-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 17 Nov 2025 19:52:25 +0100
Source: linux
Architecture: source
Version: 6.16.12-1~bpo13+1
Distribution: trixie-backports
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <benh@debian.org>
Closes: 1110703 1113681 1113765 1114806 1114898 1115002 1118100
Changes:
linux (6.16.12-1~bpo13+1) trixie-backports; urgency=medium
.
* Rebuild for trixie-backports
* d/salsa-ci.yml: Adjust filenames to allow source package name suffix
* d/salsa-ci.yml: Fix cache configuration for build job
* d/salsa-ci.yml: Move orig tarball generation to a separate job again
* d/salsa-ci.yml: Restore lintian checking of source package
.
linux (6.16.12-2) unstable; urgency=medium
.
* docs: kdoc: handle the obsolescensce of docutils.ErrorString()
(Closes: #1118100)
.
linux (6.16.12-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.12
- ALSA: hda/tas2781: Fix the order of TAS2781 calibrated-data
- drm/amdgpu: Enable MES lr_compute_wa by default
- wifi: rtw89: mcc: stop TX during MCC prepare
- wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()
- USB: serial: option: add SIMCom 8230C compositions
- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1
- wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
- wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
- gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05
- [amd64] ASoC: rt712: avoid skipping the blind write
- dm-integrity: limit MAX_TAG_SIZE to 255
- [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042
list
- drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 GPUs
- [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108
- [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
- btrfs: ref-verify: handle damaged extent root tree
- netfs: Prevent duplicate unlocking
- iommufd: WARN if an object is aborted with an elevated refcount
- can: hi311x: fix null pointer dereference when resuming from sleep before
interface was enabled
- [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
quirks list
- hid: fix I2C read buffer overflow in raw_event() for mcp2221
- nvmem: layouts: fix automatic module loading
- binder: fix double-free in dbitmap
- driver core: faux: Set power.no_pm for faux devices
- driver core/PM: Set power.no_callbacks along with power.no_pm
- crypto: rng - Ensure set_ent is always present
- net/9p: fix double req put in p9_fd_cancelled
- [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace
I/O
- ring buffer: Propagate __rb_map_vma return value to caller
.
linux (6.16.11-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.11
- blk-mq: fix blk_mq_tags double free while nr_requests grown
- scsi: target: target_core_configfs: Add length check to avoid buffer
overflow
- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
- media: b2c2: Fix use-after-free causing by irq_check_work in
flexcop_pci_remove
- media: tuner: xc5000: Fix use-after-free in xc5000_release
- media: rc: fix races with imon_disconnect()
- media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
- mm: swap: check for stable address space before operating on the VMA
- wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
- [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference
.
linux (6.16.10-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.10
- scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
- firewire: core: fix overlooked update of subsystem ABI version
- ALSA: usb-audio: Fix code alignment in mixer_quirks
- ALSA: usb-audio: Fix whitespace & blank line issues in mixer_quirks
- ALSA: usb-audio: Fix block comments in mixer_quirks
- ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
- ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
- ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
- ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
- ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
- HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in
case of Apple Touch Bar
- HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in
Apple Touch Bar
- HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar
even without a HID_DG_CONTACTMAX field
- HID: multitouch: specify that Apple Touch Bar is direct
- ALSA: usb-audio: Convert comma to semicolon
- ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
- usb: core: Add 0x prefix to quirks debug output
- [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info ->
fec_imx6sx_info
- net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
- [arm64,armhf] drm/panfrost: Drop duplicated Mediatek supplies arrays
- [arm64,armhf] drm/panfrost: Commonize Mediatek power domain array
definitions
- [arm64,armhf] drm/panfrost: Add support for Mali on the MT8370 SoC
- [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support
- i2c: designware: Add quirk for Intel Xe
- [amd64] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match
table.
- [amd64] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in
PTL match table
- [amd64] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support
for PTL.
- ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
- gpiolib: acpi: Add quirk for ASUS ProArt PX13
- ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
- ALSA: usb-audio: Add mute TLV for playback volumes on more devices
- net: sfp: add quirk for FLYPRO copper SFP+ module
- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
- HID: cp2112: fix setter callbacks return value
- [amd64] HID: amd_sfh: Add sync across amd sfh work functions
- [arm64] dts: rockchip: Fix the headphone detection on the orangepi 5
- firmware: imx: Add stub functions for SCMI MISC API
- firmware: imx: Add stub functions for SCMI LMM API
- firmware: imx: Add stub functions for SCMI CPU API
- [arm64] dts: imx8mp: Correct thermal sensor index
- cpufreq: Initialize cpufreq-based invariance before subsys
- smb: server: don't use delayed_work for post_recv_credits_work
- smb: server: use disable_work_sync in transport_rdma.c
- bpf: Check the helper function is valid in get_helper_proto
- btrfs: don't allow adding block device of less than 1 MB
- NFS: Protect against 'eof page pollution'
- NFSv4.2: Protect copy offload and clone against 'eof page pollution'
- drm/amdkfd: fix p2p links bug in topology
- amd/amdkfd: correct mem limit calculation for small APUs
- wifi: virt_wifi: Fix page fault on connect
- bpf: Reject bpf_timer for PREEMPT_RT
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
- xfrm: fix offloading of cross-family tunnels
- can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
- [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer
overflow
- can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
- can: peak_usb: fix shift-out-of-bounds issue
- net: tun: Update napi->skb after XDP process
- net/smc: fix warning in smc_rx_splice() when calling get_page()
- [arm64] ethernet: rvu-af: Remove slash from the driver name
- Bluetooth: hci_sync: Fix hci_resume_advertising_sync
- Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
- vhost: Take a reference on the task in struct vhost_task.
- Bluetooth: MGMT: Fix possible UAFs
- broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
- broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
- bnxt_en: correct offset handling for IPv6 destination address
- net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
- nexthop: Forbid FDB status change while nexthop is in a group
- net/mlx5: fs, fix UAF in flow counter release
- net/mlx5: HWS, remove unused create_dest_array parameter
- net/mlx5: HWS, ignore flow level for multi-dest table
- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
- [arm64] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
- [amd64] drm/gma500: Fix null dereference in hdmi teardown
- futex: Prevent use-after-free during requeue-PI
- gpio: regmap: fix memory leak of gpio_regmap structure
- drm/xe/vf: Don't expose sysfs attributes not applicable for VFs
- drm/xe: Fix build with CONFIG_MODULES=n
- [amd64] drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER
- drm/amd/display: remove output_tf_change flag
- futex: Use correct exit on failure from futex_hash_allocate_default()
- [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release
- [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
- smb: client: fix wrong index reference in smb2_compound_op()
- Revert "drm/xe/guc: Set RCS/CCS yield policy"
- Revert "drm/xe/guc: Enable extended CAT error reporting"
- tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()
- HID: asus: add support for missing PX series fn keys
- i40e: add validation for ring_len param
- i40e: fix idx validation in i40e_validate_queue_map
- i40e: fix idx validation in config queues msg
- i40e: fix input validation logic for action_meta
- i40e: fix validation of VF state in get resources
- i40e: add max boundary check for VF filters
- i40e: add mask to apply valid bits for itr_idx
- i40e: improve VF MAC filters accounting
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
- tracing: dynevent: Add a missing lockdown check on dynevent
- tracing: fgraph: Protect return handler from recursion loop
- tracing: fprobe: Fix to remove recorded module addresses from filter
- [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address
- [arm64] dts: marvell: cn913x-solidrun: fix sata ports status
- drm/xe: Don't copy pinned kernel bos twice on suspend
- drm/ast: Use msleep instead of mdelay for edid read
- drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume
- Revert "vhost/net: Defer TX queue re-enable until after sendmsg"
- vhost-net: flush batched before enabling notifications
- afs: Fix potential null pointer dereference in afs_put_server
- fs/proc/task_mmu: check p->vec_buf for NULL
- gpiolib: Extend software-node support to support secondary software-nodes
- netfs: fix reference leak
- [riscv64] Use an atomic xchg in pudp_huge_get_and_clear()
- [amd64] x86/topology: Implement topology_is_core_online() to address SMT
regression
- mm/hugetlb: fix folio is still mapped when deleted
- mm/damon/sysfs: do not ignore callback's return value in
damon_sysfs_damon_call()
- fbcon: fix integer overflow in fbcon_do_set_font
- fbcon: Fix OOB access in font allocation
- wifi: iwlwifi: fix byte count table for old devices
- wifi: iwlwifi: pcie: fix byte count table for some devices
- sched_ext: idle: Make local functions static in ext_idle.c
- sched_ext: idle: Handle migration-disabled tasks in BPF code
- spi: cadence-quadspi: Implement refcount to handle unbind during busy
- spi: cadence-qspi: defer runtime support on socfpga if reset bit is
enabled
- iommufd: Fix race during abort for file descriptors
.
