linux (6.12.41-1) trixie-security; urgency=high
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.39
- eventpoll: don't decrement ep refcount while still holding the ep mutex
(CVE-2025-38349)
- drm/amdgpu/discovery: use specific ip_discovery.bin for legacy asics
- drm/amdgpu/ip_discovery: add missing ip_discovery fw
- [s390x] crypto: s390/sha - Fix uninitialized variable in SHA-1 and SHA-2
- drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid
Priority Inversion in SRIOV (CVE-2025-38104)
- [amd64] ASoC: Intel: SND_SOC_INTEL_SOF_BOARD_HELPERS select
SND_SOC_ACPI_INTEL_MATCH
- [amd64] ASoC: Intel: soc-acpi: arl: Correct naming of a cs35l56 address
struct
- [amd64] ASoC: Intel: soc-acpi: arl: Add match entries for new cs42l43
laptops
- [amd64] ASoC: soc-acpi: add get_function_tplg_files ops
- [amd64] ASoC: Intel: add sof_sdw_get_tplg_files ops
- [amd64] ASoC: Intel: soc-acpi-intel-arl-match: set get_function_tplg_files
ops
- [amd64] ASoC: Intel: soc-acpi: arl: Correct order of cs42l43 matches
- perf/core: Fix the WARN_ON_ONCE is out of lock protected region
- irqchip/irq-msi-lib: Select CONFIG_GENERIC_MSI_IRQ
- sched/core: Fix migrate_swap() vs. hotplug
- perf: Revert to requiring CAP_SYS_ADMIN for uprobes
- ASoC: cs35l56: probe() should fail if the device ID is not recognized
- Bluetooth: hci_sync: Fix not disabling advertising instance
- Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
- pinctrl: amd: Clear GPIO debounce for suspend
- fix proc_sys_compare() handling of in-lookup dentries
- sched/deadline: Fix dl_server runtime calculation formula
- bnxt_en: eliminate the compile warning in bnxt_request_irq due to
CONFIG_RFS_ACCEL
- [arm64] poe: Handle spurious Overlay faults
- [arm64] net: phy: qcom: move the WoL function to shared library
- [arm64] net: phy: qcom: qca808x: Fix WoL issue by utilizing
at8031_set_wol()
- netlink: Fix wraparounds of sk->sk_rmem_alloc.
- vsock: fix `vsock_proto` declaration
- tipc: Fix use-after-free in tipc_conn_close().
- tcp: Correct signedness in skb remaining space calculation
- vsock: Fix transport_{g2h,h2g} TOCTOU
- vsock: Fix transport_* TOCTOU
- vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
- net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
- net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
- net: phy: smsc: Force predictable MDI-X state on LAN87xx
- net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
- atm: clip: Fix potential null-ptr-deref in to_atmarpd().
- atm: clip: Fix memory leak of struct clip_vcc.
- atm: clip: Fix infinite recursive call of clip_push().
- atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
- [arm64] net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for
skb_shared_info
- net/sched: Abort __tc_modify_qdisc if parent class does not exist
- rxrpc: Fix bug due to prealloc collision
- rxrpc: Fix oops due to non-existence of prealloc backlog struct
- ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
- [amd64] x86/mce/amd: Add default names for MCA banks and blocks
- [amd64] x86/mce/amd: Fix threshold limit reset
- [amd64] x86/mce: Don't remove sysfs if thresholding sysfs init fails
- [amd64] x86/mce: Ensure user polling settings are honored when restarting
timer
- [amd64] x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
- [amd64] KVM: x86/xen: Allow 'out of range' event channel ports in IRQ
routing table.
