# CVE-2019-11815: kernel-uek: [6.12.0-101.33.4.3.el10uek] - Revert 'Add normal counters' (Boris Ostrovsky)  [Orabug: 38171405]  [6.12.0-101.33.4.2....

CVE-2019-11815 is fixed in 35 products on 1 platform, first by ELSA-2025-20480, released July 17, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2019-11815
- Priority: High
- CVSS: 8.1 (IMPORTANT)
- EPSS: 0.0444
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 17, 2025

## Description

[6.12.0-101.33.4.3.el10uek] - Revert 'Add normal counters' (Boris Ostrovsky)  [Orabug: 38171405]  [6.12.0-101.33.4.2.el10uek] - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38178286]  {CVE-2025-38089} - mm: memcontrol: remove memcg from LRU on release instead of offline (Harry Yoo)  [Orabug: 38162790] - Revert 'SUNRPC: Don't allow waiting for exiting tasks' (Harshvardhan Jha)  [Orabug: 38175263] - ipv6: replace ipcm6_init calls with ipcm6_init_sk (Willem de Bruijn)  [Orabug: 38175246] - ipv6: remove leftover ip6 cookie initializer (Willem de Bruijn)  [Orabug: 38175246]  [6.12.0-101.33.4.1.el10uek] - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357} - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357} - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357} - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357} - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357} - x86/bugs: Rename MDS machinery to something more generic (Borislav Petkov (AMD))  [Orabug: 38023239]  {CVE-2024-36350} {CVE-2024-36357}  [6.12.0-101.33.4.el10uek] - rds: ib: Add cm_id generation scheme in order to detect new ones (Hakon Bugge)  [Orabug: 37617972] - uek-rpm: Enable the FWCTL PDS and CXL support in UEK8 (Qing Huang)  [Orabug: 38006732] - cxl/feature: Update out_len in set feature failure case (Li Ming)  [Orabug: 38006732] - cxl: Fix devm host device for CXL fwctl initialization (Dave Jiang)  [Orabug: 38006732] - fwctl/cxl: Fix uuid_t usage in uapi (Dan Williams)  [Orabug: 38006732] - pds_fwctl: add Documentation entries (Shannon Nelson)  [Orabug: 38006732] - pds_fwctl: add rpc and query support (Brett Creeley)  [Orabug: 38006732] - pds_fwctl: initial driver framework (Shannon Nelson)  [Orabug: 38006732] - pds_core: add new fwctl auxiliary_device (Shannon Nelson)  [Orabug: 38006732] - cxl: Fixup kdoc issues for include/cxl/features.h (Dave Jiang)  [Orabug: 38006732] - fwctl/cxl: Add documentation to FWCTL CXL (Dave Jiang)  [Orabug: 38006732] - cxl/test: Add Set Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732] - cxl/test: Add Get Feature support to cxl_test (Dave Jiang)  [Orabug: 38006732] - cxl: Add support to handle user feature commands for set feature (Dave Jiang)  [Orabug: 38006732] - cxl: Add support to handle user feature commands for get feature (Dave Jiang)  [Orabug: 38006732] - cxl: Add support for fwctl RPC command to enable CXL feature commands (Dave Jiang)  [Orabug: 38006732] - cxl: Move cxl feature command structs to user header (Dave Jiang)  [Orabug: 38006732] - cxl: Add FWCTL support to CXL (Dave Jiang)  [Orabug: 38006732] - cxl: Setup exclusive CXL features that are reserved for the kernel (Dave Jiang)  [Orabug: 38006732] - cxl/mbox: Add SET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732] - cxl/mbox: Add GET_FEATURE mailbox command (Shiju Jose)  [Orabug: 38006732] - cxl/test: Add Get Supported Features mailbox command support (Dave Jiang)  [Orabug: 38006732] - cxl: Add Get Supported Features command for kernel usage (Dave Jiang)  [Orabug: 38006732] - cxl: Enumerate feature commands (Dave Jiang)  [Orabug: 38006732] - cxl: Refactor user ioctl command path from mds to mailbox (Dave Jiang)  [Orabug: 38006732] - vhost-scsi: Fix log flooding with target does not exist errors (Mike Christie)  [Orabug: 38053075] - vhost-scsi: Change def inline_sg_cnt and max_io_vqs for exadata (Mike Christie)  [Orabug: 38053233] - sched/numa: add tracepoint that tracks the skipping of numa balancing due to cpuset memory pinning (Libo Chen)  [Orabug: 38070168] - sched/numa: skip VMA scanning on memory pinned to one NUMA node via cpuset.mems (Libo Chen)  [Orabug: 38070168] - uek-rpm: Enable CONFIG_SERIAL_RP2 as m (Samasth Norway Ananda)  [Orabug: 38091733] - serial: update the rp2 driver code (Samasth Norway Ananda)  [Orabug: 38091733]  [6.12.0-101.33.3.el10uek] - mm: do not write protect COW mappings when preserving across exec (Anthony Yznaga) [Orabug: 38029049] - mm: hold the source mmap write lock when copying PTEs (Anthony Yznaga) [Orabug: 38029049] - Enable EROFS modules and related config options (Harshit Mogalapalli) [Orabug: 38042713]  [6.12.0-101.33.2.el10uek] - net: mana: Add support for Multi Vports on Bare metal (Haiyang Zhang) [Orabug: 38052741] - tools: hv: Enable debug logs for hv_kvp_daemon (Shradha Gupta) [Orabug: 38052759] - LTS version: v6.12.33 (Jack Vogel) - Revert 'drm/amd/display: more liberal vmin/vmax update for freesync' (Aurabindo Pillai) - dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property (Xu Yang) - dt-bindings: usb: cypress,hx3: Add support for all variants (Lukasz Czechowski) - thunderbolt: Do not double dequeue a configuration request (Sergey Senozhatsky) - usb: usbtmc: Fix timeout value in get_stb (Dave Penkler) - serial: jsm: fix NPE during jsm_uart_port_init (Dustin Lundquist) - Bluetooth: hci_qca: move the SoC type check to the right place (Bartosz Golaszewski) - usb: typec: ucsi: fix Clang -Wsign-conversion warning (Qasim Ijaz) - USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB (Charles Yeh) - usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device (Hongyu Xie) - usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE (Jiayi Li) - Revert 'cpufreq: tegra186: Share policy per cluster' (Jonathan Hunter) - block: fix adding folio to bio (Ming Lei) [Orabug: 37844657] {CVE-2025-22122} - PCI/ASPM: Disable L1 before disabling L1 PM Substates (Ajay Agarwal) - accel/ivpu: Update power island delays (Karol Wachowski) - accel/ivpu: Add initial Panther Lake support (Maciej Falkowski) - rtc: Fix offset calculation for .start_secs < 0 (Alexandre Mergnat) - rtc: Make rtc_time64_to_tm() support dates before 1970 (Alexandre Mergnat) - Documentation: ACPI: Use all-string data node references (Sakari Ailus) - acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio() (Gautham R. Shenoy) - pinctrl: armada-37xx: set GPIO output value before setting direction (Gabor Juhos) - pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 (Gabor Juhos) - f2fs: fix to avoid accessing uninitialized curseg (Chao Yu) [Orabug: 37844644] {CVE-2025-22123} - tracing: Fix compilation warning on arm32 (Pan Taixi) - LTS version: v6.12.32 (Jack Vogel) - ksmbd: use list_first_entry_or_null for opinfo_get_list() (Namjae Jeon) - net: ethernet: ti: am65-cpsw: Lower random mac address error print to info (Nishanth Menon) - platform/x86: thinkpad_acpi: Ignore battery threshold change event notification (Mark Pearson) - ALSA: hda/realtek - restore auto-mute mode for Dell Chrome platform (Kailang Yang) - platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys (Valtteri Koskivuori) - NFS: Avoid flushing data while holding directory locks in nfs_rename() (Trond Myklebust) - char: tpm: tpm-buf: Add sanity check fallback in read helpers (Purva Yeshi) - drm/xe: Save the gt pointer in lrc and drop the tile (Umesh Nerlige Ramappa) - drm/xe/xe2hpg: Add Wa_22021007897 (Aradhya Bhatia) - nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro (Ilya Guterman) - spi: spi-sun4i: fix early activation (Alessandro Grassi) - phy: phy-rockchip-samsung-hdptx: Fix PHY PLL output 50.25MHz error (Algea Cao) - phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure (Hal Feng) - drm/amd/display: check stream id dml21 wrapper to get plane_id (Aurabindo Pillai) - drm/amd/display: fix link_set_dpms_off multi-display MST corner case (George Shen) - gpio: virtuser: fix potential out-of-bound write (Markus Burri) [Orabug: 38095181] {CVE-2025-38082} - um: let 'make clean' properly clean underlying SUBARCH as well (Masahiro Yamada) - platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS (John Chau) - nfs: don't share pNFS DS connections between net namespaces (Jeff Layton) - HID: quirks: Add ADATA XPG alpha wireless mouse support (Milton Barrera) - dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open (Purva Yeshi) - coredump: hand a pidfd to the usermode coredump helper (Christian Brauner) - coredump: fix error handling for replace_fd() (Christian Brauner) - perf/arm-cmn: Add CMN S3 ACPI binding (Robin Murphy) - perf/arm-cmn: Initialise cmn->cpu earlier (Robin Murphy) - perf/arm-cmn: Fix REQ2/SNP2 mixup (Robin Murphy) - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Pedro Tammela) [Orabug: 38049363] {CVE-2025-38001} - arm64: dts: ti: k3-j784s4-j742s2-main-common: Fix length of serdes_ln_ctrl (Siddharth Vadapalli) - arm64: dts: ti: k3-j722s-main: Disable 'serdes_wiz0' and 'serdes_wiz1' (Siddharth Vadapalli) - arm64: dts: ti: k3-j722s-evm: Enable 'serdes_wiz0' and 'serdes_wiz1' (Siddharth Vadapalli) - arm64: dts: ti: k3-j721e-sk: Add requiried voltage supplies for IMX219 (Yemike Abhilash Chandra) - arm64: dts: ti: k3-j721e-sk: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra) - arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators (Yemike Abhilash Chandra) - arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy (Yemike Abhilash Chandra) - arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 (Judith Mendez) - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in OV5640 overlay (Yemike Abhilash Chandra) - arm64: dts: ti: k3-am62x: Rename I2C switch to I2C mux in IMX219 overlay (Yemike Abhilash Chandra) - arm64: dts: ti: k3-am62x: Remove clock-names property from IMX219 overlay (Yemike Abhilash Chandra) - arm64: dts: ti: k3-am62p-j722s-common-main: Set eMMC clock parent to default (Judith Mendez) - arm64: dts: ti: k3-am62a-main: Set eMMC clock parent to default (Judith Mendez) - arm64: dts: ti: k3-am62-main: Set eMMC clock parent to default (Judith Mendez) - arm64: dts: qcom: x1e80100: Fix video thermal zone (Stephan Gerhold) - arm64: dts: qcom: x1e80100-yoga-slim7x: mark l12b and l15b always-on (Johan Hovold) - arm64: dts: qcom: x1e80100-qcp: mark l12b and l15b always-on (Johan Hovold) - arm64: dts: qcom: x1e80100-qcp: Fix vreg_l2j_1p2 voltage (Stephan Gerhold) - arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix vreg_l2j_1p2 voltage (Stephan Gerhold) - arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix vreg_l2j_1p2 voltage (Stephan Gerhold) - arm64: dts: qcom: sm8650: Add missing properties for cryptobam (Stephan Gerhold) - arm64: dts: qcom: sm8550: Add missing properties for cryptobam (Stephan Gerhold) - arm64: dts: qcom: sm8450: Add missing properties for cryptobam (Stephan Gerhold) - arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node (Alok Tiwari) - arm64: dts: qcom: sa8775p: Remove cdsp compute-cb@10 (Karthik Sanagavarapu) - arm64: dts: qcom: sa8775p: Remove extra entries from the iommus property (Ling Xu) - arm64: dts: qcom: ipq9574: Add missing properties for cryptobam (Stephan Gerhold) - can: kvaser_pciefd: Force IRQ edge in case of nested IRQ (Axel Forsman) - RDMA/bnxt_re: Remove unusable nq variable (Leon Romanovsky) [Orabug: 37822348] - RDMA/bnxt_re: Fix budget handling of notification queue (Kashyap Desai) [Orabug: 37822348] - bnxt_en: Add FW trace coredump segments to the coredump (Shruti Parab) [Orabug: 37822348] - bnxt_en: Add a new ethtool -W dump flag (Michael Chan) [Orabug: 37822348] - bnxt_en: Add 2 parameters to bnxt_fill_coredump_seg_hdr() (Shruti Parab) [Orabug: 37822348] - bnxt_en: Add functions to copy host context memory (Sreekanth Reddy) [Orabug: 37822348] - bnxt_en: Do not free FW log context memory (Hongguang Gao) [Orabug: 37822348] - bnxt_en: Manage the FW trace context memory (Shruti Parab) [Orabug: 37822348] - bnxt_en: Allocate backing store memory for FW trace logs (Shruti Parab) [Orabug: 37822348] - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348] - bnxt_en: Refactor bnxt_free_ctx_mem() (Hongguang Gao) [Orabug: 