linux (6.16.9-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.9
- cgroup: split cgroup_destroy_wq into 3 workqueues
- btrfs: fix invalid extref key setup when replaying dentry
- btrfs: zoned: fix incorrect ASSERT in btrfs_zoned_reserve_data_reloc_bg()
- perf maps: Ensure kmap is set up for all inserts
- wifi: wilc1000: avoid buffer overflow in WID string configuration
- nvme: fix PI insert on write
- ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not
supported
- wifi: mt76: do not add non-sta wcid entries to the poll list
- wifi: mac80211: increase scan_ies_len for S1G
- wifi: mac80211: fix incorrect type for ret
- smb: server: let smb_direct_writev() respect SMB_DIRECT_MAX_SEND_SGES
- net/mlx5: Not returning mlx5_link_info table when speed is unknown
- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
- dpll: fix clock quality level reporting
- rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()
- rxrpc: Fix untrusted unsigned subtract
- qed: Don't collect too many protection override GRC elements
- net: dst_metadata: fix IP_DF bit not extracted from tunnel headers
- bonding: set random address only when slaves already exist
- mptcp: set remote_deny_join_id0 on SYN recv
- mptcp: tfo: record 'deny join id0' info
- net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
- ice: fix Rx page leak on multi-buffer frames
- i40e: remove redundant memory barrier when cleaning Tx descs
- ixgbe: initialize aci.lock before it's used
- ixgbe: destroy aci.lock later within ixgbe_remove path
- igc: don't fail igc_probe() on LED setup error
- doc/netlink: Fix typos in operation attributes
- net/mlx5e: Harden uplink netdev access against device unbind
- net/mlx5e: Add a miss level for ipsec crypto offload
- bonding: don't set oif to bond dev when getting NS target destination
- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
- tls: make sure to abort the stream if headers are bogus
- Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
- net: clear sk->sk_ino in sk_set_socket(sk, NULL)
- net: liquidio: fix overflow in octeon_init_instr_queue()
- cnic: Fix use-after-free bugs in cnic_delete_task
- [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
- ksmbd: smbdirect: validate data_offset and data_length field of
smb_direct_data_transfer
- ksmbd: smbdirect: verify remaining_data_length respects
max_fragmented_recv_size
- zram: fix slot write race condition
- nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
- power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
- power: supply: bq27xxx: restrict no-battery detection to bq27000
- Revert "sched_ext: Skip per-CPU tasks in scx_bpf_reenqueue_local()"
- btrfs: initialize inode::file_extent_tree after i_mode has been set
- dm-raid: don't set io_min and io_opt for raid1
- dm-stripe: fix a possible integer overflow
- mm/gup: check ref_count instead of lru before migration
- mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU
batch"
- gup: optimize longterm pin_user_pages() for large folio
- mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
- mm: revert "mm: vmscan.c: fix OOM on swap stress test"
- mm: folio_may_be_lru_cached() unless folio_test_large()
- [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of
switch_to_super_page()
- [amd64] iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
- [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level
- [s390x] iommu/s390: Fix memory corruption when using identity domain
- [s390x] iommu/s390: Make attach succeed when the device was surprise
removed
- btrfs: tree-checker: fix the incorrect inode ref size check
- [amd64] ASoC: SDCA: Add quirk for incorrect function types for 3 systems
- [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S
interface
- [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if
source graph failed
- [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
- [armhf] mmc: mvsdio: Fix dma_unmap_sg() nents value
- mmc: sdhci: Move the code related to setting the clock from
sdhci_set_ios_common() into sdhci_set_ios()
- mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a
power-on
- mmc: sdhci-uhs2: Fix calling incorrect sdhci_set_clock() function
- x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT
- [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is
active
- drm/amdkfd: add proper handling for S0ix
- drm/amdgpu: suspend KFD and KGD user queues for S0ix
- drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put
- drm/amd: Only restore cached manual clock settings in restore if OD
enabled
- io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow
- io_uring: include dying ring in task_work "should cancel" state
- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
- gpiolib: acpi: initialize acpi_gpio_info struct
- [amd64] crypto: ccp - Always pass in an error pointer to
__sev_platform_shutdown_locked()
- rds: ib: Increment i_fastreg_wrs before bailing out
- mptcp: propagate shutdown to subflows when possible
- ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
- [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
message
- [amd64] ASoC: SDCA: Fix return value in sdca_regmap_mbq_size()
- [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace
- [amd64] iommu/amd: Fix alias device DTE setting
- [amd64] ASoC: amd: acp: Fix incorrect retrival of acp_chip_info
- drm/xe/tile: Release kobject for the failure path
- drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation
- [arm64] drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
- [arm64] drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
- drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
- ALSA: usb: qcom: Fix false-positive address space check
- drm/xe: Fix error handling if PXP fails to start
- drm/xe/guc: Enable extended CAT error reporting
- drm/xe/guc: Set RCS/CCS yield policy
- smb: smbdirect: introduce smbdirect_socket.recv_io.expected
- smb: client: make use of smbdirect_socket->recv_io.expected
- smb: smbdirect: introduce struct smbdirect_recv_io
- smb: client: make use of struct smbdirect_recv_io
- smb: client: let recv_done verify data_offset, data_length and
remaining_data_length
- smb: client: fix filename matching of deferred files
- smb: client: use disable[_delayed]_work_sync in smbdirect.c
- smb: client: let smbd_destroy() call
disable_work_sync(&info->post_send_credits_work)
- crypto: af_alg - Set merge to zero early in af_alg_sendmsg
- io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
- smb: client: fix file open check in __cifs_unlink()
- smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
- io_uring: fix incorrect io_kiocb reference in io_link_skb
- [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on
ASUS ROG Z13
- [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk
- mptcp: pm: nl: announce deny-join-id0 flag
- dt-bindings: serial: 8250: allow clock 'uartclk' and 'reg' for
nxp,lpc1850-uart
- dt-bindings: serial: 8250: spacemit: set clocks property as required
- dt-bindings: serial: 8250: move a constraint
- clk: sunxi-ng: mp: Fix dual-divider clock rate readback
.
linux (6.16.8-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.8
- fs: add a FMODE_ flag to indicate IOCB_HAS_METADATA availability
- block: don't silently ignore metadata for sync read/write
- coredump: don't pointlessly check and spew warnings
- fuse: Block access to folio overlimit
- fhandle: use more consistent rules for decoding file handle from userns
- dma-debug: don't enforce dma mapping check on noncoherent allocations
- perf: Fix the POLL_HUP delivery breakage
- [arm64] irqchip/mvebu-gicp: Fix an IS_ERR() vs NULL check in probe()
- Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
- [amd64] iommu/vt-d: Split intel_iommu_domain_alloc_paging_flags()
- [amd64] iommu/vt-d: Create unique domain ops for each stage
- [amd64] iommu/vt-d: Split paging_domain_compatible()
- [amd64] iommu/vt-d: Make iotlb_sync_map a static property of dmar_domain
- Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
- Bluetooth: ISO: Fix getname not returning broadcast fields
- Revert "drm/amdgpu: Add more checks to PSP mailbox" (Closes: #1114806)
- flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
- SUNRPC: call xs_sock_process_cmsg for all cmsg
- NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898)
- md: keep recovery_cp in mdp_superblock_s
- trace/fgraph: Fix error handling
- NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
- NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported
- NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
- tracing: Fix tracing_marker may trigger page fault during preempt_disable
- nfs/localio: restore creds before releasing pageio data
- ftrace/samples: Fix function size computation
- tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()
- NFS: Serialise O_DIRECT i/o and truncate()
- NFSv4.2: Serialise O_DIRECT i/o and fallocate()
- NFSv4.2: Serialise O_DIRECT i/o and clone range
- NFSv4.2: Serialise O_DIRECT i/o and copy range
- NFS: nfs_invalidate_folio() must observe the offset and size arguments
- NFSv4/flexfiles: Fix layout merge mirror check.