- [amd64] KVM: SVM: Add missing member in SNP_LAUNCH_START command structure
- [amd64] KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is
in-flight
- KVM: Allow CPU to reschedule while setting per-page memory attributes
- ASoC: fsl_sai: Force a software reset when starting in consumer mode
- gre: Fix IPv6 multicast route creation. (Closes: #
1108430)
- md/md-bitmap: fix GPF in bitmap_get_stats() (Closes: #
1109734)
- [arm64] pinctrl: qcom: msm: mark certain pins as invalid for interrupts
- pwm: Fix invalid state detection
- pwm: mediatek: Ensure to disable clocks in error path
- wifi: prevent A-MSDU attacks in mesh networks (CVE-2025-27558)
- wifi: mwifiex: discard erroneous disassoc frames on STA interface
- wifi: mt76: mt7921: prevent decap offload config before STA initialization
- wifi: mt76: mt7925: prevent NULL pointer dereference in
mt7925_sta_set_decap_offload()
- wifi: mt76: mt7925: fix the wrong config for tx interrupt
- wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw
scan
- drm/imagination: Fix kernel crash when hard resetting the GPU
- drm/amdkfd: Don't call mmput from MMU notifier callback
- drm/gem: Acquire references on GEM handles for framebuffers
- drm/sched: Increment job count before swapping tail spsc queue
- drm/ttm: fix error handling in ttm_buffer_object_transfer
- drm/gem: Fix race in drm_gem_handle_create_tail()
- drm/xe/bmg: fix compressed VRAM handling
- Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2"
- usb: gadget: u_serial: Fix race condition in TTY wakeup
- Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
- drm/framebuffer: Acquire internal references on GEM handles
- drm/xe: Allocate PF queue size on pow2 boundary
- Revert "ACPI: battery: negate current when discharging" (Closes: #
1109344)
- Revert "PCI/ACPI: Fix allocated memory release on error in
pci_acpi_scan_root()"
- kallsyms: fix build without execinfo
- maple_tree: fix mt_destroy_walk() on root leaf node
- mm: fix the inaccurate memory statistics issue for users
- mm/vmalloc: leave lazy MMU mode on PTE mapping error
- lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()
- [amd64] x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
- [amd64] x86/mm: Disable hugetlb page table sharing on 32-bit
- [arm64] clk: scmi: Handle case where child clocks are initialized before
their parents
- smb: server: make use of rdma_destroy_qp()
- ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
- erofs: fix to add missing tracepoint in erofs_read_folio()
- erofs: address D-cache aliasing
- [amd64] ASoC: Intel: sof-function-topology-lib: Print out the unsupported
dmic count
- netlink: Fix rmem check in netlink_broadcast_deliver().
- netlink: make sure we allow at least one dump skb
- netfs: Fix ref leak on inserted extra subreq in write retry
- wifi: cfg80211: fix S1G beacon head validation in nl80211
- wifi: zd1211rw: Fix potential NULL pointer dereference in
zd_mac_tx_to_dev()
- drm/tegra: nvdec: Fix dma_alloc_coherent error check
- md/raid1: Fix stack memory use after return in raid1_reshape
- raid10: cleanup memleak at raid10_make_request
- wifi: mac80211: correctly identify S1G short beacon
- wifi: mac80211: fix non-transmitted BSSID profile search
- wifi: rt2x00: fix remove callback type mismatch
- drm/nouveau/gsp: fix potential leak of memory used during acpi init
- wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
- nbd: fix uaf in nbd_genl_connect() error path
- drm/xe/pf: Clear all LMTT pages on alloc
- erofs: free pclusters if no cached folio is attached
- erofs: get rid of `z_erofs_next_pcluster_t`
- erofs: tidy up zdata.c
- erofs: refine readahead tracepoint
- erofs: fix to add missing tracepoint in erofs_readahead()
- netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
- net: appletalk: Fix device refcount leak in atrtr_create()
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
- net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
- net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
- drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
- can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to
debug level
- net/mlx5e: Fix race between DIM disable and net_dim()
- net/mlx5e: Add new prio for promiscuous mode
- net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
- bnxt_en: Fix DCB ETS validation
- bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
- ublk: sanity check add_dev input for underflow
- atm: idt77252: Add missing `dma_map_error()`
- ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
- [amd64] ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
- io_uring: make fallocate be hashed work
- [amd64] ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
- ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
- ALSA: hda/realtek: Add quirks for some Clevo laptops
- net: usb: qmi_wwan: add SIMCom 8230C composition
- driver: bluetooth: hci_qca:fix unable to load the BT driver
- HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
- net: mana: Record doorbell physical address in PF mode
- btrfs: fix assertion when building free space tree
- vt: add missing notification when switching back to text mode
- bpf: Adjust free target to avoid global starvation of LRU map
- [riscv64] vdso: Exclude .rodata from the PT_DYNAMIC segment
- HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
- HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
- HID: nintendo: avoid bluetooth suspend/resume stalls
- erofs: fix rare pcluster memory leak after unmounting
- net: wangxun: revert the adjustment of the IRQ vector sequence
- kasan: remove kasan_find_vm_area() to prevent possible deadlock
- ksmbd: fix potential use-after-free in oplock/lease break ack
- [arm64] Filter out SME hwcaps when FEAT_SME isn't implemented
- crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
(CVE-2025-37984)
- rseq: Fix segfault on registration when rseq_cs is non-zero
(CVE-2025-38067)
- [amd64] KVM: SVM: Set synthesized TSA CPUID flags
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.40
- USB: serial: option: add Telit Cinterion
FE910C04 (ECM) composition
- USB: serial: option: add Foxconn T99W640
- USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
- usb: musb: fix gadget state on disconnect
- [arm*] usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
- usb: gadget: configfs: Fix OOB read on empty string write
- [armhf] i2c: stm32: fix the device used for the DMA map
- [armhf] i2c: stm32f7: unmap DMA mapped buffer
- [amd64] thunderbolt: Fix wake on connect at runtime
- [amd64] thunderbolt: Fix bit masking in tb_dp_port_set_hops()
- Revert "staging: vchiq_arm: Create keep-alive thread during probe"
- nvmem: imx-ocotp: fix MAC address byte length
- nvmem: layouts: u-boot-env: remove crc32 endianness conversion
- Input: xpad - set correct controller type for Acer NGR200
- pch_uart: Fix dma_sync_sg_for_device() nents value
- spi: Add check for 8-bit transfer with 8 IO mode support
- dm-bufio: fix sched in atomic context
- HID: core: ensure the allocated report buffer can contain the reserved
report ID
- HID: core: ensure __hid_request reserves the report ID as the first byte
- HID: core: do not bypass hid_hw_raw_request
- tracing/probes: Avoid using params uninitialized in parse_btf_arg()
- tracing: Add down_write(trace_event_sem) when adding trace event
- tracing/osnoise: Fix crash in timerlat_dump_stack()
- drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
- drm/amdgpu: Increase reset counter only on success
- drm/amd/display: Disable CRTC degamma LUT for DCN401
- drm/amd/display: Free memory allocation
- ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
- ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
- io_uring/poll: fix POLLERR handling
- mptcp: make fallback action and fallback decision atomic
- mptcp: plug races between subflow fail and subflow creation
- mptcp: reset fallback status gracefully at disconnect() time
- phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in
pep_sock_accept()
- net/mlx5: Update the list of the PCI supported devices
- [arm64] dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
- [arm64] dts: add big-endian property back into watchdog node
- [arm64] dts: freescale: imx8mm-verdin: Keep LDO5 always on
- [arm64] dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
- [arm64] dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
- [arm64] dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
- [arm64] dts: rockchip: use cs-gpios for spi1 on ringneck
- af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
- af_packet: fix soft lockup issue caused by tpacket_snd()
- Bluetooth: btintel: Check if controller is ISO capable on
btintel_classify_pkt_type
- cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
- isofs: Verify inode mode when loading from disk
- memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
- [arm*] mmc: bcm2835: Fix dma_unmap_sg() nents value
- mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based
Positivo models
- [arm64] mmc: sdhci_am654: Workaround for Errata i2312
- [amd64] net: stmmac: intel: populate entire system_counterval_t in
get_time_fn() callback
- pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
- [s390x] bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
- smb: client: fix use-after-free in crypt_message when using async crypto
- [armhf] soc: aspeed: lpc-snoop: Cleanup resources in stack-order
- [armhf] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
- iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
- iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
- iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
- iio: adc: max1363: Reorder mode_list[] entries
- iio: adc: stm32-adc: Fix race in installing chained IRQ handler
- iio: backend: fix out-of-bound write
- iio: common: st_sensors: Fix use of uninitialize device structs
- [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
- [arm64] dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
- [arm64] dts: imx95: Correct the DMA interrupter number of pcie0_ep
- bpf: Reject %p% format string in bprintf-like helpers
- cachefiles: Fix the incorrect return value in __cachefiles_write()
- block: fix kobject leak in blk_unregister_queue
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
- rpl: Fix use-after-free in rpl_do_srh_inline().
- smb: client: fix use-after-free in cifs_oplock_break
- fix a leak in fcntl_dirnotify()
- nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
- nvme: fix endianness of command word prints in nvme_log_err_passthru()
- smc: Fix various oops due to inet_sock type confusion.