37822348] - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type (Shruti Parab) [Orabug: 37822348] - bnxt_en: refactor bnxt_alloc_rx_rings() to call bnxt_alloc_rx_agg_bmap() (David Wei) [Orabug: 37822348] - bnxt_en: ethtool: Support unset l4proto on ip4/ip6 ntuple rules (Daniel Xu) [Orabug: 37822348] - bnxt_en: ethtool: Remove ip4/ip6 ntuple support for IPPROTO_RAW (Daniel Xu) [Orabug: 37822348] - bnxt_en: use irq_update_affinity_hint() (Mohammad Heib) [Orabug: 37822348] - bnxt_en: add unlocked version of bnxt_refclk_read (Vadim Fedorenko) [Orabug: 37822348] - bnxt_en: replace PTP spinlock with seqlock (Vadim Fedorenko) [Orabug: 37822348] - bnxt_en: cache only 24 bits of hw counter (Vadim Fedorenko) [Orabug: 37822348] - bnxt_en: Update firmware interface spec to 1.10.3.85 (Michael Chan) [Orabug: 37822348] - bnxt_en: Skip reading PXP registers during ethtool -d if unsupported (Michael Chan) [Orabug: 37822348] - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (Michael Chan) [Orabug: 37822348] - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (Michael Chan) [Orabug: 37822348] - bnxt_en: Do not allow ethtool -m on an untrusted VF (Michael Chan) [Orabug: 37822348] - RDMA/bnxt_re: Fix reporting maximum SRQs on P7 chips (Preethi G) [Orabug: 37822348] - RDMA/bnxt_re: Fix allocation of QP table (Kashyap Desai) [Orabug: 37822348] - RDMA/bnxt_re: Remove deliver net device event (Yuyu Li) [Orabug: 37822348] - RDMA/bnxt_re: Remove unnecessary goto in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Remove extra new line in bnxt_re_netdev_event (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Optimize error handling in bnxt_re_probe (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Fix an issue in bnxt_re_async_notifier (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Pass the context for ulp_irq_stop (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Query firmware defaults of CC params during probe (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Add Async event handling support (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Remove unnecessary header file inclusion (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Eliminate need for some forward declarations (Kalesh Ap) [Orabug: 37822348] - bnxt_en: Add ULP call to notify async events (Michael Chan) [Orabug: 37822348] - RDMA/bnxt_re: Fix issue in the unload path (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Fix setting mandatory attributes for modify_qp (Damodharam Ammepalli) [Orabug: 37822348] - RDMA/bnxt_re: Don't fail destroy QP and cleanup debugfs earlier (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Use the default mode of congestion control (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Support different traffic class (Chandramohan Akula) [Orabug: 37822348] - RDMA/bnxt_re: Refurbish CQ to NQ hash calculation (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Enhance RoCE SRIOV resource configuration design (Bhargava Chenna Marreddy) [Orabug: 37822348] - bnxt_en: Add support for RoCE sriov configuration (Vikas Gupta) [Orabug: 37822348] - RDMA/bnxt_re: Add debugfs hook in the driver (Kalesh Ap) [Orabug: 37822348] - RDMA/bnxt_re: Support raw data query for each resources (Kashyap Desai) [Orabug: 37822348] - RDMA/bnxt_re: Add support for querying HW contexts (Kashyap Desai) [Orabug: 37822348] - RDMA/bnxt_re: Support driver specific data collection using rdma tool (Kashyap Desai) [Orabug: 37822348] - RDMA/bnxt_re: Fix access flags for MR and QP modify (Hongguang Gao) [Orabug: 37822348] - RDMA/bnxt_re: Add support for CQ rx coalescing (Chandramohan Akula) [Orabug: 37822348] - RDMA/bnxt_re: Add support for optimized modify QP (Kalesh Ap) [Orabug: 37822348] - mm/memcontrol: Fix LRU reparenting logic when !MGLRU (Kamalesh Babulal) [Orabug: 37920452] - mm: multi-gen LRU: skip rotation of offlined memcgs (Harry Yoo) [Orabug: 37997501] - mm: lru: move VM_WARN_ON_ONCE_FOLIO before MGLRU functions (Harry Yoo) [Orabug: 37997580] - mm: thp: replace folio_memcg() with folio_memcg_charged() (Muchun Song) [Orabug: 37997580] - mm: zswap: prevent lruvec release in zswap_folio_swapin() (Muchun Song) [Orabug: 37997580] - mm: workingset: prevent lruvec release in workingset_refault() (Muchun Song) [Orabug: 37997580] - mm: page_io: prevent memory cgroup release in page_io module (Muchun Song) [Orabug: 37997580] - mm: workingset: prevent memory cgroup release in lru_gen_eviction() (Muchun Song) [Orabug: 37997580] - writeback: prevent memory cgroup release in writeback module (Muchun Song) [Orabug: 37997580] - mm: memcontrol: protect lruvec critical section with the RCU read lock (Harry Yoo) [Orabug: 37997580] - mm: vmscan: disable IRQ before __mod_lruvec_state() (Harry Yoo) [Orabug: 37997618] - mm: multi-gen LRU: fix two warnings in evict_folios() (Harry Yoo) [Orabug: 37997618] - mm: multi-gen LRU: update lrugen->nr_pages during lruvec reparenting (Harry Yoo) [Orabug: 37997618] - ocfs2: fix the issue with discontiguous allocation in the global_bitmap (Heming Zhao) [Orabug: 38041352] - Reapply 'ocfs2: fix sparse warnings' (Gautham Ananthakrishna) [Orabug: 38041352] - Reapply 'ocfs2: speed up chain-list searching' (Gautham Ananthakrishna) [Orabug: 38041352] - Reapply 'ocfs2: adjust enabling place for la window' (Gautham Ananthakrishna) [Orabug: 38041352] - Reapply 'ocfs2: improve write IO performance when fragmentation is high' (Gautham Ananthakrishna) [Orabug: 38041352]  [6.12.0-101.31.1.el10uek] - LTS version: v6.12.31 (Jack Vogel) - drm/gem: Internally test import_attach for imported objects (Thomas Zimmermann) - x86/mm/init: Handle the special case of device private pages in add_pages(), to not increase max_pfn and trigger dma_addressing_limited() bounce buffers bounce buffers (Balbir Singh) - i3c: master: svc: Fix implicit fallthrough in svc_i3c_master_ibi_work() (Nathan Chancellor) - pinctrl: tegra: Fix off by one in tegra_pinctrl_get_group() (Dan Carpenter) - watchdog: aspeed: fix 64-bit division (Arnd Bergmann) - drm/amdkfd: Correct F8_MODE for gfx950 (Amber Lin) - serial: sh-sci: Save and restore more registers (Geert Uytterhoeven) - bpf: abort verification if env->cur_state->loop_entry != NULL (Eduard Zingerman) - drm/amd/display: Exit idle optimizations before accessing PHY (Ovidiu Bunea) - kbuild: Properly disable -Wunterminated-string-initialization for clang (Nathan Chancellor) - Fix mis-uses of 'cc-option' for warning disablement (Linus Torvalds) - gcc-15: disable '-Wunterminated-string-initialization' entirely for now (Linus Torvalds) - gcc-15: make 'unterminated string initialization' just a warning (Linus Torvalds) - err.h: move IOMEM_ERR_PTR() to err.h (Raag Jadav) - spi: spi-fsl-dspi: Reset SR flags before sending a new message (Larisa Grigore) - spi: spi-fsl-dspi: Halt the module after a new message transfer (Bogdan-Gabriel Roman) - spi: spi-fsl-dspi: restrict register range for regmap access (Larisa Grigore) - spi: use container_of_cont() for to_spi_device() (Greg Kroah-Hartman) - platform/x86: think-lmi: Fix attribute name usage for non-compliant items (Mark Pearson) - ksmbd: fix stream write failure (Namjae Jeon) - Revert 'arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection' (Jernej Skrabec) - Bluetooth: btmtksdio: Do close if SDIO card removed without close (Chris Lu) - Bluetooth: btmtksdio: Check function enabled before doing close (Chris Lu) - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() (Ryusuke Konishi) - mm: mmap: map MAP_STACK to VM_NOHUGEPAGE only if THP is enabled (Ignacio Moreno Gonzalez) - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Tianyang Zhang) - memcg: always call cond_resched() after fn() (Breno Leitao) - highmem: add folio_test_partial_kmap() (Matthew Wilcox) - Input: xpad - add more controllers (Vicki Pfau) - Revert 'drm/amd: Keep display off while going into S4' (Mario Limonciello) - smb: client: Reset all search buffer pointers when releasing buffer (Zhaolong Wang) - arm64: dts: marvell: uDPU: define pinctrl state for alarm LEDs (Gabor Juhos) - smb: client: Fix use-after-free in cifs_fill_dirent (Zhaolong Wang) [Orabug: 38094970] {CVE-2025-38051} - drm/edid: fixed the bug that hdr metadata was not reset (Feijuan Li) - thermal: intel: x86_pkg_temp_thermal: Fix bogus trip temperature (Zhang Rui) - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() (Vladimir Moskovkin) [Orabug: 38095141] {CVE-2025-38077} - pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() (Dan Carpenter) - pmdomain: renesas: rcar: Remove obsolete nullify checks (Geert Uytterhoeven) - vmxnet3: update MTU after device quiesce (Ronak Doshi) - net: dsa: microchip: linearize skb for tail-tagging switches (Jakob Unterwurzacher) - can: kvaser_pciefd: Fix echo_skb race (Axel Forsman) - can: kvaser_pciefd: Continue parsing DMA buf after dropped RX (Axel Forsman) - llc: fix data loss when reading from a socket in llc_ui_recvmsg() (Gavrilov Ilia) - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 (Ed Burcher) - ALSA: pcm: Fix race of buffer access at PCM OSS layer (Takashi Iwai) [Orabug: 38095145] {CVE-2025-38078} - ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction (Peter Ujfalusi) - ASoc: SOF: topology: connect DAI to a single DAI link (Kai Vehmanen) - ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms (Peter Ujfalusi) - ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext (Peter Ujfalusi) - can: bcm: add missing rcu read protection for procfs content (Oliver Hartkopp) [Orabug: 38049369] {CVE-2025-38003} - can: bcm: add locking for bcm_op runtime updates (Oliver Hartkopp) [Orabug: 38049374] {CVE-2025-38004} - can: slcan: allow reception of short error messages (Carlos Sanchez) - padata: do not leak refcount in reorder_work (Dominik Grzegorzek) [Orabug: 38094842] {CVE-2025-38031} - crypto: algif_hash - fix double free in hash_accept (Ivan Pravdin) [Orabug: 38095153] {CVE-2025-38079} - clk: s2mps11: initialise clk_hw_onecell_data::num before accessing ::hws[] in probe() (Andre Draszik) - octeontx2-af: Fix APR entry mapping based on APR_LMT_CFG (Geetha Sowjanya) - octeontx2-af: Set LMT_ENA bit for APR table entries (Subbaraya Sundeep) - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (Wang Liang) [Orabug: 38094978] {CVE-2025-38052} - octeontx2-pf: Add AF_XDP non-zero copy support (Suman Ghosh) - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Cong Wang) [Orabug: 38049357] {CVE-2025-38000} - idpf: fix idpf_vport_splitq_napi_poll() (Eric Dumazet) - io_uring: fix overflow resched cqe reordering (Pavel Begunkov) - net: lan743x: Restore SGMII CTRL register on resume (Thangaraj Samynathan) - net: dwmac-sun8i: Use parsed internal PHY address instead of 1 (Paul Kocialkowski) - pinctrl: qcom: switch to devm_register_sys_off_handler() (Dmitry Baryshkov) - loop: don't require ->write_iter for writable files in loop_configure (Christoph Hellwig) - idpf: fix null-ptr-deref in idpf_features_check (Pavan Kumar Linga) [Orabug: 38094982] {CVE-2025-38053} - ice: Fix LACP bonds without SRIOV environment (Dave Ertman) - ice: fix vf->num_mac count with port representors (Jacob Keller) - bridge: netfilter: Fix forwarding of fragmented packets (Ido Schimmel) - ptp: ocp: Limit signal/freq counts in summary output functions (Sagi Maimon) [Orabug: 38094984] {CVE-2025-38054} - Bluetooth: btusb: use skb_pull to avoid unsafe access in QCA dump handling (En-Wei Wu) - Bluetooth: L2CAP: Fix not checking l2cap_chan security level (Luiz Augusto von Dentz) - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter) [Orabug: 38094988] {CVE-2025-38055} - irqchip/riscv-imsic: Start local sync timer on correct CPU (Andrew Bresticker) - ASoC: SOF: Intel: hda: Fix UAF when reloading module (Tavian Barnes) [Orabug: 38094991] {CVE-2025-38056} - devres: Introduce devm_kmemdup_array() (Raag Jadav) - driver core: Split devres APIs to device/devres.h (Andy Shevchenko) - dmaengine: fsl-edma: Fix return code for unhandled interrupts (Stefan Wahren) - dmaengine: idxd: Fix ->poll() return value (Dave Jiang) - xfrm: Sanitize marks before insert (Paul