- tracing: Silence warning when chunk allocation fails in trace_pid_write
- bpf, cpumap: Disable page_pool direct xdp_return need larger scope
- [amd64] cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode
for performance governor
- [s390x] pai: Deny all events not handled by this PMU
- [s390x] cpum_cf: Deny all sampling events by counter PMU
- [amd64] cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume
- bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
- xsk: Fix immature cq descriptor production
- rqspinlock: Choose trylock fallback for NMI waiters
- bpf: Allow fall back to interpreter for programs with stack size <= 512
- bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
- tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate
psock->cork.
- proc: fix type confusion in pde_set_flags()
- Revert "SUNRPC: Don't allow waiting for exiting tasks"
- [arm64] kexec: initialize kexec_buf struct in load_other_segments()
- mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
- doc: mptcp: net.mptcp.pm_type is deprecated
- netlink: specs: mptcp: fix if-idx attribute type
- ocfs2: fix recursive semaphore deadlock in fiemap call
- btrfs: fix squota compressed stats leak
- btrfs: fix subvolume deletion lockup caused by inodes xarray race
- [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT
- net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM
wakeups
- PM: EM: Add function for registering a PD without capacity update
- PM: hibernate: Restrict GFP mask in hibernation_snapshot()
(Closes: #1115002)
- wifi: iwlwifi: fix 130/1030 configs
- [s390x] kexec: initialize kexec_buf struct
- smb: client: fix compound alignment with encryption
- smb: client: fix data loss due to broken rename(2)
- [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
- [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite
- fuse: do not allow mapping a non-regular backing file
- fuse: check if copy_file_range() returns larger than requested size
- fuse: prevent overflow in copy_file_range return value
- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range()
- mm/khugepaged: fix the address passed to notifier on testing young
- mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison
memory
- mm/memory-failure: fix redundant updates for already poisoned pages
- mm/damon/core: set quota->charged_from to jiffies at first charge window
- mm/damon/lru_sort: avoid divide-by-zero in
damon_lru_sort_apply_parameters()
- [arm64] drm/mediatek: fix potential OF node use-after-free
- [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration
- drm/xe: Attempt to bring bos back to VRAM after eviction
- drm/xe: Allow the pm notifier to continue on failure
- drm/xe: Block exec and rebind worker while evicting for suspend /
hibernate
- drm/amdgpu: fix a memory leak in fence cleanup when unloading
- drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
- drm/amd/display: Correct sequences and delays for DCN35 PG & RCG
- drm/amd/display: remove oem i2c adapter on finish
- drm/edid: Define the quirks in an enum list
- drm/edid: Add support for quirks visible to DRM core and drivers
- drm/dp: Add an EDID quirk for the DPCD register access probe
- drm/amd/display: Disable DPCD Probe Quirk
- btrfs: use readahead_expand() on compressed extents
- btrfs: fix corruption reading compressed range when block size is smaller
than page size
- kernfs: Fix UAF in polling when open file is released
- libceph: fix invalid accesses to ceph_connection_v1_info
- ceph: fix race condition validating r_parent before applying state
- ceph: fix race condition where r_parent becomes stale before sending
message
- ceph: always call ceph_shift_unused_folios_left()
- ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
- [arm64] mtd: spinand: Add a ->configure_chip() hook
- [arm64] mtd: spinand: winbond: Enable high-speed modes on w25n0xjw
- [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW
- mm/damon/sysfs: fix use-after-free in state_show()
- mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
- drm/amd/display: Destroy cached state in complete() callback
- drm/amd/display: Drop dm_prepare_suspend() and dm_complete()
- drm/amd/amdgpu: Declare isp firmware binary file
- hrtimers: Unconditionally update target CPU base after offline timer
migration
- fs/resctrl: Eliminate false positive lockdep warning when reading SNC
counters
- [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon
- Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
- Input: xpad - add support for Flydigi Apex 5
- Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO
runtime PM wakeups"
- tty: hvc_console: Call hvc_kick in hvc_write unconditionally
- dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
- USB: serial: option: add Telit Cinterion FN990A w/audio compositions
- USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
- [arm64] drm/panthor: validate group queue count
- [arm64,armhf] net: fec: Fix possible NPD in
fec_enet_phy_reset_after_clk_enable()
- net: phylink: add lock for serializing concurrent pl->phydev writes with
resolver
- net: phy: transfer phy_config_inband() locking responsibility to phylink
- wifi: ath12k: Fix missing station power save configuration
- wifi: ath12k: add link support for multi-link in arsta
- wifi: ath12k: Add support to enqueue management frame at MLD level
- wifi: ath12k: fix WMI TLV header misalignment
- [armhf] PCI: mvebu: Fix use of for_each_of_range() iterator
- genetlink: fix genl_bind() invoking bind() after -EPERM
- [armhf] net: dsa: b53: fix ageing time for BCM53101
- net: bridge: Bounce invalid boolopts
- tunnels: reset the GSO metadata before reusing the skb
- docs: networking: can: change bcm_msg_head frames member to support
flexible array
- igb: Fix NULL pointer dereference in ethtool loopback test
- igb: fix link test skipping when interface is admin down
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
- drm/xe/configfs: Don't touch survivability_mode on fini
- drm/amd/display: use udelay rather than fsleep
- net: dev_ioctl: take ops lock in hwtstamp lower paths
- macsec: sync features on RTM_NEWLINK
- can: j1939: implement NETDEV_UNREGISTER notification handler
- can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when
j1939_local_ecu_get() failed
- can: j1939: j1939_local_ecu_get(): undo increment when
j1939_local_ecu_get() fails
- netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation
- netfilter: nft_set_pipapo: remove unused arguments
- netfilter: nft_set: remove one argument from lookup and update functions
- netfilter: nft_set_pipapo: merge pipapo_get/lookup
- netfilter: nft_set_pipapo: don't return bogus extension pointer
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups
- netfilter: nft_set_rbtree: continue traversal if element is inactive
- netfilter: nf_tables: Reintroduce shortened deletion notifications
- netfilter: nf_tables: place base_seq in struct net
- netfilter: nf_tables: make nft_set_do_lookup available unconditionally
- netfilter: nf_tables: restart set lookup on base_seq change
- hsr: use rtnl lock when iterating over ports
- hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
- hsr: hold rcu and dev lock for hsr_get_port_ndev
- [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties
- [amd64] dmaengine: idxd: Remove improper idxd_free
- [amd64] dmaengine: idxd: Fix refcount underflow on module unload
- [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs()
- erofs: get rid of {get,put}_page() for ztailpacking data
- erofs: remove need_kmap in erofs_read_metabuf()
- erofs: unify meta buffers in z_erofs_fill_inode()
- erofs: fix invalid algorithm for encoded extents
- [armhf] dmaengine: ti: edma: Fix memory allocation size for
queue_priority_map
- erofs: fix runtime warning on truncate_folio_batch_exceptionals()
- xhci: fix memory leak regression when freeing xhci vdev devices depth
first
- USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
- [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode
drivers
- [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for
num-channels/ees
- [arm64] phy: qcom: qmp-pcie: Fix PHY initialization when powered down by
firmware
- [arm64] phy: tegra: xusb: fix device and OF node leak at probe
- [armhf] phy: ti: omap-usb2: fix device leak at unbind
- [armhf] phy: ti-pipe3: fix device leak at unbind
- netfilter: nft_set_pipapo: fix null deref for empty set
.