- net: phy: Don't register LEDs for genphy
- nvme: fix misaccounting of nvme-mpath inflight I/O
- nvmet-tcp: fix callback lock for TLS handshake
- wifi: cfg80211: remove scan request n_channels counted_by
- [amd64] hwmon: (corsair-cpro) Validate the size of the received input
buffer
- ice: add NULL check in eswitch lag check
- ice: check correct pointer in fwlog debugfs
- usb: net: sierra: check for no status endpoint
- loop: use kiocb helpers to fix lockdep warning
- [riscv64] Enable interrupt during exception handling
- [riscv64] traps_misaligned: properly sign extend value in misaligned load
handler
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
- Bluetooth: hci_sync: fix connectable extended advertising when using
static random address
- Bluetooth: SMP: If an unallowed command is received consider it a failure
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
- Bluetooth: hci_core: add missing braces when using macro parameters
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant
without board ID
- net/mlx5: Correctly set gso_size when LRO is used
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
- net: fix segmentation after TCP/UDP fraglist GRO
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
- drm/xe/pf: Sanitize VF scratch registers on FLR
- drm/xe/pf: Move VFs reprovisioning to worker
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
- [amd64,arm64] hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open
to prevent IPv6 addrconf
- virtio-net: fix recursived rtnl_lock() during probe()
- tls: always refresh the queue when reading sock
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during
runtime
- net: bridge: Do not offload IGMP/MLD messages
- net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
- rxrpc: Fix recv-recv race of completed call
- rxrpc: Fix transmission of an abort in response to an abort
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
- drm/mediatek: Add wait_event_timeout when disabling plane
- drm/mediatek: only announce AFBC if really supported
- libbpf: Fix handling of BPF arena relocations
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
- sched: Change nr_uninterruptible type to unsigned long
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right
userns
- btrfs: fix block group refcount race in
btrfs_create_pending_block_groups() (CVE-2025-22115)
- usb: hub: fix detection of high tier USB3 devices behind suspended hubs
- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime
pm
- usb: hub: Fix flushing of delayed work used for post resume purposes
- usb: hub: Don't try to recover devices lost during warm reset.
- [arm64] usb: dwc3: qcom: Don't leave BCR asserted
- [arm64,armhf] i2c: omap: Add support for setting mux
- [arm64,armhf] i2c: omap: Fix an error handling path in omap_i2c_probe()
- [arm64,armhf] i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
- [arm64,armhf] i2c: omap: fix deprecated of_property_read_bool() use
- sched,freezer: Remove unnecessary warning in __thaw_task
- drm/xe/mocs: Initialize MOCS index early
- drm/xe: Move page fault init after topology init
- smb: client: let smbd_post_send_iter() respect the peers max_send_size and
transmit all data
- [amd64] iommu/vt-d: Fix misplaced domain_attached assignment
(Closes: #
1109676)
- [amd64] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll
hypercalls
https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.41
- [amd64] x86/traps: Initialize DR7 by writing its architectural reset value
- Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
(CVE-2025-38335)
- virtio_net: Enforce minimum TX ring size for reliability
- virtio_ring: Fix error reporting in virtqueue_resize
- regulator: core: fix NULL dereference on unbind due to stale coupling data
- [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo
UX8406CA
- RDMA/core: Rate limit GID cache warning messages
- [arm64] interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1
node
- iio: adc: ad7949: use spi_is_bpw_supported()
- regmap: fix potential memory leak of regmap_bus
- [amd64] x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
- [amd64] platform/x86: Fix initialization order for
firmware_attributes_class
- [arm*] staging: vchiq_arm: Make vchiq_shutdown never fail
- xfrm: state: initialize state_ptrs earlier in xfrm_state_find
- xfrm: state: use a consistent pcpu_id in xfrm_state_find
- xfrm: Set transport header to fix UDP GRO handling
- xfrm: interface: fix use-after-free after changing collect_md xfrm
interface
- [arm64] net: ti: icssg-prueth: Fix buffer allocation for ICSSG
- net/mlx5: Fix memory leak in cmd_exec()
- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
- i40e: report VF tx_dropped with tx_errors instead of tx_discards
- i40e: When removing VF MAC filters, only check PF-set MAC
- net: appletalk: Fix use-after-free in AARP proxy probe
- net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in
qfq_delete_class
- can: netlink: can_changelink(): fix NULL pointer deref of struct
can_priv::do_set_mode