Chaignon) - clk: sunxi-ng: d1: Add missing divider for MMC mod clocks (Andre Przywara) - remoteproc: qcom_wcnss: Fix on platforms without fallback regulators (Matti Lehtimaki) - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() (David Hildenbrand) - x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (Seongman Lee) - dmaengine: idxd: Fix allowing write() from different address spaces (Vinicius Costa Gomes) - xfrm: Fix UDP GRO handling for some corner cases (Tobias Brunner) - espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca) - espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094993] {CVE-2025-38057} - soundwire: bus: Fix race on the creation of the IRQ domain (Charles Keepax) - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (Al Viro) [Orabug: 38095000] {CVE-2025-38058} - drm/amd/display: Call FP Protect Before Mode Programming/Mode Support (Austin Zheng) - xenbus: Allow PVH dom0 a non-local xenstore (Jason Andryuk) - x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 (Pawel Anikiel) [Orabug: 38094847] {CVE-2025-38033} - wifi: iwlwifi: add support for Killer on MTL (Johannes Berg) - block: only update request sector if needed (Johannes Thumshirn) - tools: ynl-gen: validate 0 len strings from kernel (David Wei) - btrfs: avoid NULL pointer dereference if no valid csum tree (Qu Wenruo) [Orabug: 38095010] {CVE-2025-38059} - btrfs: handle empty eb->folios in num_extent_folios() (Boris Burkov) - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (Goldwyn Rodrigues) [Orabug: 38094856] {CVE-2025-38034} - btrfs: compression: adjust cb->compressed_folios allocation type (Kees Cook) - ASoC: intel/sdw_utils: Add volume limit to cs42l43 speakers (Stefan Binding) - cifs: Fix changing times and read-only attr over SMB1 smb_set_file_info() function (Pali Rohar) - cifs: Fix and improve cifs_query_path_info() and cifs_query_file_info() (Pali Rohar) - io_uring/fdinfo: annotate racy sq/cq head/tail reads (Jens Axboe) - nvmet-tcp: don't restore null sk_state_change (Alistair Francis) [Orabug: 38094863] {CVE-2025-38035} - ALSA: usb-audio: Fix duplicated name in MIDI substream names (Takashi Iwai) - nvme-pci: add quirks for WDC Blue SN550 15b7:5009 (Guan Wentao) - nvme-pci: add quirks for device 126f:1001 (Guan Wentao) - ALSA: hda/realtek: Add quirk for HP Spectre x360 15-df1xxx (Takashi Iwai) - ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 (Takashi Iwai) - ASoC: cs42l43: Disable headphone clamps during type detection (Charles Keepax) - platform/x86: ideapad-laptop: add support for some new buttons (Gasper Nemgar) - platform/x86: asus-wmi: Disable OOBE state after resume from hibernation (Pavel Nikulin) - platform/x86/intel: hid: Add Pantherlake support (Saranya Gopal) - smb: server: smb2pdu: check return value of xa_store() (Salah Triki) - pinctrl: meson: define the pull up/down resistor value as 60 kOhm (Martin Blumenstingl) - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Ritesh Harjani) - ASoC: imx-card: Adjust over allocation of memory in imx_card_parse_of() (Chenyuan Yang) - drm: Add valid clones check (Jessica Zhang) - drm/panel-edp: Add Starry 116KHD024006 (Douglas Anderson) - drm/buddy: fix issue that force_merge cannot free all roots (Lin Cao) - drm/atomic: clarify the rules around drm_atomic_state->allow_modeset (Simona Vetter) - drm/xe: Reject BO eviction if BO is bound to current VM (Oak Zeng) - drm/xe/sa: Always call drm_suballoc_manager_fini() (Michal Wajdeczko) - wifi: rtw89: coex: Separated Wi-Fi connecting event from Wi-Fi scan event (Ching-Te Ku) - drm/xe: Do not attempt to bootstrap VF in execlists mode (Maarten Lankhorst) - drm/xe: Move suballocator init to after display init (Maarten Lankhorst) - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (P Praneesh) - drm/nouveau: fix the broken marco GSP_MSG_MAX_SIZE (Zhi Wang) - drm: bridge: adv7511: fill stream capabilities (Olivier Moysan) - wifi: ath12k: Fix end offset bit definition in monitor ring descriptor (P Praneesh) - wifi: ath12k: Fetch regdb.bin file from board-2.bin (Aaradhana Sahu) - wifi: ath9k: return by of_get_mac_address (Rosen Penev) - drm/xe/pf: Reset GuC VF config when unprovisioning critical resource (Michal Wajdeczko) - accel/qaic: Mask out SR-IOV PCI resources (Youssef Samir) - wifi: ath12k: fix ath12k_hal_tx_cmd_ext_desc_setup() info1 override (Nicolas Escande) - regulator: ad5398: Add device tree support (Isaac Scott) - spi: zynqmp-gqspi: Always acknowledge interrupts (Sean Anderson) - wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet (Ping-Ke Shih) - wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate (Bitterblue Smith) - wifi: rtl8xxxu: retry firmware download on error (Soeren Moch) - clk: renesas: rzg2l-cpg: Refactor Runtime PM clock validation (Lad Prabhakar) - perf/amd/ibs: Fix ->config to sample period calculation for OP PMU (Ravi Bangoria) - perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (Ravi Bangoria) - firmware: arm_scmi: Relax duplicate name constraint across protocol ids (Sudeep Holla) - bpftool: Fix readlink usage in get_fd_type (Viktor Malik) - bpf: Use kallsyms to find the function name of a struct_ops's stub function (Martin Kafai Lau) - drm/ast: Find VBIOS mode from regular display size (Thomas Zimmermann) - dm vdo: use a short static string for thread name prefix (Matthew Sakai) - dm vdo indexer: prevent unterminated string warning (Chung Chung) - irqchip/riscv-aplic: Add support for hart indexes (Vladimir Kondratiev) - ASoC: rt722-sdca: Add some missing readable registers (Charles Keepax) - ASoC: codecs: pcm3168a: Allow for 24-bit in provider mode (Cezary Rojewski) - arm64: zynqmp: add clock-output-names property in clock nodes (Naman Trivedi Manojbhai) - HID: usbkbd: Fix the bit shift number for LED_KANA (Junan) - wifi: ath12k: Avoid napi_sync() before napi_enable() (Avula Sri Charan) - scsi: st: Restore some drive settings after reset (Kai Makisara) - net/mana: fix warning in the writer of client oob (Konstantin Taranov) - drm/xe/relay: Don't use GFP_KERNEL for new transactions (Michal Wajdeczko) - ice: count combined queues using Rx/Tx count (Michal Swiatkowski) - perf: Avoid the read if the count is already updated (Peter Zijlstra) - rcu: fix header guard for rcu_all_qs() (Ankur Arora) - rcu: handle unstable rdp in rcu_read_unlock_strict() (Ankur Arora) - rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y (Ankur Arora) - ice: treat dyn_allowed only as suggestion (Michal Swiatkowski) - ice: init flow director before RDMA (Michal Swiatkowski) - bridge: mdb: Allow replace of a host-joined group (Petr Machata) - net: flush_backlog() small changes (Eric Dumazet) - r8169: don't scan PHY addresses > 0 (Heiner Kallweit) - ipv4: ip_gre: Fix set but not used warning in ipgre_err() if IPv4-only (Geert Uytterhoeven) - vxlan: Annotate FDB data races (Ido Schimmel) [Orabug: 38094879] {CVE-2025-38037} - cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (Dhananjay Ugwekar) [Orabug: 38094888] {CVE-2025-38038} - tools: ynl-gen: don't output external constants (Jakub Kicinski) - eth: fbnic: set IFF_UNICAST_FLT to avoid enabling promiscuous mode when adding unicast addrs (Alexander Duyck) - drm/rockchip: vop2: Improve display modes handling on RK3588 HDMI0 (Cristian Ciocaltea) - media: qcom: camss: Add default case in vfe_src_pad_code (Depeng Shao) - media: qcom: camss: csid: Only add TPG v4l2 ctrl if TPG hardware is available (Depeng Shao) - f2fs: introduce f2fs_base_attr for global sysfs entries (Jaegeuk Kim) - hwmon: (xgene-hwmon) use appropriate type for the latency value (Andrey Vatoropin) - tools/power turbostat: Clustered Uncore MHz counters should honor show/hide options (Len Brown) - net: page_pool: avoid false positive warning if NAPI was never added (Jakub Kicinski) - clk: qcom: camcc-sm8250: Use clk_rcg2_shared_ops for some RCGs (Jordan Crouse) - wifi: rtw89: call power_on ahead before selecting firmware (Ping-Ke Shih) - wifi: rtw89: fw: validate multi-firmware header before accessing (Ping-Ke Shih) - wifi: rtw89: fw: validate multi-firmware header before getting its size (Ping-Ke Shih) - wifi: rtw89: coex: Assign value over than 0 to avoid firmware timer hang (Ching-Te Ku) - wifi: rtw88: Fix __rtw_download_firmware() for RTL8814AU (Bitterblue Smith) - wifi: rtw88: Fix download_firmware_validate() for RTL8814AU (Bitterblue Smith) - ext4: remove writable userspace mappings before truncating page cache (Zhang Yi) - ext4: don't write back data before punch hole in nojournal mode (Zhang Yi) - leds: trigger: netdev: Configure LED blink interval for HW offload (Marek Vasut) - pstore: Change kmsg_bytes storage size to u32 (Kees Cook) - iio: adc: ad7944: don't use storagebits for sizing (David Lechner) - r8152: add vendor/device ID pair for Dell Alienware AW1022z (Aleksander Jan Bajkowski) - ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). (Kuniyuki Iwashima) - arch/powerpc/perf: Check the instruction type before creating sample with perf_mem_data_src (Athira Rajeev) - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (Gaurav Batra) - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Gaurav Batra) - net: fec: Refactor MAC reset to function (Csokas Bence) - wifi: mac80211: set ieee80211_prep_tx_info::link_id upon Auth Rx (Emmanuel Grumbach) - wifi: mac80211: remove misplaced drv_mgd_complete_tx() call (Johannes Berg) - wifi: mac80211: don't unconditionally call drv_mgd_complete_tx() (Johannes Berg) - wifi: iwlwifi: don't warn during reprobe (Miri Korenblit) - wifi: iwlwifi: use correct IMR dump variable (Johannes Berg) - mptcp: pm: userspace: flags: clearer msg if no remote addr (Matthieu Baerts) - wifi: ath12k: fix the ampdu id fetch in the HAL_RX_MPDU_START TLV (P Praneesh) - xfrm: prevent high SEQ input in non-ESN mode (Leon Romanovsky) - drm/v3d: Add clock handling (Stefan Wahren) - net/mlx5e: reduce the max log mpwrq sz for ECPF and reps (William Tu) - net/mlx5e: reduce rep rxq depth to 256 for ECPF (William Tu) - net/mlx5e: set the tx_queue_len for pfifo_fast (William Tu) - net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB (Alexei Lazar) - net/mlx5: XDP, Enable TX side XDP multi-buffer support (Alexei Lazar) - scsi: target: spc: Fix loop traversal in spc_rsoc_get_descr() (Chaohai Chen) - drm/amd/display/dm: drop hw_support check in amdgpu_dm_i2c_xfer() (Alex Deucher) - drm/amdgpu: enlarge the VBIOS binary size limit (Morris Zhang) - drm/amdgpu: Use active umc info from discovery (Lijo Lazar) - drm/amd/display: Populate register address for dentist for dcn401 (Dillon Varone) - drm/amd/display: Use Nominal vBlank If Provided Instead Of Capping It (Austin Zheng) - drm/amd/display: Increase block_sequence array size (Joshua Aberback) [Orabug: 38095164] {CVE-2025-38080} - drm/amd/display: Initial psr_version with correct setting (Tom Chung) - drm/amd/display: Update CR AUX RD interval interpretation (George Shen) - Revert 'drm/amd/display: Exit idle optimizations before attempt to access PHY' (Brandon Syu) - drm/amd/display: Support multiple options during psr entry. (Martin Tsai) - drm/amd/pm: Skip P2S load for SMU v13.0.12 (Asad Kamal) - drm/amdgpu: reset psp->cmd to NULL after releasing the buffer (Jiang Liu) - drm/amd/display: Don't try AUX transactions on disconnected link (Ilya Bakoulin) - drm/amd/display: pass calculated dram_speed_mts to dml2 (Charlene Liu) - drm/amdgpu: Set snoop bit for SDMA for MI series (Harish Kasiviswanathan) - drm/amdkfd: fix missing L2 cache info in topology (Eric Huang) - drm/amdgpu/mes11: fix set_hw_resources_1 calculation (Alex Deucher) - net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size (Huacai Chen) - soundwire: cadence_master: set frame shape and divider based on actual clk freq (Bard Liao) - soundwire: amd: change the soundwire wake enable/disable sequence (Vijendar Mukunda) - phy: exynos5-usbdrd: fix EDS distribution tuning (gs101) (Andre Draszik) - phy: core: don't require set_mode() callback for phy_get_mode() to work (Dmitry Baryshkov) - phy: phy-rockchip-samsung-hdptx: Swap the definitions of LCPLL_REF and ROPLL_REF (Damon