[ Santiago Ruano Rincón ]
* d/salsa-ci.yml: Merge the extract-source job into the build's job script
* d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
lintian tags.
* d/salsa-ci.yml: Early move orig tarballs back where they can be cached
.
linux (6.16.7-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.7
- [amd64] Add mitigations for VMSCAPE (CVE-2025-40300):
- x86/vmscape: Enumerate VMSCAPE bug
- x86/vmscape: Add conditional IBPB mitigation
- x86/vmscape: Enable the mitigation
- x86/bugs: Move cpu_bugs_smt_update() down
- x86/vmscape: Warn when STIBP is disabled with SMT
- x86/vmscape: Add old Intel CPUs to affected list
.
linux (6.16.6-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.6
- btrfs: fix race between logging inode and checking if it was logged before
- btrfs: fix race between setting last_dir_index_offset and inode logging
- btrfs: avoid load/store tearing races when checking if an inode was logged
- ASoC: soc-core: care NULL dirver name on
snd_soc_lookup_component_nolocked()
- [amd64] ASoC: SOF: Intel: WCL: Add the sdw_process_wakeen op
- ALSA: usb-audio: Allow Focusrite devices to use low samplerates
- cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
- drm/amd/display: Don't warn when missing DCE encoder caps
- cpupower: Fix a bug where the -t option of the set subcommand was not
working.
- Bluetooth: hci_sync: Avoid adding default advertising on startup
- [arm64] drm/rockchip: vop2: make vp registers nonvolatile
- btrfs: clear block dirty if submit_one_sector() failed
- btrfs: zoned: skip ZONE FINISH of conventional zones
- [amd64] platform/x86/amd: pmc: Drop SMU F/W match for Cezanne
- fs: writeback: fix use-after-free in __mark_inode_dirty()
- tee: fix NULL pointer dereference in tee_shm_put
- tee: fix memory leak in tee_dyn_shm_alloc_helper
- [arm64] dts: rockchip: mark eeprom as read-only for Radxa E52C
- [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
- [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
- [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off
- [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics
i.MX8M Plus DHCOM
- [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M
Plus eDM SBC
- [arm64] dts: rockchip: Fix the headphone detection on the orangepi 5 plus
- [arm64] dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5
- wifi: cfg80211: fix use-after-free in cmp_bss()
- wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info
work
- wifi: mt76: mt7921: don't disconnect when CSA to DFS chan
- wifi: mt76: mt7925: fix locking in mt7925_change_vif_links()
- wifi: mt76: prevent non-offchannel mgmt tx during scan/roc
- wifi: mt76: mt7996: disable beacons when going offchannel
- wifi: mt76: mt7996: use the correct vif link for scanning/roc
- wifi: mt76: mt7996: add missing check for rx wcid entries
- wifi: mt76: mt7915: fix list corruption after hardware restart
- wifi: mt76: free pending offchannel tx frames on wcid cleanup
- wifi: mt76: fix linked list corruption
- netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in()
after confirm
- netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
- wifi: iwlwifi: if scratch is ~0U, consider it a failure
- wifi: iwlwifi: acpi: check DSM func validity
- wifi: iwlwifi: uefi: check DSM item validity
- wifi: iwlwifi: cfg: restore some 1000 series configs
- wifi: iwlwifi: cfg: add back more lost PCI IDs
- Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
- netfilter: nft_flowtable.sh: re-run with random mtu sizes
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
- [amd64] xirc2ps_cs: fix register access when enabling FullDuplex
- ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
- mISDN: Fix memory leak in dsp_hwec_enable()
- bnxt_en: fix incorrect page count in RX aggr ring log
- icmp: fix icmp_ndo_send address translation for reply direction
- eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring
- net: macb: Fix tx_ptr_lock locking
- macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
- net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
- net: mctp: mctp_fraq_queue should take ownership of passed skb
- net: mctp: usb: initialise mac header in RX path
- ice: fix NULL access of tx->in_use in ice_ptp_ts_irq
- ice: fix NULL access of tx->in_use in ice_ll_ts_intr
- idpf: set mac type when adding and removing MAC filters
- i40e: remove read access to debugfs files
- i40e: Fix potential invalid access when MAC list is empty
- ixgbe: fix incorrect map used in eee linkmode
- wifi: ath12k: Set EMLSR support flag in MLO flags for EML-capable stations
- wifi: ath11k: fix group data packet drops during rekey
- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
- [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
- wifi: cw1200: cap SSID length in cw1200_do_join()
- wifi: libertas: cap SSID len in lbs_associate()
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
- net: remove sock_i_uid()
- net: lockless sock_i_ino()
- [arm64] net: thunder_bgx: add a missing of_node_put
- [arm64] net: thunder_bgx: decrement cleanup index before use
- ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
- net/smc: Remove validation of reserved bits in CLC Decline message
- mctp: return -ENOPROTOOPT for unknown getsockopt options
- ax25: properly unshare skbs in ax25_kiss_rcv()
- netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX
- net: atm: fix memory leak in atm_register_sysfs when device_register fail
- net: xilinx: axienet: Add error handling for RX metadata pointer retrieval
- ppp: fix memory leak in pad_compress_skb
- phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
- ALSA: usb-audio: Add mute TLV for playback volumes on some devices
- [amd64] accel/ivpu: Prevent recovery work from being queued during device
removal
- ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
- [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with
CONFIG_DYNAMIC_FTRACE
- pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
- mm/slub: avoid accessing metadata when pointer is invalid in object_err()
- [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and
arch_sync_kernel_mappings()
- mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
- mm: fix accounting of memmap pages
- mm: move page table sync declarations to linux/pgtable.h
- mm: introduce and use {pgd,p4d}_populate_kernel()
- mm: fix possible deadlock in kmemleak
- mm: slub: avoid wake up kswapd in set_track_prepare
- sched: Fix sched_numa_find_nth_cpu() if mask offline
- ocfs2: prevent release journal inode after journal shutdown
- of_numa: fix uninitialized memory nodes causing kernel panic
- [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize
- wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz
- wifi: mwifiex: Initialize the chan_stats array to zero
- wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete
- wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
- wifi: mt76: mt7925: fix the wrong bss cleanup for SAP
- wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state for
sta_cmd
- drm/xe: Fix incorrect migration of backed-up object to VRAM
- drm/amdgpu: drop hw access in non-DC audio fini
- drm/amdgpu/mes11: make MES_MISC_OP_CHANGE_CONFIG failure non-fatal
- drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
- drm/amdgpu/sdma: bump firmware version checks for user queue support
- [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042
quirks list
- scsi: lpfc: Fix buffer free/clear order in deferred receive path
- nouveau: fix disabling the nonstall irq due to storm code
- nouveau: Membar before between semaphore writes and the interrupt
- audit: fix out-of-bounds read in audit_compare_dname_path()
- batman-adv: fix OOB read/write in network-coding decode
- cifs: prevent NULL pointer dereference in UTF16 conversion
- e1000e: fix heap overflow in e1000_set_eeprom
- [arm64,armhf] net: dsa: mv88e6xxx: Fix fwnode reference leaks in
mv88e6xxx_port_setup_leds
- drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to
TRAINING_PATTERN_SET
- ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
- ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
- ALSA: hda: tas2781: fix tas2563 EFI data endianness
- ALSA: hda: tas2781: reorder tas2563 calibration variables
- pcmcia: omap: Add missing check for platform_get_resource
- pcmcia: Add error handling for add_interval() in do_validate_mem()
- [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan
quirk
- [amd64] platform/x86: asus-wmi: Fix racy registrations (Closes: #1110703)
- [amd64] platform/x86: acer-wmi: Stop using ACPI bitmap for platform
profile choices
- [amd64] platform/x86/intel: power-domains: Use
topology_logical_package_id() for package ID
- hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
- hwmon: (ina238) Correctly clamp temperature
- scsi: sr: Reinstate rotational media flag
- hwmon: (ina238) Correctly clamp shunt voltage limit
- hwmon: (ina238) Correctly clamp power limits
- drm/bridge: ti-sn65dsi86: fix REFCLK setting
- perf bpf-event: Fix use-after-free in synthesis
- perf bpf-utils: Constify bpil_array_desc
- perf bpf-utils: Harden get_bpf_prog_info_linear
- spi: spi-qpic-snand: unregister ECC engine on probe error and device
remove
- drm/amd/amdgpu: Fix missing error return on kzalloc failure
- md/raid1: fix data lost for writemostly rdev
- md: prevent incorrect update of resync/recovery offset
- [amd64] drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
- [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
- [riscv64] Only allow LTO with CMODEL_MEDANY
- [riscv64] uaccess: fix __put_user_nocheck for unaligned accesses
- [riscv64] use lw when reading int cpu in new_vmalloc_check
- [riscv64] use lw when reading int cpu in asm_per_cpu
- [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
- [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id
- [riscv64] kexec: Initialize kexec_buf struct
- [riscv64] Fix sparse warning in __get_user_error()
- [riscv64] Fix sparse warning about different address spaces
- Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
.
