# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-137.0.0.131
changelog:
  - !20552 ub: udma: fix some code issues.
  - !20313 Fix CVE-2025-40220
  - !20321  nvme: fix admin request_queue lifetime
  - !20512 PM / devfreq: hisi: Fix potential UAF in OPP handling
  - !20544 Fix CVE-2025-71147
  - !20548 v4  net: LTS-6.6 backport
  - !20503 Fix CVE-2025-39713
  - !20133 Fix CVE-2025-39721
  - !20438 Fix CVE-2025-38659
  - !20264 Fix CVE-2025-40277
  - !20340 Fix CVE-2025-40271
  - !20319 Fix CVE-2025-40237
  - !20392  vfs: Don't leak disconnected dentries on umount
  - !20554  iommu/s390: Implement blocking domain
  - !20489 [OLK-6.6][linux-6.6.y sync] Backport 6.6.101-6.6.102 LTS Patches
  - !20513 ACPI: PCC: Fix race condition by removing static qualifier
  - !20468  drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - !20483  rcu: Protect ->defer_qs_iw_pending from data race
  - !20510 drivers/ub/sentry: fix primary eid index value
  - !20553 ub: cdma: support separated page table feature
  - ub: udma: fix some code issues.
  - !20480 iommu/ummu-core: fix error invalidate tid
  - !20561 iommu/ummu: Add ummu sva independent page table parameter
  - ub: udma: bugfix related to 2m_hugepage.
  - ub: udma: support for separate page tables
  - ub: udma: delete debugfs code.
  - ub: udma: bugfix related to ctrlq function.
  - ub: udma: verify get cqe/ae aux info out addr and len.
  - ub: cdma: support separated page table feature
  - iommu/ummu: Add ummu sva independent page table parameter
  - iommu: Adjust PLB refresh timing in 'grant' and 'ungrant'
  - !20505 Fix CVE-2026-23035
  - iommu/s390: Implement blocking domain
  - drivers/ub/sentry: fix primary eid index value
  - !20535  libceph: make decode_pool() more resilient against corrupted osdmaps
  - !20536  mm/page_alloc: change all pageblocks migrate type on coalescing
  - !20537  mm/secretmem: fix use-after-free race in fault handler
  - !20538  wifi: avoid kernel-infoleak from struct iw_point
  - !20539  net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20440  PCI/AER: Fix NULL pointer access by aer_info
  - !20262 Fix CVE-2025-68176
  - netfilter: nf_reject: don't leak dst refcount for loopback packets
  - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  - page_pool: always add GFP_NOWARN for ATOMIC allocations
  - virtio-net: fix received length check in big packets
  - net: bridge: fix use-after-free due to MST port state bypass
  - vsock: Ignore signal/timeout on connect() if already established
  - tls: make sure to abort the stream if headers are bogus
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
  - xfrm: Duplicate SPI Handling
  - tls: handle data disappearing from under the TLS ULP
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush()
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd
  - !20237 Fix CVE-2025-68724
  - !20459 Fix CVE-2025-71131
  - !20525 Fix CVE-2025-68816
  - !20529  CVE-2025-68172
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
  - !20370 Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - wifi: avoid kernel-infoleak from struct iw_point
  - mm/secretmem: fix use-after-free race in fault handler
  - mm/page_alloc: change all pageblocks migrate type on coalescing
  - libceph: make decode_pool() more resilient against corrupted osdmaps
  - pps: Fix kabi breakage of struct pps_device for last_fetched_ev
  - sched: Fix kabi breakage of struct task_struct for saved_state
  - crypto: aspeed - fix double free caused by devm
  - !20515  Bluetooth: bcsp: receive data only if registered
  - !20507 Fix CVE-2025-40358
  - !20450 ub: ubase&unic: Fix some bug in concurrent process
  - !20452 iommu/ummu: Fix some bugs and optimize the code implementation
  - !20451 iommu/ummu: Add the function of creating devices with SVA-separated
  - !20500 mm: fix the inaccurate memory statistics issue for users
  - net/mlx5: fw_tracer, Validate format string parameters
  - Bluetooth: bcsp: receive data only if registered
  - ACPI: PCC: Fix race condition by removing static qualifier
  - ACPI: CPPC: Fix missing PCC check for guaranteed_perf
  - iommu/ummu: Add the function of creating devices with SVA-separated
  - iommu/ummu-core: fix error invalidate tid
  - riscv: stacktrace: Disable KASAN checks for non-current tasks
  - !20497  arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - !20496  drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - !20495  iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - !20494  HID: core: Harden s32ton() against conversion to 0 bits
  - !20493  iommu: Fix two issues in iommu_copy_struct_from_user()
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
  - PM / devfreq: hisi: Fix potential UAF in OPP handling
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  - !20487  interference: Fix uninitialized ifs_clock compiling issue
  - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
  - MIPS: mm: Prevent a TLB shutdown on initial uniquification
  - mm: fix the inaccurate memory statistics issue for users
  - mm: add config option for atomic mode in mm counter
  - Revert "mm: fix the inaccurate memory statistics issue for users"
  - !20444  net/mlx5e: Fix crash on profile change rollback failure
  - !20442  net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
  - iommu/amd: Avoid stack buffer overflow from kernel cmdline
  - HID: core: Harden s32ton() against conversion to 0 bits
  - iommu: Fix two issues in iommu_copy_struct_from_user()
  - SUNRPC: call xs_sock_process_cmsg for all cmsg
  - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
  - !20374 [OLK 6.6]Use Hygon IBRS and IBPB rather than software-based mitigation to mitigate Retbleed and SRSO.
  - !20227  Rename leapioraid to leapraid and release v2.0
  - mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  - MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  - x86/fpu: Delay instruction pointer fixup until after warning
  - ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  - ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
  - x86/sev: Evict cache lines during SNP memory validation
  - net: usbnet: Fix the wrong netif_carrier_on() call
  - net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  - Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
  - sched,freezer: Remove unnecessary warning in __thaw_task
  - freezer,sched: Clean saved_state when restoring it during thaw
  - freezer,sched: Do not restore saved_state of a thawed task
  - freezer,sched: Use saved_state to reduce some spurious wakeups
  - sched/core: Remove ifdeffery for saved_state
  - i2c: stm32f7: unmap DMA mapped buffer
  - i2c: stm32f7: simplify status messages in case of errors
  - i2c: stm32f7: perform most of irq job in threaded handler
  - i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
  - i2c: stm32f7: Use devm_clk_get_enabled()
  - USB: serial: option: add Foxconn T99W709
  - smb: server: Fix extension string in ksmbd_extract_shortname()
  - ksmbd: fix corrupted mtime and ctime in smb2_open
  - ksmbd: fix Preauh_HashValue race condition
  - ksmbd: fix null pointer dereference error in generate_encryptionkey
  - vsock: Do not allow binding to VMADDR_PORT_ANY
  - selftests/perf_events: Add a mmap() correctness test
  - smb: client: return an error if rdma_connect does not return within 5 seconds
  - smb: client: let recv_done() cleanup before notifying the callers.
  - smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: Correct typos in multiple comments across various files
  - smb: client: Use min() macro
  - smb: server: let recv_done() avoid touching data_transfer after cleanup/move
  - smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
  - ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
  - irqchip: Build IMX_MU_MSI only on ARM
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
  - sunrpc: fix client side handling of tls alerts
  - net/sched: taprio: enforce minimum value for picos_per_byte
  - net: drop UFO packets in udp_rcv_segment()
  - ipv6: reject malicious packets in ipv6_gso_segment()
  - net/mlx5: Correctly set gso_segs when LRO is used
  - netlink: specs: ethtool: fix module EEPROM input/output arguments
  - net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
  - phy: mscc: Fix parsing of unicast frames
  - netpoll: prevent hanging NAPI when netcons gets enabled
  - md/md-cluster: handle REMOVE message earlier
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
  - pNFS/flexfiles: don't attempt pnfs on fatal DS errors
  - PCI: pnv_php: Fix surprise plug detection and recovery
  - powerpc/eeh: Export eeh_unfreeze_pe()
  - PCI: pnv_php: Work around switches with broken presence detection
  - kconfig: qconf: fix ConfigList::updateListAllforAll()
  - scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
  - scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
  - scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
  - scsi: mpt3sas: Fix a fw_event memory leak
  - vfio/pci: Separate SR-IOV VF dev_set
  - vfio/pds: Fix missing detach_ioas op
  - vfio: Prevent open_count decrement to negative
  - vfio: Fix unbalanced vfio_df_close call in no-iommu mode
  - f2fs: fix to calculate dirty data during has_not_enough_free_secs()
  - f2fs: fix to update upper_p in __get_secs_required() correctly
  - f2fs: vm_unmap_ram() may be called from an invalid context
  - f2fs: fix to avoid out-of-boundary access in devs.path
  - f2fs: doc: fix wrong quota mount option description
  - f2fs: fix KMSAN uninit-value in extent_info usage
  - rtc: rv3028: fix incorrect maximum clock rate handling
  - rtc: pcf8563: fix incorrect maximum clock rate handling
  - rtc: pcf85063: fix incorrect maximum clock rate handling
  - rtc: nct3018y: fix incorrect maximum clock rate handling
  - rtc: hym8563: fix incorrect maximum clock rate handling
  - rtc: ds1307: fix incorrect maximum clock rate handling
  - ucount: fix atomic_long_inc_below() argument type
  - module: Restore the moduleparam prefix length check
  - apparmor: fix loop detection used in conflicting attachment resolution
  - apparmor: ensure WB_HISTORY_SIZE value is a power of 2
  - bpf: Check netfilter ctx accesses are aligned
  - bpf: Check flow_dissector ctx accesses are aligned
  - vhost-scsi: Fix log flooding with target does not exist errors
  - mtd: rawnand: atmel: set pmecc data setup time
  - mtd: rawnand: rockchip: Add missing check after DMA map
  - mtd: rawnand: atmel: Fix dma_mapping_error() address
  - jfs: fix metapage reference count leak in dbAllocCtl
  - crypto: qat - fix seq_file position update in adf_ring_next()
  - crypto: qat - fix DMA direction for compression on GEN2 devices
  - perf tools: Remove libtraceevent in .gitignore
  - sh: Do not use hyphen in exported variable name
  - ASoC: fsl_xcvr: get channel status data when PHY is not exists
  - dmaengine: nbpfaxi: Add missing check after DMA map
  - dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  - fs/orangefs: Allow 2 more characters in do_c_string()
  - PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
  - soundwire: stream: restore params when prepare ports fail
  - crypto: img-hash - Fix dma_unmap_sg() nents value
  - crypto: keembay - Fix dma_unmap_sg() nents value
  - hwrng: mtk - handle devm_pm_runtime_enable errors
  - watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  - scsi: isci: Fix dma_unmap_sg() nents value
  - scsi: mvsas: Fix dma_unmap_sg() nents value
  - scsi: elx: efct: Fix dma_unmap_sg() nents value
  - scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  - clk: sunxi-ng: v3s: Fix de clock definition
  - perf tests bp_account: Fix leaked file descriptor
  - kernel: trace: preemptirq_delay_test: use offstack cpu mask
  - crypto: inside-secure - Fix `dma_unmap_sg()` nents value
  - perf sched: Fix memory leaks in 'perf sched latency'
  - perf sched: Fix memory leaks for evsel->priv in timehist
  - perf sched: Free thread->priv using priv_destructor
  - perf dso: Add missed dso__put to dso__load_kcore
  - perf tools: Fix use-after-free in help_unknown_cmd()
  - Fix dma_unmap_sg() nents value
  - clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
  - fanotify: sanitize handle_type values when reporting fid
  - pinctrl: sunxi: Fix memory leak on krealloc failure
  - PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
  - crypto: arm/aes-neonbs - work around gcc-15 warning
  - power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  - power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
  - clk: xilinx: vcu: unregister pll_post only if registered correctly
  - media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
  - mtd: fix possible integer overflow in erase_xfer()
  - crypto: marvell/cesa - Fix engine load inaccuracy
  - crypto: qat - use unmanaged allocation for dc_data
  - crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
  - PCI: rockchip-host: Fix "Unexpected Completion" log message
  - bpf/preload: Don't select USERMODE_DRIVER
  - ipv6: annotate data-races around rt->fib6_nsiblings
  - ipv6: fix possible infinite loop in fib6_info_uses_dev()
  - vrf: Drop existing dst reference in vrf_ip6_input_dst
  - selftests: rtnetlink.sh: remove esp4_offload after test
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update
  - netfilter: xt_nfacct: don't assume acct name is null-terminated
  - can: kvaser_usb: Assign netdev.dev_port based on device channel index
  - can: kvaser_pciefd: Store device channel index
  - can: peak_usb: fix USB FD devices potential malfunction
  - tools/rv: Do not skip idle in trace
  - Bluetooth: hci_event: Mask data status from LE ext adv reports
  - kcsan: test: Initialize dummy variable
  - wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
  - wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  - wifi: ath12k: fix endianness handling while accessing wmi service bit
  - wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
  - wifi: mac80211: Don't call fq_flow_idx() for management frames
  - wifi: mac80211: Do not schedule stopped TXQs
  - wifi: plfxlc: Fix error handling in usb driver probe
  - wifi: mac80211: reject TDLS operations when station is not associated
  - iommu/amd: Fix geometry.aperture_end for V2 tables
  - mwl8k: Add missing check after DMA map
  - wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  - tcp: call tcp_measure_rcv_mss() for ooo packets
  - xen/gntdev: remove struct gntdev_copy_batch from stack
  - net_sched: act_ctinfo: use atomic64_t for three counters
  - net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  - um: rtc: Avoid shadowing err in uml_rtc_start()
  - arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  - netfilter: nf_tables: adjust lockdep assertions handling
  - netfilter: nf_tables: Drop dead code from fill_*_info routines
  - fbcon: Fix outdated registered_fb reference in comment
  - drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  - m68k: Don't unregister boot console needlessly
  - drm/msm/dpu: Fill in min_prefill_lines for SC8180X
  - kselftest/arm64: Fix check for setting new VLs in sve-ptrace
  - net: dst: annotate data-races around dst->input
  - tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists
  - iwlwifi: Add missing check for alloc_ordered_workqueue
  - wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  - wifi: rtl818x: Kill URBs before clearing tx status queue
  - wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
  - caif: reduce stack size, again
  - bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  - drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
  - net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
  - selftests/bpf: fix signedness bug in redir_partial()
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  - bpf, sockmap: Fix psock incorrectly pointing to sk
  - drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
  - staging: nvec: Fix incorrect null termination of battery manufacturer
  - interconnect: qcom: sc8180x: specify num_nodes
  - interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
  - soc: qcom: pmic_glink: fix OF node leak
  - samples: mei: Fix building on musl libc
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
  - arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
  - arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
  - ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  - soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
  - arm: dts: ti: omap: Fixup pinheader typo
  - usb: early: xhci-dbc: Fix early_ioremap leak
  - powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
  - pps: fix poll support
  - staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  - spi: stm32: Check for cfg availability in stm32_spi_probe
  - usb: misc: apple-mfi-fastcharge: Make power supply names unique
  - usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
  - ARM: dts: vfxxx: Correctly use two tuples for timer address
  - arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
  - arm64: dts: qcom: sc7180: Expand IMEM region
  - arm64: dts: qcom: sdm845: Expand IMEM region
  - soc: qcom: QMI encoding/decoding for big endian
  - selftests: Fix errno checking in syscall_user_dispatch test
  - ASoC: mediatek: use reserved memory or enable buffer pre-allocation
  - gfs2: No more self recovery
  - Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
  - hfs: make splice write available again
  - hfsplus: make splice write available again
  - ublk: use vmalloc for ublk_device's __queues
  - fs_context: fix parameter name in infofc() macro
  - audit,module: restore audit logging in load failure case
  - ASoC: amd: yc: add DMI quirk for ASUS M6501RM
  - ASoC: Intel: fix SND_SOC_SOF dependencies
  - ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
  - ethernet: intel: fix building with large NR_CPUS
  - ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
  - interference: Fix uninitialized ifs_clock compiling issue
  - iommu/ummu: optimize log printing
  - !20455 Fix compilation failure caused by PR#20174
  - !20302  CVE-2026-22980
  - !20142  CVE-2025-68803
  - !20261  ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - !20435  fix CVE-2026-22998
  - !20433  scsi: target: Reset t_task_cdb pointer in error case
  - !20432  scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - !20431  block: Use RCU in blk_mq_[un
  - !20307  tpm: Cap the number of PCR banks
  - !20062  xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - !20157 v2  md: backport from mainline
  - rcu: Protect ->defer_qs_iw_pending from data race
  - platform/x86/intel/pmt: fix compilation failure caused by PR#20174
  - iommu/ummu: optimize kv cache memory management
  - iommu/ummu: optimize permission table management
  - iommu/ummu: remove check for eid_type while del eid
  - iommu/ummu: optimize the code implementation
  - drivers/perf: fix ummu-pmu data reading exception
  - iommu/ummu: IOMMU_DOMAIN_BLOCKED type don not sync tct
  - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
  - net: unic: Notify mami of the bond ip change.
  - ub: ubase: Support for UE link by ctrlq message
  - ub: ubase: send a deactivate req in removing
  - ub: ubase: Querying TPG/TP contexts in the chip is no longer supported after enabling safe mode.
  - ub: ubase: Use an independent thread for the ctrlq workqueue.
  - !20368 ubcore: fix logging and permission for route query.
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
  - !20344  ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - net: unic: Fix the ummu 0xa event that occurs when modifying queues and resetting concurrent scenarios
  - ub: ubase: Add KABI compatibility
  - ub: ubase: fixing the issue of cdma ctp_req_vl parameter configuration
  - ub: ubase: add PMU IDEV interrupt supported abilities.
  - ub: ubase: Delete the tid mask for eq, jfs, jfr, and jfc context
  - ub: ubase: Set the completion event interrupt to auto
  - net: unic: fix poll tx read old skb cause a UAF bug
  - !20249 Fix CVE-2025-38489
  - !20250 Fix CVE-2025-38480
  - !20378 Fix CVE-2025-39838
  - !20430  Fix CVE-2025-39942
  - !20351 Fix CVE-2025-71149
  - !20375 Fix CVE-2025-71150
  - !20323 Fix CVE-2025-38730
  - !20320 Fix CVE-2025-68814
  - !20314 Fix CVE-2025-71072
  - !20315 Fix CVE-2025-68794
  - !20403  bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - !20402  bpf: Do not let BPF test infra emit invalid GSO types to stack
  - !20401  tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - !20400  netfilter: nft_ct: add seqadj extension for natted connections
  - !20399  net: xfrm: Fix CVE-2025-40215
  - !20398  net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - !20397  bpf: Reject narrower access to pointer ctx fields
  - !20396  Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - !20394  IB/mlx5: Fix potential deadlock in MR deregistration
  - !20367 ub: cdma: cdma uaf bugfix
  - net/mlx5e: Fix crash on profile change rollback failure
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
  - PCI/AER: Fix NULL pointer access by aer_info
  - gfs2: No more self recovery
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  - crypto: qat - flush misc workqueue during device shutdown
  - !20174 Backport PMT spec 3.0 support
  - !20366 [Hygon][6.6][Bugfix]: Resolve FPU state corruption between atomic and non-atomic contexts
  - !19814 [OLK-6.6] Batch flushing user memory encrytion status change
  - !20393 [OLK-6.6][linux-6.6.y sync] Backport 6.6.100-6.6.101 LTS Patches
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
  - nvmet-tcp: remove boilerplate code
  - scsi: target: Reset t_task_cdb pointer in error case
  - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
  - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
  - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
  - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
  - smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
  - smb: server: remove separate empty_recvmsg_queue
  - !20384 ub:ubus: Fix ubus link message and pool device error
  - !20389  gfs2: Prevent recursive memory reclaim
  - !20388  *** fix CVE-2025-38062 ***
  - !20387  KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - !20386  pinctrl: check the return value of pinmux_ops::get_function_name()
  - !20385  iommu/amd/pgtbl: Fix possible race while increase page table level
  - ub:ubus: Not cfg access during surprise down
  - ub:hisi-ubus: Delete validate_pa err print
  - PCI: cadence: Check for the existence of cdns_pcie::ops before using it
  - can: netlink: can_changelink(): allow disabling of automatic restart
  - Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
  - drm/sched: Remove optimization that causes hang when killing dependent jobs
  - ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  - bpf: Check skb->transport_header is set in bpf_skb_check_mtu
  - bpf: Do not let BPF test infra emit invalid GSO types to stack
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
  - netfilter: nft_ct: add seqadj extension for natted connections
  - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  - xfrm: delete x->tunnel as we delete x
  - x86/hw-vuln:Support hardware-based mitigation for Retbleed and SRSO via Hygon IBRS to avoid performance degradation caused by software-based mitigation.
  - net/sched: sch_qfq: Fix null-deref in agg_dequeue
  - bpf: Reject narrower access to pointer ctx fields
  - Bluetooth: eir: Fix possible crashes on eir_create_adv_data
  - IB/mlx5: Fix potential deadlock in MR deregistration
  - ub:ubus: Fix ubus link message and pool device error
  - ub:hisi-ubus: cq poller maximum handle 64 cqe per time
  - ub:hisi-ubus:Fix vdm message print error
  - ub:ubus:Fix ubus interrupt release issue
  - wifi: mt76: mt7921: prevent decap offload config before STA initialization
  - mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
  - iio: hid-sensor-prox: Restore lost scale assignments
  - iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  - crypto: powerpc/poly1305 - add depends on BROKEN for now
  - erofs: address D-cache aliasing
  - drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
  - ALSA: hda: Add missing NVIDIA HDA codec IDs
  - ALSA: hda/tegra: Add Tegra264 support
  - comedi: comedi_test: Fix possible deletion of uninitialized timers
  - usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
  - usb: typec: tcpm: allow switching to mode accessory to mux properly
  - usb: typec: tcpm: allow to use sink in accessory mode
  - drm/amdkfd: Don't call mmput from MMU notifier callback
  - mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  - selftests: mptcp: connect: also cover checksum
  - selftests: mptcp: connect: also cover alt modes
  - resource: fix false warning in __request_region()
  - gve: Fix stuck TX queue for DQ queue format
  - e1000e: ignore uninitialized checksum word on tgp
  - e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
  - dpaa2-switch: Fix device reference count leak in MAC endpoint handling
  - dpaa2-eth: Fix device reference count leak in MAC endpoint handling
  - ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
  - sprintf.h requires stdarg.h
  - bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
  - i2c: virtio: Avoid hang by using interruptible completion wait
  - i2c: tegra: Fix reset error handling with ACPI
  - platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
  - can: dev: can_restart(): move debug message and stats after successful restart
  - can: dev: can_restart(): reverse logic to remove need for goto
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards
  - i40e: Add rx_missed_errors for buffer exhaustion
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
  - net/mlx5: Fix memory leak in cmd_exec()
  - staging: vchiq_arm: Make vchiq_shutdown never fail
  - x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
  - regmap: fix potential memory leak of regmap_bus
  - iio: adc: ad7949: use spi_is_bpw_supported()
  - interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
  - RDMA/core: Rate limit GID cache warning messages
  - virtio_ring: Fix error reporting in virtqueue_resize
  - !20348 [OLK-6.6][linux-6.6.y sync] Backport 6.6.99-6.6.100 LTS Patches
  - !20346  tracing: Fix crash on synthetic stacktrace field usage
  - vfs: Don't leak disconnected dentries on umount
  - !20334 Fix CVE-2025-68780
  - gfs2: Prevent recursive memory reclaim
  - amd/amdkfd: enhance kfd process check in switch partition
  - drm/amdkfd: allow compute partition mode switch with cgroup exclusions
  - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
  - pinctrl: check the return value of pinmux_ops::get_function_name()
  - iommu/amd/pgtbl: Fix possible race while increase page table level
  - !19966  nvme-fc: use lock accessing port_state and rport state
  - ASoC: fsl_sai: replace regmap_write with regmap_update_bits
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - cifs: prevent NULL pointer dereference in UTF16 conversion
  - ksmbd: Fix refcount leak when invalid session is found on session lookup
  - ubcore: fix logging and permission for route query.
  - !20232 driver/coda: VirtCCA supports MSI device DA
  - Revert "Revert "RDMA/hns: Fix mismatch exception rollback""
  - !20197 ub: udma&ubase: fix a bug that caused long reboot time
  - x86: Resolve FPU state corruption between atomic and non-atomic contexts
  - ub: cdma: cdma uaf bugfix
  - ub: cdma: jfs call trace bugfix
  - !20353  x86/fpu: Clear XSTATE_BV[i
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
  - nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  - i2c: omap: fix deprecated of_property_read_bool() use
  - ASoC: fsl_sai: Force a software reset when starting in consumer mode
  - regulator: pwm-regulator: Manage boot-on with disabled PWM channels
  - regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
  - i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
  - i2c: omap: Fix an error handling path in omap_i2c_probe()
  - i2c: omap: Add support for setting mux
  - usb: dwc3: qcom: Don't leave BCR asserted
  - usb: hub: Don't try to recover devices lost during warm reset.
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
  - ipv6: make addrconf_wq single threaded
  - !20354 cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - sched/deadline: only set free_cpus for online runqueues
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
  - cpufreq/sched: Explicitly synchronize limits_changed flag handling
  - io_uring/poll: correctly handle io_poll_add() return value on update
  - shmem: fix recovery on rename failures
  - io_uring: fix filename leak in __io_openat_prep()
  - Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  - rxrpc: Fix transmission of an abort in response to an abort
  - rxrpc: Fix recv-recv race of completed call
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  - net: bridge: Do not offload IGMP/MLD messages
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  - net/mlx5: Correctly set gso_size when LRO is used
  - Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
  - Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  - Bluetooth: SMP: If an unallowed command is received consider it a failure
  - Bluetooth: hci_sync: fix connectable extended advertising when using static random address
  - hwmon: (corsair-cpro) Validate the size of the received input buffer
  - selftests: net: increase inter-packet timeout in udpgro.sh
  - wifi: cfg80211: remove scan request n_channels counted_by
  - nvme: fix misaccounting of nvme-mpath inflight I/O
  - net: phy: Don't register LEDs for genphy
  - nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
  - rpl: Fix use-after-free in rpl_do_srh_inline().
  - block: fix kobject leak in blk_unregister_queue
  - net: emaclite: Fix missing pointer increment in aligned_read()
  - soundwire: amd: fix for clearing command status register
  - soundwire: amd: fix for handling slave alerts after link is down
  - comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  - comedi: Fix some signed shift left operations
  - comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  - comedi: das6402: Fix bit shift out of bounds
  - comedi: das16m1: Fix bit shift out of bounds
  - comedi: aio_iiro_16: Fix bit shift out of bounds
  - comedi: pcl812: Fix bit shift out of bounds
  - iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  - iio: adc: max1363: Reorder mode_list[] entries
  - iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  - iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  - soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  - soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  - s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  - pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  - net: libwx: properly reset Rx ring descriptor
  - net: libwx: remove duplicate page_pool_put_full_page()
  - mmc: sdhci_am654: Workaround for Errata i2312
  - mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  - mmc: bcm2835: Fix dma_unmap_sg() nents value
  - memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  - isofs: Verify inode mode when loading from disk
  - dmaengine: nbpfaxi: Fix memory corruption in probe()
  - af_packet: fix soft lockup issue caused by tpacket_snd()
  - af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  - arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
  - arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
  - arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
  - net/mlx5: Update the list of the PCI supported devices
  - phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  - io_uring/poll: fix POLLERR handling
  - ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
  - drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
  - tracing/osnoise: Fix crash in timerlat_dump_stack()
  - spi: Add check for 8-bit transfer with 8 IO mode support
  - pch_uart: Fix dma_sync_sg_for_device() nents value
  - thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  - i2c: stm32: fix the device used for the DMA map
  - tracing: Fix crash on synthetic stacktrace field usage
  - usb: musb: fix gadget state on disconnect
  - USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  - USB: serial: option: add Foxconn T99W640
  - USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
  - phy: tegra: xusb: Disable periodic tracking on Tegra234
  - phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
  - fs/proc: fix uaf in proc_readdir_de()
  - io_uring/net: commit partial buffers on retry
  - nvme: fix admin request_queue lifetime
  - fs/notify: call exportfs_encode_fid with s_umount
  - iomap: adjust read range correctly for non-block-aligned positions
  - fuse: fix livelock in synchronous file put from fuseblk workers
  - tpm: Cap the number of PCR banks
  - nfsd: provide locking for v4_end_grace
  - Revert "nfsd: provide locking for v4_end_grace"
  - config: enable config for PMT discovery driver
  - platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
  - platform/x86/intel/pmt: Fix kobject memory leak on init failure
  - platform/x86/intel/pmt: fix a crashlog NULL pointer access
  - platform/x86/intel/pmt: fix build dependency for kunit test
  - platform/x86/intel/pmt/discovery: fix format string warning
  - platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit
  - platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API
  - platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature
  - platform/x86/intel/pmt/discovery: Get telemetry attributes
  - platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI
  - platform/x86/intel/vsec: Set OOBMSM to CPU mapping
  - platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h
  - docs: Add ABI documentation for intel_pmt feature directories
  - platform/x86/intel/pmt: Add PMT Discovery driver
  - sysfs: Fix crash on empty group attributes array
  - sysfs: Introduce a mechanism to hide static attribute_groups
  - platform/x86/intel/vsec: Add new Discovery feature
  - platform/x86/intel/vsec: Skip driverless features
  - platform/x86/intel/vsec: Skip absent features during initialization
  - platform/x86/intel/vsec: Add device links to enforce dependencies
  - platform/x86/intel/vsec: Create wrapper to walk PCI config space
  - platform/x86/intel/vsec: Add private data for per-device data
  - MAINTAINERS: Add link to documentation of Intel PMT ABI
  - platform/x86/intel/pmt: allow user offset for PMT callbacks
  - driver/coda: VirtCCA supports MSI device DA
  - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
  - Rename leapioraid to leapraid and release v2.0
  - ub: udma: fix a bug that caused long reboot time.
  - ub: ubase: Accelerate when ctrl node is shutting down
  - platform/x86/intel/pmt: Use PMT callbacks
  - platform/x86/intel/vsec: Add PMT read callbacks
  - platform/x86/intel/vsec.h: Move to include/linux
  - md: prevent incorrect update of resync/recovery offset
  - md/raid1: Fix data corruption for degraded array with slow disk
  - md/raid1: set max_sectors during early return from choose_slow_rdev()
  - md-cluster: fix no recovery job when adding/re-adding a disk
  - md-cluster: fix hanging issue while a new disk adding
  - md/raid5: recheck if reshape has finished with device_lock held
  - md-cluster: Constify struct md_cluster_operations
  - md: Remove unneeded semicolon
  - md/raid5: fix spares errors about rcu usage
  - dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
  - md: pass in max_sectors for pers->sync_request()
  - md: factor out helpers for different sync_action in md_do_sync()
  - md: replace last_sync_action with new enum type
  - md: use new helpers in md_do_sync()
  - md: don't fail action_store() if sync_thread is not registered
  - md: remove parameter check_seq for stop_sync_thread()
  - md: replace sysfs api sync_action with new helpers
  - md: factor out helper to start reshape from action_store()
  - md: add new helpers for sync_action
  - md: add a new enum type sync_action
  - md: rearrange recovery_flags
  - md/raid0: don't free conf on raid0_run failure
  - md: make md_flush_request() more readable
  - md: change the return value type of md_write_start to void
  - md: Revert "md: Fix overflow in is_mddev_idle"
  - md: don't account sync_io if iostats of the disk is disabled
  - md: Fix overflow in is_mddev_idle
  - md: add check for sleepers in md_wakeup_thread()
  - md: add a mddev_is_dm helper
  - md: add a mddev_add_trace_msg helper
  - md: add a mddev_trace_remap helper
  - dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
  - dm-raid: add a new helper prepare_suspend() in md_personality
  - dm-raid: really frozen sync_thread during suspend
  - md: add a new helper reshape_interrupted()
  - md: export helper md_is_rdwr()
  - md: export helpers to stop sync_thread
  - md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume
  - md/raid1: factor out helpers to choose the best rdev from read_balance()
  - md/raid1: factor out the code to manage sequential IO
  - md/raid1: factor out choose_bb_rdev() from read_balance()
  - md/raid1: factor out choose_slow_rdev() from read_balance()
  - md/raid1: factor out read_first_rdev() from read_balance()
  - md/raid1-10: factor out a new helper raid1_should_read_first()
  - md/raid1-10: add a helper raid1_check_read_range()
  - md/raid1: fix choose next idle in read_balance()
  - md/raid1: record nonrot rdevs while adding/removing rdevs to conf
  - md/raid1: factor out helpers to add rdev to conf
  - md: add a new helper rdev_has_badblock()
  - md: check mddev->pers before calling md_set_readonly()
  - md: clean up openers check in do_md_stop() and md_set_readonly()
  - md: sync blockdev before stopping raid or setting readonly
  - md: factor out a helper to sync mddev
  - md: return directly before setting did_set_md_closing
  - md: changed the switch of RAID_VERSION to if
  - md: merge the check of capabilities into md_ioctl_valid()
  - md: Don't suspend the array for interrupted reshape
  - md: Don't register sync_thread for reshape directly
  - md: Make sure md_do_sync() will set MD_RECOVERY_DONE
  - md: Don't ignore read-only array in md_check_recovery()
  - md: Don't ignore suspended array in md_check_recovery()
  - md: get rdev->mddev with READ_ONCE()
  - md: remove redundant md_wakeup_thread()
  - md: remove redundant check of 'mddev->sync_thread'
  - md: fix a suspicious RCU usage warning
  - raid: Remove now superfluous sentinel element from ctl_table array
  - NFSD: NFSv4 file creation neglects setting ACL
  - nfsd: set security label during create operations
  - xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
  - nvme-fc: use lock accessing port_state and rport state
  - x86/mm: Batch flushing user memory encrytion status change