Ding) - pinctrl: renesas: rzg2l: Add suspend/resume support for pull up/down (Claudiu Beznea) - serial: sh-sci: Update the suspend/resume support (Claudiu Beznea) - sched: Reduce the default slice to avoid tasks getting an extra tick (Zihan Zhou) - x86/traps: Cleanup and robustify decode_bug() (Peter Zijlstra) - x86/ibt: Handle FineIBT in handle_cfi_failure() (Peter Zijlstra) - drm/xe/debugfs: Add missing xe_pm_runtime_put in wedge_mode_set (Shuicheng Lin) - drm/xe/debugfs: fixed the return value of wedged_mode_set (Xin Wang) - clk: qcom: clk-alpha-pll: Do not use random stack value for recalc rate (Krzysztof Kozlowski) - clk: qcom: ipq5018: allow it to be bulid on arm32 (Karl Chan) - drm/xe: Fix xe_tile_init_noalloc() error propagation (Lucas De Marchi) - drm/xe: Stop ignoring errors from xe_ttm_stolen_mgr_init() (Lucas De Marchi) - net/mlx4_core: Avoid impossible mlx4_db_alloc() order value (Kees Cook) - media: v4l: Memset argument to 0 before calling get_mbus_config pad op (Sakari Ailus) - media: i2c: imx219: Correct the minimum vblanking value (David Plowman) - kunit: tool: Use qboot on QEMU x86_64 (Brendan Jackman) - smack: Revert 'smackfs: Added check catlen' (Konstantin Andreev) - smack: recognize ipv4 CIPSO w/o categories (Konstantin Andreev) - pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map (Valentin Caron) - ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot() (Kuninori Morimoto) - ASoC: tas2764: Power up/down amp on mute ops (Hector Martin) - ASoC: tas2764: Mark SW_RESET as volatile (Hector Martin) - ASoC: tas2764: Add reg defaults for TAS2764_INT_CLK_CFG (Hector Martin) - ASoC: ops: Enforce platform maximum on initial value (Martin Poviser) - firmware: xilinx: Dont send linux address to get fpga config get status (Siva Durga Prasad Paladugu) - firmware: arm_ffa: Handle the presence of host partition in the partition info (Sudeep Holla) - firmware: arm_ffa: Reject higher major version as incompatible (Sudeep Holla) - net/mlx5: Apply rate-limiting to high temperature warning (Shahar Shitrit) - net/mlx5: Modify LSB bitmask in temperature event to include only the first bit (Shahar Shitrit) - media: test-drivers: vivid: don't call schedule in loop (Hans Verkuil) - irqchip/riscv-imsic: Set irq_set_affinity() for IMSIC base (Andrew Jones) - hrtimers: Replace hrtimer_clock_to_base_table with switch-case (Andy Shevchenko) - vxlan: Join / leave MC group after remote changes (Petr Machata) - ACPI: HED: Always initialize before evged (Xiaofei Tan) - PCI: Fix old_size lower bound in calculate_iosize() too (Ilpo Jarvinen) - eth: mlx4: don't try to complete XDP frames in netpoll (Jakub Kicinski) - bpf: copy_verifier_state() should copy 'loop_entry' field (Eduard Zingerman) [Orabug: 38095018] {CVE-2025-38060} - bpf: don't do clean_live_states when state->loop_entry->branches > 0 (Eduard Zingerman) - can: c_can: Use of_property_present() to test existence of DT property (Krzysztof Kozlowski) - pmdomain: imx: gpcv2: use proper helper for property detection (Ahmad Fatoum) - RDMA/core: Fix best page size finding when it can cross SG entries (Michael Margolin) - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (Alexis Lothore) [Orabug: 38094901] {CVE-2025-38040} - drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink (Harry Wentland) - Revert 'drm/amd/display: Request HW cursor on DCN3.2 with SubVP' (Leo Zeng) - drm/amd/display: Read LTTPR ALPM caps during link cap retrieval (George Shen) - drm/amd/display: Fix BT2020 YCbCr limited/full range input (Ilya Bakoulin) - drm/amd/display: Guard against setting dispclk low when active (Nicholas Kazlauskas) - drm/amd/display: Add support for disconnected eDP streams (Harry Vanzylldejong) - drm/amd/pm: Fetch current power limit from PMFW (Lijo Lazar) - irqchip/riscv-imsic: Separate next and previous pointers in IMSIC vector (Anup Patel) - eeprom: ee1004: Check chip before probing (Eddie James) - mfd: axp20x: AXP717: Add AXP717_TS_PIN_CFG to writeable regs (Chris Morgan) - i3c: master: svc: Flush FIFO before sending Dynamic Address Assignment(DAA) (Frank Li) - EDAC/ie31200: work around false positive build warning (Arnd Bergmann) - power: supply: axp20x_battery: Update temp sensor for AXP717 from device tree (Chris Morgan) - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (Peter Seiderer) [Orabug: 38095024] {CVE-2025-38061} - wifi: rtw89: 8922a: fix incorrect STA-ID in EHT MU PPDU (Kuan-Chung Chen) - wifi: rtw89: fw: add blacklist to avoid obsolete secure firmware (Ping-Ke Shih) - wifi: rtw89: fw: get sb_sel_ver via get_unaligned_le32() (Ping-Ke Shih) - wifi: rtw89: fw: propagate error code from rtw89_h2c_tx() (Ping-Ke Shih) - wifi: rtw88: Fix rtw_desc_to_mcsrate() to handle MCS16-31 (Bitterblue Smith) - wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU (Bitterblue Smith) - wifi: rtw88: Fix rtw_init_vht_cap() for RTL8814AU (Bitterblue Smith) - PCI: epf-mhi: Update device ID for SA8775P (Mrinmay Sarkar) - clocksource: mips-gic-timer: Enable counter when CPUs start (Paul Burton) - MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core (Paul Burton) - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie (Jason Gunthorpe) [Orabug: 38095031] {CVE-2025-38062} - x86/locking: Use ALT_OUTPUT_SP() for percpu_{,try_}cmpxchg{64,128}_op() (Uros Bizjak) - drm/amdgpu: remove all KFD fences from the BO on release (Christian Konig) - MIPS: Use arch specific syscall name match function (Bibo Mao) - drm/xe/oa: Ensure that polled read returns latest data (Umesh Nerlige Ramappa) - net: ipv6: Init tunnel link-netns before registering dev (Xiao Liang) - crypto: skcipher - Zap type in crypto_alloc_sync_skcipher (Herbert Xu) - crypto: ahash - Set default reqsize from ahash_alg (Herbert Xu) - x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh) - net/mlx5: Change POOL_NEXT_SIZE define value and make it global (Patrisious Haddad) - scsi: scsi_debug: First fixes for tapes (Kai Makisara) - dm: fix unconditional IO throttle caused by REQ_PREFLUSH (Jinliang Zheng) [Orabug: 38095038] {CVE-2025-38063} - libbpf: Fix out-of-bound read (Nandakumar Edamana) - loop: check in LO_FLAGS_DIRECT_IO in loop_default_blocksize (Christoph Hellwig) - net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode (Jianbo Liu) - media: tc358746: improve calculation of the D-PHY timing registers (Matthias Fend) - media: adv7180: Disable test-pattern control on adv7180 (Niklas Soderlund) - cpuidle: menu: Avoid discarding useful information (Rafael J. Wysocki) - vdpa/mlx5: Fix mlx5_vdpa_get_config() endianness on big-endian machines (Konstantin Shkolnyy) - x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() (Waiman Long) - ASoC: mediatek: mt8188: Add reference for dmic clocks (Nicolas F R A Prado) - ASoC: mediatek: mt8188: Treat DMIC_GAINx_CUR as non-volatile (Nicolas F R A Prado) - drm/amd/display: Fix mismatch type comparison (Navid Assadian) - drm/amd/display: fix dcn4x init failed (Charlene Liu) - drm/amd/display: handle max_downscale_src_width fail check (Yihan Zhu) - x86/build: Fix broken copy command in genimage.sh when making isoimage (Nir Lichtman) - Octeontx2-af: RPM: Register driver with PCI subsys IDs (Hariprasad Kelam) - bpf: Search and add kfuncs in struct_ops prologue and epilogue (Amery Hung) - soc: ti: k3-socinfo: Do not use syscon helper to build regmap (Andrew Davis) - wifi: ath12k: Improve BSS discovery with hidden SSID in 6 GHz band (Ramasamy Kaliappan) - bonding: report duplicate MAC address in all situations (Hangbin Liu) - net: xgene-v2: remove incorrect ACPI_PTR annotation (Arnd Bergmann) - net: ethernet: mtk_ppe_offload: Allow QinQ, double ETH_P_8021Q only (Eric Woudstra) - leds: pwm-multicolor: Add check for fwnode_property_read_u32 (Yuanjun Gong) - drm/xe: xe_gen_wa_oob: replace program_invocation_short_name (Daniel Gomez) - drm/amdkfd: KFD release_work possible circular locking (Philip Yang) - pinctrl: sophgo: avoid to modify untouched bit when setting cv1800 pinconf (Inochi Amaoto) - selftests/net: have gro.sh -t return a correct exit code (Kevin Krakauer) - net/mlx5: Avoid report two health errors on same syndrome (Moshe Shemesh) - drm/xe/pf: Create a link between PF and VF devices (K V P Satyanarayana) - drm/xe/vf: Retry sending MMIO request to GUC on timeout error (K V P Satyanarayana) - firmware: arm_ffa: Set dma_mask for ffa devices (Viresh Kumar) [Orabug: 38094925] {CVE-2025-38043} - PCI: brcmstb: Add a softdep to MIP MSI-X driver (Stanimir Varbanov) - PCI: brcmstb: Expand inbound window size up to 64GB (Stanimir Varbanov) - wifi: ath12k: Report proper tx completion status to mac80211 (Vinith Kumar R) - soc: apple: rtkit: Implement OSLog buffers properly (Hector Martin) - soc: apple: rtkit: Use high prio work queue (Janne Grunau) - perf: arm_pmuv3: Call kvm_vcpu_pmu_resync_el0() before enabling counters (Rob Herring) - fpga: altera-cvp: Increase credit timeout (Kuhanh Murugasen Krishnan) - drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence (AngeloGioacchino Del Regno) - ARM: at91: pm: fix at91_suspend_finish for ZQ calibration (Li Bin) - hwmon: (gpio-fan) Add missing mutex locks (Alexander Stein) - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Breno Leitao) - clk: imx8mp: inform CCF of maximum frequency of clocks (Ahmad Fatoum) - media: uvcvideo: Handle uvc menu translation inside uvc_get_le_value (Ricardo Ribalda) - media: uvcvideo: Add sanity check to uvc_ioctl_xu_ctrl_map (Ricardo Ribalda) - ublk: complete command synchronously on error (Caleb Sander) - block: mark bounce buffering as incompatible with integrity (Christoph Hellwig) - drm/rockchip: vop2: Add uv swap for cluster window (Andy Yan) - ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). (Kuniyuki Iwashima) - scsi: logging: Fix scsi_logging_level bounds (Nicolas Bouchinet) - ALSA: hda/realtek: Enable PC beep passthrough for HP EliteBook 855 G7 (Maciej S. Szmigiero) - perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (Saket Kumar Bhaskar) - net: pktgen: fix mpls maximum labels list parsing (Peter Seiderer) - media: imx335: Set vblank immediately (Paul Elder) - iommufd: Disallow allocating nested parent domain with fault ID (Yi Liu) - ublk: enforce ublks_max only for unprivileged devices (Uday Shankar) - dpll: Add an assertion to check freq_supported_num (Jiasheng Jiang) - net: phy: nxp-c45-tja11xx: add match_phy_device to TJA1103/TJA1104 (Andrei Botila) - net: ethernet: ti: cpsw_new: populate netdev of_node (Alexander Sverdlin) - rcu: Fix get_state_synchronize_rcu_full() GP-start detection (Paul E. McKenney) - pinctrl: bcm281xx: Use 'unsigned int' instead of bare 'unsigned' (Artur Weber) - media: cx231xx: set device_caps for 417 (Hans Verkuil) [Orabug: 38094934] {CVE-2025-38044} - perf/core: Clean up perf_try_init_event() (Peter Zijlstra) - drm/amd/display: Request HW cursor on DCN3.2 with SubVP (Aric Cyr) - drm/amd/display: Fix p-state type when p-state is unsupported (Dillon Varone) - drm/amd/display: Fix DMUB reset sequence for DCN401 (Dillon Varone) - drm/amd/display: Skip checking FRL_MODE bit for PCON BW determination (George Shen) - drm/amd/display: Ensure DMCUB idle before reset on DCN31/DCN35 (Nicholas Kazlauskas) - drm/amdgpu: Do not program AGP BAR regs under SRIOV in gfxhub_v1_0.c (Victor Lu) - remoteproc: qcom_wcnss: Handle platforms with only single power domain (Matti Lehtimaki) - blk-throttle: don't take carryover for prioritized processing of metadata (Ming Lei) - net: phylink: use pl->link_interface in phylink_expects_phy() (Choong Yong Liang) - drm/gem: Test for imported GEM buffers with helper (Thomas Zimmermann) - orangefs: Do not truncate file size (Matthew Wilcox) [Orabug: 38095056] {CVE-2025-38065} - soc: mediatek: mtk-mutex: Add DPI1 SOF/EOF to MT8188 mutex tables (AngeloGioacchino Del Regno) - dm cache: prevent BUG_ON by blocking retries on failed device resumes (Ming-Hung Tsai) [Orabug: 38095063] {CVE-2025-38066} - usb: xhci: set page size to the xHCI-supported size (Niklas Neronin) - media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() (Markus Elfring) - ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 (Svyatoslav Ryhel) - soc: samsung: include linux/array_size.h where needed (Arnd Bergmann) - drm/xe: Retry BO allocation (Matthew Brost) - drm/xe: Nuke VM's mapping upon close (Matthew Brost) - ieee802154: ca8210: Use proper setters and getters for bitwise types (Andy Shevchenko) - rtc: ds1307: stop disabling alarms on probe (Alexandre Belloni) - tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() (Eric Dumazet) - ALSA: seq: Improve data consistency at polling (Takashi Iwai) - powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 (Andreas Schwab) - arm64: tegra: Resize aperture for the IGX PCIe C5 slot (Jonathan Hunter) - arm64: tegra: p2597: Fix gpio for vdd-1v8-dis regulator (Diogo Ivo) - drm/amdgpu: Fix missing drain retry fault the last entry (Emily Deng) - drm/amdkfd: Set per-process flags only once cik/vi (Harish Kasiviswanathan) - drm/amdkfd: Set per-process flags only once for gfx9/10/11/12 (Harish Kasiviswanathan) - crypto: mxs-dcp - Only set OTP_KEY bit for OTP key (Sven Schwermer) - crypto: lzo - Fix compression buffer overrun (Herbert Xu) [Orabug: 38095079] {CVE-2025-38068} - misc: pci_endpoint_test: Give disabled BARs a distinct error code (Niklas Cassel) - PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops (Christian Bruel) [Orabug: 38095087] {CVE-2025-38069} - watchdog: aspeed: Update bootstatus handling (Chin-Ting Kuo) - cpufreq: tegra186: Share policy per cluster (Aaron Kling) - iommu/amd/pgtbl_v2: Improve error handling (Vasant Hegde) - coresight-etb10: change etb_drvdata spinlock's type to raw_spinlock_t (Levi Yun) - badblocks: Fix a nonsense WARN_ON() which checks whether a u64 variable < 0 (Coly Li) - ASoC: qcom: sm8250: explicitly set format in sm8250_be_hw_params_fixup() (Alexey Klimov) - auxdisplay: charlcd: Partially revert 'Move hwidth and bwidth to struct hd44780_common' (Andy Shevchenko) - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) - drm/amd/display: Fix incorrect DPCD configs while Replay/PSR switch (Leon Huang) - drm/amd/display: not abort link train when bw is low (Peichen Huang) - drm/amd/display: calculate the remain segments for all pipes (Zhikai Zhai) - drm/amd/display: remove minimum Dispclk and apply oem panel timing. (Charlene Liu) - ipv6: save dontfrag in cork (Willem de Bruijn) - wifi: cfg80211: allow IR in 20 MHz configurations (Anjaneyulu) - wifi: mac80211_hwsim: Fix MLD address translation (Ilan Peer) - wifi: mac80211: fix warning on disconnect during failed ML reconf (Johannes Berg) - wifi: iwlwifi: fix the ECKV UEFI variable name (Emmanuel Grumbach) - wifi: iwlwifi: mark Br device not integrated (Johannes Berg) - wifi: iwlwifi: fix debug actions order (Johannes Berg) [Orabug: 38094942] {CVE-2025-38045} - wifi: iwlwifi: w/a FW SMPS mode selection (Daniel Gabay) - wifi: iwlwifi: don't warn when if there is a FW error (Miri Korenblit) - printk: Check CON_SUSPEND when unblanking a console (Marcos Paulo de Souza) - iommu: Keep dev->iommu state consistent (Robin Murphy) - hwmon: (dell-smm) Increment the number of fans (Kurt Borja) - wifi: iwlwifi: mvm: fix setting the TK when associated (Avraham Stern) - usb: xhci: Don't change the status of stalled TDs on failed Stop EP (Michal Pecio) - mmc: sdhci: Disable SD card clock before changing parameters (Erick Shepherd) - mmc: dw_mmc: add exynos7870 DW MMC support (Kaustabh Chakraborty) - arm64/mm: Check PUD_TYPE_TABLE in pud_bad() (Ryan Roberts) - arm64/mm: Check pmd_table() in pmd_trans_huge() (Ryan Roberts) - phy: rockchip: usbdp: Only verify link rates/lanes/voltage when the corresponding set flags are set (Andy Yan) - PNP: Expand length of fixup id string (Kees Cook) - netfilter: conntrack: Bound nf_conntrack sysctl writes (Nicolas Bouchinet) - wifi: rtw89: set force HE TB mode when connecting to 11ax AP (Dian-Syuan Yang) - timer_list: Don't use %pK through printk() (Thomas Weissschuh) - net: hsr: Fix PRP duplicate detection (Jaakko Karrenpalo) - net: stmmac: dwmac-rk: Validate GRF and peripheral GRF during probe (Jonas Karlman) - posix-timers: Ensure that timer initialization is fully visible (Thomas Gleixner) - posix-timers: Add cond_resched() to posix_timer_add() search loop (Eric Dumazet) - RDMA/uverbs: Propagate errors from rdma_lookup_get_uobject() (Maher Sanalla) - ext4: do not convert the unwritten extents if data writeback fails (Baokun Li) - ext4: reject the 'data_err=abort' option in nojournal mode (Baokun Li) - clk: qcom: lpassaudiocc-sc7280: Add support for LPASS resets for QCM6490 (Taniya Das) - ASoC: sun4i-codec: support hp-det-gpios property (Ryan Walklin) - drm/amdgpu: Update SRIOV video codec caps (David Rosca) - drm/amdgpu/gfx11: don't read registers in mqd init (Alex Deucher) - drm/amdgpu/gfx12: don't read registers in mqd init (Alex Deucher) - mfd: tps65219: Remove TPS65219_REG_TI_DEV_ID check (Shree Ramamoorthy) - pinctrl-tegra: Restore SFSEL bit when freeing pins (Prathamesh Shete) - xen: Add support for XenServer 6.1 platform device (Frediano Ziglio) - net/smc: use the correct ndev to find pnetid by pnetid table (Guangguan Wang) - dm: restrict dm device size to 2^63-512 bytes (Mikulas Patocka) - crypto: octeontx2 - suppress auth failure screaming due to negative tests (Shashank Gupta) - kconfig: do not clear SYMBOL_VALID when reading include/config/auto.conf (Masahiro Yamada) - kbuild: fix argument parsing in scripts/config (Seyediman Seyedarab) - bpf: Allow pre-ordering for bpf cgroup progs (Yonghong Song) - ASoC: mediatek: mt6359: Add stub for mt6359_accdet_enable_jack_detect (Nicolas F R A Prado) - ASoC: pcm6240: Drop bogus code handling IRQ as GPIO (Linus Walleij) - spi: spi-mux: Fix coverity issue, unchecked return value (Sergio Perez Gonzalez) - erofs: initialize decompression early (Gao Xiang) - thunderbolt: Do not add non-active NVM if NVM upgrade is disabled for retimer (Mika Westerberg) - objtool: Fix error handling inconsistencies in check() (Josh Poimboeuf) - rtc: rv3032: fix EERD location (Alexandre Belloni) - tcp: reorganize tcp_in_ack_event() and tcp_count_delivered() (Ilpo Jarvinen) - jbd2: do not try to recover wiped journal (Jan Kara) - PCI: dwc: Use resource start as ioremap() input in dw_pcie_pme_turn_off() (Frank Li) - bpf: Return prog btf_id without capable check (Mykyta Yatsenko) - vfio/pci: Handle INTx IRQ_NOTCONNECTED (Alex Williamson) - scsi: st: ERASE does not change tape location (Kai Makisara) - scsi: st: Tighten the page format heuristics with MODE SELECT (Kai Makisara) - hypfs_create_cpu_files(): add missing check for hypfs_mkdir() failure (Al Viro) - ext4: reorder capability check last (Christian Gottsche) - riscv: Call secondary mmu notifier when flushing the tlb (Alexandre Ghiti) - bnxt_en: Query FW parameters when the CAPS_CHANGE bit is set (Shantiprasad Shettar) - wifi: mwifiex: Fix HT40 bandwidth issue. (Jeff Chen) - um: Update min_low_pfn to match changes in uml_reserved (Tiwei Bie) - um: Store full CSGSFS and SS register from mcontext (Benjamin Berg) - clocksource/drivers/timer-riscv: Stop stimecmp when cpu hotplug (Nick Hu) - dlm: make tcp still work in multi-link env (Heming Zhao) - s390/tlb: Use mm_has_pgste() instead of mm_alloc_pgste() (Heiko Carstens) - i3c: master: svc: Fix missing STOP for master request (Stanley Chu) - drm/amdgpu: adjust drm_firmware_drivers_only() handling (Alex Deucher) - drm/amd/display: Guard against setting dispclk low for dcn31x (Jing Zhou) - drm/amdgpu: release xcp_mgr on exit (Flora Cui) - blk-cgroup: improve policy registration error handling (Chen Linxuan) - btrfs: send: return -ENAMETOOLONG when attempting a path that is too long (Filipe Manana) - btrfs: get zone unusable bytes while holding lock at btrfs_reclaim_bgs_work() (Filipe Manana) - btrfs: fix non-empty delayed iputs list on unmount due to async workers (Filipe Manana) - btrfs: run btrfs_error_commit_super() early (Qu Wenruo) - btrfs: avoid linker error in btrfs_find_create_tree_block() (Mark Harmstone) - btrfs: make btrfs_discard_workfn() block_group ref explicit (Boris Burkov) - i2c: pxa: fix call balance of i2c->clk handling routines (Vitalii Mordan) - i2c: qup: Vote for interconnect bandwidth to DRAM (Stephan Gerhold) - x86/mm: Check return value from memblock_phys_alloc_range() (Philip Redkin) [Orabug: 38095101] {CVE-2025-38071} - x86/microcode: Update the Intel processor flag scan check (Sohil Mehta) - x86/smpboot: Fix INIT delay assignment for extended Intel Families (Sohil Mehta) - x86/stackprotector/64: Only export __ref_stack_chk_guard on CONFIG_SMP (Ingo Molnar) - x86/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in UAPI headers (Thomas Huth) - wifi: mt76: mt7925: fix fails to enter low power mode in suspend state (Quan Zhou) - wifi: mt76: mt7925: load the appropriate CLC data based on hardware type (Ming Yen Hsieh) - wifi: mt76: mt7996: revise TXS size (Benjamin Lin) - wifi: mt76: mt7996: fix SER reset trigger on WED reset (Rex Lu) - wifi: mt76: only mark tx-status-failed frames as ACKed on mt76x0/2 (Felix Fietkau) - cgroup/rstat: avoid disabling irqs for O(num_cpu) (Eric Dumazet) - drm/amdgpu: Skip pcie_replay_count sysfs creation for VF (Victor Skvortsov) - mmc: host: Wait for Vdd to settle on card power off (Erick Shepherd) - staging: vchiq_arm: Create keep-alive thread during probe (Stefan Wahren) - pidfs: improve multi-threaded exec and premature thread-group leader exit polling (Christian Brauner) - libnvdimm/labels: Fix divide error in nd_label_data_init() (Robert Richter) [Orabug: 38095109] {CVE-2025-38072} - ext4: on a remount, only log the ro or r/w state when it has changed (Nicolas Bretz) - xen/pci: Do not register devices with segments >= 0x10000 (Roger Pau Monne) - PCI: vmd: Disable MSI remapping bypass under Xen (Roger Pau Monne) - drm/amdkfd: set precise mem ops caps to disabled for gfx 11 and 12 (Jonathan Kim) - drm/amdgpu/discovery: check ip_discovery fw file available (Flora Cui) - pNFS/flexfiles: Report ENETDOWN as a connection error (Trond Myklebust) - tools/build: Don't pass test log files to linker (Ian Rogers) - r8169: disable RTL8126 ZRX-DC timeout (Chunhao Lin) - PCI: dwc: ep: Ensure proper iteration over outbound map windows (Frank Li) - objtool: Properly disable uaccess validation (Josh Poimboeuf) - lockdep: Fix wait context check on softirq for PREEMPT_RT (Ryo Takakura) - dql: Fix dql->limit value when reset. (Jing Su) - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken (Pedro Nishiyama) - Bluetooth: btmtksdio: Prevent enabling interrupts after IRQ handler removal (Sean Wang) - thermal/drivers/qoriq: Power down TMU on system suspend (Alice Guo) - thermal/drivers/mediatek/lvts: Start sensor interrupts disabled (Nicolas F R A Prado) - net: tn40xx: create swnode for mdio and aqr105 phy and add to mdiobus (Hans-Frieder Vogt) - net: tn40xx: add pci-id of the aqr105-based Tehuti TN4010 cards (Hans-Frieder Vogt) - mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (Daniel Hsu) - ASoC: codecs: wsa883x: Correct VI sense channel mask (Krzysztof Kozlowski) - ASoC: codecs: wsa884x: Correct VI sense channel mask (Krzysztof Kozlowski) - spi-rockchip: Fix register out of bounds access (Luis de Arquer) [Orabug: 38095173] {CVE-2025-38081} - SUNRPC: rpcbind should never reset the port to the value '0' (Trond Myklebust) - SUNRPC: rpc_clnt_set_transport() must not change the autobind setting (Trond Myklebust) - NFSv4: Treat ENETUNREACH errors as fatal for state recovery (Trond Myklebust) - cifs: Fix establishing NetBIOS session for SMB2+ connection (Pali Rohar) - cifs: add validation check for the fields in smb_aces (Namjae Jeon) - cifs: Set default Netbios RFC1001 server name to hostname in UNC (Pali Rohar) - fbdev: core: tileblit: Implement missing margin clearing for tileblit (Zsolt Kajtar) - fbcon: Use correct erase colour for clearing in fbcon (Zsolt Kajtar) - fbdev: fsl-diu-fb: add missing device_remove_file() (Shixiong Ou) - riscv: Allow NOMMU kernels to access all of RAM (Samuel Holland) - mailbox: use error ret code of of_parse_phandle_with_args() (Tudor Ambarus) - mailbox: pcc: Use acpi_os_ioremap() instead