- [arm64] drm/bridge: ti-sn65dsi86: Remove extra semicolon in
ti_sn_bridge_probe()
- ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop
- [s390x] ism: fix concurrency management in ism_cmd()
- [arm64] net: hns3: fix concurrent setting vlan filter issue
- [arm64] net: hns3: disable interrupt when ptp init failed
- [arm64] net: hns3: fixed vf get max channels bug
- [arm64] net: hns3: default enable tx bounce buffer when smmu enabled
- [amd64] platform/x86: ideapad-laptop: Fix FnLock not remembered among
boots
- [amd64] platform/x86: ideapad-laptop: Fix kbd backlight not remembered
among boots
- drm/amdgpu: Reset the clear flag in buddy during resume
- drm/sched: Remove optimization that causes hang when killing dependent
jobs
- mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show()
- timekeeping: Zero initialize system_counterval when querying time from phc
drivers
- [arm64] i2c: qup: jump out of the loop in case of timeout
- [arm64,armhf] i2c: tegra: Fix reset error handling with ACPI
- i2c: virtio: Avoid hang by using interruptible completion wait
- bus: fsl-mc: Fix potential double device reference in
fsl_mc_get_endpoint()
- sprintf.h requires stdarg.h
- ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
- ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
- [arm64] entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
- [arm64] dpaa2-eth: Fix device reference count leak in MAC endpoint
handling
- e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
- e1000e: ignore uninitialized checksum word on tgp
- gve: Fix stuck TX queue for DQ queue format
- ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
- nilfs2: reject invalid file types when reading inodes
- resource: fix false warning in __request_region()
- mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
- mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
- [amd64,arm64] usb: typec: tcpm: allow to use sink in accessory mode
- [amd64,arm64] usb: typec: tcpm: allow switching to mode accessory to mux
properly
- [amd64,arm64] usb: typec: tcpm: apply vbus before data bringup in
tcpm_src_attach
- spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
- [amd64] x86/bugs: Fix use of possibly uninit value in
amd_check_tsa_microcode()
- jfs: reject on-disk inodes of an unsupported type (CVE-2025-37925)
- [amd64] comedi: comedi_test: Fix possible deletion of uninitialized timers
- [arm64] dts: qcom: x1e78100-t14s: mark l12b and l15b always-on
- erofs: simplify z_erofs_load_compact_lcluster()
- erofs: refine z_erofs_get_extent_compressedlen()
- erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches
- erofs: simplify tail inline pcluster handling
- erofs: clean up header parsing for ztailpacking and fragments
- erofs: fix large fragment handling
- ext4: don't explicit update times in ext4_fallocate()
- ext4: refactor ext4_punch_hole()
- ext4: refactor ext4_zero_range()
- ext4: refactor ext4_collapse_range()
- ext4: refactor ext4_insert_range()
- ext4: factor out ext4_do_fallocate()
- ext4: move out inode_lock into ext4_fallocate()
- ext4: move out common parts into ext4_fallocate()
- ext4: fix incorrect punch max_end
- ext4: correct the error handle in ext4_fallocate()
- ext4: fix out of bounds punch offset
- [amd64] KVM: x86: drop x86.h include from cpuid.h
- [amd64] KVM: x86: Route non-canonical checks in emulator through
emulate_ops
- [amd64] KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical
checks
- [amd64] KVM: x86: model canonical checks more precisely
- [amd64] KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
(CVE-2025-38351)
- [amd64] x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()
- [arm64] dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage
- Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO"
- wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure
- iio: hid-sensor-prox: Restore lost scale assignments
- iio: hid-sensor-prox: Fix incorrect OFFSET calculation
- [amd64,arm64] Drivers: hv: Make the sysfs node size for the ring buffer
dynamic
- ALSA: hda/tegra: Add Tegra264 support
- ALSA: hda: Add missing NVIDIA HDA codec IDs
- [amd64] drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
- Revert "drm/xe/gt: Update handling of xe_force_wake_get return"
(Closes: #
1109799)
- Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling"
- Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return"
- Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()"
- [amd64] KVM: x86: Free vCPUs before freeing VM state
- mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
[ Bastian Blank ]
* Store build time signing key encrypted.
* Enable CRYPTO_ECDSA.
[ Aurelien Jarno ]
* Fix installation of DTB files
[ Tj ]
* drivers/gpu/drm/nouveau: Enable DRM_NOUVEAU_GSP_DEFAULT (Closes: #
1088522)
[ Uwe Kleine-König ]
* [armhf] Add phy-gmii-sel module to nic-shared-modules udeb for
ti/omap/am335x based machines (e.g. BeagleBone black).
[ Salvatore Bonaccorso ]
* d/salsa-ci.yml: Update for trixie: Set RELEASE to trixie
[dgit import unpatched linux 6.12.41-1]
projects / linux.git / log