author: Li Nan <linan122@huawei.com> - 6.6.0-138.0.0.132
changelog:
  - !20588 [OLK-6.6] Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - Revert "x86/csv: Enhance CMA memory usage reporting for CSV3"
  - !20576  media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - !20575  RDMA/cm: Fix leaking the multicast GID table reference
  - !20580  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - !20551  Fix CVE-2025-68785
  - !20478  f2fs: fix to avoid potential deadlock
  - !20501 [OLK-6.6] backport important bugfix for bnxt driver from upstream linux-6.6.y
  - !20520 Fix CVE-2026-23038
  - !20424  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  - !20425  mlx5: Fix default values in create CQ
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
  - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
  - RDMA/cm: Fix leaking the multicast GID table reference
  - net: openvswitch: fix middle attribute validation in push_nsh() action
  - net: openvswitch: remove never-working support for setting nsh fields
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
  - bnxt_en: Fix potential data corruption with HW GRO/LRO
  - f2fs: fix to avoid potential deadlock
  - mlx5: Fix default values in create CQ
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup


author: Li Nan <linan122@huawei.com> - 6.6.0-139.0.0.133
changelog:
  - !20727 v2  bpf: sockmap fixes
  - !20741  scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - !20744  fix CVE-2025-38449
  - !20763  net: usb: asix: validate PHY address before use
  - !20762  smc91x: fix broken irq-context in PREEMPT_RT
  - !20293 [Hygon][6.6][EDAC] The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - !20290 [Hygon][6.6][Bugfix] Bug fix for EDAC to use unicast instead of broadcast on hygon family 18h model 4h
  - !20289 [Hygon][6.6][Bugfix] Bug fix for EDAC to correct the address translation on hygon family 18h model 4h
  - !20245 KVM: arm64: Refactor exit handlers
  - !20246 KVM: arm64: Mark some header functions as inline
  - !19005 [Hygon] [OLK-6.6] [Bugfix] Fix memory bandwidth counter width for Hygon QoS
  - !20292 [Hygon][6.6][TSC Adjust] Backport x86 TSC adjust patch
  - !20273 [Hygon][6.6][Bugfix] Get correct CPU LLC ID in guest for Hygon processors
  - !20722 [OLK-6.6][linux-6.6.y sync] Backport 6.6.104-6.6.106 LTS Patches
  - !20667  fix CVE-2024-50102
  - !20736  netfilter: nf_tables: remove redundant chain validation on register store
  - !20758 ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20721 obmm: reduce log noise for successful export/import/preimport
  - net: usb: asix: validate PHY address before use
  - smc91x: fix broken irq-context in PREEMPT_RT
  - !20731  devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - !20732  libceph: return the handler error from mon_handle_auth_done()
  - !20743  mm: slub: avoid wake up kswapd in set_track_prepare
  - ub: ubase: Fixed the alarm issue caused by the initialization of the structure variable definition.
  - !20750 ub: cdma: adapted to UMMU interface changes
  - !20713 urma: DFX of log in kernel
  - urma: optimize log levels for kernel space
  - ub: cdma: adapted to UMMU interface changes
  - wifi: ath11k: avoid bit operation on key flags
  - drm/mediatek: fix potential OF node use-after-free
  - cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes
  - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
  - !20708 ub:hisi-ubus: Add create bus instance ummu bypass
  - drm: fix kabi for struct drm_framebuffer
  - drm/framebuffer: Acquire internal references on GEM handles
  - drm/gem: Acquire references on GEM handles for framebuffers
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - scsi: qla2xxx: Sanitize payload size to prevent member overflow
  - netfilter: nf_tables: remove redundant chain validation on register store
  - libceph: return the handler error from mon_handle_auth_done()
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
  - Documentation/hw-vuln: Add VMSCAPE documentation
  - dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
  - riscv: use lw when reading int cpu in asm_per_cpu
  - mm: slub: avoid wake up kswapd in set_track_prepare
  - tools: gpio: remove the include directory on make clean
  - tools: gpio: rm .*.cmd on make clean
  - drm/amd/amdgpu: Fix missing error return on kzalloc failure
  - drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
  - perf bpf-event: Fix use-after-free in synthesis
  - drm/bridge: ti-sn65dsi86: fix REFCLK setting
  - spi: spi-fsl-lpspi: Clear status register after disabling the module
  - spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  - spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  - spi: spi-fsl-lpspi: Fix transmissions when using CONT
  - hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
  - pcmcia: omap: Add missing check for platform_get_resource
  - Revert "drm/amdgpu: Avoid extra evict-restore process."
  - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY
  - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
  - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
  - drm/mediatek: Fix using wrong drm private data to bind mediatek-drm
  - drm/mediatek: Add crtc path enum for all_drm_priv array
  - vmxnet3: update MTU after device quiesce
  - net: dsa: microchip: linearize skb for tail-tagging switches
  - net: dsa: microchip: update tag_ksz masks for KSZ9477 family
  - dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
  - ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
  - ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
  - iio: pressure: mprls0025pa: use aligned_s64 for timestamp
  - iio: chemical: pms7003: use aligned_s64 for timestamp
  - iio: imu: inv_mpu6050: align buffer for timestamp
  - thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
  - nouveau: fix disabling the nonstall irq due to storm code
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
  - net: pcs: rzn1-miic: Correct MODCTRL register offset
  - platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
  - drm/amdgpu: drop hw access in non-DC audio fini
  - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data()
  - wifi: mwifiex: Initialize the chan_stats array to zero
  - tcp_bpf: Fix copied value in tcp_bpf_sendmsg
  - skmsg: Return copied bytes in sk_msg_memcopy_from_iter
  - tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
  - Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap"
  - ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock
  - selftest: net: Fix weird setsockopt() in bind_bhash.c.
  - net: atm: fix memory leak in atm_register_sysfs when device_register fail
  - ax25: properly unshare skbs in ax25_kiss_rcv()
  - mctp: return -ENOPROTOOPT for unknown getsockopt options
  - net/smc: Remove validation of reserved bits in CLC Decline message
  - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
  - net: thunder_bgx: decrement cleanup index before use
  - net: thunder_bgx: add a missing of_node_put
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
  - wifi: libertas: cap SSID len in lbs_associate()
  - wifi: cw1200: cap SSID length in cw1200_do_join()
  - net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  - wifi: ath11k: fix group data packet drops during rekey
  - wifi: ath11k: avoid forward declaration of ath11k_mac_start_vdev_delay()
  - wifi: ath11k: rename ath11k_start_vdev_delay()
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
  - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()
  - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint
  - netlink: add variable-length / auto integers
  - net: macb: Fix tx_ptr_lock locking
  - icmp: fix icmp_ndo_send address translation for reply direction
  - mISDN: Fix memory leak in dsp_hwec_enable()
  - xirc2ps_cs: fix register access when enabling FullDuplex
  - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  - wifi: cfg80211: fix use-after-free in cmp_bss()
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC
  - arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM
  - tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"
  - arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro
  - Bluetooth: hci_sync: Avoid adding default advertising on startup
  - cpupower: Fix a bug where the -t option of the set subcommand was not working.
  - drm/amd/display: Don't warn when missing DCE encoder caps
  - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN
  - LoongArch: Save LBT before FPU in setup_sigcontext()
  - btrfs: avoid load/store tearing races when checking if an inode was logged
  - btrfs: fix race between setting last_dir_index_offset and inode logging
  - btrfs: fix race between logging inode and checking if it was logged before
  - bpf: Fix oob access in cgroup local storage
  - !20556 urma: fix update topo logic
  - !20639 [OLK-6.6][linux-6.6.y sync] Backport 6.6.103-6.6.104 LTS Patches
  - !20641 [OLK-6.6][linux-6.6.y sync] LoongArch: Add more instruction opcodes and emit_* helpers
  - !20560  *** fix CVE-2025-38062 ***
  - !20662  pNFS: Fix a deadlock when returning a delegation during open()
  - ub:hisi-ubus: Add create bus instance ummu bypass
  - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
  - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
  - HID: mcp2221: Handle reads greater than 60 bytes
  - HID: mcp2221: Don't set bus speed on every transfer
  - net/mlx5: SF, Fix add port error handling
  - drm/nouveau/disp: Always accept linear modifier
  - smb3 client: fix return code mapping of remap_file_range
  - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
  - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
  - HID: wacom: Add a new Art Pen 2
  - HID: logitech: Add ids for G PRO 2 LIGHTSPEED
  - HID: quirks: add support for Legion Go dual dinput modes
  - net: stmmac: Set CIC bit only for TX queues with COE
  - net: stmmac: xgmac: Correct supported speed modes
  - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  - net/mlx5e: Set local Xoff after FW update
  - net/mlx5e: Update and set Xon/Xoff upon port speed set
  - net/mlx5e: Update and set Xon/Xoff upon MTU set
  - net/mlx5: Nack sync reset when SFs are present
  - net/mlx5: Convert SF port_indices xarray to function_ids xarray
  - net/mlx5: Use devlink port pointer to get the pointer of container SF struct
  - net/mlx5: Call mlx5_sf_id_erase() once in mlx5_sf_dealloc()
  - phy: mscc: Fix when PTP clock is register and unregister
  - net: dlink: fix multicast stats being counted incorrectly
  - dt-bindings: display/msm: qcom,mdp5: drop lut clock
  - drm/nouveau: remove unused memory target test
  - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
  - Bluetooth: hci_event: Mark connection as closed during suspend disconnect
  - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success
  - HID: input: report battery status changes immediately
  - HID: input: rename hidinput_set_battery_charge_status()
  - powerpc/kvm: Fix ifdef to remove build warning
  - drm/msm: Defer fd_install in SUBMIT ioctl
  - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list
  - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
  - ASoC: codecs: tx-macro: correct tx_macro_component_drv name
  - smb: client: fix race with concurrent opens in unlink(2)
  - scsi: core: sysfs: Correct sysfs attributes access rights
  - of: dynamic: Fix use after free in of_changeset_add_prop_helper()
  - of: Add a helper to free property struct
  - mips: lantiq: xway: sysctrl: rename the etop node
  - mips: dts: lantiq: danube: add missing burst length property
  - pinctrl: STMFX: add missing HAS_IOMEM dependency
  - of: dynamic: Fix memleak when of_pci_add_properties() failed
  - !20684 urma: adjust urma log format
  - !20355  udp: Deal with race between UDP socket address change and rehash
  - !20627  Fixes CVE-2025-38627
  - !20702  CVE-2025-39948
  - !20701  netfilter: ctnetlink: remove refcounting in expectation dumpers
  - !20700  CVE-2025-38678
  - !20703  CVE-2025-38491
  - !20690  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - obmm: reduce log noise for successful export/import/preimport
  - mptcp: avoid deadlock on fallback while reinjecting
  - mptcp: plug races between subflow fail and subflow creation
  - mptcp: make fallback action and fallback decision atomic
  - ice: fix Rx page leak on multi-buffer frames
  - ice: fix incorrect counter for buffer allocation failures
  - ice: stop storing XDP verdict within ice_rx_buf
  - ice: gather page_count()'s of each frag right before XDP prog call
  - ice: Introduce ice_xdp_buff
  - netfilter: ctnetlink: remove refcounting in expectation dumpers
  - netfilter: nf_tables: reject duplicate device on updates
  - netfilter: nf_tables: Introduce functions freeing nft_hook objects
  - netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c
  - err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  - !20498 Fix CVE-2025-71118
  - !20608  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - !20679  x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20650  fix cve-2025-40300
  - !20661  Input: alps - fix use-after-free bugs caused by dev3_register_work
  - !20664  backport some net bugfix from 6.6 lts
  - urma: adjust urma log format
  - !20678 ub: udma: close debug switch load parameters.
  - ub: udma: close debug switch load parameters.
  - x86/CPU/AMD: Add RDSEED fix for Zen5
  - !20630  net: LTS-6.6 bugfix backport
  - !20632  net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - !20631  macvlan: fix possible UAF in macvlan_forward_source()
  - !20628  Fix CVE-2025-39910
  - !20659 v2  Fix CVE-2025-22090
  - !20506  XSched: Update XSched manual
  - !20647  media: imon: make send_packet() more robust
  - !20646  ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - !20645  fbcon: Set fb_display[i
  - !20648  parse_longname(): strrchr() expects NUL-terminated string
  - !20621 urma: modify log level
  - !20602 urma: fix the jfe uaf issue that occurred during the killall process.
  - !20567 urma:change log level and pass status 9
  - !20640  iio: common: st_sensors: Fix use of uninitialize device structs
  - !20634  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - !20633  net: dsa: properly keep track of conduit reference
  - !20635  fix CVE-2025-68231
  - !20651  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !20649  drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - !20652  mm/vmalloc: fix data race in show_numa_info()
  - x86: uaccess: don't use runtime-const rewriting in modules
  - x86: fix off-by-one in access_ok()
  - x86: fix user address masking non-canonical speculation issue
  - x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit
  - x86/uaccess: Improve the 8-byte getuser() case
  - x86: fix whitespace in runtime-const assembler output
  - dcache: keep dentry_hashtable or d_hash_shift even when not used
  - runtime constants: add x86 architecture support
  - runtime constants: deal with old decrepit linkers
  - x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address()
  - !20345 arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  - libceph: replace BUG_ON with bounds check for map->max_osd
  - libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
  - libceph: fix potential use-after-free in have_mon_and_osd_map()
  - sctp: Hold sock lock while iterating over address list
  - sctp: Prevent TOCTOU out-of-bounds write
  - sctp: Hold RCU read lock while iterating over address list
  - tipc: Fix use-after-free in tipc_mon_reinit_self().
  - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  - sctp: avoid NULL dereference when chunk data buffer is missing
  - bpf: Explicitly check accesses to bpf_sock_addr
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - nexthop: Forbid FDB status change while nexthop is in a group
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  - sctp: initialize more fields in sctp_v6_from_sk()
  - pNFS: Fix a deadlock when returning a delegation during open()
  - Input: alps - fix use-after-free bugs caused by dev3_register_work
  - x86/cpu: Get CPU LLC ID from CPUID 0x8000001d in guest for Hygon processors
  - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()
  - mm: (un)track_pfn_copy() fix + doc improvements
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
  - !20642  mtdchar: fix integer overflow in read/write ioctls
  - mm/vmalloc: fix data race in show_numa_info()
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - config: enable CONFIG_MITIGATION_VMESCAPE by default on x86
  - x86/vmscape: Enable the mitigation
  - x86/vmscape: Enumerate VMSCAPE bug
  - x86/vmscape: Add conditional IBPB mitigation
  - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
  - parse_longname(): strrchr() expects NUL-terminated string
  - media: imon: make send_packet() more robust
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  - fbcon: Set fb_display[i]->mode to NULL when the mode is released
  - !20569  CVE-2024-35808
  - mtdchar: fix integer overflow in read/write ioctls
  - !20619 Fix CVE-2026-22991
  - !20612 net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - LoongArch: Add more instruction opcodes and emit_* helpers
  - iio: common: st_sensors: Fix use of uninitialize device structs
  - !20581  null_blk: fix kmemleak by releasing references to fault configfs items
  - mm/mempool: fix poisoning order>0 pages with HIGHMEM
  - mm/page_poison: replace kmap_atomic() with kmap_local_page()
  - mm/mempool: replace kmap_atomic() with kmap_local_page()
  - usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  - net: dsa: properly keep track of conduit reference
  - net/sched: sch_qfq: do not free existing class in qfq_change_class()
  - macvlan: fix possible UAF in macvlan_forward_source()
  - netfilter: nft_objref: validate objref and objrefmap expressions
  - arp: do not assume dev_hard_header() does not change skb->head
  - ip6_gre: make ip6gre_header() robust
  - netfilter: nf_tables: avoid chain re-validation if possible
  - netfilter: nf_tables: drop unused 3rd argument from validate callback ops
  - Revert "netfilter: nft_objref: validate objref and objrefmap expressions"
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp()
  - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
  - ethtool: Avoid overflowing userspace buffer on stats query
  - ipvs: fix ipv4 null-ptr-deref in route error path
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  - !20596  mm/page_alloc: prevent pcp corruption with SMP=n
  - !20598  team: fix check for port enabled in team_queue_override_port_prio_changed()
  - !18823  hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
  - kasan: avoid sleepable page allocation from atomic context
  - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
  - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi
  - !20583 [OLK-6.6][linux-6.6.y sync] Backport 6.6.102-6.6.103 LTS Patches
  - !20460  fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - urma:fix log level and pass status 9
  - urma: modify log level
  - !20592  CVE-2025-71141 fixup
  - !20594  CVE-2025-39744 fixup
  - !20607  powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - !20606  mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20604 Fix CVE-2026-22984
  - !20603 Fix CVE-2026-23021
  - !20600 Fix CVE-2026-22990
  - urma: fix the jfe uaf issue that occurred during the killall process.
  - !20380 pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - libceph: make free_choose_arg_map() resilient to partial allocation
  - drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET
  - net: hns3: extend HCLGE_FD_AD_COUNTER_NUM to 8 bits
  - net: hns3: extend HCLGE_FD_AD_QID to 11 bits
  - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue
  - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M
  - Revert "net: hns3: add support for FD counter"
  - !20587  dmaengine: stm32: dmamux: fix device leak on route allocation
  - pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  - powerpc/64s/slb: Fix SLB multihit issue during SLB preload
  - mm/huge_memory: fix NULL pointer deference when splitting folio
  - !20562  LoongArch: BPF: Sign extend kfunc call arguments
  - !20470  ipv4: Fix reference count leak when using error routes with nexthop objects
  - !20471  net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - !20472  net: fix memory leak in skb_segment_list for GRO packets
  - !20473  ipv4: ip_gre: make ipgre_header() robust
  - !20469  SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - !20476  ipv6: Fix use-after-free in inet6_addr_del().
  - !20477  svcrdma: bound check rq_pages index in inline path
  - !20578  ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - !20579  fix CVE-2025-68768
  - !20542  Fix NFS deadlock
  - USB: storage: Remove subclass and protocol overrides from Novatek quirk
  - cpuidle: governors: menu: Select polling state in some more cases
  - cpuidle: governors: menu: Rearrange main loop in menu_select()
  - cpuidle: menu: Update documentation after previous changes
  - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader"
  - parisc: Remove spurious if statement from raw_copy_from_user()
  - ata: libata-scsi: Fix system suspend for a security locked drive
  - Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  - mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present
  - drm/amd/display: use udelay rather than fsleep
  - sched/fair: Revert max_newidle_lb_cost bump
  - net: ipv4: fix regression in local-broadcast routes
  - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
  - PM: runtime: Do not clear needs_force_resume with enabled runtime PM
  - usb: typec: ucsi: psy: Set max current to zero when disconnected
  - io_uring/rw: cast rw->flags assignment to rwf_t
  - Documentation: ACPI: i2c-muxes: fix I2C device references
  - s390/hypfs: Enable limited access during lockdown
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  - net/mlx5e: Preserve shared buffer capacity during headroom updates
  - net/mlx5: Base ECVF devlink port attrs from 0
  - Octeontx2-af: Skip overlap check for SPI field
  - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU
  - bonding: Add independent control state machine
  - bonding: update LACP activity flag after setting lacp_active
  - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
  - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
  - gve: prevent ethtool ops after shutdown
  - phy: mscc: Fix timestamping for vsc8584
  - net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path
  - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  - mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
  - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
  - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - RDMA/bnxt_re: Fix to initialize the PBL array
  - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path
  - RDMA/bnxt_re: Fix to do SRQ armena by default
  - RDMA/erdma: Fix ignored return value of init_kernel_qp
  - iosys-map: Fix undefined behavior in iosys_map_clear()
  - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key
  - spi: spi-fsl-lpspi: Clamp too high speed_hz
  - usb: typec: maxim_contaminant: disable low power mode when reading comparator values
  - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
  - iio: imu: inv_icm42600: change invalid data error to -EBUSY
  - iio: imu: inv_icm42600: Convert to uXX and sXX integer types
  - iio: imu: inv_icm42600: use = { } instead of memset()
  - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64
  - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
  - iio: light: as73211: Ensure buffer holes are zeroed
  - tls: fix handling of zero-length records on the rx_list
  - powerpc/boot: Fix build with gcc 15
  - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER
  - compiler: remove __ADDRESSABLE_ASM{_STR,}() again
  - drm/amd/display: Don't overclock DCE 6 by 15%
  - usb: dwc3: pci: add support for the Intel Wildcat Lake
  - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  - usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  - usb: renesas-xhci: Fix External ROM access timeouts
  - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
  - comedi: Make insn_rw_emulate_bits() do insn->n samples
  - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
  - cdx: Fix off-by-one error in cdx_rpmsg_probe()
  - most: core: Drop device reference after usage in get_channel()
  - iio: proximity: isl29501: fix buffered read on big-endian systems
  - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe()
  - fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
  - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  - cpuidle: governors: menu: Avoid selecting states with too much latency
  - cpuidle: menu: Remove iowait influence
  - mmc: sdhci-pci-gli: Add a new function to simplify the code
  - mmc: sdhci-pci-gli: Use PCI AER definitions, not hard-coded values
  - mptcp: disable add_addr retransmission when timeout is 0
  - mptcp: remove duplicate sk_reset_timer call
  - use uniform permission checks for all mount propagation changes
  - arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support
  - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems
  - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers
  - scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
  - PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features
  - PCI: imx6: Delay link start until configfs 'start' written
  - PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining
  - PCI: rockchip: Use standard PCIe definitions
  - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
  - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
  - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
  - mm/debug_vm_pgtable: clear page table entries at destroy_args()
  - squashfs: fix memory leak in squashfs_fill_super
  - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency
  - memstick: Fix deadlock by moving removing flag earlier
  - KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix
  - sched/fair: Fix frequency selection for non-invariant case
  - kbuild: userprogs: use correct linker when mixing clang and GNU ld
  - ata: libata-scsi: Return aborted command when missing sense and result TF
  - PM: runtime: Take active children into account in pm_runtime_get_if_in_use()
  - PM: runtime: Simplify pm_runtime_get_if_active() usage
  - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
  - usb: dwc3: imx8mp: fix device leak at unbind
  - wifi: mac80211: check basic rates validity in sta_link_apply_parameters
  - KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  - s390/mm: Remove possible false-positive warning in pte_free_defer()
  - btrfs: send: make fs_path_len() inline and constify its argument
  - btrfs: send: use fallocate for hole punching with send stream v2
  - btrfs: send: avoid path allocation for the current inode when issuing commands
  - btrfs: send: keep the current inode's path cached
  - btrfs: send: add and use helper to rename current inode when processing refs
  - btrfs: send: only use boolean variables at process_recorded_refs()
  - btrfs: send: factor out common logic when sending xattrs
  - btrfs: populate otime when logging an inode item
  - btrfs: constify more pointer parameters
  - btrfs: fix ssd_spread overallocation
  - btrfs: open code timespec64 in struct btrfs_inode
  - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
  - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
  - btrfs: always abort transaction on failure to add block group to free space tree
  - btrfs: move transaction aborts to the error site in add_block_group_free_space()
  - btrfs: qgroup: fix race between quota disable and quota rescan ioctl
  - usb: typec: fusb302: cache PD RX state
  - block: Make REQ_OP_ZONE_FINISH a write operation
  - block: reject invalid operation in submit_bio_noacct
  - leds: flash: leds-qcom-flash: Fix registry access after re-bind
  - leds: flash: leds-qcom-flash: Limit LED current based on thermal condition
  - selftests/memfd: add test for mapping write-sealed memfd read-only
  - mm: update memfd seal write check to include F_SEAL_WRITE
  - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit
  - mptcp: drop skb if MPTCP skb extension allocation fails
  - ipv6: sr: Fix MAC comparison to be constant-time
  - drm/amd/display: Don't overwrite dce60_clk_mgr
  - drm/amd/display: Add primary plane to commits for correct VRR handling
  - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
  - drm/amdgpu: update mmhub 3.0.1 client id mappings
  - drm/amdgpu: Avoid extra evict-restore process.
  - drm/amd: Restore cached power limit during resume
  - media: venus: venc: Clamp param smaller than 1fps and bigger than 240
  - media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
  - media: venus: protect against spurious interrupts during probe
  - media: venus: hfi: explicitly release IRQ during teardown
  - media: qcom: camss: cleanup media device allocated resource on error path
  - media: ov2659: Fix memory leaks in ov2659_probe()
  - media: usbtv: Lock resolution while streaming
  - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
  - media: verisilicon: Fix AV1 decoder clock frequency
  - media: vivid: fix wrong pixel_array control size
  - media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
  - media: hi556: correct the test pattern configuration
  - media: gspca: Add bounds checking to firmware parser
  - parisc: Update comments in make_insert_tlb
  - parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault()
  - parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c
  - parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers
  - parisc: Define and use set_pte_at()
  - parisc: Check region is readable by user in raw_copy_from_user()
  - soc/tegra: pmc: Ensure power-domains are in a known state
  - f2fs: fix to avoid out-of-boundary access in dnode page
  - phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence
  - vhost/vsock: Avoid allocating arbitrarily-sized SKBs
  - PCI: endpoint: Fix configfs group removal on driver teardown
  - PCI: endpoint: Fix configfs group list head handling
  - mtd: rawnand: renesas: Add missing check after DMA map
  - mtd: rawnand: fsmc: Add missing check after DMA map
  - mtd: spinand: propagate spinand_wait() errors from spinand_write_page()
  - mtd: spi-nor: Fix spi_nor_try_unlock_all()
  - hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
  - pwm: mediatek: Fix duty and period setting
  - pwm: mediatek: Handle hardware enable and clock enable separately
  - pwm: imx-tpm: Reset counter if CMOD is 0
  - wifi: ath11k: fix dest ring-buffer corruption when ring is full
  - wifi: ath11k: fix source ring-buffer corruption
  - wifi: ath11k: fix dest ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption when ring is full
  - wifi: ath12k: fix source ring-buffer corruption
  - wifi: ath12k: fix dest ring-buffer corruption
  - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
  - iio: adc: ad_sigma_delta: change to buffer predisable
  - zynq_fpga: use sgtable-based scatterlist wrappers
  - scsi: ufs: ufs-pci: Fix default runtime and system PM levels
  - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
  - ata: libata-scsi: Fix ata_to_sense_error() status handling
  - scsi: mpi3mr: Fix race between config read submit and interrupt completion
  - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints
  - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints
  - arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses
  - arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1
  - arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default
  - btrfs: zoned: fix write time activation failure for metadata block group
  - ext4: fix hole length calculation overflow in non-extent inodes
  - ext4: don't try to clear the orphan_present feature block device is r/o
  - ext4: fix reserved gdt blocks handling in fsmap
  - ext4: fix fsmap end of range reporting with bigalloc
  - ext4: check fast symlink for ea_inode correctly
  - tracing: fprobe-event: Sanitize wildcard for fprobe event name
  - crypto: qat - lower priority for skcipher and aead algorithms
  - lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap
  - vt: defkeymap: Map keycodes above 127 to K_HOLE
  - vt: keyboard: Don't process Unicode characters in K_OFF mode
  - bus: mhi: host: Fix endianness of BHI vector table
  - usb: dwc3: meson-g12a: fix device leaks at unbind
  - usb: musb: omap2430: fix device leak at unbind
  - usb: gadget: udc: renesas_usb3: fix device leak at unbind
  - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  - m68k: Fix lost column on framebuffer debug console
  - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister()
  - cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - HID: apple: avoid setting up battery timer for devices without battery
  - HID: magicmouse: avoid setting up battery timer when not needed
  - RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
  - tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros
  - media: uvcvideo: Do not mark valid metadata as invalid
  - media: venus: Fix OOB read due to missing payload bound check
  - parisc: Makefile: fix a typo in palo.conf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - btrfs: do not allow relocation of partially dropped subvolumes
  - btrfs: zoned: do not select metadata BG as finish target
  - btrfs: clear dirty status from extent buffer on error at insert_new_root()
  - btrfs: zoned: do not remove unwritten non-data block group
  - btrfs: abort transaction during log replay if walk_log_tree() failed
  - btrfs: zoned: use filesystem size not disk size for reclaim decision
  - cdc-acm: fix race between initial clearing halt and open
  - thunderbolt: Fix copy+paste error in match_service_id()
  - usb: typec: ucsi: Update power_supply on power role change
  - misc: rtsx: usb: Ensure mmc child device is active when card is present
  - iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range
  - cifs: reset iface weights when we cannot find a candidate
  - drm/amdgpu: fix incorrect vm flags to map bo
  - scsi: lpfc: Remove redundant assignment to avoid memory leak
  - rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
  - pNFS: Handle RPC size limit for layoutcommits
  - pNFS: Fix disk addr range check in block/scsi layout
  - pNFS: Fix stripe mapping in block/scsi layout
  - ASoC: Intel: avs: Fix uninitialized pointer error in probe()
  - net: phy: smsc: add proper reset flags for LAN8710A
  - ipmi: Fix strcpy source and destination the same
  - kconfig: lxdialog: fix 'space' to (de)select options
  - kconfig: gconf: fix potential memory leak in renderer_edited()
  - kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
  - ipmi: Use dev_warn_ratelimited() for incorrect message warnings
  - vfio/mlx5: fix possible overflow in tracking max message size
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: target: core: Generate correct identifiers for PR OUT transport IDs
  - scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
  - kconfig: nconf: Ensure null termination where strncpy is used
  - vfio/type1: conditional rescheduling while pinning
  - kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
  - f2fs: check the generic conditions first
  - exfat: add cluster chain loop check for dir
  - i2c: Force DLL0945 touchpad i2c freq to 100khz
  - apparmor: use the condition in AA_BUG_FMT even with debug disabled
  - dm-table: fix checking for rq stackable devices
  - dm-mpath: don't print the "loaded" message if registering fails
  - i3c: master: Initialize ret in i3c_i2c_notifier_call()
  - i3c: don't fail if GETHDRCAP is unsupported
  - apparmor: shift ouid when mediating hard links in userns
  - rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
  - i3c: add missing include to internal header
  - module: Prevent silent truncation of module name in delete_module(2)
  - md: dm-zoned-target: Initialize return variable r to avoid uninitialized use
  - soundwire: Move handle_nested_irq outside of sdw_dev_lock
  - soundwire: amd: serialize amd manager resume sequence during pm_prepare
  - crypto: octeontx2 - add timeout for load_fvc completion poll
  - media: uvcvideo: Fix bandwidth issue for Alcor camera
  - media: usb: hdpvr: disable zero-length read messages
  - media: tc358743: Increase FIFO trigger level to 374
  - media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
  - media: tc358743: Check I2C succeeded during probe
  - pinctrl: stm32: Manage irq affinity settings
  - scsi: mpi3mr: Correctly handle ATA device errors
  - scsi: mpt3sas: Correctly handle ATA device errors
  - power: supply: qcom_battmgr: Add lithium-polymer entry
  - RDMA/core: reduce stack using in nldev_stat_get_doit()
  - dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs
  - leds: leds-lp50xx: Handle reg to get correct multi_index
  - media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control
  - MIPS: lantiq: falcon: sysctrl: fix request memory check logic
  - crypto: jitter - fix intermediary handling
  - watchdog: iTCO_wdt: Report error if timeout configuration fails
  - MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
  - clk: qcom: ipq5018: keep XO clock always on
  - hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state
  - watchdog: dw_wdt: Fix default timeout
  - fs/orangefs: use snprintf() instead of sprintf()
  - phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal
  - mfd: axp20x: Set explicit ID for AXP313 regulator
  - clk: tegra: periph: Fix error handling and resolve unsigned compare warning
  - fbdev: fix potential buffer overflow in do_register_framebuffer()
  - cifs: Fix calling CIFSFindFirst() for root path without msearch
  - watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition
  - drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported
  - drm/amd/display: Only finalize atomic_obj if it was initialized
  - vhost: fail early when __vhost_add_used() fails
  - vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page
  - net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/amd/display: Avoid trying AUX transactions on disconnected ports
  - selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size
  - bpf: Make reg_not_null() true for CONST_PTR_TO_MAP
  - uapi: in6: restore visibility of most IPv6 socket options
  - drm/ttm: Should to return the evict error
  - drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range
  - net: ncsi: Fix buffer overflow in fetching version id
  - ionic: clean dbpage in de-init
  - wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc()
  - ptp: Use ratelimite for freerun error message
  - bpftool: Fix JSON writer resource leak in version command
  - net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
  - net: dsa: b53: prevent DIS_LEARNING access on BCM5325
  - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
  - net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
  - gve: Return error for unknown admin queue command
  - net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
  - net: vlan: Make is_vlan_dev() a stub when VLAN is not configured
  - drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual
  - dpaa_eth: don't use fixed_phy_change_carrier
  - wifi: iwlegacy: Check rate_idx range after addition
  - netmem: fix skb_frag_address_safe with unreadable skbs
  - powerpc: floppy: Add missing checks after DMA map
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling
  - wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0
  - wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
  - wifi: mac80211: update radar_required in channel context after channel switch
  - drm/amd/display: Fix 'failed to blank crtc!'
  - wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
  - wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
  - wifi: ath12k: Add memset and update default rate value in wmi tx completion
  - drm/amd/display: Separate set_gsl from set_gsl_source_select
  - net: fec: allow disable coalescing
  - net: atlantic: add set_power to fw_ops for atl2 to fix wol
  - net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths()
  - net: thunderbolt: Enable end-to-end flow control also in transmit
  - kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace
  - wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch
  - wifi: rtw89: Disable deep power saving for USB/SDIO
  - wifi: rtw89: Fix rtw89_mac_power_switch() for USB
  - drm/msm: use trylock for debugfs
  - wifi: mac80211: fix rx link assignment for non-MLO stations
  - ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc().
  - (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
  - wifi: mac80211: don't complete management TX on SAE commit
  - sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails
  - s390/stp: Remove udelay from stp_sync_clock()
  - wifi: iwlwifi: mvm: fix scan request validation
  - um: Re-evaluate thread flags repeatedly
  - wifi: iwlwifi: mvm: set gtk id also in older FWs
  - perf/cxlpmu: Remove unintended newline from IRQ name format string
  - net: phy: micrel: Add ksz9131_resume()
  - net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
  - net: ipv4: fix incorrect MTU in broadcast routes
  - wifi: cfg80211: Fix interface type validation
  - net: mctp: Prevent duplicate binds
  - arm64: Mark kernel as tainted on SAE and SError panic
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable
  - net: ag71xx: Add missing check after DMA map
  - et131x: Add missing check after DMA map
  - wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB
  - be2net: Use correct byte order and format string for TCP seq and ack_seq
  - s390/time: Use monotonic clock in get_cycles()
  - wifi: cfg80211: reject HTC bit for management frames
  - ktest.pl: Prevent recursion of default variable options
  - wifi: ath12k: Correct tid cleanup when tid setup fails
  - net: usb: cdc-ncm: check for filtering capability
  - xen/netfront: Fix TX response spurious interrupts
  - Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie()
  - powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64
  - ASoC: qcom: use drvdata instead of component to keep id
  - ASoC: codecs: rt5640: Retry DEVICE_ID verification
  - iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement
  - ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
  - ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop
  - platform/chrome: cros_ec_typec: Defer probe on missing EC parent
  - platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
  - soc: qcom: mdt_loader: Actually use the e_phoff
  - imx8m-blk-ctrl: set ISI panic write hurry level
  - pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
  - usb: core: usb_submit_urb: downgrade type check
  - usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present
  - ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
  - ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
  - ALSA: hda: Disable jack polling at shutdown
  - ALSA: hda: Handle the jack polling always via a work
  - mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
  - mei: bus: Check for still connected devices in mei_cl_bus_dev_release()
  - char: misc: Fix improper and inaccurate error code returned by misc_init()
  - reset: brcmstb: Enable reset drivers for ARCH_BCM2835
  - pps: clients: gpio: fix interrupt handling order in remove path
  - ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
  - mmc: sdhci-msm: Ensure SD card power isn't ON when card removed
  - ACPI: processor: fix acpi_object initialization
  - PM: sleep: console: Fix the black screen issue
  - thermal: sysfs: Return ENODATA instead of EAGAIN for reads
  - PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
  - firmware: tegra: Fix IVC dependency problems
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion
  - selftests: tracing: Use mutex_unlock for testing glob filter
  - tools/build: Fix s390(x) cross-compilation with clang
  - gpio: tps65912: check the return value of regmap_update_bits()
  - iio: adc: ad_sigma_delta: don't overallocate scan buffer
  - tools/nolibc: define time_t in terms of __kernel_old_time_t
  - thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required
  - ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
  - EDAC/synopsys: Clear the ECC counters on init
  - gpio: wcd934x: check the return value of regmap_update_bits()
  - remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
  - soc: qcom: rpmh-rsc: Add RSC version 4 support
  - usb: xhci: Avoid showing errors during surprise removal
  - usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
  - usb: xhci: Avoid showing warnings for dying controller
  - usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
  - selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
  - cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
  - platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
  - usb: xhci: print xhci->xhc_state when queue_command failed
  - tracefs: Add d_delete to remove negative dentries
  - securityfs: don't pin dentries twice, once is enough...
  - fix locking in efi_secret_unlink()
  - ext2: Handle fiemap on empty files to prevent EINVAL
  - fs/ntfs3: correctly create symlink for relative path
  - fs/ntfs3: Add sanity check for file name
  - better lockdep annotations for simple_recursive_removal()
  - hfs: fix not erasing deleted b-tree node issue
  - drbd: add missing kref_get in handle_write_conflicts
  - udf: Verify partition map count
  - gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
  - nvme-pci: try function level reset on init failure
  - smb/server: avoid deadlock when linking with ReplaceIfExists
  - arm64: Handle KCOV __init vs inline mismatches
  - ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
  - intel_idle: Allow loading ACPI tables for any family
  - net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
  - netfilter: ctnetlink: fix refcount leak on table dump
  - udp: also consider secpath when evaluating ipsec use for checksumming
  - KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
  - KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
  - KVM: VMX: Extract checking of guest's DEBUGCTL into helper
  - KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
  - KVM: VMX: Handle forced exit due to preemption timer in fastpath
  - KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
  - KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
  - libceph: prevent potential out-of-bounds reads in handle_auth_done()
  - net: usb: pegasus: fix memory leak in update_eth_regs_async()
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
  - !20540 urma: added support for ipoverurma
  - team: fix check for port enabled in team_queue_override_port_prio_changed()
  - mm/page_alloc: prevent pcp corruption with SMP=n
  - !20528 Fix CVE-2025-71083
  - KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
  - KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
  - KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
  - smb: client: don't wait for info->send_pending == 0 on error
  - smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
  - ACPI: processor: perflib: Move problematic pr->performance check
  - ACPI: processor: perflib: Fix initial _PPC limit application
  - Documentation: ACPI: Fix parent device references
  - fs: Prevent file descriptor table allocations exceeding INT_MAX
  - sunvdc: Balance device refcount in vdc_port_mpgroup_check
  - PCI: Extend isolated function probing to LoongArch
  - NFSD: detect mismatch of file handle and delegation stateid in OPEN op
  - net: dpaa: fix device leak when querying time stamp info
  - net: ti: icss-iep: fix device and OF node leaks at probe
  - net: mtk_eth_soc: fix device leak at probe
  - net: enetc: fix device and OF node leak at probe
  - net: gianfar: fix device leak when querying time stamp info
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test
  - gpio: mlxbf3: use platform_get_irq_optional()
  - gpio: mlxbf2: use platform_get_irq_optional()
  - gpio: virtio: Fix config space reading.
  - ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
  - ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work
  - drm/tilcdc: Fix removal actions in case of failed probe
  - drm/tilcdc: request and mapp iomem with devres
  - urma: fix update topo logic
  - dmaengine: stm32: dmamux: fix device leak on route allocation
  - pswiotlb: Adapt to the IOMMU DMA API upgraded by IOMMUFD
  - null_blk: fix kmemleak by releasing references to fault configfs items
  - inet: frags: flush pending skbs in fqdir_pre_exit()
  - inet: frags: add inet_frag_queue_flush()
  - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
  - md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen
  - md/dm-raid: don't call md_reap_sync_thread() directly
  - ACPICA: Avoid walking the Namespace if start_node is NULL
  - arm64: entry: xcall/xint: make asm conditionals compatible with clang IAS
  - LoongArch: BPF: Sign extend kfunc call arguments
  - genirq/msi:: Fix kabi break of struct msi_desc
  - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
  - NFS: Fix a deadlock involving nfs_release_folio()
  - Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page""
  - urma: added support for ipoverurma
  - drm/ttm: Avoid NULL pointer deref for evicted BOs
  - XSched: Update XSched manual
  - svcrdma: bound check rq_pages index in inline path
  - ipv6: Fix use-after-free in inet6_addr_del().
  - ipv4: ip_gre: make ipgre_header() robust
  - net: fix memory leak in skb_segment_list for GRO packets
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue
  - ipv4: Fix reference count leak when using error routes with nexthop objects
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
  - udp: Deal with race between UDP socket address change and rehash
  - EDAC/amd64: The width of hash value is 2 bits for Hygon family 18h model 6h processors
  - x86/tsc: Use topology_max_packages() to get package number
  - EDAC/amd64: Use unicast instead of broadcast to access the cs_config register
  - EDAC/amd64: Correct the address translation for hygon family 18h model 4h
  - KVM: arm64: Mark some header functions as inline
  - KVM: arm64: Refactor exit handlers
  - x86/resctrl: Fix memory bandwidth counter width for Hygon CPUs
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio


author: Li Nan <linan122@huawei.com> - 6.6.0-140.0.0.134
changelog:
  - !20820 ub/obmm: add sysfs interface for mempool statistics & bugfixes
  - ub/obmm: fix wrong pxm_numa parameter validation
  - ub/obmm: Remove unused parameters from obmm_addr_check.c
  - ub/obmm: Enhance mem_allocator_granu validation
  - ub/obmm: simplify allocator naming scheme
  - ub/obmm: fix allow_slow logic and optimize conti_alloc_memory
  - ub/obmm: add sysfs interface with fine-grained memory statistics
  - !20804  net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20813  migrate: correct lock ordering for hugetlb file folios
  - !20812  libceph: make calc_target() set t->paused, not just clear it
  - !20719 drivers/ub/sentry: some bugfix
  - !20798 urma: log should not retrieve eid_idx from uctx
  - !20808 urma: support triple bonding device
  - urma: log should not retrieve eid_idx from uctx
  - migrate: correct lock ordering for hugetlb file folios
  - libceph: make calc_target() set t->paused, not just clear it
  - !20745 vfio platform VFIO support for hisi05a1 devices
  - urma: support triple bonding device
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table
  - !20789  gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - !20726  tracing: Add recursion protection in kernel stack trace recording
  - !20668  irqchip/gic-v3-its: Avoid truncating memory addresses
  - !20795 ub: udma: support query and set qos info.
  - !20791 Migration/urma:optimize performance in live migration.
  - ub: udma: Support for UE link establishment message.
  - Migration/urma: optimize performance in live migration.
  - !20787 ub: cdma: modify the method of assigning values to the structure
  - !20759 ubcore: hotfix route query for port eid on the same node.
  - ub: udma: support query and set qos info.
  - Revert "ub: ubase: Support for RC saved by queue granularity"
  - ubcore: hotfix route query for port eid on the same node.
  - !20676 urma: set/get sl
  - !20765 urma: bugfix of UAF and double free in ubcm
  - !20778 ub: ubase&unic: Fixes some bugfix in resetting and dfx ability
  - gic: Add hip09 support for HISILICON_ERRATUM_165010801
  - vfio/platform: Add CONFIG_VFIO_HISI05A1 to openeuler_defconfig and turn it on by default
  - vfio/platform: VFIO support for hisi05a1 devices
  - ub: cdma: modify the method of assigning values to the structure
  - urma: set/get sl
  - ub: ubase: support to query ub dl pkt stats and real-time peak bandwidth
  - ub: ubase: Support for RC saved by queue granularity
  - ub: ubase: Traverse mailbox AE events using interrupts and polling.
  - ub: ubase: Modify ubase ctrlq trace to distinguish between MUE and UE messages
  - net: unic: The function of dumping himac registers is added.
  - ub: ubase: Fix MAC is_pfc sync, optimize list ops and code style
  - ub: ubase: Retain the initial tm qset configuration and restore it
  - net: unic: Fixed an issue in the bond IP address notification and pause configuration when an exception occurs.
  - ub: ubase: Add a retransmission function to improve reliability.
  - net: unic: Increase the readability and reliability of loopback code
  - net: unic: Synchronize the code modify for ip management and deactivation
  - net: unic: Increase the readability and reliability of VLAN feature.
  - net: unic: Added unic DFX log information.
  - ub: ubase: Add and correct comments for some functions and data structures
  - net: unic: Notify MAMI when the bond port status changes
  - ub: ubase: Support for HIMAC reset during ELR reset and Optimize ELR reset
  - !20768 iommu/ummu-core: Fix separate page table compatibility
  - !20665 [OLK-6.6] Enhance CMA memory usage reporting for CSV3
  - !20764 net: hns3: fix double free issue for tx spare buffer
  - urma: bugfix of UAF and double free in ubcm
  - iommu/ummu-core: Fix separate page table compatibility
  - net: hns3: fix double free issue for tx spare buffer
  - drivers/ub/sentry: fix memory leak in sentry_msg_helper
  - drivers/ub/sentry: initialize some variables
  - drivers/ub/sentry: fix potential buffer overflow in convert_str_to_smh_msg()
  - drivers/ub/sentry: fix potential null pointer reference in sentry_uvb_comm
  - drivers/ub/sentry: add input parameter verification for exported symbols
  - tracing: Add recursion protection in kernel stack trace recording
  - x86/csv: Enhance CMA memory usage reporting for CSV3
  - irqchip/gic-v3-its: Avoid truncating memory addresses