[ Salvatore Bonaccorso ]
* drivers/leds/trigger: Enable LEDS_TRIGGER_INPUT_EVENTS as module
(Closes: #1113681)
.
linux (6.16.5-1) unstable; urgency=medium
.
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.4
- serial: 8250: fix panic due to PSLVERR
- ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
- platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
- PM: runtime: Take active children into account in
pm_runtime_get_if_in_use()
- dm: dm-crypt: Do not partially accept write BIOs with zoned targets
- dm: Check for forbidden splitting of zone write operations
- usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
- usb: gadget: udc: renesas_usb3: fix device leak at unbind
- usb: musb: omap2430: fix device leak at unbind
- [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind
- [arm64] usb: dwc3: imx8mp: fix device leak at unbind
- bus: mhi: host: Fix endianness of BHI vector table
- bus: mhi: host: Detect events pointing to unexpected TREs
- vt: keyboard: Don't process Unicode characters in K_OFF mode
- vt: defkeymap: Map keycodes above 127 to K_HOLE
- netfs: Fix unbuffered write error handling
- [armel,armhf] lib/crypto: arm/poly1305: Fix register corruption in no-SIMD
contexts
- [arm64] lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD
contexts
- [amd64] crypto: qat - lower priority for skcipher and aead algorithms
- [amd64] crypto: ccp - Fix SNP panic notifier unregistration
- [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM /
iMX8ULP
- [amd64] crypto: qat - flush misc workqueue during device shutdown
- [amd64] crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
- [amd64] crypto: x86/aegis - Add missing error checks
- crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390)
- Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
- ksmbd: fix refcount leak causing resource not released
- ksmbd: extend the connection limiting mechanism to support IPv6
- tracing: fprobe-event: Sanitize wildcard for fprobe event name
- ext4: preserve SB_I_VERSION on remount
- ext4: check fast symlink for ea_inode correctly
- ext4: fix fsmap end of range reporting with bigalloc
- ext4: fix reserved gdt blocks handling in fsmap
- ext4: use kmalloc_array() for array space allocation
- ext4: fix hole length calculation overflow in non-extent inodes
- btrfs: zoned: fix write time activation failure for metadata block group
- btrfs: fix incorrect log message for nobarrier mount option
- btrfs: restore mount option info messages during mount
- btrfs: fix printing of mount info messages for NODATACOW/NODATASUM
- [arm64] dts: apple: t8012-j132: Include touchbar framebuffer node
- [arm64] dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
- [arm64] dts: exynos7870-j6lte: reduce memory ranges to base amount
- [arm64] dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
- [arm64] dts: exynos7870: add quirk to disable USB2 LPM in gadget mode
- [arm64] dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576
- [arm64] dts: rockchip: Enable HDMI PHY clk provider on rk3576
- [arm64] dts: exynos: gs101: ufs: add dma-coherent property
- [arm64] dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
- [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file
- [arm64] dts: exynos7870-on7xelte: reduce memory ranges to base amount
- [arm64] dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
- [arm64] dts: rockchip: Remove workaround that prevented Turing RK1 GPU
power regulator control
- apparmor: Fix 8-byte alignment for initial dfa blob streams
- dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
- dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks
constraints
- dt-bindings: display: vop2: Add optional PLL clock property for rk3576
- scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host
- [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
- scsi: mpi3mr: Fix race between config read submit and interrupt completion
- ata: libata-scsi: Fix ata_to_sense_error() status handling
- ata: libata-scsi: Return aborted command when missing sense and result TF
- scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host
controllers
- scsi: ufs: ufs-pci: Fix default runtime and system PM levels
- ata: libata-scsi: Fix CDL control
- [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
- iio: imu: bno055: fix OOB access of hw_xlate array
- iio: adc: ad_sigma_delta: change to buffer predisable
- iio: adc: ad7173: fix channels index for syscalib_mode
- iio: adc: ad7173: fix calibration channel
- iio: adc: ad7173: fix setting ODR in probe
- wifi: brcmsmac: Remove const from tbl_ptr parameter in
wlc_lcnphy_common_read_table()
- wifi: ath12k: fix dest ring-buffer corruption
- wifi: ath12k: fix source ring-buffer corruption
- wifi: ath12k: fix dest ring-buffer corruption when ring is full
- wifi: ath11k: fix dest ring-buffer corruption
- wifi: ath11k: fix source ring-buffer corruption
- wifi: ath11k: fix dest ring-buffer corruption when ring is full
- pwm: mediatek: Handle hardware enable and clock enable separately
- pwm: mediatek: Fix duty and period setting
- mtd: spi-nor: Fix spi_nor_try_unlock_all()
- [arm64] mtd: spinand: propagate spinand_wait() errors from
spinand_write_page()
- [arm64] mfd: mt6397: Do not use generic name for keypad sub-devices
- readahead: fix return value of page_cache_next_miss() when no hole is
found
- PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
- PCI: Fix link speed calculation on retrain failure
- PCI: endpoint: Fix configfs group list head handling
- PCI: endpoint: Fix configfs group removal on driver teardown
- [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features
- [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4
in epc_features
- [arm64,armhf] PCI: imx6: Remove apps_reset toggling from
imx_pcie_{assert/deassert}_core_reset
- [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written
- vsock/virtio: Validate length in packet header before skb_put()
- vhost/vsock: Avoid allocating arbitrarily-sized SKBs
- amdgpu/amdgpu_discovery: increase timeout limit for IFWI init
- [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in
resume context
- block: restore default wbt enablement
- f2fs: fix to avoid out-of-boundary access in dnode page
- [amd64] i2c: qcom-geni: fix I2C frequency table to achieve accurate bus
rates
- iomap: Fix broken data integrity guarantees for O_SYNC writes
- jbd2: prevent softlockup in jbd2_log_do_checkpoint()
- kbuild: userprogs: use correct linker when mixing clang and GNU ld
- Mark xe driver as BROKEN if kernel page size is not 4kB
- open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
- proc: proc_maps_open allow proc_mem_open to return NULL
- [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state
- media: gspca: Add bounds checking to firmware parser
- media: hi556: correct the test pattern configuration
- [armhf] media: imx: fix a potential memory leak in
imx_media_csc_scaler_device_init()
- media: ipu6: isys: Use correct pads for xlate_streams()
- media: vivid: fix wrong pixel_array control size
- media: verisilicon: Fix AV1 decoder clock frequency
- media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
- media: usbtv: Lock resolution while streaming
- media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
- media: pisp_be: Fix pm_runtime underrun in probe
- media: ov2659: Fix memory leaks in ov2659_probe()
- media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
- media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable()
calls
- [arm64] media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of
SDM660/SDM670 phy init
- [arm64] media: qcom: camss: cleanup media device allocated resource on
error path
- [arm64] media: qcom: camss: Remove extraneous -supply postfix on supply
names
- [arm64] media: venus: Add a check for packet size after reading from
shared memory
- [arm64] media: venus: Fix MSM8998 frequency table
- [arm64] media: venus: hfi: explicitly release IRQ during teardown
- [arm64] media: venus: protect against spurious interrupts during probe
- [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than
240.
