - f2fs: fix to do sanity check on ino and xnid
    - f2fs: prevent kernel warning due to negative i_nlink from corrupted
      image
    - f2fs: fix to do sanity check on sit_bitmap_size
    - hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
    - NFC: nci: uart: Set tty->disc_data only in success path
    - net/sched: fix use-after-free in taprio_dev_notifier
    - net: ftgmac100: select FIXED_PHY
    - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in
      fb_videomode_to_var
    - EDAC/altera: Use correct write width with the INTTEST register
    - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
    - parisc/unaligned: Fix hex output to show 8 hex chars
    - vgacon: Add check for vc_origin address range in vgacon_scroll()
    - parisc: fix building with gcc-15
    - clk: meson-g12a: add missing fclk_div2 to spicc
    - ipc: fix to protect IPCS lookups using RCU
    - watchdog: fix watchdog may detect false positive of softlockup
    - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
    - mm: fix ratelimit_pages update error in dirty_ratio_handler()
    - soc: qcom: pmic_glink_altmode: fix spurious DP hotplug events
    - configfs-tsm-report: Fix NULL dereference of tsm_ops
    - firmware: arm_scmi: Ensure that the message-id supports fastchannel
    - mtd: rawnand: sunxi: Add randomizer configuration in
      sunxi_nfc_hw_ecc_write_chunk
    - mtd: nand: sunxi: Add randomizer configuration before randomizer enable
    - KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
    - KVM: VMX: Flush shadow VMCS on emergency reboot
    - dm-mirror: fix a tiny race condition
    - dm-verity: fix a memory leak if some arguments are specified multiple
      times
    - mtd: rawnand: qcom: Fix read len for onfi param page
    - ftrace: Fix UAF when lookup kallsym after ftrace disabled
    - dm: lock limits when reading them
    - phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
    - net: ch9200: fix uninitialised access during mii_nway_restart
    - KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
    - sysfb: Fix screen_info type check for VGA
    - video: screen_info: Relocate framebuffers behind PCI bridges
    - pwm: axi-pwmgen: fix missing separate external clock
    - staging: iio: ad5933: Correct settling cycles encoding per datasheet
    - mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
    - ovl: Fix nested backing file paths
    - regulator: max14577: Add error check for max14577_read_reg()
    - remoteproc: core: Cleanup acquired resources when
      rproc_handle_resources() fails in rproc_attach()
    - remoteproc: core: Release rproc->clean_table after rproc_attach() fails
    - remoteproc: k3-m4: Don't assert reset in detach routine
    - cifs: reset connections for all channels when reconnect requested
    - cifs: update dstaddr whenever channel iface is updated
    - cifs: dns resolution is needed only for primary channel
    - smb: client: add NULL check in automount_fullpath
    - Drivers: hv: Allocate interrupt and monitor pages aligned to system page
      boundary
    - uio_hv_generic: Use correct size for interrupt and monitor pages
    - uio_hv_generic: Align ring size to system page
    - PCI: cadence-ep: Correct PBA offset in .set_msix() callback
    - PCI: dwc: ep: Correct PBA offset in .set_msix() callback
    - PCI: Add ACS quirk for Loongson PCIe
    - PCI: Fix lock symmetry in pci_slot_unlock()
    - PCI: dw-rockchip: Remove PCIE_L0S_ENTRY check from
      rockchip_pcie_link_up()
    - PCI: dw-rockchip: Fix PHY function call sequence in
      rockchip_pcie_phy_deinit()
    - iio: accel: fxls8962af: Fix temperature scan element sign
    - accel/ivpu: Improve buffer object logging
    - accel/ivpu: Use firmware names from upstream repo
    - accel/ivpu: Use dma_resv_lock() instead of a custom mutex
    - accel/ivpu: Fix warning in ivpu_gem_bo_free()
    - dummycon: Trigger redraw when switching consoles with deferred takeover
    - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
    - iio: imu: inv_icm42600: Fix temperature calculation
    - iio: adc: ad7944: mask high bits on direct read
    - iio: adc: ti-ads1298: Kconfig: add kfifo dependency to fix module build
    - iio: adc: ad7606_spi: fix reg write value mask
    - ACPICA: fix acpi operand cache leak in dswstate.c
    - ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
    - clocksource: Fix the CPUs' choice in the watchdog per CPU verification
    - power: supply: collie: Fix wakeup source leaks on device unbind
    - mmc: Add quirk to disable DDR50 tuning
    - ACPICA: Avoid sequence overread in call to strncmp()
    - ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
    - ASoC: intel/sdw_utils: Assign initial value in
      asoc_sdw_rt_amp_spk_rtd_init()
    - ACPI: bus: Bail out if acpi_kobj registration fails
    - ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
    - ACPICA: fix acpi parse and parseext cache leaks
    - ACPICA: Apply pack(1) to union aml_resource
    - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Acer Helios
      laptops
    - power: supply: bq27xxx: Retrieve again when busy
    - pmdomain: core: Reset genpd->states to avoid freeing invalid data
    - ACPICA: utilities: Fix overflow check in vsnprintf()
    - platform-msi: Add msi_remove_device_irq_domain() in
      platform_device_msi_free_irqs_all()
    - ASoC: tegra210_ahub: Add check to of_device_get_match_data()
    - Make 'cc-option' work correctly for the -Wno-xyzzy pattern
    - gpiolib: of: Add polarity quirk for s5m8767
    - PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
    - power: supply: max17040: adjust thermal channel scaling
    - net: macb: Check return value of dma_set_mask_and_coherent()
    - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
    - tipc: use kfree_sensitive() for aead cleanup
    - f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
    - bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
    - Bluetooth: btusb: Add new VID/PID 13d3/3584 for MT7922
    - i2c: designware: Invoke runtime suspend on quick slave re-registration
    - wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
    - emulex/benet: correct command version selection in be_cmd_get_stats()
    - Bluetooth: btusb: Add new VID/PID 13d3/3630 for MT7925
    - wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
    - wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
    - wifi: mt76: mt7925: introduce thermal protection
    - wifi: mac80211: validate SCAN_FLAG_AP in scan request during MLO
    - sctp: Do not wake readers in __sctp_write_space()
    - libbpf/btf: Fix string handling to support multi-split BTF
    - cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
    - i2c: tegra: check msg length in SMBUS block read
    - i2c: npcm: Add clock toggle recovery
    - clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
    - net: dlink: add synchronization for stats update
    - wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
    - wifi: ath12k: fix a possible dead lock caused by ab->base_lock
    - wifi: ath11k: Fix QMI memory reuse logic
    - wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
    - tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
    - tcp: remove zero TCP TS samples for autotuning
    - tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
    - tcp: add receive queue awareness in tcp_rcv_space_adjust()
    - x86/sgx: Prevent attempts to reclaim poisoned pages
    - ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
    - net: page_pool: Don't recycle into cache on PREEMPT_RT
    - xfrm: validate assignment of maximal possible SEQ number
    - net: atlantic: generate software timestamp just before the doorbell
    - pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
    - pinctrl: armada-37xx: propagate error from
      armada_37xx_gpio_get_direction()
    - bpf: Pass the same orig_call value to trampoline functions
    - net: stmmac: generate software timestamp just before the doorbell
    - pinctrl: armada-37xx: propagate error from
      armada_37xx_pmx_gpio_set_direction()
    - libbpf: Check bpf_map_skeleton link for NULL
    - pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
    - net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
    - net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
    - wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
    - wifi: mac80211: do not offer a mesh path if forwarding is disabled
    - clk: rockchip: rk3036: mark ddrphy as critical
    - hid-asus: check ROG Ally MCU version and warn
    - wifi: iwlwifi: mvm: fix beacon CCK flag
    - f2fs: fix to bail out in get_new_segment()
    - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
    - libbpf: Add identical pointer detection to btf_dedup_is_equiv()
    - scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64
      commands
    - scsi: smartpqi: Add new PCI IDs
    - iommu/amd: Ensure GA log notifier callbacks finish running before module
      unload
    - wifi: iwlwifi: pcie: make sure to lock rxq->read
    - wifi: rtw89: 8922a: fix TX fail with wrong VCO setting
    - wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
    - netdevsim: Mark NAPI ID on skb in nsim_rcv
    - bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
    - wifi: mac80211: VLAN traffic in multicast path
    - Revert "mac80211: Dynamically set CoDel parameters per station"
    - wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
    - net: bridge: mcast: update multicast contex when vlan state is changed
    - net: bridge: mcast: re-implement br_multicast_{enable, disable}_port
      functions
    - vxlan: Do not treat dst cache initialization errors as fatal
    - bnxt_en: Remove unused field "ref_count" in struct bnxt_ulp
    - wifi: ath12k: using msdu end descriptor to check for rx multicast
      packets
    - net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
    - software node: Correct a OOB check in software_node_get_reference_args()
    - isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry
    - pinctrl: mcp23s08: Reset all pins to input at probe