author: Li Nan <linan122@huawei.com> - 6.6.0-141.0.0.136
changelog:
  - !20704 kernel support hisi-cca-da
  - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - !20905 v2  KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization
  - !20964 iommu/ummu: Support TID and EID Granularity for MPAM
  - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver
  - hisi-cca-da: Start dev by rsi call
  - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV
  - hisi-cca-da: Support swiotlb and realm memory use
  - hisi-cca-da: Add smmu info when dev attach
  - hisi-cca-da: Transfer realm msix access to rmm
  - hisi-cca-da: Support pcipc sriov capability
  - hisi-cca-da: Delay realm memory release to kvm_destroy_realm
  - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm
  - hisi-cca-da: Add cca realm s2 pgtable framework
  - hisi-cca-da: Use bitmap to determine whether the command can be forwarded
  - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only
  - hisi-cca-da: Add cmd forward mechanism in realm smmu
  - hisi-cca-da: Add realm smmu event and gerror irq initialization
  - hisi-cca-da: Add realm smmu stream table initialization
  - hisi-cca-da: Add realm smmu cmdq and evtq initialization
  - hisi-cca-da: Add realm smmu initialization
  - hisi-cca-da: Add relam iommu support to iommufd
  - hisi-cca-da: Add realm iommu support for vfio-iommu-type1
  - hisi-cca-da: Support dev map and unmap
  - hisi-cca-da: Support dev validate and dev start
  - hisi-cca-da: VFIO support ccada
  - hisi-cca-da: Support dev delegate and dev attach
  - hisi-cca-da: Support root dev delegate and dev init
  - hisi-cca-da: Add hisilicon extension smc and ccada cmd
  - hisi-cca-da: Add hisi ccada feature config
  - !20751 ARM CCA supports hugepage
  - !20944 ub: ubmempfd: supports for D2H mapping and demapping
  - !20888  HiSock Enhancement
  - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver.
  - net: unic: Resolve the residual MAC address problem
  - net: unic: Optimized the code for the cmd structure and FEC function.
  - ub: ubase: add log for post mailbox timeout
  - ub: ubus: Remove black box header file to include dir
  - rme: Remove the secret bit of the vring desc addr
  - rme: improve hisi-cca data mmap and destroy method
  - !20943 uvb: fix wd_obtain logic err
  - !20942 urma: fix bond device id not release
  - !20892  dcache: Limit the minimal number of bucket to two
  - rme: isolate page when do delegation to avoid migration
  - rme: hisi-cca supports different levels for mapping ram
  - rme: rename ccal to hisi-cca
  - rme: support set ripas for ccal realm vm
  - rme: support destroy ram data for ccal realm vm
  - rme: support populate region for ccal realm vm
  - rme: support map ram for ccal realm vm
  - rme: support config ccal realm vm
  - rme: support ccal RMI calls
  - rme: realm vm supports wfx handler
  - !20952 urma: introduce ipourma module
  - iommu/ummu-core: Simplifies tdev initialization resources
  - iommu/ummu: Optimized log printing
  - iommu/ummu: Use passed gfp_mask in map_pages callback
  - uvb: fix wd_obtain logic err
  - !20949 ub: udma: support user ctl function.
  - urma: fix bond device id not release
  - !20901 drivers/ub/sentry: some bugfix
  - ub: ubmempfd: supports for D2H mapping and demapping
  - ub: ubmempfd: supports providing services to the QEMU process through file nodes
  - [virtCCA Live Migration 2]virtcca secure cvm supports live migration
  - urma: query priority and enable bit, support ring size configuration
  - urma: implement debugfs, improve boundary checks and error handling logic
  - urma: implement data plane interaction and statistics
  - urma: implement ipourma network device operations
  - urma: ipourma resource management
  - urma: ipourma resource management and err code
  - urma: introduce ipourma main module
  - iommu/ummu: Optimized the TID invalidation configuration
  - iommu/ummu: Optimized SVA permission table memory allocation approach
  - iommu/ummu: Adapt UMMU SVA interface adjustment
  - iommu/ummu: Support TID and EID Granularity for MPAM
  - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !20847 urma: sl resource query error
  - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches
  - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption
  - !20929  PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - drivers/ub/sentry: fix check input parameters
  - ub: udma: support user ctl function.
  - ub: udma: support uboe function.
  - ub: udma: bugfix related to query aux info.
  - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - drivers/ub/sentry: do not use magic numbers
  - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface
  - urma: sl resource query error
  - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time
  - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs
  - ub: ubmem_vmmu: supports parsing and configuring the hardware node information
  - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation
  - !20806 Fix CVE-2025-71225
  - !20896  scsi: qla2xxx: Free sp in error path to fix system crash
  - !20894  scsi: qla2xxx: Delay module unload while fabric scan in progress
  - !20893  scsi: qla2xxx: Validate sp before freeing associated memory
  - !20802 Fix CVE-2026-23110
  - urma: Kernel-mode specific implementations file for Jetty extension interface
  - drivers/ub/sentry: fix memory leak in process_urma_data()
  - drivers/ub/sentry: initialize some variables
  - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
  - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory
  - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00
  - mm: consider non-anon swap cache folios in folio_expected_ref_count()
  - mm: simplify folio_expected_ref_count()
  - ASoC: qcom: audioreach: fix potential null pointer dereference
  - gcc-plugins: Remove TODO_verify_il for GCC >= 16
  - crypto: sha256 - fix crash at kexec
  - drm/i915/backlight: Return immediately when scale() finds invalid parameters
  - minmax.h: remove some #defines that are only expanded once
  - minmax.h: simplify the variants of clamp()
  - minmax.h: move all the clamp() definitions after the min/max() ones
  - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
  - minmax.h: reduce the #define expansion of min(), max() and clamp()
  - minmax.h: update some comments
  - minmax.h: add whitespace around operators and after commas
  - minmax: fix up min3() and max3() too
  - minmax: improve macro expansion and type checking
  - minmax: don't use max() in situations that want a C constant expression
  - minmax: simplify min()/max()/clamp() implementation
  - minmax: make generic MIN() and MAX() macros available everywhere
  - drm/ast: Use msleep instead of mdelay for edid read
  - gpiolib: Extend software-node support to support secondary software-nodes
  - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB
  - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
  - kmsan: fix out-of-bounds access to shadow memory
  - afs: Fix potential null pointer dereference in afs_put_server
  - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
  - i40e: improve VF MAC filters accounting
  - i40e: add mask to apply valid bits for itr_idx
  - HID: asus: add support for missing PX series fn keys
  - drm/gma500: Fix null dereference in hdmi teardown
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
  - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
  - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
  - net: dsa: lantiq_gswip: do also enable or disable cpu port
  - selftests: fib_nexthops: Fix creation of non-FDB nexthops
  - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
  - bnxt_en: correct offset handling for IPv6 destination address
  - vhost: Take a reference on the task in struct vhost_task.
  - Bluetooth: hci_sync: Fix hci_resume_advertising_sync
  - ethernet: rvu-af: Remove slash from the driver name
  - can: peak_usb: fix shift-out-of-bounds issue
  - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
  - bpf: Reject bpf_timer for PREEMPT_RT
  - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  - wifi: virt_wifi: Fix page fault on connect
  - cpufreq: Initialize cpufreq-based invariance before subsys
  - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
  - arm64: dts: imx8mp: Correct thermal sensor index
  - mm: folio_may_be_lru_cached() unless folio_test_large()
  - mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
  - mm/gup: check ref_count instead of lru before migration
  - mm: add folio_expected_ref_count() for reference count calculation
  - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  - ALSA: usb-audio: Add mute TLV for playback volumes on more devices
  - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
  - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
  - i2c: designware: Add quirk for Intel Xe
  - mmc: sdhci-cadence: add Mobileye eyeQ support
  - usb: core: Add 0x prefix to quirks debug output
  - ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  - ALSA: usb-audio: Convert comma to semicolon
  - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
  - ALSA: usb-audio: Fix block comments in mixer_quirks
  - firewire: core: fix overlooked update of subsystem ABI version
  - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
  - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches
  - !20869 ub:hisi-ubus: fix bug of security smatch
  - !20861  CVE-2026-23163
  - ub: ubdevshm: supports the memory user to obtain and release shared memory
  - ub: ubdevshm: supports granting and revoking shared memory permissions
  - ub: ubdevshm: supports the registration and deregistration of shared memory segments
  - ub: ubdevshm: supports the registration and deregistration
  - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
  - !20886  Fix CVE-2026-23205
  - !20803 Fix CVE-2026-23112
  - !20868  sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - !20811  smb/server: fix refcount leak in smb2_open()
  - !20810  smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - !20809  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4
  - sunrpc: fix race in cache cleanup causing stale nextcheck time
  - scsi: qla2xxx: Free sp in error path to fix system crash
  - scsi: qla2xxx: Delay module unload while fabric scan in progress
  - scsi: qla2xxx: Validate sp before freeing associated memory
  - dcache: Limit the minimal number of bucket to two
  - !20872 Fix CVE-2026-23220
  - !20846 Fix CVE-2026-23193
  - !20815 Fix CVE-2026-23216
  - !20859 Fix CVE-2026-23179
  - !20871  CVE-2026-23096
  - !20858 ub: ubase: resolve the cmdq crq overflow problem
  - bpf: Deprecate hisock unused kfuncs and orig ingress logic
  - bpf: Add local connect support for hisock
  - bpf: Add ipv4-mapped ipv6 addr support for hisock
  - bpf: Add target comm parse to hisock_cmd
  - bpf: Add multi port parse to hisock_cmd
  - bpf: Only deploy hisock in server
  - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress
  - bpf: Add bpf_handle_ingress/egress_ptype kfunc
  - bpf: Add bpf_get_skb_ethhdr kfunc
  - bpf: Add bpf_set_ingress/egress_dev kfunc
  - bpf: Add bpf_set_ingress_dst kfunc
  - bpf: Add BPF_HISOCK_INGRESS attach type
  - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted
  - smb: client: fix potential UAF and double free in smb2_open_file()
  - smb/client: fix memory leak in smb2_open_file()
  - !20852  ASoC: amd: fix memory leak in acp3x pdm dma ops
  - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
  - uacce: fix cdev handling in the cleanup path
  - Revert "uacce: fix for cdev memory leak"
  - ub:hisi-ubus: fix bug of security smatch
  - ub:ubus: injected route event
  - ub:ubus: Black Box Development
  - !20865 urma: urma support uboe
  - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
  - urma: urma support uboe
  - !20857 ub_fwctl driver adds support for querying some functions
  - ub:ub_fwctl:Add illegal verification for scc
  - ub:ub_fwctl:Support querying the historical status of port links
  - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
  - drm/amdkfd: Don't use sw fault filter if retry cam enabled
  - ub:ub_fwctl:Support querying firmware version numbers
  - ub: ub_fwctl: Support querying real-time bandwidth statistics
  - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - !20854 [URMA] add ping server for urma_ping
  - urma: add ping server
  - ub: ubase: resolve the cmdq crq overflow problem
  - ub: ubase: Optimized the QoS code naming to improve code readability.
  - ub: ubase&unic: optimizing code and configuration settings.
  - net: unic: not support query and configure ip by control plane in UBoE
  - net: unic: fix the automatically enable uc guid promisc mode.
  - !20844 urma:kernel header of userctl
  - urma: Kernel-mode header file for Jetty extension interface
  - ASoC: amd: fix memory leak in acp3x pdm dma ops
  - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
  - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again)
  - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
  - !20835 Fix CVE-2026-23084
  - minmax: add a few more MIN_T/MAX_T users
  - minmax: simplify and clarify min_t()/max_t() implementation
  - minmax: avoid overly complicated constant expressions in VM code
  - rtc: pcf2127: fix SPI command byte for PCF2131 backport
  - xhci: dbc: Fix full DbC transfer ring after several reconnects
  - xhci: dbc: decouple endpoint allocation from initialization
  - phy: ti: omap-usb2: fix device leak at unbind
  - phy: Use device_get_match_data()
  - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
  - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  - ASoC: wm8974: Correct PLL rate rounding
  - ASoC: wm8940: Correct typo in control name
  - ASoC: wm8940: Correct PLL rate rounding
  - io_uring: include dying ring in task_work "should cancel" state
  - io_uring: backport io_should_terminate_tw()
  - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
  - selftests: mptcp: avoid spurious errors on TCP disconnect
  - selftests: mptcp: connect: catch IO errors on listen side
  - rds: ib: Increment i_fastreg_wrs before bailing out
  - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  - mmc: mvsdio: Fix dma_unmap_sg() nents value
  - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
  - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
  - btrfs: tree-checker: fix the incorrect inode ref size check
  - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
  - LoongArch: Check the return value when creating kobj
  - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
  - LoongArch: Update help info of ARCH_STRICT_ALIGN
  - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
  - net: liquidio: fix overflow in octeon_init_instr_queue()
  - bonding: don't set oif to bond dev when getting NS target destination
  - net/mlx5e: Consider aggregated port speed during rate configuration
  - i40e: remove redundant memory barrier when cleaning Tx descs
  - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  - selftests: mptcp: sockopt: fix error messages
  - mptcp: tfo: record 'deny join id0' info
  - mptcp: set remote_deny_join_id0 on SYN recv
  - dpaa2-switch: fix buffer pool seeding for control traffic
  - btrfs: fix invalid extref key setup when replaying dentry
  - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  - wifi: mac80211: fix incorrect type for ret
  - wifi: mac80211: increase scan_ies_len for S1G
  - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
  - !20776 ub:ubfi: Release the chosen node
  - !20817  CVE-2026-23094
  - !20819  dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - ub:ubus: Add port num check
  - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - !20830  sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
  - btrfs: fix incorrect readahead expansion length
  - x86: disable image size check for test builds
  - drm/i915/power: fix size for for_each_set_bit() in abox iteration
  - drm/amdgpu: fix a memory leak in fence cleanup when unloading
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device()
  - phy: ti-pipe3: fix device leak at unbind
  - phy: tegra: xusb: fix device and OF node leak at probe
  - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
  - usb: gadget: midi2: Fix MIDI2 IN EP max packet size
  - usb: gadget: midi2: Fix missing UMP group attributes initialization
  - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  - RISC-V: Remove unnecessary include from compat.h
  - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
  - hrtimer: Remove unused function
  - regulator: sy7636a: fix lifecycle of power good gpio
  - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
  - hsr: use rtnl lock when iterating over ports
  - net: hsr: Add VLAN CTAG filter support
  - net: hsr: Add support for MC filtering at the slave device
  - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
  - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  - igb: fix link test skipping when interface is admin down
  - docs: networking: can: change bcm_msg_head frames member to support flexible array
  - tunnels: reset the GSO metadata before reusing the skb
  - net: bridge: Bounce invalid boolopts
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  - USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
  - serial: sc16is7xx: fix bug in flow control levels init
  - tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
  - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
  - Input: iqs7222 - avoid enabling unused interrupts
  - mm/khugepaged: fix the address passed to notifier on testing young
  - btrfs: fix corruption reading compressed range when block size is smaller than page size
  - btrfs: use readahead_expand() on compressed extents
  - mm/damon/sysfs: fix use-after-free in state_show()
  - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  - mtd: nand: raw: atmel: Fix comment in timings preparation
  - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages
  - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time
  - mm/damon/core: set quota->charged_from to jiffies at first charge window
  - fuse: prevent overflow in copy_file_range return value
  - fuse: check if copy_file_range() returns larger than requested size
  - mtd: rawnand: stm32_fmc2: fix ECC overwrite
  - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
  - i2c: i801: Hide Intel Birch Stream SoC TCO WDT
  - ocfs2: fix recursive semaphore deadlock in fiemap call
  - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
  - compiler-clang.h: define __SANITIZE_*__ macros only when undefined
  - EDAC/altera: Delete an inappropriate dma_free_coherent() call
  - rcu-tasks: Maintain real-time response in rcu_tasks_postscan()
  - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks
  - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks
  - s390/cpum_cf: Deny all sampling events by counter PMU
  - NFSv4/flexfiles: Fix layout merge mirror check.
  - NFSv4.2: Serialise O_DIRECT i/o and copy range
  - NFSv4.2: Serialise O_DIRECT i/o and clone range
  - NFSv4.2: Serialise O_DIRECT i/o and fallocate()
  - NFS: Serialise O_DIRECT i/o and truncate()
  - fs/nfs/io: make nfs_start_io_*() killable
  - ftrace/samples: Fix function size computation
  - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
  - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
  - media: i2c: imx214: Fix link frequency validation
  - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs()
  - nfsd: Fix a regression in nfsd_setattr()
  - kasan: fix GCC mem-intrinsic prefix with sw tags
  - kunit: kasan_test: disable fortify string checker on kasan_strings() test
  - io_uring: fix kabi broken in struct io_ring_ctx
  - io_uring: Support forcing sq thread to be idle and woken up by hrtimer
  - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
  - uacce: fix isolate sysfs check condition
  - Revert "uacce: fix isolate sysfs check condition"
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
  - smb/server: fix refcount leak in smb2_open()
  - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
  - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
  - md: suspend array while updating raid_disks via sysfs
  - scsi: core: Wake up the error handler when final completions race against each other
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  - ub:ubfi: Release the chosen node
  - ub:ubus: Delete unused functions
  - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption


author: Li Nan <linan122@huawei.com> - 6.6.0-142.0.0.137
changelog:
  - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - !21192 urma: bugfix of ubagg&ubcore&uburma
  - !21183  platform/x86: classmate-laptop: Add missing NULL pointer checks
  - urma: bugfix of ubagg&ubcore&uburma
  - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise.
  - platform/x86: classmate-laptop: Add missing NULL pointer checks
  - !21167 urma: fix kernel codecheck issues.
  - !21174 urma: change return value for provider err
  - !21127 urma: copy linked ports when importing bond jetty/seg
  - !20247 ubcore: query primary eid in ipourma loopback mode.
  - !21077 Fix hisi cca bugs
  - ubcore: route query refine and ipo loopback adapt.
  - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device.
  - hisi-cca-da: Write NS STE for PF drivers.
  - hisi-cca-da: Provide IO interfaces
  - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices
  - !21045  scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe.
  - !21165  tools/interference: add ifstool utility for kernel interference statistics
  - !21166 urma: fix jfce uaf in batch cleanup
  - !21043 urma: fix tjetty ref in ping server
  - urma: change return value for provider err
  - !21128  sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21129  procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - urma: fix jfce uaf in batch cleanup
  - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches
  - urma: fix kernel codecheck issues.
  - tools/interference: add ifstool utility for kernel interference statistics
  - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor
  - !21092  kexec: derive purgatory entry from symbol
  - !21154  sched: Add SOFT_DOMAIN feature interface for cgroup2
  - !21153  fix CVE-2025-39981
  - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm"
  - urma: fix tjetty ref in ping server
  - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA
  - hisi-cca-da: Improve hisi cca dev validate and delegate
  - hisi-cca-da: Fix smmu enable rme problem
  - hisi-cca-da: Fix msi region shared problem
  - sched: Add SOFT_DOMAIN feature interface for cgroup2
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
  - overflow: Introduce __DEFINE_FLEX for having no initializer
  - overflow: Fix direct struct member initialization in _DEFINE_FLEX()
  - overflow: Change DEFINE_FLEX to take __counted_by member
  - overflow: add DEFINE_FLEX() for on-stack allocs
  - Bluetooth: MGMT: Fix possible UAFs
  - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete()
  - !21103  Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !21104 v2  vsock/virtio: cap TX credit to local buffer size
  - !21070  Fixes CVE-2026-23100
  - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - !21088  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - RDMA/hns: Support configure and query the CNP DSCP through sysfs
  - RDMA/hns: Support query FW cap bit
  - RDMA/hns: Support query HW ID.
  - !20934  smb/server: fix refcount leak in parse_durable_handle_context()
  - !21004  regmap: Fix race condition in hwspinlock irqsave routine
  - !19568 [OLK-6.6]fix txgbe clang compile warning
  - urma: copy linked ports when importing bond jetty/seg
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat()
  - sched/rt: Skip currently executing CPU in rto_next_cpu()
  - !21073  scsi: qla2xxx: Fix bsg_done() causing double free
  - !21114  CVE-2024-57979
  - !21113  iommu: disable SVA when CONFIG_X86 is set
  - !20957  dmaengine: xilinx: xdma: Fix regmap max_register
  - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset
  - pps: Fix a use-after-free - fix kabi
  - pps: Fix a use-after-free
  - !21078  of: unittest: Fix memory leak in unittest_data_add()
  - !21079  *** fix CVE-2026-23208 ***
  - !21082  ALSA: aloop: Fix racy access at PCM trigger
  - !21083  bus: fsl-mc: fix use-after-free in driver_override_show()
  - iommu: disable SVA when CONFIG_X86 is set
  - vsock/virtio: cap TX credit to local buffer size
  - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
  - !20983 Fix CVE-2026-23139
  - !20878 Fix CVE-2026-23230
  - kexec: derive purgatory entry from symbol
  - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
  - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
  - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
  - rtc: interface: Alarm race handling should not discard preceding error
  - perf test stat tests: Fix for virtualized machines
  - perf test stat: Update test expectations and events
  - perf test stat: Avoid hybrid assumption when virtualized
  - writeback: Avoid excessively long inode switching times
  - writeback: Avoid softlockup when switching many inodes
  - cramfs: Verify inode mode when loading from disk
  - fs: Add 'initramfs_options' to set initramfs mount options
  - minixfs: Verify inode mode when loading from disk
  - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume
  - irqchip/sifive-plic: Make use of __assign_bit()
  - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled
  - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
  - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
  - s390/bpf: Describe the frame using a struct instead of constants
  - s390/bpf: Centralize frame offset calculations
  - s390/bpf: Change seen_reg to a mask
  - ACPI: property: Do not pass NULL handles to acpi_attach_data()
  - ACPI: property: Add code comments explaining what is going on
  - ACPI: property: Disregard references in data-only subnode lists
  - ACPI: battery: Add synchronization between interface updates
  - ACPI: battery: Check for error code from devm_mutex_init() call
  - ACPI: battery: initialize mutexes through devm_ APIs
  - ACPI: battery: allocate driver data through devm_ APIs
  - arm64: mte: Do not flag the zero page as PG_mte_tagged
  - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
  - !20790  dm: use bio_clone_blkg_association
  - ipmi: Add HiSilicon IPMI Page Soft Offline driver
  - net: unic: Resolve network unavailability caused by concurrent activation and reset
  - net: unic: Provide the DFX capability for querying MNG table
  - net: unic: Delete the elr reset process after the tx timeout
  - bus: fsl-mc: fix use-after-free in driver_override_show()
  - ALSA: aloop: Fix racy access at PCM trigger
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames
  - of: unittest: Fix memory leak in unittest_data_add()
  - !21034  CVE-2026-23140
  - !21016  net: fix segmentation of forwarding fraglist GRO
  - !21017  mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - !21018  CVE-2026-23209
  - !21019  ipv6: annotate data-race in ndisc_router_discovery()
  - !20881  ipvlan: Make the addrs_lock be per port
  - rme: Imporve range delegate
  - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
  - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release
  - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan()
  - misc: fastrpc: Save actual DMA size in fastrpc_map structure
  - misc: fastrpc: Add missing dev_err newlines
  - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  - media: mc: Clear minor number before put device
  - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
  - ACPICA: Allow to skip Global Lock initialization
  - ext4: validate ea_ino and size in check_xattrs
  - ext4: correctly handle queries for metadata mappings
  - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
  - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0
  - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
  - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500
  - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again
  - selftests: mptcp: join: validate C-flag + def limit
  - spi: cadence-quadspi: Flush posted register writes before DAC access
  - spi: cadence-quadspi: Flush posted register writes before INDAC access
  - PCI: tegra194: Handle errors in BPMP response
  - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
  - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock
  - PCI: rcar-host: Drop PMSR spinlock
  - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  - PCI/AER: Support errors introduced by PCIe r6.0
  - PCI/AER: Fix missing uevent on recovery when a reset is requested
  - PCI/ERR: Fix uevent on failure to recover
  - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  - PCI/sysfs: Ensure devices are powered for config reads
  - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock
  - rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  - rtc: interface: Fix long-standing race when setting alarm
  - rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  - mmc: core: SPI mode remove cmd7
  - mtd: rawnand: fsmc: Default to autodetect buswidth
  - xtensa: simdisk: add input size check in proc_write_simdisk
  - sparc: fix error handling in scan_one_device()
  - sparc64: fix hugetlb for sun4u
  - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  - sched/deadline: Fix race in push_dl_task()
  - pwm: berlin: Fix wrong register in suspend/resume
  - powerpc/pseries/msi: Fix potential underflow and leak issue
  - powerpc/powernv/pci: Fix underflow and leak issue
  - power: supply: max77976_charger: fix constant current reporting
  - pinctrl: samsung: Drop unused S3C24xx driver data
  - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
  - parisc: don't reference obsolete termio struct for TC* constants
  - openat2: don't trigger automounts with RESOLVE_NO_XDEV
  - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify
  - lib/genalloc: fix device leak in of_gen_pool_get()
  - KEYS: trusted_tpm1: Compare HMAC values in constant time
  - iommu/vt-d: PRS isn't usable if PDS isn't supported
  - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
  - init: handle bootloader identifier in kernel parameters
  - iio: xilinx-ams: Unmask interrupts after updating alarms
  - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK
  - iio: frequency: adf4350: Fix prescaler usage.
  - iio: dac: ad5421: use int type to store negative error codes
  - iio: dac: ad5360: use int type to store negative error codes
  - fs/ntfs3: Fix a resource leak bug in wnd_extend()
  - fbdev: Fix logic error in "offb" name match
  - crypto: rockchip - Fix dma_unmap_sg() nents value
  - crypto: atmel - Fix dma_unmap_sg() direction
  - crypto: aspeed - Fix dma_unmap_sg() direction
  - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
  - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
  - bus: mhi: ep: Fix chained transfer handling in read path
  - btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  - blk-crypto: fix missing blktrace bio split events
  - drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  - drm/rcar-du: dsi: Fix 1/2/3 lane support
  - media: lirc: Fix error handling in lirc_register()
  - media: venus: firmware: Use correct reset sequence for IRIS2
  - media: pci: ivtv: Add missing check after DMA map
  - media: mc: Fix MUST_CONNECT handling for pads with no links
  - media: i2c: mt9v111: fix incorrect type for ret
  - media: cx18: Add missing check after DMA map
  - firmware: meson_sm: fix device leak at probe
  - xen/events: Update virq_to_irq on migration
  - xen/events: Return -EEXIST for bound VIRQs
  - xen/manage: Fix suspend error path
  - xen/events: Cleanup find_virq() return codes
  - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required
  - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
  - arm64: dts: ti: k3-am62a-main: Fix main padcfg length
  - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
  - arm64: dts: qcom: msm8939: Add missing MDSS reset
  - arm64: dts: qcom: msm8916: Add missing MDSS reset
  - ACPI: debug: fix signedness issues in read/write helpers
  - ACPI: property: Fix buffer properties extraction for subnodes
  - gpio: wcd934x: mark the GPIO controller as sleeping
  - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  - smb: client: fix missing timestamp updates after utime(2)
  - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
  - drm/amd/display: Properly disable scaling on DCE6
  - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
  - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
  - drm/amdgpu: Add additional DCE6 SCL registers
  - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat()
  - perf python: split Clang options when invoking Popen
  - tools build: Align warning options with perf
  - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  - drm/vmwgfx: Fix copy-paste typo in validation
  - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  - LoongArch: Init acpi_gbl_use_global_lock to false
  - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init()
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
  - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  - clk: tegra: do not overallocate memory for bpmp clocks
  - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags()
  - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m
  - perf evsel: Ensure the fallback message is always written to
  - perf tools: Add fallback for exclude_guest
  - perf test: Add a test for default perf stat command
  - perf test: Don't leak workload gopipe in PERF_RECORD_*
  - perf session: Fix handling when buffer exceeds 2 GiB
  - perf arm_spe: Correct memory level for remote access
  - perf arm_spe: Correct setting remote access
  - rtc: optee: fix memory leak on driver removal
  - rtc: x1205: Fix Xicor X1205 vendor prefix
  - perf util: Fix compression checks returning -1 as bool
  - clk: at91: peripheral: fix return value
  - libperf event: Ensure tracing data is multiple of 8 sized
  - perf evsel: Avoid container_of on a NULL leader
  - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled
  - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  - clocksource/drivers/clps711x: Fix resource leaks in error paths
  - fscontext: do not consume log entries when returning -EMSGSIZE
  - fs: always return zero on success from replace_fd()
  - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches
  - scsi: qla2xxx: Fix bsg_done() causing double free
  - !21065 Fix CVE-2026-23069
  - !21062 v4  Support multi-level cgroup
  - !20987 Fix CVE-2026-23212
  - !20982 Fix CVE-2026-23119
  - !20979 Fix CVE-2026-23111
  - !20974 Fix CVE-2026-23099
  - !20973 Fix CVE-2026-23105
  - !20972 Fix CVE-2026-23074
  - !20884  ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - !20947 Fix CVE-2026-23101
  - ext4: clear i_state_flags when alloc inode
  - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup
  - Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
  - fs/ntfs3: fix mount failure for sparse runs in run_unpack()
  - !20825  efivarfs: fix error propagation in efivar_entry_get()
  - !20824  io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - mm/rmap: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix two comments related to huge_pmd_unshare()
  - mm/hugetlb: fix hugetlb_pmd_shared()
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count
  - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit()
  - !21001 Fix CVE-2026-23229
  - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
  - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
  - !20999 Fix CVE-2026-23173
  - usb: typec: tipd: Clear interrupts first
  - bus: fsl-mc: Check return value of platform_get_resource()
  - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
  - Input: atmel_mxt_ts - allow reset GPIO to sleep
  - misc: fastrpc: Skip reference for DMA handles
  - misc: fastrpc: fix possible map leak in fastrpc_put_args
  - misc: fastrpc: Fix fastrpc_map_lookup operation
  - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
  - ext4: fix checks for orphan inodes
  - ksmbd: fix error code overwriting in smb2_get_info_filesystem()
  - LoongArch: Automatically disable kaslr if boot from kexec_file
  - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  - mfd: rz-mtu3: Fix MTU5 NFCR register offset
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
  - vhost: vringh: Modify the return value check
  - net/mlx5: fw reset, add reset timeout work
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown
  - net/mlx5: Stop polling for command response if interface goes down
  - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  - nfp: fix RSS hash key size when RSS is not supported
  - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
  - drivers/base/node: fix double free in register_one_node()
  - hwrng: ks-sa - fix division by zero in ks_sa_rng_init
  - KEYS: X.509: Fix Basic Constraints CA flag parsing
  - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
  - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
  - vhost: vringh: Fix copy_to_iter return value check
  - RDMA/siw: Always report immediate post SQ errors
  - usb: vhci-hcd: Prevent suspending virtually attached devices
  - NFSv4.1: fix backchannel max_resp_sz verification check
  - coresight: trbe: Return NULL pointer for allocation failures
  - coresight: etm4x: Support atclk
  - coresight-etm4x: Conditionally access register TRCEXTINSELR
  - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
  - vfio/pds: replace bitmap_free with vfree
  - sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  - sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  - wifi: mac80211: fix Rx packet handling when pubsta information is not available
  - wifi: ath10k: avoid unnecessary wait for service ready message
  - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
  - IB/sa: Fix sa_local_svc_timeout_ms read race
  - RDMA/core: Resolve MAC of next-hop device without ARP support
  - f2fs: fix zero-sized extent for precache extents
  - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
  - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
  - scsi: qla2xxx: edif: Fix incorrect sign of error code
  - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
  - f2fs: fix to truncate first page in error path of f2fs_truncate()
  - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
  - wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  - RDMA/cm: Rate limit destroy CM ID timeout error message
  - drivers/base/node: handle error properly in register_one_node()
  - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
  - iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
  - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
  - fs: ntfs3: Fix integer overflow in run_unpack()
  - drm/msm/dpu: fix incorrect type for ret
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  - misc: genwqe: Fix incorrect cmd field being reported in error
  - usb: gadget: configfs: Correctly set use_os_string at bind
  - usb: phy: twl6030: Fix incorrect type for ret
  - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
  - tcp: fix __tcp_close() to only send RST when required
  - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  - wifi: mwifiex: send world regulatory domain to driver
  - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
  - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
  - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
  - drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
  - drm/amd/pm: Fix si_upload_smc_data (v3)
  - drm/amd/pm: Disable ULV even if unsupported (v3)
  - drm/amdgpu: Power up UVD 3 for FW validation (v2)
  - coresight: Only register perf symlink for sinks with alloc_buffer
  - inet: ping: check sock_net() in ping_get_port() and ping_lookup()
  - media: st-delta: avoid excessive stack usage
  - ALSA: lx_core: use int type to store negative error codes
  - media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  - scsi: myrs: Fix dma_alloc_coherent() error check
  - hwrng: nomadik - add ARM_AMBA dependency
  - crypto: keembay - Add missing check after sg_nents_for_len()
  - drm/amd/display: Remove redundant semicolons
  - serial: max310x: Add error checking in probe()
  - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
  - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
  - media: zoran: Remove zoran_fh structure
  - drm/bridge: it6505: select REGMAP_I2C
  - f2fs: fix condition in __allow_reserved_blocks()
  - drm/radeon/r600_cs: clean up of dead code in r600_cs
  - drm/panel: novatek-nt35560: Fix invalid return value
  - bpf: Enforce expected_attach_type for tailcall compatibility
  - i2c: designware: Add disabling clocks when probe fails
  - i2c: designware: Fix clock issue when PM is disabled
  - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  - thermal/drivers/qcom/lmh: Add missing IRQ includes
  - thermal/drivers/qcom: Make LMH select QCOM_SCM
  - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
  - once: fix race by moving DO_ONCE to separate section
  - smp: Fix up and expand the smp_call_function_many() kerneldoc
  - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  - i3c: master: svc: Recycle unused IBI slot
  - i3c: master: svc: Use manual response for IBI events
  - ACPICA: Fix largest possible resource descriptor index
  - pwm: tiehrpwm: Fix corner case in clock divisor calculation
  - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
  - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
  - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
  - cpuidle: qcom-spm: fix device and OF node leaks at probe
  - firmware: firmware: meson-sm: fix compile-test default
  - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
  - null_blk: Fix the description of the cache_size module argument
  - pinctrl: renesas: Use int type to store negative error codes
  - power: supply: cw2015: Fix a alignment coding style issue
  - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
  - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
  - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
  - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
  - block: use int to store blk_stack_limits() return value
  - selftests/nolibc: fix EXPECT_NZ macro
  - regulator: scmi: Use int type to store negative error codes
  - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
  - ARM: at91: pm: fix MCKx restore routine
  - pinctrl: meson-gxl: add missing i2c_d pinmux
  - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  - leds: flash: leds-qcom-flash: Update torch current clamp setting
  - ARM: dts: renesas: porter: Fix CAN pin group
  - libbpf: Fix reuse of DEVMAP
  - bpf: Remove migrate_disable in kprobe_multi_link_prog_run
  - bpf/selftests: Fix test_tcpnotify_user
  - regmap: Remove superfluous check for !config in __regmap_init()
  - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
  - x86/vdso: Fix output operand size of RDPID
  - smb: server: fix IRD/ORD negotiation with the client
  - coresight: trbe: Prevent overflow in PERF_IDX2OFF()
  - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
  - selftests: arm64: Check fread return value in exec_target
  - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
  - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
  - filelock: add FL_RECLAIM to show_fl_flags() macro
  - !21022  KVM: Don't clobber irqfd routing type when deassigning irqfd
  - !20998  ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !21023  l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - xsched: fix potential NULL dereference in xsched_quota_timeout_update
  - xsched: remove the standalone xcu_cfs_cg_deinit() helper
  - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle
  - xsched: simplify root group check by direct comparison with root_xcg
  - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length
  - xsched/core: immediate cleanup of remaining operators on task exit
  - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization
  - xsched: modify xcu_cg_initialize_components helper
  - xsched: refactor xsched_entity initialization
  - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq
  - xsched: harden and clarify xcu_move_task() logic
  - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs
  - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling
  - xsched/quota: support multi-level cgroup
  - xsched: remove redundant xcu parameter from dequeue_ctx
  - xsched: update group shares using xcu_grp_shares_add/sub helpers
  - xsched: delete unused code
  - xsched/cfs: propagate group activation/deactivation up the hierarchy
  - xsched/cfs: move xruntime updates to pick/put paths
  - xsched: add has_running hook to xsched classes for wake-up eligibility check
  - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches
  - scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
  - !21013  CVE-2026-23177
  - !21007  bonding: fix use-after-free due to enslave fail after slave array update
  - !21006  net: Fix CVE-2026-23204
  - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
  - bpf, test_run: Subtract size of xdp_frame from allowed metadata size
  - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN
  - bpf: Make variables in bpf_prog_test_run_xdp less confusing
  - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K
  - !21015  libceph: reset sparse-read state in osd_fault()
  - !21024 ub: udma: bugfix related to print messages.
  - !20980 Fix CVE-2026-23126
  - !20922 Fix CVE-2026-23133
  - ub: udma: bugfix related to print messages.
  - l2tp: avoid one data-race in l2tp_tunnel_del_work()
  - KVM: Don't clobber irqfd routing type when deassigning irqfd
  - ipv6: annotate data-race in ndisc_router_discovery()
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path
  - macvlan: fix error recovery in macvlan_common_newlink()
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
  - net: fix segmentation of forwarding fraglist GRO
  - can: rcar_canfd: Fix CAN-FD mode as default
  - libceph: reset sparse-read state in osd_fault()
  - !21008 uvb: fix cis call return value and obtain
  - mm, shmem: prevent infinite loop on truncate race
  - mm/shmem, swap: fix race of truncate and swap entry split
  - net/9p: fix double req put in p9_fd_cancelled
  - riscv: mm: Do not restrict mmap address based on hint
  - riscv: mm: Use hint address in mmap if available
  - driver core/PM: Set power.no_callbacks along with power.no_pm
  - serial: stm32: allow selecting console when the driver is module
  - hid: fix I2C read buffer overflow in raw_event() for mcp2221
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
  - ALSA: usb-audio: Kill timer properly at removal
  - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list
  - can: rcar_canfd: Fix controller mode setting
  - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
  - btrfs: ref-verify: handle damaged extent root tree
  - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
  - perf subcmd: avoid crash in exclude_cmds when excludes is empty
  - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
  - dm-integrity: limit MAX_TAG_SIZE to 255
  - ASoC: amd: acp: Adjust pdm gain value
  - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  - USB: serial: option: add SIMCom 8230C compositions
  - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  - !20931 Fix CVE-2026-23060
  - uvb: fix cis call return value and obtain
  - bonding: fix use-after-free due to enslave fail after slave array update
  - net/sched: cls_u32: use skb_header_pointer_careful()
  - net: add skb_header_pointer_careful() helper
  - regmap: Fix race condition in hwspinlock irqsave routine
  - crypto: virtio - Add spinlock protection with virtqueue notification
  - net/mlx5e: TC, delete flows only for existing peers
  - !20967 net: hns3: modify code of judging if SMMU DMA is enabled
  - ceph: fix oops due to invalid pointer for kfree() in parse_longname()
  - !20969 Fix CVE-2026-23125
  - !20948 v4  arm64: Add memory poison recovery support for various paths
  - !20975  CVE-2026-23102
  - !20977 v4  support apei_page_offline_policy
  - bonding: annotate data-races around slave->last_rx
  - netfilter: nf_conncount: update last_gc only when GC has been performed
  - bonding: provide a net pointer to __skb_flow_dissect()
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
  - apei/ghes: Add sysctl interface to control soft-offline page isolation
  - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages"
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
  - arm64/fpsimd: signal: Fix restoration of SVE context
  - arm64/fpsimd: signal: Consistently read FPSIMD context
  - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state
  - bonding: limit BOND_MODE_8023AD to Ethernet devices
  - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag
  - net/sched: Enforce that teql can only be used as root qdisc
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
  - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers
  - net: hns3: modify code of judging if SMMU DMA is enabled
  - dmaengine: xilinx: xdma: Fix regmap max_register
  - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem
  - ub:ubus: Avoid getting empty uent from ubc
  - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory
  - arm64: send sig fault for user task when apei_claim_sea fails
  - arm64: add ras log during do_sea
  - arm64: move getting valid siaddr to the top of do_sea
  - arm64: mm: shmem: support poison recovery from shmem_file_read_iter()
  - arm64: fs: support poison recovery from __kernel_read()
  - iov_iter: add mc support for copy_page_to_iter
  - arm64: mm: support recovery from copy_{from/to}_user_page()
  - iov_iter: get rid of 'copy_mc' flag
  - leds: led-class: Only Add LED to leds_list when it is fully ready
  - wifi: ath10k: fix dma_free_coherent() pointer
  - smb/server: fix refcount leak in parse_durable_handle_context()
  - ksmbd: add chann_lock to protect ksmbd_chann_list xarray
  - ipvlan: Make the addrs_lock be per port
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races
  - efivarfs: fix error propagation in efivar_entry_get()
  - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
  - dm: use bio_clone_blkg_association
  - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor
  - net: txgbe: fix clang compile warning


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: tianmuyang <tianmuyang@huawei.com> 2:1.2.2-11
changelog:
  - Adaption for sched type eBPF program:
    backport-libbpf-Adaption-for-sched-type-eBPF-program.patch


author: Wenhua Huang <huangwenhua@kylinos.cn> - 0.14.2-2
changelog:
  - Rebuild for gimp-3.0.2
    exiv2 fix cve and abi change(https://gitee.com/src-openeuler/exiv2/pulls/95)


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: xinghe <xinghe2@h-partners.com> - 2.74.3-4
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-5
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.3-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: nickyang <nickyang228@163.com> - 2.74.3-12
changelog:
  - Type:cves
  - ID:CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716
  - SUG:NA
  - DESC:fix CVE-2026-1539 CVE-2026-1467 CVE-2026-1761 CVE-2026-0716


author: nickyang <nickyang228@163.com> - 2.74.3-13
changelog:
  - Type:cves
  - ID:CVE-2026-1760 CVE-2026-1801 CVE-2026-2369
  - SUG:NA
  - DESC:fix CVE-2026-1760 CVE-2026-1801 CVE-2026-2369


author: renmingshuai <renmingshuai@huawei.com> - 0.10.5-2
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
  - SUG:NA
  - DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
changelog:
  - Type:CVE
  - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-9
changelog:
  - Type:bugfix
  - Id:NA
  - SUG:NA
  - DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821


author: JiaboFeng <fengjiabo1@huawei.com> - 9.10.0-14
changelog:
  - Bugfix: Enhance the capability to trace the shutdown status of large VMS
  - conf: qemu: support provide inject secret for Hygon CSV
  - conf: qemu: add libvirt support reuse id for hygon CSV
  - Automatically unbind all devices' driver under same root port and bind to vfio-pci in the context of CVM.
  - Consistent coding style with opensource.
  - build: Make daemons depend on generated *_protocol.[ch]
  - Add the get tmm memory info API into libvirt-host. Also should add the RPC calls into libvirtd for API calling.
  - Add cvm parameter into the type of LaunchSecurity which is a optional filed for libvirt xml


author: fangyi <eric.fangyi@huawei.com> - 9.10.0-15
changelog:
  - cpu-Add-new-Dharma-CPU-model.patch
  - qemu-cvm-support-uefi-boot-by-rom.patch
  - iommufd-Support-configuring-iommufd-backends-for-qem.patch
  - vdpa-iommufd-Support-associating-iommufd-with-vDPA-h.patch
  - capabilities-add-fun-to-determine-if-binary-is-strat.patch
  - qemu_command-unsupport-command-line-will-not-built-f.patch
  - chardev-use-path-instead-of-fd-for-stratovirt.patch
  - Revert-qemu-command-Delegate-qemuBuildDriveStr-to-SD.patch
  - Revert-qemu-Remove-pre-blockdev-PFLASH-setup.patch
  - qemu_command-get-disk-alias-from-disk-instead-of-nod.patch


author: JiaboFeng <fengjiabo1@huawei.com> - 9.10.0-17
changelog:
  - Revert "Automatically unbind all devices' driver under same root port and bind to vfio-pci in the context of CVM."