of ioremap() (Sudeep Holla) - tpm: Convert warn to dbg in tpm2_start_auth_session() (Jonathan Mcdowell) - ACPI: PNP: Add Intel OC Watchdog IDs to non-PNP device list (Diogo Ivo) - tracing: Mark binary printing functions with __printf() attribute (Andy Shevchenko) - iommufd: Extend IOMMU_GET_HW_INFO to report PASID capability (Yi Liu) - arm64: Add support for HIP09 Spectre-BHB mitigation (Jinqian Yang) - SUNRPC: Don't allow waiting for exiting tasks (Trond Myklebust) - NFS: Don't allow waiting for exiting tasks (Trond Myklebust) - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Trond Myklebust) - io_uring/msg: initialise msg request opcode (Pavel Begunkov) - exfat: call bh_read in get_block only when necessary (Sungjong Seo) - fuse: Return EPERM rather than ENOSYS from link() (Matt Johnston) - smb: client: Store original IO parameters and prevent zero IO sizes (Zhaolong Wang) - cifs: Fix negotiate retry functionality (Pali Rohar) - cifs: Fix querying and creating MF symlinks over SMB1 (Pali Rohar) - cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES (Pali Rohar) - s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log (Tony Krowiak) - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li) [Orabug: 38094951] {CVE-2025-38047} - kconfig: merge_config: use an empty file as initfile (Daniel Gomez) - samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (Haoran Jiang) - bpf: fix possible endless loop in BPF map iteration (Brandon Kammerdiener) - io_uring: don't duplicate flushing in io_req_post_cqe (Pavel Begunkov) - block: fix race between set_blocksize and read paths (Darrick J. Wong) [Orabug: 38095117] {CVE-2025-38073} - selftests/bpf: Mitigate sockmap_ktls disconnect_after_delete failure (Ihor Solodrai) - drm/amdgpu: Allow P2P access through XGMI (Felix Kuehling) - drm/amd/display: Enable urgent latency adjustment on DCN35 (Nicholas Susanto) - fs/ext4: use sleeping version of sb_find_get_block() (Davidlohr Bueso) - fs/jbd2: use sleeping version of __find_get_block() (Davidlohr Bueso) - fs/ocfs2: use sleeping version of __find_get_block() (Davidlohr Bueso) - fs/buffer: use sleeping version of __find_get_block() (Davidlohr Bueso) - fs/buffer: introduce sleeping flavors for pagecache lookups (Davidlohr Bueso) - fs/buffer: split locking for pagecache lookups (Davidlohr Bueso) - ima: process_measurement() needlessly takes inode_lock() on MAY_READ (Frederick Lawler) - dma-mapping: Fix warning reported for missing prototype (Balbir Singh) - net: enetc: refactor bulk flipping of RX buffers to separate function (Vladimir Oltean) - vhost_task: fix vhost_task_create() documentation (Stefano Garzarella) - cgroup: Fix compilation issue due to cgroup_mutex not being exported (Gao Xu) - dma-mapping: avoid potential unused data compilation warning (Marek Szyprowski) - mei: vsc: Use struct vsc_tp_packet as vsc-tp tx_buf and rx_buf type (Hans de Goede) - intel_th: avoid using deprecated page->mapping, index fields (Lorenzo Stoakes) - dma/mapping.c: dev_dbg support for dma_addressing_limited (Balbir Singh) - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN (Zhongqiu Han) [Orabug: 38094958] {CVE-2025-38048} - scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices (Manish Pandey) - scsi: target: iscsi: Fix timeout on deleted connection (Dmitry Bogdanov) [Orabug: 38095134] {CVE-2025-38075} - nvmem: qfprom: switch to 4-byte aligned reads (Dmitry Baryshkov) - nvmem: core: update raw_len if the bit reading is required (Dmitry Baryshkov) - nvmem: core: verify cell's raw_len (Dmitry Baryshkov) - nvmem: core: fix bit offsets of more than one byte (Dmitry Baryshkov) - nvmem: rockchip-otp: add rk3576 variant data (Heiko Stuebner) - nvmem: rockchip-otp: Move read-offset into variant-data (Heiko Stuebner) - cpufreq: Add SM8650 to cpufreq-dt-platdev blocklist (Pengyu Luo) - phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off (Claudiu Beznea) - phy: renesas: rcar-gen3-usb2: Lock around hardware registers and driver data (Claudiu Beznea) - phy: renesas: rcar-gen3-usb2: Move IRQ request in probe (Claudiu Beznea) - i2c: designware: Fix an error handling path in i2c_dw_pci_probe() (Christophe Jaillet) - i2c: designware: Use temporary variable for struct device (Andy Shevchenko) - drm/amd/display: Defer BW-optimization-blocked DRR adjustments (John Olender) - drm/amd/display: Correct timing_adjust_pending flag setting. (Zhongwei) - drm/amd/display: Do not enable replay when vtotal update is pending. (Sung-Huai Wang) - drm/amd/display: Configure DTBCLK_P with OPTC only for dcn401 (Dillon Varone) - LTS version: v6.12.30 (Jack Vogel) - drm/amdgpu: fix pm notifier handling (Alex Deucher) - phy: tegra: xusb: remove a stray unlock (Dan Carpenter) - usb: typec: ucsi: displayport: Fix deadlock (Andrei Kuchynski) [Orabug: 37977018] {CVE-2025-37967} - drm/tiny: panel-mipi-dbi: Use drm_client_setup_with_fourcc() (Fabio Estevam) - drm/panel-mipi-dbi: Run DRM default client setup (Thomas Zimmermann) - drm/fbdev-dma: Support struct drm_driver.fbdev_probe (Thomas Zimmermann) - Bluetooth: btnxpuart: Fix kernel panic during FW release (Neeraj Sanjay Kale) [Orabug: 37844459] {CVE-2025-22102} - iio: light: opt3001: fix deadlock due to concurrent flag access (Luca Ceresoli) [Orabug: 37977026] {CVE-2025-37968} - accel/ivpu: Fix fw log printing (Jacek Lawrynowicz) - accel/ivpu: Refactor functions in ivpu_fw_log.c (Jacek Lawrynowicz) - accel/ivpu: Reset fw log on cold boot (Tomasz Rusinowicz) - accel/ivpu: Rename ivpu_log_level to fw_log_level (Jacek Lawrynowicz) - mm/page_alloc: fix race condition in unaccepted memory handling (Kirill A. Shutemov) [Orabug: 38094767] {CVE-2025-38008} - drm/xe/gsc: do not flush the GSC worker from the reset path (Daniele Ceraolo Spurio) - CIFS: New mount option for cifs.upcall namespace resolution (Ritvik Budhiraja) - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (Shuai Xue) [Orabug: 38094790] {CVE-2025-38014} - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe (Shuai Xue) - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094793] {CVE-2025-38015} - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call (Shuai Xue) - dmaengine: idxd: Add missing cleanups in cleanup internals (Shuai Xue) - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals (Shuai Xue) - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups (Shuai Xue) - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines (Shuai Xue) - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs (Shuai Xue) - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy (Yemike Abhilash Chandra) - dmaengine: ti: k3-udma: Add missing locking (Ronald Wahl) [Orabug: 38094756] {CVE-2025-38005} - mm: userfaultfd: correct dirty flags set for both present and swap pte (Barry Song) - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor) - ring-buffer: Fix persistent buffer when commit page is the reader page (Steven Rostedt) - wifi: mt76: disable napi on driver removal (Fedor Pchelkin) [Orabug: 38094770] {CVE-2025-38009} - tpm: Mask TPM RC in tpm2_start_auth_session() (Jarkko Sakkinen) - spi: tegra114: Use value to check for invalid delays (Aaron Kling) - smb: client: fix memory leak during error handling for POSIX mkdir (Jethro Donaldson) - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer (Steve Siwinski) - phy: renesas: rcar-gen3-usb2: Set timing registers only once (Claudiu Beznea) - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind (Claudiu Beznea) - phy: Fix error handling in tegra_xusb_port_init (Ma Ke) - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking (Wayne Chang) [Orabug: 38094777] {CVE-2025-38010} - tracing: samples: Initialize trace_array_printk() with the correct function (Steven Rostedt) - ftrace: Fix preemption accounting for stacktrace filter command (Donglin Peng) - ftrace: Fix preemption accounting for stacktrace trigger command (Donglin Peng) - kbuild: Disable -Wdefault-const-init-unsafe (Nathan Chancellor) - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer() (Michael Kelley) - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (Michael Kelley) - arm64: dts: rockchip: Remove overdrive-mode OPPs from RK3588J SoC dtsi (Dragan Simic) - arm64: dts: amlogic: dreambox: fix missing clkc_audio node (Christian Hewitt) - hv_netvsc: Remove rmsg_pgcnt (Michael Kelley) - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (Michael Kelley) - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (Michael Kelley) - dma-buf: insert memory barrier before updating num_fences (Hyejeong Choi) - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera (Nicolas Chauvet) - ALSA: usb-audio: Add sample rate quirk for Audioengine D1 (Christian Heusel) - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() (Xu Wang) - ACPI: PPTT: Fix processor subtable walk (Jeremy Linton) - gpio: pca953x: fix IRQ storm on system wake up (Emanuele Ghidoli) - MAINTAINERS: Update Alexey Makhalov's email address (Alexey Makhalov) - drm/amd/display: Avoid flooding unnecessary info messages (Wayne Lin) - drm/amd/display: Correct the reply value when AUX write incomplete (Wayne Lin) - drm/amdgpu: csa unmap use uninterruptible lock (Philip Yang) [Orabug: 38094779] {CVE-2025-38011} - drm/amdgpu: fix incorrect MALL size for GFX1151 (Tim Huang) - Revert 'drm/amd/display: Hardware cursor changes color when switched to software cursor' (Melissa Wen) - btrfs: add back warning for mount option commit values exceeding 300 (Kyoji Ogasawara) - btrfs: fix folio leak in submit_one_async_extent() (Boris Burkov) - btrfs: fix discard worker infinite loop after disabling discard (Filipe Manana) - LoongArch: uprobes: Remove redundant code about resume_era (Tiezhu Yang) - LoongArch: uprobes: Remove user_{en,dis}able_single_step() (Tiezhu Yang) - LoongArch: Fix MAX_REG_OFFSET calculation (Huacai Chen) - LoongArch: Save and restore CSR.CNTC for hibernation (Huacai Chen) - LoongArch: Move __arch_cpu_idle() to .cpuidle.text section (Huacai Chen) - LoongArch: Prevent cond_resched() occurring within kernel-fpu (Tianyang Zhang) - HID: bpf: abort dispatch if device destroyed (Rongrong) [Orabug: 38094796] {CVE-2025-38016} - udf: Make sure i_lenExtents is uptodate on inode eviction (Jan Kara) - sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator (Tejun Heo) [Orabug: 38094786] {CVE-2025-38012} - dmaengine: Revert 'dmaengine: dmatest: Fix dmatest waiting less when interrupted' (Nathan Lynch) - NFSv4/pnfs: Reset the layout state after a layoutreturn (Trond Myklebust) - tsnep: fix timestamping with a stacked DSA driver (Gerhard Engleder) - net/tls: fix kernel panic when alloc_page failed (Pengtao He) [Orabug: 38094802] {CVE-2025-38018} - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (Ido Schimmel) [Orabug: 38094804] {CVE-2025-38019} - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request (Kees Cook) [Orabug: 38094788] {CVE-2025-38013} - octeontx2-pf: Do not reallocate all ntuple filters (Subbaraya Sundeep) - octeontx2-af: Fix CGX Receive counters (Hariprasad Kelam) - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability (Bc-Bocun Chen) - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy (Subbaraya Sundeep) - netlink: specs: tc: all actions are indexed arrays (Jakub Kicinski) - netlink: specs: tc: fix a couple of attribute names (Jakub Kicinski) - drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value (Umesh Nerlige Ramappa) - regulator: max20086: fix invalid memory access (Cosmin Tanislav) [Orabug: 38094833] {CVE-2025-38027} - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() (Abdun Nihaal) - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094808] {CVE-2025-38020} - vsock/test: Fix occasional failure in SIOCOUTQ tests (Konstantin Shkolnyy) - net: dsa: b53: prevent standalone from trying to forward to other ports (Jonas Gorski) - ALSA: sh: SND_AICA should depend on SH_DMA_API (Geert Uytterhoeven) - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (Keith Busch) - nvme-pci: make nvme_pci_npages_prp() __always_inline (Kees Cook) - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING (Vladimir Oltean) - net: cadence: macb: Fix a possible deadlock in macb_halt_tx. (Mathieu Othacehe) - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info (Takashi Iwai) - ALSA: seq: Fix delivery of UMP events to group ports (Takashi Iwai) - net: mctp: Ensure keys maintain only one ref to corresponding dev (Andrew Jeffery) - tests/ncdevmem: Fix double-free of queue array (Cosmin Ratiu) - selftests: ncdevmem: Switch to AF_INET6 (Stanislav Fomichev) - selftests: ncdevmem: Make client_ip optional (Stanislav Fomichev) - selftests: ncdevmem: Unify error handling (Stanislav Fomichev) - selftests: ncdevmem: Separate out dmabuf provider (Stanislav Fomichev) - selftests: ncdevmem: Redirect all non-payload output to stderr (Stanislav Fomichev) - net: mctp: Don't access ifa_index when missing (Matt Johnston) - mctp: no longer rely on net->dev_index_head[] (Eric Dumazet) - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing (Hangbin Liu) - net_sched: Flush gso_skb list too during ->change() (Cong Wang) [Orabug: 37998128] {CVE-2025-37992} - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags (Luiz Augusto von Dentz) - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (Zhu Yanjun) [Orabug: 38094813] {CVE-2025-38022} - spi: loopback-test: Do not split 1024-byte hexdumps (Geert Uytterhoeven) - nfs: handle failure of nfs_get_lock_context in unlock path (Li Lingfeng) [Orabug: 38094818] {CVE-2025-38023} - HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 38094764] {CVE-2025-38007} - HID: thrustmaster: fix memory leak in thrustmaster_interrupts() (Qasim Ijaz) - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (Zhu Yanjun) [Orabug: 38094827] {CVE-2025-38024} - virtio_net: ensure netdev_tx_reset_queue is called on bind xsk for tx (Koichiro Den) - virtio_ring: add a func argument 'recycle_done' to virtqueue_reset() (Koichiro Den) - iio: chemical: sps30: use aligned_s64 for timestamp (David Lechner) - iio: adc: ad7768-1: Fix insufficient alignment of timestamp. (Jonathan Cameron) - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. (Mathias Nyman) - xhci: dbc: Improve performance by removing delay in transfer event polling. (Mathias Nyman) - Revert 'drm/amd: Stop evicting resources on APUs in suspend' (Alex Deucher) - drm/amd: Add Suspend/Hibernate notification callback support (Mario Limonciello) - iio: pressure: mprls0025pa: use aligned_s64 for timestamp (David Lechner) - iio: chemical: pms7003: use aligned_s64 for timestamp (David Lechner) - iio: adc: ad7266: Fix potential timestamp alignment issue. (Jonathan Cameron) - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson) - KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata) - uio_hv_generic: Fix sysfs creation path for ring buffer (Naman Jain) - tpm: tis: Double the timeout B to 4s (Michal Suchanek) - tracing: probes: Fix a possible race in trace_probe_log APIs (Masami Hiramatsu) - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks (Waiman Long) - arm64: dts: imx8mp-var-som: Fix LDO5 shutdown causing SD card timeout (Himanshu Bhavani) - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection (Hans de Goede) - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL) (Runhua He) - binfmt_elf: Move brk for static PIE even if ASLR disabled (Kees Cook) - riscv: dts: sophgo: fix DMA data-width configuration for CV18xx (Ze Huang) - drivers/platform/x86/amd: pmf: Check for invalid Smart PC Policies (Mario Limonciello) - drivers/platform/x86/amd: pmf: Check for invalid sideloaded Smart PC Policies (Mario Limonciello) - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs (Stephen Smalley) - arm64: dts: rockchip: Assign RT5616 MCLK rate on rk3588-friendlyelec-cm3588 (Tom Vincent) - LTS version: v6.12.29 (Jack Vogel) - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (James Morse) - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (James Morse) [Orabug: 37977004] {CVE-2025-37963} - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (James Morse) [Orabug: 37976926] {CVE-2025-37948} - arm64: proton-pack: Expose whether the branchy loop k value (James Morse) - arm64: proton-pack: Expose whether the platform is mitigated by firmware (James Morse) - arm64: insn: Add support for encoding DSB (James Morse) - mm: page_alloc: speed up fallbacks in rmqueue_bulk() (Johannes Weiner) - mm: page_alloc: don't steal single pages from biggest buddy (Johannes Weiner) - Bluetooth: btmtk: Remove the resetting step before downloading the fw (Hao Qin) - Bluetooth: btmtk: Remove resetting mt7921 before downloading the fw (Hao Qin) - io_uring: always arm linked timeouts prior to issue (Jens Axboe) - rust: clean Rust 1.88.0's clippy::uninlined_format_args lint (Miguel Ojeda) - rust: allow Rust 1.87.0's clippy::ptr_eq lint (Miguel Ojeda) - Revert 'um: work around sched_yield not yielding in time-travel mode' (Christian Lamparter) - do_umount(): add missing barrier before refcount checks in sync case (Al Viro) - io_uring/sqpoll: Increase task_work submission batch size (Gabriel Krisman Bertazi) - drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs (Tejas Upadhyay) - drm/xe/tests/mocs: Update xe_force_wake_get() return handling (Himal Prasad Ghimiray) - riscv: misaligned: enable IRQs while handling misaligned accesses (Clement Leger) - riscv: misaligned: factorize trap handling (Clement Leger) - nvme: unblock ctrl state transition for firmware update (Daniel Wagner) - drm/panel: simple: Update timings for AUO G101EVN010 (Kevin Baker) - loop: Add sanity check for read/write_iter (Lizhi Xu) - loop: factor out a loop_assign_backing_file helper (Christoph Hellwig) - loop: refactor queue limits updates (Christoph Hellwig) - loop: Fix ABBA locking race (Ogawa Hirofumi) - loop: Simplify discard granularity calc (John Garry) - loop: Use bdev limit helpers for configuring discard (John Garry) - riscv: misaligned: Add handling for ZCB instructions (Nylon Chen) - MIPS: Fix MAX_REG_OFFSET (Thorsten Blum) - iio: adc: dln2: Use aligned_s64 for timestamp (Jonathan Cameron) - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64 (Jonathan Cameron) - types: Complement the aligned types with signed 64-bit one (Andy Shevchenko) - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer. (Jonathan Cameron) - iio: accel: adxl367: fix setting odr for activity time update (Lothar Rubusch) - usb: usbtmc: Fix erroneous generic_read ioctl return (Dave Penkler) - usb: usbtmc: Fix erroneous wait_srq ioctl return (Dave Penkler) - usb: usbtmc: Fix erroneous get_stb ioctl error returns (Dave Penkler) - USB: usbtmc: use interruptible sleep in usbtmc_read (Oliver Neukum) - usb: typec: ucsi: displayport: Fix NULL pointer access (Andrei Kuchynski) [Orabug: 38015126] {CVE-2025-37994} - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition (Rd Babiera) - usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs (Lukasz Czechowski) - usb: host: tegra: Prevent host controller crash when OTG port is used (Jim Lin) - usb: gadget: Use get_status callback to set remote wakeup capability (Prashanth K) - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN (Wayne Chang) - usb: gadget: f_ecm: Add get_status callback (Prashanth K) - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version (Pawel Laszczak) - usb: cdnsp: Fix issue with resuming from L1 (Pawel Laszczak) - usb: dwc3: gadget: Make gadget_wakeup asynchronous (Prashanth K) - x86/microcode: Consolidate the loader enablement checking (Borislav Petkov) - module: ensure that kobject_put() is safe for module type kobjects (Dmitry Antipov) [Orabug: 38015131] {CVE-2025-37995} - memblock: Accept allocated memory before use in memblock_double_array() (Tom Lendacky) [Orabug: 37976994] {CVE-2025-37960} - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable() (Sebastian Andrzej Siewior) - arm64: cpufeature: Move arm64_use_ng_mappings to the .data section to prevent wrong idmap generation (Levi Yun) - accel/ivpu: Increase state dump msg timeout (Jacek Lawrynowicz) - xenbus: Use kref to track req lifetime (Jason Andryuk) [Orabug: 37976934] {CVE-2025-37949} - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it (John Ernberg) - smb: client: Avoid race in open_cached_dir with lease breaks (Paul Aurich) [Orabug: 37976959] {CVE-2025-37954} - usb: uhci-platform: Make the clock really optional (Alexey Charkov) - drm/amdgpu/hdp7: use memcfg register to post the write for HDP flush (Alex Deucher) - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush (Alex Deucher) - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush (Alex Deucher) - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush (Alex Deucher) - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush (Alex Deucher) - drm/amd/display: Copy AUX read reply data whenever length > 0 (Wayne Lin) - drm/amd/display: Fix wrong handling for AUX_DEFER case (Wayne Lin) - drm/amd/display: Remove incorrect checking in dmub aux handler (Wayne Lin) - drm/amd/display: Fix the checking condition in dmub aux handling (Wayne Lin) - drm/amd/display: more liberal vmin/vmax update for freesync (Aurabindo Pillai) - drm/amd/display: Fix invalid context error in dml helper (Roman Li) [Orabug: 37977185] {CVE-2025-37965} - drm/amdgpu/vcn: using separate VCN1_AON_SOC offset (Ruijing Dong) - drm/xe: Add page queue multiplier (Matthew Brost) - drm/v3d: Add job to pending list if the reset was skipped (Maira Canal) [Orabug: 37976942] {CVE-2025-37951} - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo (Silvano Seva) [Orabug: 37977031] {CVE-2025-37969} - iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo (Silvano Seva) [Orabug: 37977037] {CVE-2025-37970} - iio: imu: inv_mpu6050: align buffer for timestamp (David Lechner) - iio: adis16201: Correct inclinometer channel resolution (Gabriel) - iio: adc: rockchip: Fix clock initialization sequence (Simon Xue) - iio: adc: ad7606: fix serial register access (Angelo Dureghello) - io_uring: ensure deferred completions are flushed for multishot (Jens Axboe) - drm/amd/display: Shift DMUB AUX reply command if necessary (Wayne Lin) - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (Mikhail Lobanov) [Orabug: 37976977] {CVE-2025-37957} - selftests/mm: fix a build failure on powerpc (Nysal Jan K.A.) - selftests/mm: compaction_test: support platform with huge mount of memory (Feng Tang) - mm/userfaultfd: fix uninitialized output field for -EAGAIN race (Peter Xu) - mm/huge_memory: fix dereferencing invalid pmd migration entry (Gavin Guo) [Orabug: 37976982] {CVE-2025-37958} - mm: fix folio_pte_batch() on XEN PV (Petr Vanek) - x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (Dave Hansen) [Orabug: 37977013] {CVE-2025-37964} - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation (Gabriel) - staging: axis-fifo: Remove hardware resets for user errors (Gabriel) - staging: bcm2835-camera: Initialise dev in v4l2_dev (Dave Stevenson) [Orabug: 37977042] {CVE-2025-37971} - staging: iio: adc: ad7816: Correct conditional logic for store mode (Gabriel) - rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration (Miguel Ojeda) - objtool/rust: add one more noreturn Rust function for Rust 1.87.0 (Miguel Ojeda) - rust: clean Rust 1.88.0's unnecessary_transmutes lint (Miguel Ojeda) - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 (Aditya Garg) - Input: synaptics - enable SMBus for HP Elitebook 850 G1 (Dmitry Torokhov) - Input: synaptics - enable InterTouch on Dell Precision M3800 (Aditya Garg) - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G (Aditya Garg) - Input: synaptics - enable InterTouch on Dynabook Portege X30-D (Manuel Fombuena) - Input: xpad - fix two controller table values (Vicki Pfau) - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller (Lode Willems) - Input: xpad - fix Share button on Xbox One controllers (Vicki Pfau) - Input: mtk-pmic-keys - fix possible null pointer dereference (Gary Bisson) [Orabug: 37977044] {CVE-2025-37972} - Input: cyttsp5 - fix power control issue on wakeup (Mikael Gonella-Bolduc) - Input: cyttsp5 - ensure minimum reset pulse width (Hugo Villeneuve) - virtio-net: fix total qstat values (Jakub Kicinski) - net: export a helper for adding up queue stats (Jakub Kicinski) - fbnic: Do not allow mailbox to toggle to ready outside fbnic_mbx_poll_tx_ready (Alexander Duyck) - fbnic: Pull fbnic_fw_xmit_cap_msg use out of interrupt context (Alexander Duyck) - fbnic: Improve responsiveness of fbnic_mbx_poll_tx_ready (Alexander Duyck) - fbnic: Actually flush_tx instead of stalling out (Alexander Duyck) - fbnic: Gate AXI read/write enabling on FW mailbox (Alexander Duyck) - fbnic: Fix initialization of mailbox descriptor rings (Alexander Duyck) - net: dsa: b53: do not set learning and unicast/multicast on up (Jonas Gorski) - net: dsa: b53: fix learning on VLAN unaware bridges (Jonas Gorski) - net: dsa: b53: fix toggling vlan_filtering (Jonas Gorski) - net: dsa: b53: do not program vlans when vlan filtering is off (Jonas Gorski) - net: dsa: b53: do not allow to configure VLAN 0 (Jonas Gorski) - net: dsa: b53: always rejoin default untagged VLAN on bridge leave (Jonas Gorski) - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave (Jonas Gorski) - net: dsa: b53: fix flushing old pvid VLAN on pvid change (Jonas Gorski) - net: dsa: b53: fix clearing PVID of a port (Jonas Gorski) - net: dsa: b53: keep CPU port always tagged again (Jonas Gorski) - net: dsa: b53: allow leaky reserved multicast (Jonas Gorski) - bpf: Scrub packet on bpf_redirect_peer (Paul Chaignon) [Orabug: 37976990] {CVE-2025-37959} - netfilter: ipset: fix region locking in hash types (Jozsef Kadlecsik) [Orabug: 38015141] {CVE-2025-37997} - ipvs: fix uninit-value for saddr in do_output_route4 (Julian Anastasov) [Orabug: 37976996] {CVE-2025-37961} - erofs: ensure the extra temporary copy is valid for shortened bvecs (Gao Xiang) - ice: use DSN instead of PCI BDF for ice_adapter index (Przemek Kitszel) - ice: Initial support for E825C hardware in ice_adapter (Sergey Temerkhanov) - wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping (Michael-Cy Lee) - can: gw: fix RCU/BH usage in cgw_create_job() (Oliver Hartkopp) - can: mcp251xfd: fix TDC setting for low data bit rates (Kelsey Maes) - can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe (Antonios Salios) [Orabug: 38015123] {CVE-2025-37993} - net: ethernet: mtk_eth_soc: do not reset PSE when setting FE (Frank Wunderlich) - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free (Daniel Golle) - gre: Fix again IPv6 link-local address generation. (Guillaume Nault) - virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (Jakub Kicinski) [Orabug: 37976969] {CVE-2025-37955} - virtio_net: xsk: bind/unbind xsk for tx (Xuan Zhuo) - sch_htb: make htb_deactivate() idempotent (Cong Wang) [Orabug: 37977176] {CVE-2025-37953} - s390/entry: Fix last breaking event handling in case of stack corruption (Heiko Carstens) - ksmbd: fix memory leak in parse_lease_state() (Zhaolong Wang) [Orabug: 37977180] {CVE-2025-37962} - openvswitch: Fix unsafe attribute parsing in output_userspace() (Eelco Chaudron) [Orabug: 38015148] {CVE-2025-37998} - ksmbd: Fix UAF in __close_file_table_ids (Sean Heelan) [Orabug: 37976951] {CVE-2025-37952} - ksmbd: prevent out-of-bounds stream writes by validating *pos (Norbert Szetei) [Orabug: 37976923] {CVE-2025-37947} - ksmbd: prevent rename with empty string (Namjae Jeon) [Orabug: 37976972] {CVE-2025-37956} - can: rockchip_canfd: rkcanfd_remove(): fix order of unregistration calls (Marc Kleine-Budde) - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls (Marc Kleine-Budde) - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Niklas Schnelle) [Orabug: 37976920] {CVE-2025-37946} - vfio/pci: Align huge faults to order (Alex Williamson) - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation (Veerendranath Jakkam) [Orabug: 37977046] {CVE-2025-37973} - s390/pci: Fix missing check for zpci_create_device() error return (Niklas Schnelle) [Orabug: 37977050] {CVE-2025-37974} - can: mcan: m_can_class_unregister(): fix order of unregistration calls (Marc Kleine-Budde) - firmware: arm_scmi: Fix timeout checks on polling path (Cristian Marussi) - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2 (Wojciech Dubowik) - Revert 'btrfs: canonicalize the device path before adding it' (Qu Wenruo) - fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (Max Kellermann) [Orabug: 38015155] {CVE-2025-37999} - dm: add missing unlock on in dm_keyslot_evict() (Dan Carpenter) - mm/vmscan: wake up flushers conditionally to avoid cgroup OOM (Zeng Jingxiang) [Orabug: 37480932] - dmaengine: idxd: Narrow the restriction on BATCH to ver. 1 only (Vinicius Costa Gomes) [Orabug: 37801355] - uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 37810636] - fwctl: Adapt upstream code for UEK8 (Mikhael Goikhman) [Orabug: 37810636] - mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 37810636] - fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 37810636] - fwctl: Add documentation (Jason Gunthorpe) [Orabug: 37810636] - fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 37810636] - taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 37810636] - fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 37810636] - fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 37810636] - fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 37810636] - Revert 'fwctl: Add basic structure for a class subsystem with a cdev' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl: Basic ioctl dispatch for the character device' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl: FWCTL_INFO to return basic information about the device' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl/mlx5: Support for communicating with mlx5 fw' (Qing Huang) [Orabug: 37810636] - Revert 'mlx5: Create an auxiliary device for fwctl_mlx5' (Qing Huang) [Orabug: 37810636] - Revert 'taint: Add TAINT_FWCTL' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl: Adapt code for UEK-NEXT' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability' (Qing Huang) [Orabug: 37810636] - Revert 'fwctl: Allow up to 4k devices' (Qing Huang) [Orabug: 37810636] - Revert 'uek-rpm: build the fwctl mlx5 driver on UEK' (Qing Huang) [Orabug: 37810636] - dmaengine: idxd: Change err messages to dbg (Jack Vogel) [Orabug: 37841831] - PCI: Add PCI_VDEVICE_SUB helper macro (Piotr Kwapulinski) [Orabug: 37889575] - ixgbevf: Add support for Intel(R) E610 device (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Enable link management in E610 device (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Clean up the E610 link management related code (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Add support for EEPROM dump in E610 device (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Add support for NVM handling in E610 device (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Add link management support for E610 device (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Add support for E610 device capabilities detection (Piotr Kwapulinski) [Orabug: 37889575] - ixgbe: Add support for E610 FW Admin Command Interface (Piotr Kwapulinski) [Orabug: 37889575] - uek-rpm: Move the gve kernel module from extra to kernel-uek-core (Samasth Norway Ananda) [Orabug: 37940897] - uek-rpm/config-aarch64: Enable BT_HCIUART_BCM for RPi Bluetooth (Vijay Kumar) [Orabug: 37961540] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (Shravan Kumar Ramani) [Orabug: 37964051] - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (David Thompson) [Orabug: 37964051,38037120] {CVE-2025-37866} - mlxbf-bootctl: Support sysfs entries for RTC battery status (Xiangrong Li) [Orabug: 37964051] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (Ai Chao) [Orabug: 37964051] - uek-rpm: CONFIG_PTP_1588_CLOCK_OCP enable for OCI (Vijayendra Suman) [Orabug: 37966384] - x86/its: Fix build errors when CONFIG_MODULES=n (Eric Biggers) [Orabug: 37970148] - x86/its: Use dynamic thunks for indirect branches (Peter Zijlstra) [Orabug: 37970148] - x86/ibt: Keep IBT disabled during alternative patching (Pawan Gupta) [Orabug: 37970148] - RDMA/mlx5: Fix CC counters query for MPV (Patrisious Haddad) [Orabug: 37989268] - amd_hsmp: Increase the SMU timeout to 500ms (Vijay Kumar) [Orabug: 38000074]

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | kernel-uek ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-core ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-core ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-core ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-core ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-devel ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-devel ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-core ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-core ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-deprecated ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-deprecated ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-desktop ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-desktop ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-extra ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-extra ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-extra-netfilter ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-extra-netfilter ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-usb ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-usb ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-wireless ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-debug-modules-wireless ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-devel ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-devel ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-doc ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-doc ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-core ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-core ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-deprecated ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-deprecated ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-desktop ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-desktop ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-extra ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-extra ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-extra-netfilter ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-extra-netfilter ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-usb ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-usb ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-wireless ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-modules-wireless ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-tools ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek-tools ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-core ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-core ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-devel ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-devel ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-core ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-core ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-deprecated ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-deprecated ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-desktop ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-desktop ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-extra ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-extra ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-extra-netfilter ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-extra-netfilter ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-usb ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-usb ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-wireless ol 10 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |
| Linux | kernel-uek64k-modules-wireless ol 9 | 0:6.12.0-101.33.4.3.el9uek | [ELSA-2025-20480](https://patchblox.com/security/data/fix/linux/elsa-2025-20480.md) | Jul 17, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.