- [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than
240
- drm/xe/bmg: Add one additional PCI ID
- drm/xe: Defer buffer object shrinker write-backs and GPU waits
- drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access
- drm/amdgpu/discovery: fix fw based ip discovery
- drm/amd: Restore cached power limit during resume
- drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14
- drm/amdgpu: add missing vram lost check for LEGACY RESET
- drm/amdgpu: Avoid extra evict-restore process.
- drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
- drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram()
- drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job
- drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop
- drm/amdgpu: Update external revid for GC v9.5.0
- drm/amdgpu: update mmhub 3.0.1 client id mappings
- drm/amdgpu: update mmhub 3.3 client id mappings
- drm/amdgpu: update mmhub 4.1.0 client id mappings
- drm/amdgpu: Update supported modes for GC v9.5.0
- drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
- drm/amdkfd: Fix checkpoint-restore on multi-xcc
- drm/amd/display: Add primary plane to commits for correct VRR handling
- drm/amd/display: fix a Null pointer dereference vulnerability
- drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming.
- drm/amd/display: fix initial backlight brightness calculation
- drm/amd/display: Pass up errors for reset GPU that fails to init HW
- drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value"
- drm/amd/display: Don't overwrite dce60_clk_mgr
- net, hsr: reject HSR frame if skb can't hold tag
- sched/ext: Fix invalid task state transitions on class switch
- ipv6: sr: Fix MAC comparison to be constant-time
- cgroup: avoid null de-ref in css_rstat_exit()
- cpuidle: governors: menu: Avoid selecting states with too much latency
- ACPI: pfr_update: Fix the driver update version check
- ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text
- mptcp: drop skb if MPTCP skb extension allocation fails
- mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
- mptcp: remove duplicate sk_reset_timer call
- mptcp: disable add_addr retransmission when timeout is 0
- mm/damon/ops-common: ignore migration request to invalid nodes
- btrfs: move transaction aborts to the error site in
add_block_group_free_space()
- btrfs: always abort transaction on failure to add block group to free
space tree
- btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
- btrfs: reorganize logic at free_extent_buffer() for better readability
- btrfs: add comment for optimization in free_extent_buffer()
- btrfs: use refcount_t type for the extent buffer reference counter
- btrfs: fix subpage deadlock in try_release_subpage_extent_buffer()
- btrfs: add comments on the extra btrfs specific subpage bitmaps
- btrfs: rename btrfs_subpage structure
- btrfs: subpage: keep TOWRITE tag until folio is cleaned
- xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc
- xfs: return the allocated transaction from xfs_trans_alloc_empty
- xfs: improve the comments in xfs_select_zone_nowait
- xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
- xfs: Remove unused label in xfs_dax_notify_dev_failure
- erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y
- erofs: Do not select tristate symbols from bool symbols
- crypto: acomp - Fix CFI failure due to type punning
- [riscv64] iommu/riscv: prevent NULL deref in iova_to_phys
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure
- iov_iter: iterate_folioq: fix handling of offset >= folio size
- [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
- mm/damon/core: fix commit_ops_filters by using correct nth function
- [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before
power-up
- mmc: sdhci-pci-gli: Add a new function to simplify the code
- kho: init new_physxa->phys_bits to fix lockdep
- kho: mm: don't allow deferred struct page with KHO
- kho: warn if KHO is disabled due to an error
- memstick: Fix deadlock by moving removing flag earlier
- mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
- mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
- mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1
- NFS: Fix a race when updating an existing write
- squashfs: fix memory leak in squashfs_fill_super
- mm/damon/core: fix damos_commit_filter not changing allow
- mm/debug_vm_pgtable: clear page table entries at destroy_args()
- mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn
- mm/mremap: fix WARN with uffd that has remap events disabled
- ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
- ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook
830 G6
- RDMA/rxe: Flush delayed SKBs while releasing RXE resources
- [s390x] sclp: Fix SCCB present check
- [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC
- compiler: remove __ADDRESSABLE_ASM{_STR,}() again
- [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with
kvcalloc()
- drm/amdgpu/swm14: Update power limit logic
- [amd64] drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access
- drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()
- [amd64] drm/i915/gt: Relocate compression repacking WA for JSL/EHL
- [adm64] drm/i915/lnl+/tc: Fix handling of an enabled/disconnected dp-alt
sink
- [amd64] drm/i915/icl+/tc: Cache the max lane count value
- [amd64] drm/i915/lnl+/tc: Fix max lane count HW readout
- [amd64] drm/i915/lnl+/tc: Use the cached max lane count value
- [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
- drm/amd/display: Avoid a NULL pointer dereference
- drm/amd/display: Don't overclock DCE 6 by 15%
- drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
- drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
- drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
- drm/amd/display: Find first CRTC and its line time in
dce110_fill_display_configs
- drm/amd/display: Fill display clock and vblank time in
dce110_fill_display_configs
- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
- scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
- [arm64] PCI: rockchip: Use standard PCIe definitions
- [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
- drm/amdgpu: fix task hang from failed job submission during process kill
- [arm64] soc: qcom: mdt_loader: Fix error return values in
mdt_header_valid()
- xfs: fix frozen file system assert in xfs_trans_alloc
- debugfs: fix mount options not being applied
- fs: fix incorrect lflags value in the move_mount syscall
- btrfs: zoned: fix data relocation block group reservation
- fhandle: do_handle_open() should get FD with user flags
- libfs: massage path_from_stashed() to allow custom stashing behavior
- smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
- fs/buffer: fix use-after-free when call bh_read() helper
- signal: Fix memory leak for PIDFD_SELF* sentinels
- use uniform permission checks for all mount propagation changes
- iommu: Remove ops.pgsize_bitmap from drivers that don't use it
- iommu/virtio: Make instance lookup robust
- drm/amd: Restore cached manual clock settings during resume
- drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
- iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4
- iio: accel: sca3300: fix uninitialized iio scan data
- ftrace: Also allocate and copy hash for reading of filter files
- iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
- iio: adc: ad7124: fix channel lookup in syscalib functions
- iio: light: as73211: Ensure buffer holes are zeroed
- iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
- iio: adc: rzg2l_adc: Set driver data before enabling runtime PM
- iio: adc: bd79124: Add GPIOLIB dependency
- iio: adc: ad7173: prevent scan if too many setups requested
- iio: proximity: isl29501: fix buffered read on big-endian systems
- iio: adc: rzg2l: Cleanup suspend/resume path
- most: core: Drop device reference after usage in get_channel()
- kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
- cdx: Fix off-by-one error in cdx_rpmsg_probe()
- usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
- [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples
- [amd64] comedi: pcl726: Prevent invalid irq number
- [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and
do_insnlist_ioctl()
- usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE
test
- usb: renesas-xhci: Fix External ROM access timeouts
- USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
- usb: storage: realtek_cr: Use correct byte order for bcs->Residue
- USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
- usb: typec: maxim_contaminant: disable low power mode when reading
comparator values
- usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port
is clean
- usb: xhci: Fix slot_id resource race conflict
- usb: xhci: fix host not responding after suspend and resume
- usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
- usb: dwc3: Remove WARN_ON for device endpoint command timeouts
- usb: dwc3: pci: add support for the Intel Wildcat Lake
- tracing: Remove unneeded goto out logic
- tracing: Limit access to parser->buffer when trace_get_user failed
- ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp()
- PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up
- tls: fix handling of zero-length records on the rx_list
- [amd64] x86/CPU/AMD: Ignore invalid reset reason value
- [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
- devlink: let driver opt out of automatic phys_port_name generation
- ixgbe: prevent from unwanted interface name changes
- iio: imu: inv_icm42600: use = { } instead of memset()
- iio: imu: inv_icm42600: Convert to uXX and sXX integer types
- iio: imu: inv_icm42600: change invalid data error to -EBUSY
- spi: spi-qpic-snand: use correct CW_PER_PAGE value for OOB write
- spi: spi-fsl-lpspi: Clamp too high speed_hz
- spi: spi-qpic-snand: fix calculating of ECC OOB regions' properties
- drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().