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-18
changelog:
  - add qemu VIRTCCA capability detection
  - add virtcca test xml
  - virtcca use hugepage disable bind numa
  - util: resctrl: add parsing process for the new parameters cache id
  - util:resctrl:add L3 priority parse and format method
  - conf: add support for cachetune/L3 priority
  - util: resctrl: define memory bandwidth types & add parse and format method
  - conf: add support for memorytune XML processing for MB hardlimit
  - conf: add support for memorytune XML processing for MB priority
  - conf: add support for memorytune XML processing for MB min_bandwidth
  - [backport]domcaps: Report launchSecurity
  - [backport]qemu: Fill launchSecurity in domaincaps
  - [v4-1-4]src: Add ARM CCA support in qemu driver to launch VM
  - [v4-2-4]src: Add ARM CCA support in domain capabilities command
  - [v4-3-4]src: Add ARM CCA support in domain schema
  - hostdev: add numa configure for host pci device


author: PengruiZhang <zhangpengrui@huawei.com> - 9.10.0-19
changelog:
  - Fix the translation problem of libvirtd.policy's prompts.
  - cpu: Add new Chengdu CPU model
  - util:resctrl:add L3 min/max parse and format method
  - conf: add support for cachetune/L3 min/max
  - conf: add support for hugepage hugepage pod
  - backends:add support of one guest numa node alloc memory from multi host nodes
  - migration: support vfio-pci device migration


author: ZixinLi <lizixin10@h-partners.com> - 9.10.0-20
changelog:
  - Fix CVE-2025-12748 CVE-2025-13193
  - conf: Add virDomainDefIDsParseString
  - bhyve: Check ACLs before parsing the whole domain XML
  - libxl: Check ACLs before parsing the whole domain XML
  - lxc: Check ACLs before parsing the whole domain XML
  - vz: Check ACLs before parsing the whole domain XML
  - ch: Check ACLs before parsing the whole domain XML
  - qemu: Check ACLs before parsing the whole domain XML
  - qemu: snapshot: Set umask for 'qemu-img' when creating external inactive snapshots


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 19.1.7-3
changelog:
  - Backport riscv64 support for offload host plugin
  - Exclude packaging non-supported liborc_rt.a for riscv64


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-9
changelog:
  - update to llvm-for-oE-19.1.7-2506.0.1
  - release-note https://gitee.com/openeuler/llvm-project/compare/cd708029e0b2869e80abe31ddb175f7c35361f90...0c7685b92302b234e353f64d6589a63051a29cea


author: liyunfei <liyunfei33@huawei.com> - 19.1.7-11
changelog:
  - update to llvm-for-oE-19.1.7-2506.0.2
  - release note: https://gitee.com/openeuler/llvm-project/releases/tag/llvm-for-oE-19.1.7-2506.0.2


author: Vladimir Pavlov <pavlov@openscaler.ru> - 19.1.7-15
changelog:
  - Change the os_version macros to number only
  - chnage the prefix path to /opt/openScaler
  - skiped release numbers


author: xiejing <xiejing@kylinos.cn> - 4:10.5.25-1
changelog:
  - Bump to 10.5.25 for resolving CVE-2024-21096
  - Fix version description in systemd service file
  - Add conflict with greatsql and change requires


author: wangkai <13474090681@163.com> - 20240312-1
changelog:
  - Update to 20240312 for fix CVE-2023-38575, CVE-2023-39368,
    CVE-2023-22655, CVE-2023-43490, CVE-2023-28746


author: Funda Wang <fundawang@yeah.net> - 20240813-1
changelog:
  - update to 20240813 for fix CVE-2024-24853, CVE-2024-25939,
    CVE-2024-24980, CVE-2023-42667, CVE-2023-49141


author: Funda Wang <fundawang@yeah.net> - 20250211-1
changelog:
  - update to 2025021 for fix CVE-2024-28047, CVE-2024-31157, CVE-2024-39279,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-24582, CVE-2023-34440, CVE-2024-37020,
    CVE-2024-39355, CVE-2023-43758, CVE-2024-36293, CVE-2024-31068


author: Funda Wang <fundawang@yeah.net> - 20250512-1
changelog:
  - update to 20250512 to fix CVE-2024-28956, CVE-2025-24495, CVE-2025-20012,
    CVE-2024-45332, CVE-2025-20623, CVE-2024-43420, CVE-2025-20054, CVE-2025-20103


author: Funda Wang <fundawang@yeah.net> - 20250812-1
changelog:
  - update to 20250812 to fix CVE-2025-20053, CVE-2025-20109, CVE-2025-21090,
    CVE-2025-22839, CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
    CVE-2025-32086


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: wangkai <13474090681@163.com> - 8.0.37-1
changelog:
  - Update to 8.0.37 for fix CVEs(CVE-2024-20964,CVE-2024-20971,CVE-2024-20976,
    CVE-2024-20973,CVE-2024-20978,CVE-2024-20981,CVE-2024-20962,CVE-2024-20977,
    CVE-2024-20963,CVE-2024-20965,CVE-2024-20972,CVE-2024-20961,CVE-2024-20982,
    CVE-2024-20970,CVE-2024-20967,CVE-2024-20984,CVE-2024-20974,CVE-2024-20966,
    CVE-2024-20960,CVE-2024-20985,CVE-2024-20969,CVE-2024-21000,CVE-2024-21069,
    CVE-2024-21009,CVE-2024-21087,CVE-2024-21047,CVE-2024-20998,CVE-2024-21013,
    CVE-2024-21060,CVE-2024-21008,CVE-2024-21102,CVE-2024-21054,CVE-2024-21062,
    CVE-2024-20994,CVE-2024-21096,CVE-2024-21061,CVE-2024-20993,CVE-2024-21055,
    CVE-2024-21057,CVE-2023-6129)


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: gaihuiying <eaglegai@163.com> - 1:5.9.3-2
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Customized the anti-attacki/reset-last_engineTime function for IdeaUI
         change the permissions of passtest


author: xingwei <xingwei14@h-partners.com> - 1:5.9.3-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Migration patch from upstream, add compatibility to parse
  Linux 6.7 Ip header while keep support for previous versions.


author: lingsheng <lingsheng1@h-partners.com> - 1:1.0.8-3
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:datatype: don't return a const string from cgroupv2_get_path()
  datatype: fix leak and cleanup reference counting for struct datatype
  datatype: initialize TYPE_CT_EVENTBIT slot in datatype array
  datatype: initialize TYPE_CT_LABEL slot in datatype array
  evaluate: do not remove anonymous set with protocol flags and single element
  evaluate: don't crash if object map does not refer to a value
  evaluate: error out when expression has no datatype
  evaluate: error out when store needs more than one 128bit register of align fixup
  evaluate: fix check for truncation in stmt_evaluate_log_prefix()
  evaluate: fix double free on dtype release
  evaluate: fix memleak in prefix evaluation with wildcard interface name
  evaluate: reject set in concatenation
  evaluate: revisit anonymous set with single element optimization
  evaluate: skip anonymous set optimization for concatenations
  evaluate: stmt_nat: set reference must point to a map
  evaluate: tproxy: move range error checks after arg evaluation
  evaluate: validate chain max length
  evaluate: validate maximum log statement prefix length
  exthdr: prefer raw_type instead of desc->type
  json: expose dynamic flag
  json: fix use after free in table_flags_json()
  libnftables: Drop cache in -c/--check mode
  meta: fix tc classid parsing out-of-bounds access
  netlink: don't crash if prefix for < byte is requested
  netlink: fix leaking typeof_expr_data/typeof_expr_key in netlink_delinearize_set()
  netlink: handle invalid etype in set_make_key()
  parser_bison: fix ct scope underflow if ct helper section is duplicated
  parser_bison: fix memleak in meta set error handling
  parser_bison: make sure obj_free releases timeout policies
  parser_json: Catch nonsense ops in match statement
  parser_json: Default meter size to zero
  parser_json: Fix flowtable prio value parsing
  parser_json: Fix synproxy object mss/wscale parsing
  parser_json: Fix typo in json_parse_cmd_add_object()
  parser_json: Proper ct expectation attribute parsing
  parser_json: Wrong check in json_parse_ct_timeout_policy()
  py: fix exception during cleanup of half-initialized Nftables
  rule: fix sym refcount assertion


author: liweigang <liweiganga@uniontech.com> - 1:1.0.8-4
changelog:
  - Type: bugfix
  - CVE: NA
  - SUG: NA
  - DESC: evaluate: guard against NULL basetype
  evaluate: error out if basetypes are different
  evaluate: reject attempt to update a set
  evaluate: release mpz type in expr_evaluate_list() error path
  expression: missing line in describe command with invalid expression
  evaluate: handle invalid mapping expressions in stateful object statements gracefully


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-5
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: disable meta set with ranges
         src: reject large raw payload and concat expressions
         evaluate: fix stack overflow with huge priority string
         tcpopt: don't create exthdr expression without datatype
         src: do not allow to chain more than 16 binops
         rule: fix ASAN errors in chain priority to textual names
         tests: shell: add regression test for double-free crash bug
         evaluate: handle invalid mapping expressions in stateful object
         evaluate: Fix incorrect checking the `base` variable in case of IPV6


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-6
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:ct expectation: fix 'list object x' vs. 'list objects in table' confusion
         tests: shell: connect chains to hook point


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-7
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         parser_json: release buffer returned by json_dumps
         parser_json: fix crash in json_parse_set_stmt_list
         parser_json: fix handle memleak from error path
         parser_json: fix several expression memleaks from error path
         libnftables: Zero ctx->vars after freeing it


author: hdliu <dev03108@linx-info.com> - 1:1.0.8-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patch to adapt iproute2 config path datatype: adjust rt_symbol_table_init() to search /usr/share/iproute2 update paths for rt_marks, group and rt_realms


author: eaglegai <eaglegai@163.com> - 1:1.0.8-9
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         evaluate: don't allow nat map with specified protocol
         rule: return error if table does not exist
         json: make sure timeout list is initialised
         evaluate: don't update cache for anonymous chains
         json: return error if table does not exist
         json: don't BUG when asked to list synproxies
         evaluate: compact STMT_F_STATEFUL checks
         evaluate: only allow stateful statements in set and map definitions
         optimize: expand expression list when merging into concatenation
         netlink: fix stack overflow due to erroneous rounding
         netlink: bogus concatenated set ranges with netlink message overrun
         netlink: fix crash when ops doesn't support udata
         netlink: Catch unknown types when deserializing objects
         netlink: Avoid potential NULL-ptr deref parsing set elem expressions
         netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY
         evaluate: don't BUG on unexpected base datatype
         src: BASECHAIN flag no longer implies presence of priority expression
         parser_bison: only reset by name is supported by now


author: gaihuiying <eaglegai@163.com> - 1:1.0.8-11
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:backport upstream patches
         segtree: fix string data initialisation
         src: netlink: netlink_delinearize_table() may return NULL
         src: ensure chain policy evaluation when specified
         src: fix memory leak in anon chain error handling
         mnl: silence compiler warning
         datatype: Increase symbolic constant printer robustness
         evaluate: follow prefix expression recursively if needed


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: wangkai <13474090681@163.com> - 1:20.18.2-5
changelog:
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
    CVE-2025-59465, CVE-2025-59466, CVE-2026-21637


author: yyjeqhc <jialin.oerv@isrc.iscas.ac.cn> - 0.2.17-3
changelog:
  - Migrated legacy `import pango` and `pangocairo` usage to modern PyGObject (`gi.repository.Pango`, `PangoCairo`)
  - Replaced all legacy constants (`pango.STRETCH_...`) with `Pango.Stretch.XXX` enums


author: fly_1997 <flylove7@outlook.com> -v2.0.2-4
changelog:
  - use double for analysis tlb parameters
  - if an error occurs during smc config loading, smc_tune fails to be enabled
  - remove unused instance


author: LHesperus <liuchanggeng@huawei.com> -v2.1.0-1
changelog:
  - remove the logger.h interface and add TRACE interface, increase safe_queue wait time to 5s
  - support reload log-level online
  - adapt analysis on riscv
  - add load base sched instance
  - v2.0.6-3 add adapt dynamicsmt analysis if smt is not enable
  - fix code check
  - add trace log and change level intf and delete logger
  - smc-d analysis fix inconsistency in the display of zero connection
  - v2.0.6-2 add realtime compile macro
  - v2.0.6-1 add smc_acc.yaml check and some logs
  - add net_hardirq_tune_data.h
  - fux binary coredump
  - v2.0.5-3 fix xcall analysis issues
  - v2.0.5-2 improve some output format
  - add xcall prefetch
  - network interface plugin : adapt same nic with different ifindex
  - v2.0.5-1 fix issues
  - v2.0.4-1 add docker coordination burst tune
  - add multi net path tune and analysis
  - add error log and params check
  - v2.0.3-3 oeaware-sdk enhances user permissions
  - v2.0.3-2 Fixed memory leak issues:
    - Fixed unsubscribeHandler topic deserialize memory leak
    - Fixed analysis module memory leak
  - Enhanced eBPF functionality:
    - Set memory lock limit to infinity for eBPF
    - Used eBPF to collect thread information
  - Network improvements:
    - Fixed ntoh port error
    - Added support for attaching all network interfaces
    - Used tcp-set-state to adapt k8s docker
  - New features:
    - Added xcall parameters
    - Added support for docker coordination burst analysis
    - Added parameter validation
    - Added NUMA parallel scheduler tuning support
  - Other improvements:
    - Fixed header files and added CI test
  - v2.0.3-1: Refactored and enhanced the analysis module:
    - Added scenario-aware analysis for multiple optimization plugins
    - Introduced command-line result viewing capability
    - Implemented Markdown format output support
  - Add new plugin: smt,binary,hirq


author: fly_1997 <flylove7@outlook.com> -v2.1.1-1
changelog:
  - add hwprobe_analysis for RISC-V
  - fix error logger info
  - support kernel cluster scheduler
  - adapt for kylin-v10-sp3
  - realtime tune add new tuning item
  - fix smc insmod err
  - realtime tune skip grubby update
  - add hwprobe_tune hwprobe_ext_zbb_tune for RISC-V
  - add high_load value check


author: xiaochn <xiaochuannan@inspur.com> - 1.1.5-3
changelog:
  - Resolve the issue of different kernel source download locations in kabi test case
  - Resolve the issue that kabiwhitelist still passes when the ko and rpm file does not exist
  - Add the way for manually adding kabiwhitelist file
  - For custom vendors, refer to the method of obtaining openEuler os information
  - Supports custom vendor


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-0
changelog:
  - Add new test suite srpm and intel
  - Add virtual branch of test suite
  - Add support for Kylin and UOS
  - Bugfix


author: wangshuai <wangshuai321@huawei.com> - 1.1.6-3
changelog:
  - Update the pci.ids file
  - Remove unused variable in cdrom test suite
  - Update test_guide doc
  - Unify the location for downloading kernel source RPMs
  - Optimize kabiwhitelist and system test


author: xiaochn <xiaochuannan@inspur.com> - 1.1.7-1
changelog:
  - Add KylinSec 3.5.3 support
  - Fix the problem of disk size calculation
  - Fix bcm57414 nic test failed issue
  - Change the format of date
  - Fixed a bug where a non-existent logger level was used
  - Update README.md
  - Fix vgpu testing issue


author: xu_ping <707078654@qq.com> - 3.24.0-1
changelog:
  - Upgrade version to 3.24.0
    * Add support for FIPS-session mode
    * Updates to harden against RSA timing attacks
    * Add option to show the master key verification patterns of secure keys
    * Add support for exporting a key or certificate as URI-PEM file
    * Performance improvements for attribute retrieval
    * Add support for SHA-2 mechanisms
    * Experimental support for IBM Dilithium via OpenSSL OQS provider
    * Support live guest relocation for protected key (PKEY) operations
    * Add support for CKA_ALWAYS_AUTHENTICATE
    * Add support for CKD_*_SP800 KDFs for ECDH
    * Add support for SHA based key derivation mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms
    * Add support for building Opencryptoki on the IBM AIX platform
    * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
    * Add support for protecting tokens with a token specific user group
    * Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
    * Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later


author: zhang_wenyu <zhang_wenyu@hoperun.com> - 3.25.0-1
changelog:
  - Upgrade version to 3.25.0
    * Add support for PKCS#11 v3.0 SHAKE key derivation
    * Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
    * Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
    * Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
    * Add support for CCA AES CIPHER secure key types
    * Add support for the CKM_ECDH1_DERIVE mechanism
    * Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
    * Add support for the CKM_RSA_AES_KEY_WRAP mechanism
    * Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
    * Add a tool for import and exporting PKCS#11 keys to a KMIP server
    * Add support for opaque secure key blob import via C_CreateObject
    * Add support for key wrapping with AES-GCM
    * Add support for newer CCA versions on s390x and non-s390x platforms
    * Add support for CKM_AES_GCM (single-part operations only)


author: fly_fzc <2385803914@qq.com> - 1:3.0.12-24
changelog:
  - fix CVE-2025-15467,CVE-2025-69418,
        CVE-2025-69419,CVE-2025-69420,
        CVE-2025-69421,CVE-2026-22795,
        CVE-2026-22796


author: Guofeng Yue <yueguofeng@h-partners.com> - 4.5-12
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify "--source_ip" to "--bind_source_ip" to fix init connection establishment with specific interface


author: wangyu <wangqingsan@huawei.com> - 123-1
changelog:
  - update to 123
    - duktape:prevent wrongful termination of runway thread
    - harden the security features of the systemd service
    - add packit build tool
    - systemd:set User/Group and don't change uid/gid if already set
    - stop installing /usr/share/polkit-1/rules.d as 700/polkitd
    - moving the 50-default.rules file location


author: heppen <hepeng68@huawei.com> - 1.1.0-3
changelog:
  - Bug fix: fix build warning.
  - Bug fix: export PWR_SYS_GetRtPowerInfo.
  - Bug fix: data collection task intercept invalid task type.


author: heppen <hepeng68@huawei.com> - 1.1.0-4
changelog:
  - Bug fix: memcpy null pointer, array out of bounds, struct align.
  - Bug fix: get watt state will failed at the first time.
  - Bug fix: use process name to query pid but return all pids.
  - Bug fix: mismatch fopen/pclose and popen/fclose, useless if statement.


author: heppen <hepeng68@huawei.com> - 1.1.0-5
changelog:
  - Bug fix: SIGPIPE cause powerapi server exit.
  - Bug fix: pstree command is too slow to get all pid.
  - Bug fix: set smart grid state failed.
  - Bug fix: get watt attr and task list is not correct.


author: Zihao Xue <xuezihao@huawei.com> - 1.1.0-6
changelog:
  - Bug fix: heap buffer overflow caused by sending incomplete strings.
  - Bug fix: too long strings into QueryProcs causes services broke down.


author: shenzhongwei <shenzhongwei@kylinos.cn> - 1.3.8b-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix: %patchN is deprecated (7 usages found), use %patch N (or %patch -P N)


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-8
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differences


author: dongyuzhen <dongyuzhen@h-partners.com> - 25.1-10
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: revert:distinguish between statically and dynamically compiled pc files and cmake dir to prevent BEP binary differe
  nces


author: Funda Wang <fundawang@yeah.net> - 25.1-12
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: fix build with wrong permission
  - DESC: fix conflicts with protobuf2


author: zhengxiaoxiao <zhengxiaoxiao2@huawei.com> - 25.1-13
changelog:
  - Type:CVE
  - CVE:CVE-2026-0994
  - SUG:NA
  - DESC:Fix Any recursion depth bypass in Python json_format.ParseDict


author: xu_ping <707078654@qq.com> - 7.0.0-1
changelog:
  - Upgrade version to 7.0.0
  - Python 3.12 support and python 3.7 no longer supported
  - Add support bind mount propagation.


author: gengqihu <gengqihu2@h-partners.com> - 23.3.1-1
changelog:
  - update version to 23.3.1
  - Fix parallel pip cache downloads causing crash (#12364)
  - Upgrade urllib3 to 1.26.17 (#12343)
  - Fix zsh completion script (#12173)
  - Fix #12166
  - Move the setuptools settings into pyproject.toml
  - Use `-r=...` instead of `-r ...` for hg
  - Drop isort and flake8 settings from setup.cfg
  - Follow imports for more vendored dependencies
  - Enable mypy's strict equality checks (#12209)
  - Fixed argument name in docstring
  - Allow truststore to not import on Python 3.9 and earlier
  - Vendor truststore
  - Fix formatting, combine numbers not strings!
  - Remove uses of `utcnow` in non-vendored code (#12006)
  - Fix issues raised in code review
  - move test_download_metadata mock pypi index utilities to conftest.py
  - Use strict optional checking in req_install.py (#11379)
  - Fix 'force' remove file without write permissions
  - Dropped unused attribute
  - Fix Pytest --use-venv init
  - Limit the double download fix to wheels
  - Fix slowness on Python 3.11 when updating an existing large environment.
  - Fix `pip completion --zsh`


author: yaoxin <yao_xin001@hoperun.com> - 6.4.1-1
changelog:
  - Update to 6.4.1
    * Parsing of the ``Transfer-Encoding`` header is now stricter.
    * Handling of whitespace in headers now matches the RFC more closely.
    * ``tornado.curl_httpclient`` now prohibits carriage return and linefeed headers in HTTP headers
    (matching the behavior of ``simple_httpclient``).