    - wifi: ath12k: fix failed to set mhi state error during reboot with
      hardware grouping
    - scsi: lpfc: Use memcpy() for BIOS version
    - sock: Correct error checking condition for (assign|release)_proto_idx()
    - i40e: fix MMIO write access to an invalid page in i40e_clear_hw
    - ixgbe: Fix unreachable retry logic in combined and byte I2C write
      functions
    - RDMA/hns: initialize db in update_srq_db()
    - ice: fix check for existing switch rule
    - usbnet: asix AX88772: leave the carrier control to phylink
    - f2fs: fix to set atomic write status more clear
    - bpf, sockmap: Fix data lost during EAGAIN retries
    - net: ethernet: cortina: Use TOE/TSO on all TCP
    - octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
    - wifi: ath11k: determine PM policy based on machine model
    - wifi: ath12k: fix link valid field initialization in the monitor Rx
    - wifi: ath12k: fix incorrect CE addresses
    - wifi: ath12k: Pass correct values of center freq1 and center freq2 for
      160 MHz
    - fbcon: Make sure modelist not set on unregistered console
    - watchdog: da9052_wdt: respect TWDMIN
    - bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
    - ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
    - tee: Prevent size calculation wraparound on 32-bit kernels
    - Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices
      first"
    - fs/xattr.c: fix simple_xattr_list()
    - platform/x86/amd: pmc: Clear metrics table at start of cycle
    - platform/x86/amd: pmf: Prevent amd_pmf_tee_deinit() from running twice
    - platform/x86: dell_rbu: Fix list usage
    - platform/x86: dell_rbu: Stop overwriting data buffer
    - powerpc/vdso: Fix build of VDSO32 with pcrel
    - powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH
      recovery
    - io_uring/kbuf: don't truncate end buffer for multiple buffer peeks
    - io_uring: fix task leak issue in io_wq_create()
    - drivers/rapidio/rio_cm.c: prevent possible heap overwrite
    - platform/loongarch: laptop: Get brightness setting from EC on probe
    - platform/loongarch: laptop: Unregister generic_sub_drivers on exit
    - platform/loongarch: laptop: Add backlight power control support
    - LoongArch: vDSO: Correctly use asm parameters in syscall wrappers
    - LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
    - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
    - jffs2: check that raw node were preallocated before writing summary
    - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
    - cifs: deal with the channel loading lag while picking channels
    - cifs: serialize other channels when query server interfaces is pending
    - cifs: do not disable interface polling on failure
    - smb: improve directory cache reuse for readdir operations
    - scsi: storvsc: Increase the timeouts to storvsc_timeout
    - scsi: s390: zfcp: Ensure synchronous unit_add
    - nvme: always punt polled uring_cmd end_io work to task_work
    - net_sched: sch_sfq: reject invalid perturb period
    - net: clear the dst when changing skb protocol
    - mm: close theoretical race where stale TLB entries could linger
    - udmabuf: use sgtable-based scatterlist wrappers
    - x86/virt/tdx: Avoid indirect calls to TDX assembly functions
    - selftests/x86: Add a test to detect infinite SIGTRAP handler loop
    - ksmbd: fix null pointer dereference in destroy_previous_session
    - platform/x86: ideapad-laptop: use usleep_range() for EC polling
    - selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
    - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
    - sched_ext, sched/core: Don't call scx_group_set_weight() prematurely
      from sched_create_group()
    - atm: Revert atm_account_tx() if copy_from_iter_full() fails.
    - Input: sparcspkr - avoid unannotated fall-through
    - arm64: Restrict pagetable teardown to avoid false warning
    - ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound
      card
    - ALSA: hda/intel: Add Thinkpad E15 to PM deny list
    - ALSA: hda/realtek - Add mute LED support for HP Victus 16-s1xxx and HP
      Victus 15-fa1xxx
    - ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
    - ALSA: hda/realtek: Add quirk for Asus GU605C
    - mm/hugetlb: unshare page tables during VMA split, not before
    - kbuild: rust: add rustc-min-version support function
    - erofs: remove unused trace event erofs_destroy_inode
    - nfsd: use threads array as-is in netlink interface
    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
    - drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`
    - Kunit to check the longest symbol length
    - x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
    - ipv6: replace ipcm6_init calls with ipcm6_init_sk
    - smb: fix secondary channel creation issue with kerberos by populating
      hostname when adding channels
    - drm/msm/disp: Correct porch timing for SDM845
    - drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
    - drm/msm: Fix CP_RESET_CONTEXT_STATE bitfield names
    - drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE
    - drm/ssd130x: fix ssd132x_clear_screen() columns
    - ionic: Prevent driver/fw getting out of sync on devcmd(s)
    - drm/nouveau/bl: increase buffer size to avoid truncate warning
    - drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
    - hwmon: (occ) Rework attribute registration for stack usage
    - hwmon: (occ) fix unaligned accesses
    - hwmon: (ltc4282) avoid repeated register write
    - pldmfw: Select CRC32 when PLDMFW is selected
    - aoe: clean device rq_list in aoedev_downdev()
    - io_uring/sqpoll: don't put task_struct on tctx setup failure
    - net: ice: Perform accurate aRFS flow match
    - ice: fix eswitch code memory leak in reset scenario
    - workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()
    - ksmbd: add free_transport ops in ksmbd connection
    - net: netmem: fix skb_ensure_writable with unreadable skbs
    - bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
    - bnxt_en: Add a helper function to configure MRU and RSS
    - bnxt_en: Update MRU and RSS table of RSS contexts on queue reset
    - ptp: fix breakage after ptp_vclock_in_use() rework
    - ptp: allow reading of currently dialed frequency to succeed on free-
      running clocks
    - wifi: carl9170: do not ping device which has failed to load firmware
    - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
    - atm: atmtcp: Free invalid length skb in atmtcp_c_send().
    - tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen()
      behavior
    - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
    - tcp: fix passive TFO socket having invalid NAPI ID
    - eth: fbnic: avoid double free when failing to DMA-map FW msg
    - net: lan743x: fix potential out-of-bounds write in
      lan743x_ptp_io_event_clock_get()
    - ublk: santizize the arguments from userspace when adding a device
    - drm/xe/bmg: Update Wa_16023588340
    - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
    - mlxbf_gige: return EPROBE_DEFER if PHY IRQ is not available
    - net: atm: add lec_mutex
    - net: atm: fix /proc/net/atm/lec handling
    - EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
    - dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
    - smb: Log an error when close_all_cached_dirs fails
    - smb: client: fix first command failure during re-negotiation
    - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
    - perf: Fix sample vs do_exit()
    - perf: Fix cgroup state vs ERROR
    - perf/core: Fix WARN in perf_cgroup_switch()
    - arm64/ptrace: Fix stack-out-of-bounds read in
      regs_get_kernel_stack_nth()
    - scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
    - RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
    - RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
    - gpio: pca953x: fix wrong error probe return value
    - perf evsel: Missed close() when probing hybrid core PMUs
    - perf test: Directory file descriptor leak
    - gpio: mlxbf3: only get IRQ for device instance 0
    - cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr()
      function
    - bpftool: Fix cgroup command to only show cgroup bpf programs
    - alloc_tag: handle module codetag load errors as module load failures
    - sched/rt: Fix race in push_rt_task
    - sched/fair: Adhere to place_entity() constraints
    - firmware: cs_dsp: Fix OOB memory read access in KUnit test
    - ASoC: amd: amd_sdw: Fix unlikely uninitialized variable use in
      create_sdw_dailinks()
    - powerpc64/ftrace: fix clobbered r15 during livepatching
    - powerpc/bpf: fix JIT code size calculation of bpf trampoline
    - s390/pci: Fix __pcilg_mio_inuser() inline assembly
    - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
    - fs: add S_ANON_INODE
    - nfsd: fix access checking for NLM under XPRTSEC policies
    - NFS: always probe for LOCALIO support asynchronously
    - media: ov08x40: Extend sleep after reset to 5 ms
    - media: rcar-vin: Fix RAW10
    - firmware: ti_sci: Convert CPU latency constraint from us to ms
    - iommu: Allow attaching static domains in iommu_attach_device_pasid()
    - mtd: rawnand: qcom: Fix last codeword read in
      qcom_param_page_type_exec()
    - dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits
    - iio: accel: fxls8962af: Fix temperature calculation
    - io_uring/net: only consider msg_inq if larger than 1
    - iio: adc: ad7173: fix compiling without gpiolib
    - iio: adc: ad7606: fix raw read for 18-bit chips
    - power: supply: gpio-charger: Fix wakeup source leaks on device unbind
    - EDAC/igen6: Skip absent memory controllers
    - ALSA: hda/realtek: Add support for Acer Helios Laptops using CS35L41 HDA
    - drm/amd/display: disable DPP RCG before DPP CLK enable
    - drm/bridge: select DRM_KMS_HELPER for AUX_BRIDGE
    - drm/amdgpu/gfx6: fix CSIB handling
    - media: imx-jpeg: Check decoding is ongoing for motion-jpeg
    - drm/rockchip: inno-hdmi: Fix video timing HSYNC/VSYNC polarity setting
      for rk3036
    - drm/dp: add option to disable zero sized address only transactions.