- cgroup/cpuset: Use static_branch_enable_cpuslocked() on
cpusets_insane_config_key
- cgroup/cpuset: Fix a partition error with CPU hotplug
- iosys-map: Fix undefined behavior in iosys_map_clear()
- [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm
- RDMA/bnxt_re: Fix to do SRQ armena by default
- RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
- RDMA/bnxt_re: Fix a possible memory leak in the driver
- RDMA/bnxt_re: Fix to initialize the PBL array
- RDMA/core: Free pfn_list with appropriate kvfree call
- [arm64] RDMA/hns: Fix dip entries leak on devices newer than hip09
- net: bridge: fix soft lockup in br_multicast_query_expired()
- net/sched: Fix backlog accounting in qdisc_dequeue_internal
- scsi: qla4xxx: Prevent a potential error pointer dereference
- [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline
(CVE-2025-38676)
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
- Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings
- Bluetooth: hci_core: Fix using ll_privacy_capable for current settings
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
- Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections
- Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
- drm: nova-drm: fix 32-bit arm build
- md: rename recovery_cp to resync_offset
- md: add helper rdev_needs_recovery()
- md: fix sync_action incorrect display during resync
- [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac
init failed
- [arm64] drm/hisilicon/hibmc: fix irq_request()'s irq name variable is
local
- [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug
- [arm64] drm/hisilicon/hibmc: fix rare monitors cannot display problem
- [arm64] drm/hisilicon/hibmc: fix dp and vga cannot show together
- ALSA: usb-audio: Fix size validation in convert_chmap_v3()
- [arm64] regulator: pca9450: Use devm_register_sys_off_handler
- drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
- drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
- drm/amd/display: Don't print errors for nonexistent connectors
- net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
- ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
- bnxt_en: Fix lockdep warning during rmmod
- scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock
- scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl()
- scsi: ufs: ufs-qcom: Update esi_vec_mask for HW major version >= 6
- scsi: ufs: ufs-qcom: Fix ESI null pointer dereference
- [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
- ppp: fix race conditions in ppp_fill_forward_path
- net: ti: icssg-prueth: Fix HSR and switch offload Enablement during
firwmare reload.
- drm/xe: Assign ioctl xe file handler to vm in xe_vm_create
- cifs: Fix oops due to uninitialised variable
- phy: mscc: Fix timestamping for vsc8584
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
- gve: prevent ethtool ops after shutdown
- [riscv64] net: stmmac: thead: Enable TX clock before MAC initialization
- net/smc: fix UAF on smcsk after smc_listen_out()
- net/mlx5: HWS, fix bad parameter in CQ creation
- net/mlx5: HWS, fix complex rules rehash error flow
- net/mlx5: HWS, Fix table creation UID
- net/mlx5: CT: Use the correct counter offset
- ASoC: cs35l56: Update Firmware Addresses for CS35L63 for production
silicon
- ASoC: cs35l56: Handle new algorithms IDs for CS35L63
- ASoC: cs35l56: Remove SoundWire Clock Divider workaround for CS35L63
- [s390x] mm: Do not map lowcore with identity mapping
- ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
- igc: fix disabling L1.2 PCI-E link substate on I226 on init
- [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
- net/sched: Remove unnecessary WARNING condition for empty child qdisc in
htb_activate
- ALSA: timer: fix ida_free call while not allocated
- bonding: update LACP activity flag after setting lacp_active
- bonding: send LACPDUs periodically in passive mode after receiving
partner's LACPDU
- block: move elevator queue allocation logic into blk_mq_init_sched
- block: fix lockdep warning caused by lock dependency in elv_iosched_store
- block: fix potential deadlock while running nr_hw_queue update
- blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues
- block: decrement block_rq_qos static key in rq_qos_del()
- block: skip q->rq_qos check in rq_qos_done_bio()
- block: avoid cpu_hotplug_lock depedency on freeze_lock
- [arm64] Octeontx2-af: Skip overlap check for SPI field
- net/mlx5: Base ECVF devlink port attrs from 0
- net/mlx5: Add IFC bits and enums for buf_ownership
- net/mlx5e: Query FW for buffer ownership
- net/mlx5e: Preserve shared buffer capacity during headroom updates
- ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
- [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs
- [s390x] hypfs: Enable limited access during lockdown
- netfilter: nf_reject: don't leak dst refcount for loopback packets
- drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create
- drm/xe: Fix vm_bind_ioctl double free bug
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.5
- perf: Avoid undefined behavior from stopping/starting inactive events
- rtla: Check pkg-config install
- trace/fgraph: Fix the warning caused by missing unregister notifier
- of: dynamic: Fix memleak when of_pci_add_properties() failed
- of: reserved_mem: Add missing IORESOURCE_MEM flag on resources
- of: dynamic: Fix use after free in of_changeset_add_prop_helper()
- fgraph: Copy args in intermediate storage with entry
- ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id
- Revert "virtio: reject shm region if length is zero"
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
- scsi: core: sysfs: Correct sysfs attributes access rights
- smb: client: fix race with concurrent opens in unlink(2)
- smb: client: fix race with concurrent opens in rename(2)
- [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name
- [amd64] ASoC: rt721: fix FU33 Boost Volume control not working
- [amd64] ASoC: rt1320: fix random cycle mute issue
- erofs: Fallback to normal access if DAX is not supported on extra device
- erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
- io_uring/io-wq: add check free worker before create new worker
- [amd64] platform/x86: int3472: add hpd pin support
- vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
- net: ipv4: fix regression in local-broadcast routes (Closes: #1113765)
- [arm64] drm/msm: Defer fd_install in SUBMIT ioctl
- of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
- HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C
regs save
- HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow
- drm/msm/kms: move snapshot init earlier in KMS init
- [arm64] drm/msm/dpu: correct dpu_plane_virtual_atomic_check()
- [arm64] drm/msm: update the high bitfield of certain DSI registers
- [arm64] drm/mediatek: Add error handling for old state CRTC in
atomic_disable
- [powerpc*] kvm: Fix ifdef to remove build warning
- HID: input: rename hidinput_set_battery_charge_status()
- HID: input: report battery status changes immediately
- idpf: add support for Tx refillqs in flow scheduling mode
- idpf: simplify and fix splitq Tx packet rollback error path
- idpf: replace flow scheduling buffer ring with buffer pool
- idpf: stop Tx if there are insufficient buffer resources
- net: macb: fix unregister_netdev call order in macb_remove()
- Bluetooth: hci_conn: Make unacked packet handling more robust
- Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
- Bluetooth: hci_event: Mark connection as closed during suspend disconnect
- Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
- Bluetooth: hci_event: Disconnect device when BIG sync is lost
- Bluetooth: hci_sync: fix set_local_name race condition
- page_pool: fix incorrect mp_ops error handling
- [arm64] Octeontx2-vf: Fix max packet length errors
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
- drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
- drm/nouveau: remove unused memory target test
- ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset
- ice: don't leave device non-functional if Tx scheduler config fails
- ice: use fixed adapter index for E825C embedded devices
- ice: fix incorrect counter for buffer allocation failures
- ixgbe: fix ixgbe_orom_civd_info struct layout
- dt-bindings: display/msm: qcom,mdp5: drop lut clock
- [arm64] drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
- [arm64] octeontx2: Set appropriate PF, VF masks and shifts based on
silicon
- [arm64] Octeontx2-af: Fix NIX X2P calibration failures
- mISDN: hfcpci: Fix warning when deleting uninitialized timer
- net: dlink: fix multicast stats being counted incorrectly
- drm/xe/xe_sync: avoid race during ufence signaling
- drm/xe/vm: Don't pin the vm_resv during validation
- drm/xe: Don't trigger rebind on initial dma-buf validation
- block: validate QoS before calling __rq_qos_done_bio()
- phy: mscc: Fix when PTP clock is register and unregister
- net: macb: Fix offset error in gem_update_stats
- bnxt_en: Fix memory corruption when FW resources change during ifdown
- bnxt_en: Adjust TX rings if reservation is less than requested
- bnxt_en: Fix stats context reservation logic
- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path
- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow
- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error
flow
- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error
path
- net/mlx5: Reload auxiliary drivers on fw_activate
- net/mlx5: Fix lockdep assertion on sync reset unload event
- net/mlx5: Nack sync reset when SFs are present
- net/mlx5: Prevent flow steering mode changes in switchdev mode
- net/mlx5e: Update and set Xon/Xoff upon MTU set
- net/mlx5e: Update and set Xon/Xoff upon port speed set
- net/mlx5e: Set local Xoff after FW update
- net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
- net: stmmac: xgmac: Correct supported speed modes
- net: stmmac: Set CIC bit only for TX queues with COE
- [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host
during channel open.