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


author: lixiaoyong <lixiaoyong@kylinos.cn> - 0.14.1-1
changelog:
  - Upgrade package to version 0.14.1
    - Drop support for Python older than 3.6
    - Additional ruff/Pyflakes/codespell fixes


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-4032, CVE-2024-0397 and fix xml tree assert error


author: Dingli Zhang <dingli@iscas.ac.cn> - 3.11.6-5
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:enable profile guided optimizations for some architectures


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-6
changelog:
  - Type:CVE
  - CVE:NA
  - SUG:NA
  - DESC:fix CVE-2024-6923,CVE-2024-7592,CVE-2024-8088
      - Encode newlines in headers, and verify headers are sound
      - Fix quadratic complexity in parsing quoted cookie values with backslashes
      - Replaced SanitizedNames with a more surgical fix


author: xinsheng <xinsheng3@huawei.com> - 3.11.6-7
changelog:
  - Type:CVE
  - CVE:CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
  - SUG:NA
  - DESC:fix CVE-2024-6232,CVE-2024-3219,CVE-2024-0450,CVE-2023-6597
      - rename all CVE patch name
      - CVE-2024-6232: Remove backtracking when parsing tarfile headers
      - CVE-2024-3219: patch1 Authenticate socket connection for `socket.socketpair()` fallback
      - CVE-2024-3219: patch2 Rework pure Python socketpair tests to avoid use of importlib.reload.
      - CVE-2024-0450: Protect zipfile from "quoted-overlap" zipbomb
      - CVE-2023-6597: tempfile.TemporaryDirectory: fix symlink bug in cleanup


author: Funda Wang <fundawang@yeah.net> - 3.11.6-8
changelog:
  - Type:CVE
  - CVE:CVE-2024-9287
  - SUG:NA
  - DESC:fix CVE-2024-9287
    - Quote template strings in venv activation scripts


author: lipengyu <lipengyu@kylinos.cn> - 3.11.6-20
changelog:
  - Type:CVE
  - CVE:CVE-2025-13836 CVE-2025-13837 CVE-2025-12084
  - SUG:NA
  - DESC:fix CVE-2025-13836 CVE-2025-13837 CVE-2025-12084


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-41
changelog:
  - target/i386/kvm: Refine VMX controls setting for backward compatibility
  - Bugfix: Correctly set vms->bootinfo.confidential in virtCCA senarios.
  - hw/arm/virt-acpi-build.c: Migrate fw_cfg creation to common location
  - hw/arm/virt-acpi-build.c: Migrate virtio creation to common location
  - hw/i386/acpi-microvm.c: Use common function to add virtio in DSDT
  - hw/riscv: virt: Make few IMSIC macros and functions public
  - hw/riscv/virt-acpi-build.c: Add AIA support in RINTC
  - hw/riscv/virt-acpi-build.c: Add IMSIC in the MADT
  - hw/riscv/virt-acpi-build.c: Add APLIC in the MADT
  - hw/riscv/virt-acpi-build.c: Add CMO information in RHCT
  - hw/riscv/virt-acpi-build.c: Add MMU node in RHCT
  - hw/pci-host/gpex: Define properties for MMIO ranges
  - hw/riscv/virt: Update GPEX MMIO related properties
  - hw/riscv/virt-acpi-build.c: Add IO controllers and devices
  - hw/riscv/virt-acpi-build.c: Add PLIC in MADT
  - hw/riscv/virt.c: fix the interrupts-extended property format of PLIC
  - hw/riscv/virt-acpi-build.c: Add namespace devices for PLIC and APLIC
  - hw/riscv/virt-acpi-build.c: Update the HID of RISC-V UART
  - hw/riscv/virt-acpi-build.c: Generate SPCR table
  - hw/riscv/virt-acpi-build.c: Add SRAT and SLIT ACPI tables
  - plugins/loader: fix deadlock when resetting/uninstalling a plugin
  - smbios: Fix buffer overrun when using path= option


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-42
changelog:
  - migration: show error message when postcopy fails
  - docs/about/emulation: Fix broken link
  - update include/hw/xen/arch_hvm.h.
  - hw/display/qxl-render: fix qxl_unpack_chunks() chunk size calculation
  - hw/i386/amd_iommu: Assign pci-id 0x1419 for the AMD IOMMU device
  - amd_iommu: Use correct bitmask to set capability BAR
  - amd_iommu: Use correct DTE field for interrupt passthrough
  - tcg: Reset data_gen_ptr correctly
  - hw/virtio: fix -Werror=maybe-uninitialized


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-43
changelog:
  - util/timer: fix -Werror=maybe-uninitialized false-positive
  - hw/qxl: fix -Werror=maybe-uninitialized false-positives
  - nbd: fix -Werror=maybe-uninitialized false-positive
  - block/mirror: fix -Werror=maybe-uninitialized false-positive
  - hw/ahci: fix -Werror=maybe-uninitialized false-positive
  - hw/sdhci: fix -Werror=maybe-uninitialized false-positive
  - migration: fix -Werror=maybe-uninitialized false-positive
  - qemu-img: improve queue depth validation in img_bench


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-44
changelog:
  - qemu-img: fix division by zero in bench_cb() for zero-sized images
  - target/i386: cpu: set correct supported XCR0 features for TCG
  - target/i386: do not rely on ExtSaveArea for accelerator-supported XCR0 bits
  - target/i386: return bool from x86_cpu_filter_features
  - target/i386: add AVX10 feature and AVX10 version property
  - target/i386: add CPUID.24 features for AVX10
  - target/i386: Add feature dependencies for AVX10
  - target/i386: Add AVX512 state when AVX10 is supported
  - target/i386: Introduce GraniteRapids-v2 model
  - i386/cpu: Mark avx10_version filtered when prefix is NULL
  - target/i386: add avx-vnni-int16 feature
  - block/stream: fix -Werror=maybe-uninitialized false-positives
  - migration: fix -Werror=maybe-uninitialized false-positives
  - hw/ssi/xilinx_spips: Fix flash erase assert in dual parallel configuration
  - hw/nvme: cap MDTS value for internal limitation
  - accel/kvm: Make kvm_has_guest_debug static
  - vtarget/arm/tcg: Including missing 'exec/exec-all.h' header
  - system/qtest: Include missing 'hw/core/cpu.h' header
  - qemu-options: Clarify handling of commas in options parameters


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-45
changelog:
  - tests/unit/test-qmp-event: Drop superfluous mutex
  - configure: use a native non-cross compiler for linux-user
  - target/riscv/kvm: do not use non-portable strerrorname_np()
  - qemu-options: Unify the help entries for cocoa
  - virtio: rng: Check notifier helpers for VIRTIO_CONFIG_IRQ_IDX
  - vhost-scsi: fix usage of error_reportf_err()
  - esp: check for NULL result from scsi_device_find()
  - migration: fix coverity migrate_mode finding
  - hw/core/cpu: Remove final vestiges of dynamic state tracing
  - target/riscv: Fix mcycle/minstret increment behavior
  - chardev/char.c: fix "abstract device type" error message
  - hw/net: cadence_gem: Fix MDIO_OP_xxx values


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-47
changelog:
  - vdpa: Allow vDPA to work on big-endian machine
  - vfio/container: Replace basename with g_path_get_basename
  - vfio/migration: Report only stop-copy size in vfio_state_pending_exact()
  - vfio/pci: Clear MSI-X IRQ index always
  - hw/arm boot.c: Enforce CCA and virtCCA isolation.
  - block/qed: fix use-after-free by nullifying timer pointer after free
  - hw/gpio: npcm7xx: fixup out-of-bounds access
  - pci/msix: Fix msix pba read vector poll end calculation
  - physmem: fix qemu_ram_alloc_from_fd size calculation
  - s390x/s390-virtio-ccw: don't crash on weird RAM sizes
  - ssh: Do not switch session to non-blocking mode
  - target/ppc: Fix mtDPDES targeting SMT siblings
  - target/ppc: Fix non-maskable interrupt while halted
  - elfload: Fix alignment when unmapping excess reservation


author: Junqi Ma <majunqi1@huawei.com> - 11:8.2.0-48
changelog:
  - target/s390x: Fix MVC not always invalidating translation blocks
  - target/sparc: Fix gdbstub incorrectly handling registers f32-f62
  - virtio-net: Fix size check in dhclient workaround
  - vdpa: Fix endian bugs in shadow virtqueue
  - x86/loader: only patch linux kernels
  - target/ppc: Fix e200 duplicate SPRs
  - vfio/container: For CSV3 VM, only register listener to shared_memory_listener list in vfio_connect_container()
  - target/riscv/kvm: update the KVM regs to Linux rvck-6.6
  - target/riscv/kvm: Fix exposure of Zkr
  - hw/arm/virt: Introduce a IPIV machine option
  - hw/vfio/migration: Fix vfio migration isn't aborted in a corner case


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-49
changelog:
  - common-user/host/riscv: use tail pseudoinstruction for calling tail
  - meson: Remove CONFIG_STATX and CONFIG_STATX_MNT_ID
  - qga: fix potentially not initialized nr_volumes in qga_vss_fsfreeze()
  - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint(CVE-2024-8354)
  - hw/usb/hcd-xhci: Unmap canceled packet
  - meson: Use has_header_symbol() to check getcpu()
  - hw/intc/arm_gicv3_cpuif: Don't downgrade monitor traps for AArch32 EL3
  - migration: fix SEEK_CUR offset calculation in qio_channel_block_seek


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-50
changelog:
  - Revert "hw/arm/virt: Introduce a IPIV machine option"
  - target/arm: add ipiv=on/off option
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64smfr0 into the idregs array
  - arm/cpu: Store id_isar0-7 into the idregs array
  - arm/cpu: Store id_pfr0/1/2 into the idregs array
  - arm/cpu: Store id_dfr0/1 into the idregs array
  - arm/cpu: Store id_mmfr0-5 into the idregs array
  - arm/cpu: Add generated sysreg properties
  - arm/cpu: Add sysreg properties generation
  - arm/cpu: Add infra to handle generated ID register definitions
  - kvm: kvm_get_writable_id_regs
  - arm/kvm: use fd instead of fdarray[2]
  - arm/cpu: switch to a generated cpu-sysregs.h.inc
  - arm/cpu: Add sysreg generation scripts
  - arm/cpu: Store aa64dfr0/1 into the idregs array
  - arm/cpu: Store aa64mmfr0-2 into the idregs array
  - arm/cpu: Store aa64pfr0/1 into the idregs array
  - arm/cpu: Store aa64isar1/2 into the idregs array
  - arm/cpu: Store aa64isar0/aa64zfr0 into the idregs arrays
  - arm/cpu: Add sysreg definitions in cpu-sysregs.h
  - arm/cpu: more customization for the kvm host cpu model
  - arm/kvm: write back modified ID regs to KVM
  - arm/kvm: Allow reading all the writable ID registers
  - arm/cpu-features: document ID reg properties
  - arm/qmp-cmds: introspection for ID register props
  - arm/cpu: manually make MIDR/REVIDR/AIDR writable
  - arm/cpu: enable MIDR writable
  - target/arm/kvm: Add SMMC hypercall definitions
  - hw/arm/virt: Initial support to set target_impl CPUs
  - target/arm/kvm: Use PSCI_VERSION for version info
  - target/arm/kvm: Set DISCOVER_IMPL_* hypercalls
  - Fix the compilation of target arm-softmmu


author: huangyan <huangyan@cdjrlc.com> - 11:8.2.0-51
changelog:
  - Add qemu-user package for arm, aarch64, riscv32, riscv64 targets
  - Add user-static, user-binfmt package for statically-linked QEMU user emulator


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-52
changelog:
  - trace: Add trace to measure hot migrate downtime
  - backends: Add support of one guest numa node alloc memory from multi host nodes


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-54
changelog:
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464)
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665)


author: panchenbo <panchenbo@kylinsec.com.cn> - 5.15.10-5
changelog:
  - Backport ffmpeg: avcodec/x86/mathops: clip constants used with shift instructions within inline assembly


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-32
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Increase input parameter checks and adjust inline data size.


author: Donghua Huang <huangdonghua3@h-partners.com> - 50.0-36
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: libhns: Fix wrong WQE data in new post send API when QP wraps around


author: shixuantong <shixuantong1@huawei.com> - 8.2-4
changelog:
  - Add shell command to switch bracketed-paste mode from on to off to keep consistent with realine-8.0


author: wangkai <13474090681@163.com> - 7.2.7-1
changelog:
  - Update to 7.2.7
  - Fix CVE-2021-32626 CVE-2021-32627 CVE-2021-32762 CVE-2021-32675
    CVE-2021-41099 CVE-2021-32628 CVE-2021-32687 CVE-2022-24735
    CVE-2022-24736 CVE-2022-3647 CVE-2022-3734 CVE-2022-35977
    CVE-2023-25155 CVE-2024-46981


author: zouzhimin <zouzhimin@kylinos.cn> - 4.13.0-13
changelog:
  - nfsserver: fix "server scope" functionality for both potentially other dropins AND multiple ExecStart


author: zouzhimin <zouzhimin@kylinos.cn> - 4.15.1-1
changelog:
  - update to 4.15.1
  - IPaddr2: dont fail with "IPv4 does not support lvs_ipv6_addrlabel"
    error, as the parameter is not used in IPv4 scenarioes


author: Funda Wang <fundawang@yeah.net> - 3.2.7-6
changelog:
  - fix CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087,
    CVE-2024-12088, CVE-2024-12747


author: zhangyaqi <zhangyaqi@kylinos.cn> - 8.2312.0-6
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix memory leak in omazureeventhubs on accepted PN_DELIVERY event


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 8.2312.0-7
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix passing the value to EscapeChar
         Do not free the uninitialized cstring
         Keep original free pattern
         network subsystem: improve connection failure error message
         Fix runConf NULL pointer refence
         rainerscript: do not try to call a function if it does not exist
         nsd_ptcp regression fix: remove debugging messages emited to stderr
         Fix legacy $ActionQueueDiscardMark parameter


author: zhangqiumiao <zhangqiumiao1@h-partners.com> - 8.2312.0-8
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:gnutls bugfix: Avoid blocking sockets during TLS handshake
         gnutls bugfix: Add timeout to GnuTLS handshake
         core: fix potential NULL ptr access on HUP in very early startup phase
         omfwd: fix segfault in UDP freeaddrinfo
         gnutls TLS driver: fix small memory leak
         rsyslog startup bugfix: cosmetic memory leak
         core: fix potential misadressing in sigmask
         covscan: remove defect type of RESOURCE_LEAK
         Fix a buffer overflow when the argument to replace is empty


author: jinlun<jinlun@huawei.com> - 40.7-1
changelog:
  - update version to 40.7
    - Allow chronyd-restricted read chronyd key files
    - Allow systemd-sleep set attributes of efivarfs files
    - Make name_zone_t and named_var_run_t a part of the mountpoint attribute
    - Update cifs interfaces to include fs_search_auto_mountpoints()
    - Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on
    - Add map_read map_write to kernel_prog_run_bpf
    - Add policy for nvme-stas
    - Make new virt drivers permissive
    - Allow named and ndc use the io_uring api
    - Allow sssd send SIGKILL to passket_child running in ipa_otpd_t


author: yanglu <yanglu72@h-partners.com> - 7:6.1-2
changelog:
  - Type:cves
  - ID:CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848
  - SUG:NA
  - DESC:fix CVE-2023-5824 CVE-2023-46846 CVE-2023-46847 CVE-2023-46848


author: fuanan <fuanan3@h-partners.com> - 255-42
changelog:
  - backport: sync patches from systemd community
    add backport-run-pass-the-pty-slave-fd-to-transient-service.patch
        backport-run-do-not-pass-the-pty-slave-fd-to-transient-servic.patch


author: Yu Peng <yupeng@kylinos.cn> - 1:0.17-81
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Fix telnet crashes on stack overflow due to infinite recursion.


author: chenyaqiang <chengyaqiang@huawei.com> - 1:9.0.96-1
changelog:
  - Update to 9.0.96
  - Fix CVE-2021-43980 CVE-2022-25762 CVE-2023-44487 CVE-2023-46589
    CVE-2024-23672 CVE-2024-24549 CVE-2024-34750


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: jinlun <jinlun@huawei.com> - 4.0.1-1
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:update version to 4.0.1
    - Fix CVE-2023-22745
    - TPM version 1.59 support
    - libmu soname from 0:0:0 to 0:1:0.
    - tss2-sys soname from 1:0:0 to 1:1:0
    - FAPI ignores vendor properties on Fapi_GetInfo
    - FAPI Event Logging JSON format
    - Dead struct TPMS_ALGORITHM_DESCRIPTION
    - Dead field intelPttProperty from TPMU_CAPABLITIES
    - Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
    - Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal


author: chench <chench@hygon.cn> - 4.0.1-5
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:add SM4 algorithm support
    - Add support for udev to create tcm devices
    - add ecc encrypt/decrypt support
    - add bootstrap file from upstream


author: liuchao <liuchao173@huawei.com> - 2.21.0-1
changelog:
  - upgrade to 2.21.0:
    - api: fixed stop method not to require any parameter
    - plugin_scheduler: fix perf fd leaks
    - allow skipping rollback when restarting TuneD or switching profile
    - function_calc_isolated_cores: no errors for offline CPUs
    - sap-hana: new profile sap-hana-kvm-guest
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
    - fixed possible traceback on SIGHUP
    - updated manual pages to be consistent
    - tuned-adm: better error message for unauthorized switch_profile
    - plugin_sysctl: report reapplied sysctls only on different values
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - plugin_cpu: added support for intel_pstate scaling driver
    - plugin_scheduler: do not leak FDs from the perf
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - throughput-performance: set net.core.somaxconn to at least 2048
    - API: added support for moving devices between instances
    - added support for the API access through the Unix Domain Socket
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - do not exit on duplicate config lines


author: ZhaoYu Jiang <jiangzhaoyu@kylinos.cn> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)
    - tuned-ppd: fixed controller init to correctly set_on_battery


author: tianmuyang <tianmuyang@huawei.com> - 2.24.1-4
changelog:
  - profiles: add programmable scheduling based on eBPF
  - package:  change package tuned to architecture-dependent


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: cenhuilin <cenhuilin@kylinos.cn> - 2.39.1-29
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:lsblk: fix memory leak [coverity scan]
         lsblk: fix possible use-after-free


author: yixiangzhike <yixiangzhike007@163.com> - 2.39.1-31
changelog:
  - backport community patches
      fix columns reduction
      fix memory leak issue in read_Subid_range
      fix off-by-one in maximum last sector calculation
      fix memory corruption in size calculation
      fix memory corruption in read buffers


author: lutong <lutong14@huawei.com> - 1.1-9
changelog:
  - bugfix:fixed display error caused by missing signal_exits & revert change method of getting domain id


author: Funda Wang <fundawang@yeah.net> - 1.20.11-37
changelog:
  - fix CVE-2025-26594, CVE-2025-26595, CVE-2025-26596,
    CVE-2025-26597, CVE-2025-26598, CVE-2025-26599
    CVE-2025-26600, CVE-2025-26601


author: Wang Kui <wangkui35@h-partners.com> - 1.20.11-41
changelog:
  - Fix CVE-2025-49176 CVE-2025-49179 CVE-2025-49180 CVE-2022-49737
    CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


author: lingsheng <ultra_planet@qq.com> - 1.20.11-42
changelog:
  - fix CVE-2022-49737 CVE-2025-49175 CVE-2025-49176 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 CVE-2025-62229 CVE-2025-62230 CVE-2025-62231