    - sunrpc: update nextcheck time when adding new cache entries
    - drm/amdgpu: Fix API status offset for MES queue reset
    - drm/amd/display: DCN32 null data check
    - drm/xe: Fix CFI violation when accessing sysfs files
    - drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling
      disable_irq()
    - workqueue: Fix race condition in wq->stats incrementation
    - drm/panel/sharp-ls043t1le01: Use _multi variants
    - exfat: fix double free in delayed_free
    - drm/bridge: anx7625: enable HPD interrupts
    - drm/panthor: Don't update MMU_INT_MASK in panthor_mmu_irq_handler()
    - drm/bridge: anx7625: change the gpiod_set_value API
    - exfat: do not clear volume dirty flag during sync
    - drm/amdkfd: Drop workaround for GC v9.4.3 revID 0
    - drm/amdgpu/gfx11: fix CSIB handling
    - media: nuvoton: npcm-video: Fix stuck due to no video signal error
    - drm/nouveau: fix hibernate on disabled GPU
    - media: i2c: imx334: Enable runtime PM before sub-device registration
    - drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1
    - drm/nouveau/gsp: fix rm shutdown wait condition
    - drm/msm/hdmi: add runtime PM calls to DDC transfer function
    - media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
    - drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
    - media: verisilicon: Enable wide 4K in AV1 decoder
    - drm/amd/display: Skip to enable dsc if it has been off
    - drm/amdgpu: Add basic validation for RAS header
    - dlm: use SHUT_RDWR for SCTP shutdown
    - drm/msm/a6xx: Increase HFI response timeout
    - drm/amd/display: Do Not Consider DSC if Valid Config Not Found
    - media: i2c: imx334: Fix runtime PM handling in remove function
    - drm/amdgpu/gfx10: fix CSIB handling
    - drm: panel-orientation-quirks: Add ZOTAC Gaming Zone
    - media: ccs-pll: Better validate VT PLL branch
    - media: uapi: v4l: Change V4L2_TYPE_IS_CAPTURE condition
    - drm/amd/display: fix zero value for APU watermark_c
    - drm/ttm/tests: fix incorrect assert in ttm_bo_unreserve_bulk()
    - drm/amdgpu/gfx7: fix CSIB handling
    - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in
      ext4_ext_remove_space()
    - jfs: fix array-index-out-of-bounds read in add_missing_indices
    - media: ti: cal: Fix wrong goto on error path
    - drm/xe/vf: Fix guc_info debugfs for VFs
    - drm/amd/display: Correct SSC enable detection for DCN351
    - drm/amd/display: Fix Vertical Interrupt definitions for dcn32, dcn401
    - media: cec: extron-da-hd-4k-plus: Fix Wformat-truncation
    - media: rkvdec: Initialize the m2m context before the controls
    - drm/amdgpu: fix MES GFX mask
    - drm/amdgpu: Disallow partition query during reset
    - sunrpc: fix race in cache cleanup causing stale nextcheck time
    - ext4: prevent stale extent cache entries caused by concurrent get
      es_cache
    - drm/amdgpu/gfx8: fix CSIB handling
    - drm/amdgpu/gfx9: fix CSIB handling
    - drm/amd/display: Fix VUpdate offset calculations for dcn401
    - jfs: Fix null-ptr-deref in jfs_ioc_trim
    - drm/amd/pm: Reset SMU v13.0.x custom settings
    - drm/amd/display: Correct prefetch calculation
    - drm/amd/display: Restructure DMI quirks
    - media: renesas: vsp1: Fix media bus code setup on RWPF source pad
    - drm/msm/dpu: don't select single flush for active CTL blocks
    - drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
    - media: tc358743: ignore video while HPD is low
    - media: platform: exynos4-is: Add hardware sync wait to
      fimc_is_hw_change_mode()
    - media: i2c: imx334: update mode_3840x2160_regs array
    - nios2: force update_mmu_cache on spurious tlb-permission--related
      pagefaults
    - media: rcar-vin: Fix stride setting for RAW8 formats
    - drm/amdgpu: Add indirect L1_TLB_CNTL reg programming for VFs
    - drm/xe/uc: Remove static from loop variable
    - media: qcom: venus: Fix uninitialized variable warning
    - drm/panel: simple: Add POWERTIP PH128800T004-ZZA01 panel entry
    - Bluetooth: btusb: Add RTL8851BE device 0x0bda:0xb850
    - Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind
    - Bluetooth: btmtksdio: Fix wakeup source leaks on device unbind
    - i2c: pasemi: Enable the unjam machine
    - i2c: pasemi: Add registers bits and switch to BIT()
    - clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750
    - net: phy: mediatek: do not require syscon compatible for pio property
    - net/mlx5: HWS, fix counting of rules in the matcher
    - wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM
    - ipmi:ssif: Fix a shutdown race
    - rtla: Define __NR_sched_setattr for LoongArch
    - wifi: iwlwifi: dvm: pair transport op-mode enter/leave
    - net/mlx5: HWS, Fix IP version decision
    - vxlan: Add RCU read-side critical sections in the Tx path
    - wifi: ath12k: correctly handle mcast packets for clients
    - wifi: ath12k: make assoc link associate first
    - wifi: rtw88: Set AMPDU factor to hardware for RTL8814A
    - wifi: ath12k: Fix incorrect rates sent to firmware
    - wifi: ath12k: Fix the enabling of REO queue lookup table feature
    - wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
    - net/mlx5: HWS, Harden IP version definer checks
    - watchdog: stm32: Fix wakeup source leaks on device unbind
    - i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler()
    - platform/x86/amd: pmf: Use device managed allocations
    - io_uring/rsrc: validate buffer count with offset for cloning
    - firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
    - firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
    - tracing: Fix regression of filter waiting a long time on RCU
      synchronization
    - x86/its: move its_pages array to struct mod_arch_specific
    - io_uring/net: always use current transfer count for buffer put
    - drm/msm/dp: Disable wide bus support for SDM845
    - Octeontx2-pf: Fix Backpresure configuration
    - tools: ynl: parse extack for sub-messages
    - tools: ynl: fix mixing ops and notifications on one socket
    - KVM: arm64: VHE: Synchronize restore of host debug registers
    - perf/x86/intel: Fix crash in icl_update_topdown_event()
    - EDAC/igen6: Fix NULL pointer dereference
    - dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lock
    - tracing: Do not free "head" on error path of
      filter_free_subsystem_filters()
    - mtd: spinand: Use more specific naming for the (single) read from cache
      ops
    - mtd: spinand: Use more specific naming for the (dual output) read from
      cache ops
    - mtd: spinand: Use more specific naming for the (dual IO) read from cache
      ops
    - mtd: spinand: Use more specific naming for the (quad output) read from
      cache ops
    - mtd: spinand: Use more specific naming for the (quad IO) read from cache
      ops
    - mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O
      variants
    - PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC
    - Revert "drm/amd/display: Fix VUpdate offset calculations for dcn401"
    - drm/i915: fix build error some more
    - bridge: mcast: Fix use-after-free during router port configuration
    - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
    - kallsyms: fix build without execinfo
    - ata: ahci: Use correct DMI identifier for ASUSPRO-D840SA LPM quirk
    - smb: client: fix warning when reconnecting channel
    - tools/hv: fcopy: Fix irregularities with size of ring buffer
    - Upstream stable to v6.12.35, v6.15.4
  * CVE-2025-39682
    - tls: fix handling of zero-length records on the rx_list
  * CVE-2025-38541
    - wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
  * CVE-2025-38477
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate
    - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
      qfq_delete_class
  * CVE-2025-38500
    - xfrm: interface: fix use-after-free after changing collect_md xfrm
      interface
  * CVE-2025-38617
    - net/packet: fix a race in packet_set_ring() and packet_notifier()
  * CVE-2025-38618
    - vsock: Do not allow binding to VMADDR_PORT_ANY
  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log

 -- Stefan Bader <email address hidden>  Tue, 23 Sep 2025 14:59:16 +0200
Published in noble-security
Published in noble-updates
linux-hwe-6.14 (6.14.0-33.33~24.04.1) noble; urgency=medium

  * noble/linux-hwe-6.14: 6.14.0-33.33~24.04.1 -proposed tracker (LP: #2124040)

  [ Ubuntu: 6.14.0-33.33 ]

  * plucky/linux: 6.14.0-33.33 -proposed tracker (LP: #2124042)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync git-ubuntu-log
  * CVE-2025-38477
    - net/sched: sch_qfq: Fix race condition on qfq_aggregate
    - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
      qfq_delete_class
  * CVE-2025-38500
    - xfrm: interface: fix use-after-free after changing collect_md xfrm
      interface
  * CVE-2025-38617
    - net/packet: fix a race in packet_set_ring() and packet_notifier()
  * CVE-2025-38618
    - vsock: Do not allow binding to VMADDR_PORT_ANY

 -- Stefan Bader <email address hidden>  Fri, 19 Sep 2025 16:21:21 +0200
Superseded in noble-security
Superseded in noble-updates
Superseded in noble-proposed
linux-hwe-6.14 (6.14.0-32.32~24.04.1) noble; urgency=medium

  * noble/linux-hwe-6.14: 6.14.0-32.32~24.04.1 -proposed tracker (LP: #2120124)

  * Packaging resync (LP: #1786013)
    - [Packaging] debian.hwe-6.14/dkms-versions -- update from kernel-versions
      (main/2025.08.11)

  [ Ubuntu: 6.14.0-32.32 ]

  * plucky/linux: 6.14.0-32.32 -proposed tracker (LP: #2121653)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2025.08.11)
  * Pytorch reports incorrect GPU memory causing "HIP Out of Memory" errors
    (LP: #2120454)
    - drm/amdkfd: add a new flag to manage where VRAM allocations go
    - drm/amdkfd: use GTT for VRAM on APUs only if GTT is larger
  * nvme no longer detected on boot after upgrade to 6.8.0-60 (LP: #2111521)
    - SAUCE: PCI: Disable RRS polling for Intel SSDPE2KX020T8 nvme
  * kernel panic when reloading apparmor 5.0.0 profiles (LP: #2120233)
    - SAUCE: apparmor5.0.0 [59/53]: apparmor: prevent profile->disconnected
      double free in aa_free_profile
  * [SRU] Add support for ALC1708 codec on TRBL platform (LP: #2116247)
    - ASoC: Intel: soc-acpi-intel-lnl-match: add rt1320_l12_rt714_l0 support
  * [SRU] Add waiting latency for USB port resume (LP: #2115478)
    - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
    - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
      pm
    - usb: hub: Fix flushing of delayed work used for post resume purposes
  * minimal kernel lacks modules for blk disk in arm64 openstack environments
    where config_drive is required (LP: #2118499)
    - [Config] Enable SYM53C8XX_2 on arm64
  * Support xe2_hpg (LP: #2116175)
    - drm/xe/xe2_hpg: Add PCI IDs for xe2_hpg
    - drm/xe/xe2_hpg: Define additional Xe2_HPG GMD_ID
    - drm/xe/xe2_hpg: Add set of workarounds
    - drm/xe/xe2hpg: Add Wa_16025250150
  * drm/xe: Lite restore breaks fdinfo drm-cycles-rcs reporting (LP: #2119526)
    - drm/xe: Add WA BB to capture active context utilization
    - drm/xe/lrc: Use a temporary buffer for WA BB
  * No IP Address assigned after hot-plugging Ethernet cable on HP Platform
    (LP: #2115393)
    - Revert "e1000e: change k1 configuration on MTP and later platforms"
  * I/O performance regression on NVMes under same bridge (dual port nvme)
    (LP: #2115738)
    - iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes
    - iommu/vt-d: Split intel_iommu_domain_alloc_paging_flags()
    - iommu/vt-d: Create unique domain ops for each stage
    - iommu/vt-d: Split intel_iommu_enforce_cache_coherency()
    - iommu/vt-d: Split paging_domain_compatible()
    - iommu/vt-d: Make iotlb_sync_map a static property of dmar_domain
  * BPF header file in wrong location (LP: #2118965)
    - [Packaging] Install bpf header to correct location
  * Internal microphone not working on ASUS VivoBook with Realtek ALC256
    (Ubuntu 24.04 + kernel 6.15) (LP: #2112330)
    - ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X513EA
  * Documentation update for  [Ubuntu25.04] "virsh attach-interface" requires
    a reboot to reflect the attached interfaces on the guest (LP: #2111231)
    - powerpc/pseries/dlpar: Search DRC index from ibm, drc-indexes for IO add
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603)
    - tools/x86/kcpuid: Fix error handling
    - x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in
      mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
    - crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
    - sched: Fix trace_sched_switch(.prev_state)
    - perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member
    - perf/x86/amd/uncore: Prevent UMC counters from saturating
    - gfs2: replace sd_aspace with sd_inode
    - gfs2: gfs2_create_inode error handling fix
    - perf/core: Fix broken throttling when max_samples_per_tick=1
    - crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
    - powerpc: do not build ppc_save_regs.o always
    - powerpc/crash: Fix non-smp kexec preparation
    - sched/core: Tweak wait_task_inactive() to force dequeue sched_delayed
      tasks
    - x86/microcode/AMD: Do not return error when microcode update is not
      necessary
    - crypto: sun8i-ce - undo runtime PM changes during driver removal
    - x86/cpu: Sanitize CPUID(0x80000000) output
    - x86/insn: Fix opcode map (!REX2) superscript tags
    - brd: fix aligned_sector from brd_do_discard()
    - brd: fix discard end sector
    - kselftest: cpufreq: Get rid of double suspend in rtcwake case
    - crypto: marvell/cesa - Avoid empty transfer descriptor
    - erofs: fix file handle encoding for 64-bit NIDs
    - powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view
    - btrfs: scrub: update device stats when an error is detected
    - btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
    - btrfs: fix invalid data space release when truncating block in NOCOW
      mode
    - rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
    - crypto: lrw - Only add ecb if it is not already there
    - crypto: xts - Only add ecb if it is not already there
    - crypto: sun8i-ce - move fallback ahash_request to the end of the struct
    - kunit: Fix wrong parameter to kunit_deactivate_static_stub()
    - crypto: api - Redo lookup on EEXIST
    - ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
    - ASoC: tas2764: Enable main IRQs
    - EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo
      channel 0
    - spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
    - spi: tegra210-quad: remove redundant error handling code
    - spi: tegra210-quad: modify chip select (CS) deactivation
    - power: reset: at91-reset: Optimize at91_reset()
    - ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
    - ASoC: SOF: amd: add missing acp descriptor field
    - PM: wakeup: Delete space in the end of string shown by
      pm_show_wakelocks()
    - ACPI: resource: fix a typo for MECHREVO in
      irq1_edge_low_force_override[]
    - x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
    - PM: sleep: Print PM debug messages during hibernation
    - thermal/drivers/mediatek/lvts: Fix debugfs unregister on failure
    - ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
    - spi: sh-msiof: Fix maximum DMA transfer size
    - ASoC: apple: mca: Constrain channels according to TDM mask
    - ALSA: core: fix up bus match const issues.