- io_uring/kbuf: fix signedness in this_len calculation
- net: rose: split remove and free operations in rose_remove_neigh()
- net: rose: convert 'use' field to refcount_t
- net: rose: include node references in rose_neigh refcount
- sctp: initialize more fields in sctp_v6_from_sk()
- l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
- fbnic: Move phylink resume out of service_task and into open/close
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
- net: macb: Disable clocks once
- io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths
- [arm64] drm/mediatek: mtk_hdmi: Fix inverted parameters in some
regmap_update_bits calls
- [amd64] KVM: x86: use array_index_nospec with indices that come from guest
- [riscv64] KVM: fix stack overrun when loading vlenb
- [amd64] x86/cpu/intel: Fix the constant_tsc model check for Pentium 4
- [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode
- [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on
AMD/HYGON
- HID: asus: fix UAF via HID_CLAIMED_INPUT validation
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
- HID: elecom: add support for ELECOM M-DT2DRBK
- HID: quirks: add support for Legion Go dual dinput modes
- HID: logitech: Add ids for G PRO 2 LIGHTSPEED
- HID: wacom: Add a new Art Pen 2
- HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
- Revert "drm/amdgpu: fix incorrect vm flags to map bo"
- [arm64] mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature
- blk-zoned: Fix a lockdep complaint about recursive locking
- dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
- fs/smb: Fix inconsistent refcnt update
- net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
- smb3 client: fix return code mapping of remap_file_range
- xfs: do not propagate ENODATA disk errors into xattr code
- drm/xe/vm: Clear the scratch_pt pointer on error
- drm/nouveau/disp: Always accept linear modifier
- drm/nouveau: fix error path in nvkm_gsp_fwsec_v2
- drm/msm/dpu: Initialize crtc_state to NULL in
dpu_plane_virtual_atomic_check()
- drm/mediatek: Fix device/node reference count leaks in
mtk_drm_get_all_drm_priv
- drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
- drm/amdgpu/userq: fix error handling of invalid doorbell
- drm/amdgpu: update firmware version checks for user queue support
- drm/amdgpu/gfx11: set MQD as appriopriate for queue types
- drm/amdgpu/gfx12: set MQD as appriopriate for queue types
- net: rose: fix a typo in rose_clear_routes()
- [arm64] firmware: qcom: scm: remove unused arguments from SHM bridge
routines
- [arm64] firmware: qcom: scm: take struct device as argument in SHM bridge
enable
- [arm64] firmware: qcom: scm: initialize tzmem before marking SCM as
available
- [arm64] firmware: qcom: scm: request the waitqueue irq *after*
initializing SCM
- Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to
LANE0_1_STATUS"
- [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array
to static const
- [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their
sizes to driver data
- [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands
Checksums-Sha1:
4af78493a254d594639af9b45fe56145b094d7aa 210689 linux_6.16.12-1~bpo13+1.dsc
dd8730f24f2702110f9181581290f9faafd4c8b4 1552980 linux_6.16.12-1~bpo13+1.debian.tar.xz
cf099e0162c64ca7bdffd82ca89f54bc2261db56 5968 linux_6.16.12-1~bpo13+1_source.buildinfo
Checksums-Sha256:
5cadf7ed85cde4d7c435974ba1769c68555bccebc17cc6a9064c7ddec6d99ce6 210689 linux_6.16.12-1~bpo13+1.dsc
30f9729f72e0eb85857248a24f41fa7542860ffe070661e2d1d3a6c45bf875e4 1552980 linux_6.16.12-1~bpo13+1.debian.tar.xz
4fdfbd06c8b883be44608436c6c6654e7bfc9ab41605d58ed0c47a38b982f92b 5968 linux_6.16.12-1~bpo13+1_source.buildinfo
Files:
8efed59b3ca3cbeda8058a875e1ee713 210689 kernel optional linux_6.16.12-1~bpo13+1.dsc
c50adc5421caf61c5268664b370e47a0 1552980 kernel optional linux_6.16.12-1~bpo13+1.debian.tar.xz
b84ccfb07f4b5929ceec4628ec9b449f 5968 kernel optional linux_6.16.12-1~bpo13+1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAmkflT8ACgkQ57/I7JWG
EQn0kRAArlq8e77FZEDuXZtmRyW2aXNCslnVyeVaJ0p21p7uS7KYPZNVDqJitMHj
WrP17O/my9qYIyO49PWiIowOu+cLkqVsI4QIDjcySyskL7wLxkrm4LICi+TAsxwQ
DTdL44IYQwQyBBrD3MS2O70udNO2ml2W/O0XezE9grC0oHz2ixar70oZVUKIiYbo
mV5K0lSYvV0yDBUuU9VbX6Mu1FOKyPM1pp2Vg6/GnIU8+XQxpwSPfrPAYHr3fEBr
sq22tPQLfIVc2SLcyUoLKhpXdWNYeByjzTs/v6K2UsSY33lVrNCpwFXGQR7sLvAU
7wtFKcmEvTfHDMyoyPHgQLkfHMJNf58YiyjDnG0r9pPI5n+kmuTCq7hQ8JqYmvBN
h9LFGfs2y4UELqS4+4Q2gplIp5PNePmpx1zi3mTHODpaHzD4j+aDDnwAc6zen1so
Raw+Q4VNTtGZ49Sbfsambz+Y8v/l93YsEo/2D8ze7JVZAE3pkfZeWMvl8aXEtHaR
XLGGSqDIWGcqpJMtNWOgRW++5FxvnuUGt+xIoNnOz3ZzEei/X/OPT2oZnwUK4MWh
eBxZwYw4ORulA5pxCkuWjOm/WGFPEUK4PtzS4mXqgWW1mLmT58wJn4EjVl+iZpFm
zuqQdhzV8WmgFPBIIiCLarjrHlL83EobbY688ogWLAdOa7EiGa0=
=u26M
-----END PGP SIGNATURE-----
Attachment:
pgp3IOzXpKdfm.pgp
Description: PGP signature