    - drm/vmwgfx: Add seqno waiter for sync_files
    - drm/vmwgfx: Add error path for xa_store in vmw_bo_add_detached_resource
    - drm/vmwgfx: Fix dumb buffer leak
    - drm/xe/d3cold: Set power state to D3Cold during s2idle/s3
    - drm/vc4: tests: Use return instead of assert
    - media: rkvdec: Fix frame size enumeration
    - arm64/fpsimd: Avoid RES0 bits in the SME trap handler
    - arm64/fpsimd: Don't corrupt FPMR when streaming mode changes
    - arm64/fpsimd: Reset FPMR upon exec()
    - arm64/fpsimd: Fix merging of FPSIMD state during signal return
    - drm/panthor: Fix GPU_COHERENCY_ACE[_LITE] definitions
    - drm/panthor: Update panthor_mmu::irq::mask when needed
    - drm/panel: samsung-sofef00: Drop s6e3fc2x01 support
    - drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
    - fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr
    - kunit/usercopy: Disable u64 test on 32-bit SPARC
    - watchdog: exar: Shorten identity name to fit correctly
    - m68k: mac: Fix macintosh_config for Mac II
    - firmware: psci: Fix refcount leak in psci_dt_init
    - arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
    - selftests/seccomp: fix syscall_restart test for arm compat
    - drm/msm/dpu: enable SmartDMA on SM8150
    - drm/msm/dpu: enable SmartDMA on SC8180X
    - drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
    - drm/vkms: Adjust vkms_state->active_planes allocation type
    - drm/tegra: rgb: Fix the unbound reference count
    - firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
    - arm64/fpsimd: Do not discard modified SVE state
    - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
    - scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
    - selftests/seccomp: fix negative_ENOSYS tracer tests on arm32
    - drm/msm/a6xx: Disable rgb565_predicator on Adreno 7c3
    - drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
    - drm/mediatek: Fix kobject put for component sub-drivers
    - drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
    - media: verisilicon: Free post processor buffers on error
    - svcrdma: Reduce the number of rdma_rw contexts per-QP
    - xen/x86: fix initial memory balloon target
    - wifi: ath12k: Fix memory leak during vdev_id mismatch
    - wifi: ath12k: Fix invalid memory access while forming 802.11 header
    - IB/cm: use rwlock for MAD agent lock
    - bpf: Check link_create.flags parameter for multi_kprobe
    - selftests/bpf: Fix bpf_nf selftest failure
    - bpf, sockmap: fix duplicated data transmission
    - wifi: ath12k: fix cleanup path after mhi init
    - wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
    - f2fs: clean up unnecessary indentation
    - f2fs: prevent the current section from being selected as a victim during
      GC
    - page_pool: Move pp_magic check into helper functions
    - page_pool: Track DMA-mapped pages and unmap them when destroying the
      pool
    - net: ncsi: Fix GCPS 64-bit member variables
    - libbpf: Fix buffer overflow in bpf_object__init_prog
    - net/mlx5: Avoid using xso.real_dev unnecessarily
    - xfrm: Use xdo.dev instead of xdo.real_dev
    - wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
    - wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
    - wifi: rtw88: do not ignore hardware read error during DPK
    - wifi: ath12k: Add MSDU length validation for TKIP MIC error
    - wifi: ath12k: Fix the QoS control field offset to build QoS header
    - RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
    - scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
    - libbpf: Fix event name too long error
    - libbpf: Remove sample_period init in perf_buffer
    - Use thread-safe function pointer in libbpf_print
    - iommu: Protect against overflow in iommu_pgsize()
    - bonding: assign random address if device address is same as bond
    - f2fs: clean up w/ fscrypt_is_bounce_page()
    - f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
    - libbpf: Use proper errno value in linker
    - bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
    - netfilter: bridge: Move specific fragmented packet to slow_path instead
      of dropping it
    - netfilter: nft_quota: match correctly when the quota just depleted
    - bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
    - tracing: Move histogram trigger variables from stack to per CPU
      structure
    - clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
    - clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
    - clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
    - clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
    - bpftool: Fix regression of "bpftool cgroup tree" EINVAL on older kernels
    - wifi: iwlfiwi: mvm: Fix the rate reporting
    - efi/libstub: Describe missing 'out' parameter in efi_load_initrd
    - selftests/bpf: Fix caps for __xlated/jited_unpriv
    - tracing: Rename event_trigger_alloc() to trigger_data_alloc()
    - tracing: Fix error handling in event_trigger_parse()
    - of: unittest: Unlock on error in unittest_data_add()
    - ktls, sockmap: Fix missing uncharge operation
    - libbpf: Use proper errno value in nlattr
    - dt-bindings: soc: fsl,qman-fqd: Fix reserved-memory.yaml reference
    - clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
    - s390/bpf: Store backchain even for leaf progs
    - wifi: rtw89: pci: enlarge retry times of RX tag to 1000
    - wifi: rtw89: fix firmware scan delay unit for WiFi 6 chips
    - iommu: remove duplicate selection of DMAR_TABLE
    - wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
    - hisi_acc_vfio_pci: add eq and aeq interruption restore
    - scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
    - Bluetooth: ISO: Fix not using SID from adv report
    - wifi: mt76: mt7925: prevent multiple scan commands
    - wifi: mt76: mt7925: refine the sniffer commnad
    - wifi: mt76: mt7925: ensure all MCU commands wait for response
    - wifi: mt76: mt7996: set EHT max ampdu length capability
    - wifi: mt76: mt7996: fix RX buffer size of MCU event
    - bpf: Revert "bpf: remove unnecessary rcu_read_{lock,unlock}() in multi-
      uprobe attach logic"
    - netfilter: xtables: support arpt_mark and ipv6 optstrip for iptables-nft
      only builds
    - netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
    - vfio/type1: Fix error unwind in migration dirty bitmap allocation
    - Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
    - netfilter: nf_tables: nft_fib: consistent l3mdev handling
    - netfilter: nft_tunnel: fix geneve_opt dump
    - RISC-V: KVM: lock the correct mp_state during reset
    - vsock/virtio: fix `rx_bytes` accounting for stream sockets
    - net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
    - net: xilinx: axienet: Fix Tx skb circular buffer occupancy check in
      dmaengine xmit
    - net: phy: fix up const issues in to_mdio_device() and to_phy_device()
    - net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
    - net: lan743x: Fix PHY reset handling during initialization and WOL
    - octeontx2-pf: QOS: Perform cache sync on send queue teardown
    - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
    - f2fs: use d_inode(dentry) cleanup dentry->d_inode
    - f2fs: fix to correct check conditions in f2fs_cross_rename
    - arm64: dts: qcom: sm8650: setup gpu thermal with higher temperatures
    - arm64: dts: qcom: sm8650: add missing cpu-cfg interconnect path in the
      mdss node
    - arm64: dts: qcom: x1e80100-romulus: Keep L12B and L15B always on
    - arm64: dts: qcom: sdm845-starqltechn: remove wifi
    - arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
    - arm64: dts: qcom: sdm845-starqltechn: refactor node order
    - arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
    - arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
    - arm64: dts: qcom: sm8250: Fix CPU7 opp table
    - arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
    - arm64: dts: qcom: ipq9574: Fix USB vdd info
    - arm64: dts: rockchip: Move SHMEM memory to reserved memory on rk3588
    - ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
    - ARM: dts: at91: at91sam9263: fix NAND chip selects
    - arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
    - arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect
      GPIO
    - arm64: dts: mt8183: Add port node to mt8183.dtsi
    - arm64: dts: imx8mm-beacon: Fix RTC capacitive load
    - arm64: dts: imx8mn-beacon: Fix RTC capacitive load
    - arm64: dts: imx8mp-beacon: Fix RTC capacitive load
    - arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI
      audio
    - arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI
      audio
    - arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
    - arm64: dts: mt6359: Add missing 'compatible' property to regulators node
    - arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
    - arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
    - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3566-rock3c
    - arm64: dts: rockchip: Update eMMC for NanoPi R5 series
    - arm64: tegra: Drop remaining serial clock-names and reset-names
    - arm64: tegra: Add uartd serial alias for Jetson TX1 module
    - arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
    - soc: qcom: smp2p: Fix fallback to qcom,ipc parse
    - ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
    - nilfs2: add pointer check for nilfs_direct_propagate()
    - nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
    - dt-bindings: vendor-prefixes: Add Liontron name
    - ARM: dts: qcom: apq8064: add missing clocks to the timer node
    - ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon
      device
    - ARM: dts: qcom: apq8064: move replicator out of soc node
    - arm64: defconfig: mediatek: enable PHY drivers
    - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399
      Puma with Haikou
    - arm64: dts: qcom: qcm2290: fix (some) of QUP interconnects
    - arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
    - arm64: dts: mt6359: Rename RTC node to match binding expectations
    - ARM: aspeed: Don't select SRAM
    - soc: aspeed: lpc: Fix impossible judgment condition
    - randstruct: gcc-plugin: Remove bogus void member
    - randstruct: gcc-plugin: Fix attribute addition
    - perf build: Warn when libdebuginfod devel files are not available
    - perf ui browser hists: Set actions->thread before calling
      do_zoom_thread()
    - dm: don't change md if dm_table_set_restrictions() fails
    - dm: free table mempools if not used in __bind
    - x86/irq: Ensure initial PIR loads are performed exactly once
    - perf symbol-minimal: Fix double free in filename__read_build_id
    - dm-flakey: error all IOs when num_features is absent
    - dm-flakey: make corrupting read bios work
    - perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
    - perf tests: Fix 'perf report' tests installation
    - perf intel-pt: Fix PEBS-via-PT data_src
    - perf scripts python: exported-sql-viewer.py: Fix pattern matching with
      Python 3
    - remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
    - remoteproc: k3-r5: Drop check performed in
      k3_r5_rproc_{mbox_callback/kick}
    - remoteproc: k3-dsp: Drop check performed in
      k3_dsp_rproc_{mbox_callback/kick}
    - rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
    - mfd: exynos-lpass: Fix an error handling path in exynos_lpass_probe()
    - mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in
      exynos_lpass_remove()
    - mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
    - perf tests switch-tracking: Fix timestamp comparison
    - mailbox: imx: Fix TXDB_V2 sending
    - mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
    - perf symbol: Fix use-after-free in filename__read_build_id
    - perf record: Fix incorrect --user-regs comments
    - perf trace: Always print return value for syscalls returning a pid
    - nfs: clear SB_RDONLY before getting superblock
    - nfs: ignore SB_RDONLY when remounting nfs
    - perf trace: Set errpid to false for rseq and set_robust_list
    - perf callchain: Always populate the addr_location map when adding IP
    - cifs: Fix validation of SMB1 query reparse point response
    - rust: alloc: add missing invariant in Vec::set_len()
    - rtc: sh: assign correct interrupts with DT
    - phy: rockchip: samsung-hdptx: Fix clock ratio setup
    - phy: rockchip: samsung-hdptx: Do no set rk_hdptx_phy->rate in case of
      errors
    - PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
    - PCI: rcar-gen4: set ep BAR4 fixed size
    - PCI: cadence: Fix runtime atomic count underflow
    - PCI: apple: Use gpiod_set_value_cansleep in probe flow
    - PCI/DPC: Initialize aer_err_info before using it
    - PCI/DPC: Log Error Source ID only when valid
    - rtc: loongson: Add missing alarm notifications for ACPI RTC events
    - PCI: endpoint: Retain fixed-size BAR size as well as aligned size
    - thunderbolt: Fix a logic error in wake on connect
    - iio: filter: admv8818: fix band 4, state 15
    - iio: filter: admv8818: fix integer overflow
    - iio: filter: admv8818: fix range calculation
    - iio: filter: admv8818: Support frequencies >= 2^32
    - iio: adc: ad7124: Fix 3dB filter frequency reading
    - MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
    - coresight: Fixes device's owner field for registered using
      coresight_init_driver()
    - coresight: catu: Introduce refcount and spinlock for enabling/disabling
    - counter: interrupt-cnt: Protect enable/disable OPs with mutex
    - vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
    - mei: vsc: Cast tx_buf to (__be32 *) when passed to cpu_to_be32_array()
    - iio: adc: PAC1934: fix typo in documentation link
    - iio: adc: mcp3911: fix device dependent mappings for conversion result
      registers
    - USB: gadget: udc: fix const issue in gadget_match_driver()
    - USB: typec: fix const issue in typec_match()
    - loop: add file_start_write() and file_end_write()
    - drm/xe: Make xe_gt_freq part of the Documentation
    - Fix sock_exceed_buf_limit not being triggered in
      __sk_mem_raise_allocated
    - net: stmmac: platform: guarantee uniqueness of bus_id
    - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
    - net: tipc: fix refcount warning in tipc_aead_encrypt
    - driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
    - net/mlx4_en: Prevent potential integer overflow calculating Hz
    - net: lan966x: Make sure to insert the vlan tags also in host mode
    - spi: bcm63xx-spi: fix shared reset
    - spi: bcm63xx-hsspi: fix shared reset
    - Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
    - ice: create new Tx scheduler nodes for new queues only
    - ice: fix rebuilding the Tx scheduler tree for large queue counts
    - idpf: fix a race in txq wakeup
    - idpf: avoid mailbox timeout delays during reset
    - net: dsa: tag_brcm: legacy: fix pskb_may_pull length
    - drm/i915/guc: Check if expecting reply before decrementing
      outstanding_submission_g2h
    - drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP
    - drm/i915/guc: Handle race condition where wakeref count drops below 0
    - vmxnet3: correctly report gso type for UDP tunnels
    - selftests: net: build net/lib dependency in all target
    - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
    - nvme: fix command limits status code
    - drm/panel-simple: fix the warnings for the Evervision VGG644804
    - netfilter: nf_nat: also check reverse tuple to obtain clashing entry
    - net: ti: icssg-prueth: Fix swapped TX stats for MII interfaces.
    - net: dsa: b53: do not enable RGMII delay on bcm63xx
    - net: dsa: b53: allow RGMII for bcm63xx RGMII ports
    - net: dsa: b53: do not touch DLL_IQQD on bcm53115
    - wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements
    - net: wwan: mhi_wwan_mbim: use correct mux_id for multiplexing
    - wireguard: device: enable threaded NAPI
    - scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
    - ASoC: codecs: hda: Fix RPM usage count underflow
    - ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
    - ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
    - iov_iter: use iov_offset for length calculation in iov_iter_aligned_bvec
    - path_overmount(): avoid false negatives
    - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
    - do_change_type(): refuse to operate on unmounted/not ours mounts
    - tools/power turbostat: Fix AMD package-energy reporting
    - ALSA: hda/realtek: Add support for various HP Laptops using CS35L41 HDA
    - ALSA: hda/realtek - Support mute led function for HP platform
    - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
    - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
    - Input: synaptics-rmi - fix crash with unsupported versions of F34
    - pmdomain: core: Introduce dev_pm_genpd_rpm_always_on()
    - mmc: sdhci-of-dwcmshc: add PD workaround on RK3576
    - pinctrl: samsung: refactor drvdata suspend & resume callbacks
    - pinctrl: samsung: add dedicated SoC eint suspend/resume callbacks
    - pinctrl: samsung: add gs101 specific eint suspend/resume callbacks
    - Bluetooth: hci_core: fix list_for_each_entry_rcu usage
    - Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers
    - Bluetooth: btintel_pcie: Increase the tx and rx descriptor count
    - Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race
      condition
    - Bluetooth: MGMT: Remove unused mgmt_pending_find_data
    - net: dsa: b53: fix untagged traffic sent via cpu tagged with VID 0
    - ath10k: snoc: fix unbalanced IRQ enable in crash recovery
    - wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
    - wifi: ath11k: don't use static variables in
      ath11k_debugfs_fw_stats_process()
    - wifi: ath11k: don't wait when there is no vdev started
    - wifi: ath11k: move some firmware stats related functions outside of
      debugfs
    - wifi: ath11k: validate ath11k_crypto_mode on top of
      ath11k_core_qmi_firmware_ready
    - wifi: ath12k: refactor ath12k_hw_regs structure
    - regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
    - spi: omap2-mcspi: Disable multi mode when CS should be kept asserted
      after message
    - spi: omap2-mcspi: Disable multi-mode when the previous message kept CS
      asserted
    - pinctrl: qcom: pinctrl-qcm2290: Add missing pins
    - scsi: iscsi: Fix incorrect error path labels for flashnode operations
    - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
    - drm/meson: fix debug log statement when setting the HDMI clocks
    - drm/meson: use vclk_freq instead of pixel_freq in debug print
    - drm/meson: fix more rounding issues with 59.94Hz modes
    - i40e: return false from i40e_reset_vf if reset is in progress
    - i40e: retry VFLR handling if there is ongoing VF reset
    - macsec: MACsec SCI assignment for ES = 0
    - Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
    - Bluetooth: MGMT: Fix sparse errors
    - net/mlx5: Ensure fw pages are always allocated on same NUMA
    - net/mlx5: Fix return value when searching for existing flow group
    - net/mlx5: HWS, fix missing ip_version handling in definer
    - net/mlx5e: Fix leak of Geneve TLV option object
    - net_sched: tbf: fix a race in tbf_change()
    - fs/filesystems: Fix potential unsigned integer underflow in fs_name()
    - gfs2: pass through holder from the VFS for freeze/thaw
    - btrfs: exit after state split error at set_extent_bit()
    - nvmet-fcloop: access fcpreq only when holding reqlock
    - perf: Ensure bpf_perf_link path is properly serialized
    - block: use q->elevator with ->elevator_lock held in elv_iosched_show()
    - io_uring: consistently use rcu semantics with sqpoll thread
    - bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
    - block: Fix bvec_set_folio() for very large folios
    - objtool/rust: relax slice condition to cover more `noreturn` Rust
      functions
    - tools/resolve_btfids: Fix build when cross compiling kernel with clang.
    - Revert "wifi: mwifiex: Fix HT40 bandwidth issue."
    - ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
    - usb: usbtmc: Fix read_stb function and get_stb ioctl
    - tty: serial: 8250_omap: fix TX with DMA for am33xx
    - usb: misc: onboard_usb_dev: Fix usb5744 initialization sequence
    - usb: cdnsp: Fix issue with detecting command completion event
    - usb: cdnsp: Fix issue with detecting USB 3.2 speed
    - usb: Flush altsetting 0 endpoints before reinitializating them after
      reset.
    - usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
    - 9p: Add a migrate_folio method
    - ring-buffer: Move cpus_read_lock() outside of buffer->mutex
    - xfs: don't assume perags are initialised when trimming AGs
    - xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
    - x86/fred/signal: Prevent immediate repeat of single step trap on return
      from SIGTRAP handler
    - calipso: unlock rcu before returning -EAFNOSUPPORT
    - regulator: dt-bindings: mt6357: Drop fixed compatible requirement
    - usb: misc: onboard_usb_dev: fix build warning for
      CONFIG_USB_ONBOARD_DEV_USB5744=n
    - net: usb: aqc111: debug info before sanitation
    - overflow: Introduce __DEFINE_FLEX for having no initializer
    - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add
    - thermal/drivers/mediatek/lvts: Remove unused lvts_debugfs_exit
    - pidfs: move O_RDWR into pidfs_alloc_file()
    - ACPICA: Introduce ACPI_NONSTRING
    - ACPICA: Apply ACPI_NONSTRING
    - ACPICA: Apply ACPI_NONSTRING in more places
    - bcachefs: Repair code for directory i_size
    - bcachefs: delete dead code from may_delete_deleted_inode()
    - bcachefs: Run may_delete_deleted_inode() checks in bch2_inode_rm()
    - bcachefs: Fix subvol to missing root repair
    - crypto: ecdsa - Fix enc/dec size reported by KEYCTL_PKEY_QUERY
    - crypto: ecdsa - Fix NIST P521 key size reported by KEYCTL_PKEY_QUERY
    - spinlock: extend guard with spinlock_bh variants
    - crypto: zynqmp-sha - Add locking
    - gfs2: Move gfs2_dinode_dealloc
    - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc
    - selftests: coredump: Properly initialize pointer
    - selftests: coredump: Fix test failure for slow machines
    - selftests: coredump: Raise timeout to 2 minutes
    - sched/fair: Fixup wake_up_sync() vs DELAYED_DEQUEUE
    - gfs2: Move gfs2_trans_add_databufs
    - gfs2: Don't start unnecessary transactions during log flush
    - platform/chrome: cros_ec_typec: Set Pin Assignment E in DP PORT VDO
    - PM: runtime: Add new devm functions
    - spi: atmel-quadspi: Fix unbalanced pm_runtime by using devm_ API
    - EDAC/bluefield: Don't use bluefield_edac_readl() result on error
    - drm: xlnx: zynqmp_dpsub: fix Kconfig dependencies for ASoC
    - drm/vc4: hdmi: Call HDMI hotplug helper on disconnect
    - drm/panthor: Call panthor_gpu_coherency_init() after PM resume()
    - accel/amdxdna: Fix incorrect size of ERT_START_NPU commands
    - drm/panthor: Fix the panthor_gpu_coherency_init() error path
    - drm/amdgpu: Refine Cleaner Shader MEC firmware version for GFX10.1.x
      GPUs
    - drm/v3d: Associate a V3D tech revision to all supported devices
    - drm/v3d: fix client obtained from axi_ids on V3D 4.1
    - drm/v3d: client ranges from axi_ids are different with V3D 7.1
    - drm/msm/dpu: remove DSC feature bit for PINGPONG on MSM8937
    - drm/msm/dpu: remove DSC feature bit for PINGPONG on MSM8917
    - drm/msm/dpu: remove DSC feature bit for PINGPONG on MSM8953
    - drm/amd/display: Don't check for NULL divisor in fixpt code
    - kselftest/arm64: fp-ptrace: Fix expected FPMR value when PSTATE.SM is
      changed
    - drm/i915/dp_mst: Use the correct connector while computing the link BPP
      limit on MST
    - libbpf: Fix implicit memfd_create() for bionic
    - bpf: Check link_create.flags parameter for multi_uprobe
    - net: phy: mediatek: permit to compile test GE SOC PHY driver
    - wifi: ath12k: Resolve multicast packet drop by populating key_cipher in
      ath12k_install_key()
    - wifi: ath12k: fix SLUB BUG - Object already free in ath12k_reg_free()
    - wifi: ath12k: fix ATH12K_FLAG_REGISTERED flag handling
    - net/mlx5: HWS, Fix matcher action template attach
    - xfrm: provide common xdo_dev_offload_ok callback implementation
    - xfrm: Add explicit dev to .xdo_dev_state_{add,delete,free}
    - bonding: Mark active offloaded xfrm_states
    - bonding: Fix multiple long standing offload races
    - wifi: ath12k: Handle error cases during extended skb allocation
    - wifi: ath12k: Refactor the monitor Rx parser handler argument
    - wifi: ath12k: Add extra TLV tag parsing support in monitor Rx path
    - wifi: ath12k: Avoid fetch Error bitmap and decap format from Rx TLV
    - wifi: ath12k: Replace band define G with GHZ where appropriate
    - wifi: ath12k: change the status update in the monitor Rx
    - wifi: ath12k: add rx_info to capture required field from rx descriptor
    - wifi: ath12k: remove redundant declaration of ath12k_dp_rx_h_find_peer()
    - wifi: ath12k: replace the usage of rx desc with rx_info
    - wifi: ath12k: fix wrong handling of CCMP256 and GCMP ciphers
    - wifi: iwlwifi: re-add IWL_AMSDU_8K case
    - iommu: ipmmu-vmsa: avoid Wformat-security warning
    - iommu/io-pgtable-arm: dynamically allocate selftest device struct
    - f2fs: zone: fix to calculate first_zoned_segno correctly
    - selftests/bpf: Fix kmem_cache iterator draining
    - iommu/arm-smmu-v3: Fix incorrect return in arm_smmu_attach_dev
    - clk: test: Forward-declare struct of_phandle_args in kunit/clk.h
    - pinctrl: qcom: correct the ngpios entry for QCS615
    - pinctrl: qcom: correct the ngpios entry for QCS8300
    - wifi: ath12k: Reorder and relocate the release of resources in
      ath12k_core_deinit()
    - hisi_acc_vfio_pci: bugfix cache write-back issue
    - hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
    - wifi: mt76: mt7996: avoid null deref in mt7996_stop_phy()
    - Bluetooth: separate CIS_LINK and BIS_LINK link types
    - wifi: mt76: scan: Fix 'mlink' dereferenced before IS_ERR_OR_NULL check
    - wifi: mt76: mt7996: fix beamformee SS field
    - wifi: mt76: mt7996: fix invalid NSS setting when TX path differs from
      NSS
    - wifi: mt76: fix available_antennas setting
    - octeontx2-af: Send Link events one by one
    - f2fs: fix to skip f2fs_balance_fs() if checkpoint is disabled
    - arm64: dts: qcom: sa8775p: Partially revert "arm64: dts: qcom: sa8775p:
      add QCrypto nodes"
    - arm64: dts: qcom: qcs8300: Partially revert "arm64: dts: qcom: qcs8300:
      add QCrypto nodes"
    - arm64: dts: qcom: sm8550: use ICC tag for all interconnect phandles
    - arm64: dts: qcom: sm8550: add missing cpu-cfg interconnect path in the
      mdss node
    - arm64: dts: qcom: ipq9574: fix the msi interrupt numbers of pcie3
    - arm64: dts: qcom: sm8750: Fix cluster hierarchy for idle states
    - arm64: dts: qcom: sm8750: Correct clocks property for uart14 node
    - arm64: dts: qcom: qcs615: remove disallowed property in spmi bus node
    - arm64: dts: qcom: sm8650: Fix domain-idle-state for CPU2
    - arm64: dts: rockchip: Add missing uart3 interrupt for RK3528
    - arm64: dts: mediatek: mt8188: Fix IOMMU device for rdma0
    - arm64: dts: qcom: x1e001de-devkit: Describe USB retimers resets pin
      configs
    - arm64: dts: qcom: x1e001de-devkit: Fix pin config for USB0 retimer vregs
    - arm64: dts: allwinner: a100: set maximum MMC frequency
    - arm64: dts: renesas: white-hawk-single: Improve Ethernet TSN description
    - arm64: dts: qcom: sm8650: add the missing l2 cache node
    - arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399
      Puma
    - dt-bindings: display/msm/dsi-phy: Add header with exposed clock IDs
    - arm64: dts: qcom: msm8998: Use the header with DSI phy clock IDs
    - arm64: dts: qcom: msm8998: Remove mdss_hdmi_phy phandle argument
    - arm64: dts: qcom: qcs615: Fix up UFS clocks
    - ubsan: integer-overflow: depend on BROKEN to keep this out of CI
    - [Config] disable UBSAN_SIGNED_WRAP
    - tools build: Don't set libunwind as available if test-all.c build
      succeeds
    - tools build: Don't show libunwind build status as it is opt-in
    - tools build: Don't show libbfd build status as it is opt-in
    - dm: handle failures in dm_table_set_restrictions
    - HID: intel-thc-hid: intel-quicki2c: pass correct arguments to
      acpi_evaluate_object
    - perf tool_pmu: Fix aggregation on duration_time
    - remoteproc: k3-r5: Refactor sequential core power up/down operations
    - netfs: Fix setting of transferred bytes with short DIO reads
    - netfs: Fix the request's work item to not require a ref
    - netfs: Fix wait/wake to be consistent about the waitqueue used
    - mfd: exynos-lpass: Fix another error handling path in
      exynos_lpass_probe()
    - netfs: Fix undifferentiation of DIO reads from unbuffered reads
    - mailbox: mchp-ipc-sbi: Fix COMPILE_TEST build error
    - perf pmu: Avoid segv for missing name/alias_name in wildcarding
    - s390/uv: Don't return 0 from make_hva_secure() if the operation was not
      successful
    - s390/uv: Always return 0 from s390_wiggle_split_folio() if successful
    - s390/uv: Improve splitting of large folios that cannot be split while
      dirty
    - nfs_localio: use cmpxchg() to install new nfs_file_localio
    - nfs_localio: always hold nfsd net ref with nfsd_file ref
    - nfs_localio: simplify interface to nfsd for getting nfsd_file
    - nfs_localio: duplicate nfs_close_local_fh()
    - nfs_localio: protect race between nfs_uuid_put() and
      nfs_close_local_fh()
    - nfs_localio: change nfsd_file_put_local() to take a pointer to __rcu
      pointer
    - rust: file: mark `LocalFile` as `repr(transparent)`
    - exportfs: require ->fh_to_parent() to encode connectable file handles
    - PCI: pciehp: Ignore Presence Detect Changed caused by DPC
    - PCI: pciehp: Ignore Link Down/Up caused by Secondary Bus Reset
    - PCI: rockchip: Fix order of rockchip_pci_core_rsts
    - PCI: imx6: Save and restore the LUT setting during suspend/resume for
      i.MX95 SoC
    - Revert "phy: qcom-qusb2: add QUSB2 support for IPQ5424"
    - phy: qcom-qusb2: reuse the IPQ6018 settings for IPQ5424
    - soundwire: only compute port params in specific stream states
    - rust: pci: fix docs related to missing Markdown code spans
    - coresight: core: Disable helpers for devices that fail to enable
    - iio: dac: adi-axi-dac: fix bus read
    - coresight: tmc: fix failure to disable/enable ETF after reading
    - coresight: etm4x: Fix timestamp bit field handling
    - coresight/etm4: fix missing disable active config
    - staging: gpib: Fix PCMCIA config identifier
    - staging: gpib: Fix secondary address restriction
    - rust: miscdevice: fix typo in MiscDevice::ioctl documentation
    - drm/bridge: analogix_dp: Remove the unnecessary calls to
      clk_disable_unprepare() during probing
    - drm/bridge: analogix_dp: Remove CONFIG_PM related check in
      analogix_dp_bind()/analogix_dp_unbind()
    - drm/bridge: analogix_dp: Add support to get panel from the DP AUX bus
    - drm/bridge: analogix_dp: Fix clk-disable removal
    - drm/xe: Add missing documentation of rpa_freq
    - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT
    - net: Fix checksum update for ILA adj-transport
    - bpf: Clarify the meaning of BPF_F_PSEUDO_HDR
    - bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
    - iavf: iavf_suspend(): take RTNL before netdev_lock()
    - iavf: centralize watchdog requeueing itself
    - iavf: simplify watchdog_task in terms of adminq task scheduling
    - iavf: extract iavf_watchdog_step() out of iavf_watchdog_task()
    - iavf: sprinkle netdev_assert_locked() annotations
    - drm/amdgpu/gfx10: Refine Cleaner Shader for GFX10.1.10
    - block: flip iter directions in blk_rq_integrity_map_user()
    - nvme: fix implicit bool to flags conversion
    - net: dsa: b53: implement setting ageing time
    - net: dsa: b53: do not configure bcm63xx's IMP port interface
    - netlink: specs: rt-link: add missing byte-order properties
    - net: annotate data-races around cleanup_net_task
    - drm/xe/vsec: fix CONFIG_INTEL_VSEC dependency
    - drm/xe: Rework eviction rejection of bound external bos
    - ALSA: hda: Allow to fetch hlink by ID
    - ASoC: Intel: avs: PCM operations for LNL-based platforms
    - ASoC: Intel: avs: Fix PPLCxFMT calculation
    - ASoC: Intel: avs: Ignore Vendor-space manipulation for ACE
    - ASoC: Intel: avs: Read HW capabilities when possible
    - ASoC: Intel: avs: Relocate DSP status registers
    - ASoC: Intel: avs: Fix paths in MODULE_FIRMWARE hints
    - fs: convert mount flags to enum
    - finish_automount(): don't leak MNT_LOCKED from parent to child
    - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the
      right userns
    - genksyms: Fix enum consts from a reference affecting new values
    - accel/amdxdna: Fix incorrect PSP firmware size
    - drm/vc4: fix infinite EPROBE_DEFER loop
    - iavf: fix reset_task for early reset event
    - ice/ptp: fix crosstimestamp reporting
    - net/mlx5: HWS, make sure the uplink is the last destination
    - btrfs: fix fsync of files with no hard links not persisting deletion
    - io_uring: fix spurious drain flushing
    - smb: client: fix perf regression with deferred closes
    - rust: compile libcore with edition 2024 for 1.87+
    - pidfs: never refuse ppid == 0 in PIDFD_GET_INFO
    - powerpc/kernel: Fix ppc_save_regs inclusion in build
    - mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback
    - mm/filemap: use filemap_end_dropbehind() for read invalidation
    - x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
    - Upstream stable to v6.12.34, v6.15.1, v6.15.2, v6.15.3
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38105
    - ALSA: usb-audio: Kill timer properly at removal
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38114
    - e1000: Move cancel_work_sync to avoid deadlock
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38116
    - wifi: ath12k: fix uaf in ath12k_core_init()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38306
    - fs/fhandle.c: fix a race in call of has_locked_children()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38272
    - net: dsa: b53: do not enable EEE on bcm63xx
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38311
    - iavf: get rid of the crit lock
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38128
    - Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38130
    - drm/connector: only call HDMI audio helper plugged cb if non-null
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38132
    - coresight: holding cscfg_csdev_lock while removing cscfg from csdev
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38137
    - PCI/pwrctrl: Cancel outstanding rescan work when unregistering
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38139
    - netfs: Fix oops in write-retry from mis-resetting the subreq iterator
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38140
    - dm: limit swapping tables for devices with zone write plugs
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38279
    - bpf: Do not include stack ptr register in precision backtracking
      bookkeeping
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38314
    - virtio-pci: Fix result size returned for the admin command completion
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38316
    - wifi: mt76: mt7996: avoid NULL pointer dereference in
      mt7996_set_monitor()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38281
    - wifi: mt76: mt7996: Add NULL check in mt7996_thermal_init
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38284
    - wifi: rtw89: pci: configure manual DAC mode via PCI config API only
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38287
    - IB/cm: Drop lockdep assert and WARN when freeing old msg
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38289
    - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38291
    - wifi: ath12k: Prevent sending WMI commands to firmware during firmware
      crash
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38294
    - wifi: ath12k: fix NULL access in assign channel context handler
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38296
    - ACPI: platform_profile: Avoid initializing on non-ACPI platforms
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38100
    - x86/iopl: Cure TIF_IO_BITMAP inconsistencies
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38101
    - ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38267
    - ring-buffer: Do not trigger WARN_ON() due to a commit_overrun
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38268
    - usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38102
    - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38301
    - nvmem: zynqmp_nvmem: unbreak driver after cleanup
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38352
    - posix-cpu-timers: fix race between handle_posix_cpu_timers() and
      posix_cpu_timer_del()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38103
    - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38302
    - block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38106
    - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38269
    - btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38270
    - net: drv: netdevsim: don't napi_complete() from netpoll
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38107
    - net_sched: ets: fix a race in ets_qdisc_change()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38108
    - net_sched: red: fix a race in __red_change()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38109
    - net/mlx5: Fix ECVF vports unload on shutdown flow
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38303
    - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38304
    - Bluetooth: Fix NULL pointer deference on eir_get_service_data
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38110
    - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38111
    - net/mdiobus: Fix potential out-of-bounds read/write access
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38112
    - net: Fix TOCTOU issue in sk_is_readable()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38113
    - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38088
    - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38115
    - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38414
    - wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38305
    - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38117
    - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38118
    - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38119
    - scsi: core: ufs: Fix a hang in the error handler
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38307
    - ASoC: Intel: avs: Verify content returned by parse_int_array()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38310
    - seg6: Fix validation of nexthop addresses
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38120
    - netfilter: nf_set_pipapo_avx2: fix initial map fill
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38122
    - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38123
    - net: wwan: t7xx: Fix napi rx poll issue
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38124
    - net: fix udp gso skb_segment after pull from frag_list
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38125
    - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38126
    - net: stmmac: make sure that ptp_rate is not 0 before configuring
      timestamping
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38127
    - ice: fix Tx scheduler error handling in XDP callback
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38129
    - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38131
    - coresight: prevent deactivate active config while enabling the config
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38274
    - fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38134
    - usb: acpi: Prevent null pointer dereference in
      usb_acpi_add_usb4_devlink()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38135
    - serial: Fix potential null-ptr-deref in mlb_usio_probe()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38136
    - usb: renesas_usbhs: Reorder clock handling and power management in probe
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38138
    - dmaengine: ti: Add NULL check in udma_probe()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38275
    - phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38141
    - dm: fix dm_blk_report_zones
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38142
    - hwmon: (asus-ec-sensors) check sensor index in read_string()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38277
    - mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38143
    - backlight: pm8941: Add NULL check in wled_configure()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38312
    - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38145
    - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38313
    - bus: fsl-mc: fix double-free on mc_dev
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38415
    - Squashfs: check return result of sb_min_blocksize
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38146
    - net: openvswitch: Fix the dead loop of MPLS parse
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38147
    - calipso: Don't call calipso functions for AF_INET sk.
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38278
    - octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38148
    - net: phy: mscc: Fix memory leak when using one step timestamping
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38149
    - net: phy: clear phydev->devlink when the link is deleted
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38280
    - bpf: Avoid __bpf_prog_ret0_warn when jit fails
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38151
    - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38153
    - net: usb: aqc111: fix error handling of usbnet read calls
  * Plucky update: upstream stable patchset 2025-08-06 (LP: #2119603) //
    CVE-2025-38154
    - bpf, sockmap: Avoid using sk_socket after free when sending
  * Plucky update: upstream stable patchset 2025-08-06 (LP: