# changelog

author: Weilin Tong <tongweilin@linux.alibaba.com> [6.6.102-6_rc1.1.an23]
changelog:
  - ext4: get rid of ppath in convert_initialized_extent() (Baokun Li)
  - ext4: get rid of ppath in ext4_force_split_extent_at() (Baokun Li)
  - ext4: get rid of ppath in get_ext_path() (Baokun Li)


author: Tianchen Ding <dtcccc@linux.alibaba.com> [6.6.102-6_rc2.an23]
changelog:
  - anolis: arm64: mm: explicitly zero pgtable pages in split_*_mapping() paths (Kaihao Bai)
  - anolis: configs: disable Hisilicon crypto accelerator drivers on arm64 (Shuai Xue)
  - macsec: use rcu_work to defer TX SA crypto cleanup out of softirq (Jinliang Zheng)
  - macsec: use rcu_work to defer RX SA crypto cleanup out of softirq (Jinliang Zheng)
  - macsec: introduce dedicated workqueue for SA crypto cleanup (Jinliang Zheng)
  - anolis: security: lua-lsm: avoid softirq reentry during lazy kvcache init (Zongyao Chen)
  - anolis: security: lua-lsm: gate inactive cleanup after policy load (Zongyao Chen)
  - anolis: security: lua-lsm: skip inactive hook dispatch earlier (Zongyao Chen)
  - anolis: security: lua-lsm: initialize kvcache dictionaries lazily (Zongyao Chen)
  - anolis: security: lua-lsm: allocate task VM state on first use (Zongyao Chen)
  - anolis: security: lua-lsm: disable stats by default (Zongyao Chen)
  - anolis: security: lua-lsm: fix lazy VM first-use publication (Zongyao Chen)
  - anolis: security: lua-lsm: hide xfrm_state_pol_flow_match hook (Zongyao Chen)
  - anolis: security: lua-lsm: separate dispatch failures from hook results (Zongyao Chen)
  - anolis: security: lua-lsm: avoid lazy VM creation during unregister (Zongyao Chen)
  - anolis: security: lua-lsm: fail hook dispatch when lazy VM allocation fails (Zongyao Chen)
  - anolis: security: lua-lsm: build per-task Lua VM lazily on first dispatch (Zongyao Chen)
  - anolis: security: lua-lsm: skip hook dispatch when no modules are live (Zongyao Chen)
  - anolis: security: lua-lsm: drop redundant size args for file data hooks (Zongyao Chen)
  - anolis: security: lua-lsm: expose kernel file load ids to Lua hooks (Zongyao Chen)
  - anolis: security: lua-lsm: add userns support for capable hook (Zongyao Chen)
  - anolis: security: lua-lsm: reset dirty VMs on task exit (Zongyao Chen)
  - anolis: security: lua-lsm: add inode_setattr attributes (Zongyao Chen)
  - anolis: security: lua-lsm: skip empty kvcache dict free (Zongyao Chen)
  - anolis: security: lua-lsm: wait for SRCU readers before freeing module (Zongyao Chen)
  - anolis: security: lua-lsm: fix length handling for Lua string buffers (Zongyao Chen)
  - anolis: security: lua-lsm: don't store filp_open errors in file userdata (Zongyao Chen)
  - anolis: security: lua-lsm: return nil for missing wrapped objects (Zongyao Chen)
  - anolis: security: lua-lsm: validate numeric capability arguments (Zongyao Chen)
  - anolis: security: lua-lsm: put looked-up task after descendant walk (Zongyao Chen)
  - anolis: security: lua-lsm: document OCFS2 xattr name lifetime issue (Zongyao Chen)
  - anolis: security: lua-lsm: own inode_init_security xattr name storage (Zongyao Chen)
  - anolis: security: lua-lsm: validate inode_init_security xattr output (Zongyao Chen)
  - anolis: bpf, lsm: drop stale inode_xattr_skipcap BTF ID (Zongyao Chen)
  - iommu: Warn on premature unblock during DMA aliased sibling reset (Nicolin Chen)
  - iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset (Nicolin Chen)
  - iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid() (Nicolin Chen)
  - iommu: Fix nested pci_dev_reset_iommu_prepare/done() (Nicolin Chen)
  - iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done() (Nicolin Chen)
  - iommu: Replace per-group resetting_domain with per-gdev blocked flag (Nicolin Chen)
  - iommu: Fix kdocs of pci_dev_reset_iommu_done() (Nicolin Chen)
  - iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done() (Nicolin Chen)
  - anolis: sched/sli: fix block_latency and nr_uninterruptible not accounting for non-iowait D state (Qihang Zhou)
  - anolis: sched: balance cg_nr_iowait across sched_class switches (Tianchen Ding)
  - perf/x86/rapl: Fix the energy-pkg event for AMD CPUs (Dhananjay Ugwekar)
  - anolis: perf cpumap: Fix buffer overflow in cpu_map__snprint() (Tianchen Ding)
  - anolis: configs: enable CONFIG_PVPANIC_MMIO and CONFIG_PVPANIC_PCI (Tianchen Ding)
  - selftests: bpf: adjust rx_dropped xskxceiver's test to respect tailroom (Maciej Fijalkowski)
  - selftests: bpf: introduce a common routine for reading procfs (Maciej Fijalkowski)
  - anolis: Revert "virtio: break and reset virtio devices on device_shutdown()" (Jingbo Xu)
  - anolis: Revert "virtgpu: don't reset on shutdown" (Jingbo Xu)
  - anolis: Revert "anolis: drm/virtio: implement virtio_gpu_shutdown" (Jingbo Xu)
  - anolis: kabi: Do not occupy KABI reserved fields (Zelin Deng)
  - anolis: iommu: vfio: Fix incorrect symbol namespece import issue (Zelin Deng)
  - selftests: net: change shebang to bash in amt.sh (Taehee Yoo)


author: Tianchen Ding <dtcccc@linux.alibaba.com> [6.6.102-6.an23]
changelog:
  * Wed Jun 24 2026 Tianchen Ding <dtcccc@linux.alibaba.com> [6.6.102-6_rc2.2.an23]
  - anolis: crypto: ccp: fix host hang when launching QEMU after binding driver (liyabin)
  - anolis: iommu: fix iova_to_phys return none-zero after make range failed (yangdepei)
  - LoongArch: KVM: Replace eiointc_enable_irq() with eiointc_update_irq() (Bibo Mao)
  - LoongArch: KVM: Use generic function loongarch_eiointc_write() (Bibo Mao)
  - LoongArch: KVM: Use generic function loongarch_eiointc_read() (Bibo Mao)
  - LoongArch: KVM: Use standard bitops API with eiointc (Bibo Mao)
  - LoongArch: KVM: Remove never called default case statement (Bibo Mao)
  - LoongArch: KVM: Remove unused parameter len (Bibo Mao)
  - LoongArch: KVM: Remove unnecessary local variable (Bibo Mao)
  - LoongArch: KVM: Disable updating of "num_cpu" and "feature" (Bibo Mao)
  - LoongArch: KVM: Check validity of "num_cpu" from user space (Bibo Mao)
  - LoongArch: KVM: Check interrupt route from physical CPU (Bibo Mao)
  - LoongArch: KVM: Fix interrupt route update with EIOINTC (Bibo Mao)
  - LoongArch: KVM: Add address alignment check for IOCSR emulation (Bibo Mao)
  - LoongArch: KVM: Avoid overflow with array index (Bibo Mao)
  - anolis: LoongArch: KVM: sync eiointc to upstream (Xianglai Li)
  - anolis: LoongArch: KVM: Delete the kvm mmu interfaces that are no longer in use (Xianglai Li)
  - LoongArch: KVM: Fix VM migration failure with PTW enabled (Bibo Mao)
  - LoongArch: KVM: Do not flush tlb if HW PTW supported (Bibo Mao)
  - LoongArch: KVM: Skip PMU checking on vCPU context switch (Bibo Mao)
  - LoongArch: KVM: Add sign extension with kernel IOCSR read emulation (Bibo Mao)
  - LoongArch: KVM: Add sign extension with kernel MMIO read emulation (Bibo Mao)
  - irqchip/loongson-eiointc: Add multiple interrupt pin routing support (Bibo Mao)
  - irqchip/loongson-eiointc: Add virt extension support (Bibo Mao)
  - irqchip/loongson-eiointc: Route interrupt parsed from bios table (Bibo Mao)
  - LoongArch: KVM: Protect kvm_io_bus_{read,write}() with SRCU (Huacai Chen)
  - LoongArch: KVM: Move unconditional delay into timer clear scenery (Bibo Mao)
  - LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software (Bibo Mao)
  - anolis: Revert "LoongArch: Add ARCH_HAS_SET_MEMORY support" (Kanglong Wang)
  - anolis: Revert "anolis: LoongArch: Enable CONFIG_STRICT_MODULE_RWX" (Kanglong Wang)
  - module: Optimize function definition in include/linux/module.h (Christophe Leroy)
  - anolis: selftests/cgroup: Fix the time window management logic in the test_cpu_identity. (Qihang Zhou)
  - perf test: Fixes for check branch stack sampling (Ian Rogers)
  - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (Jinjie Ruan)


author: Ferry Meng <mengferry@linux.alibaba.com> [6.6.102-6.1.an23]
changelog:
  * Tue Jul 14 2026 Ferry Meng <mengferry@linux.alibaba.com> [6.6.102-6.1_rc1.an23]
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) {CVE-2026-53166}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) {CVE-2026-46242}
  - eventpoll: move epi_fget() up (Christian Brauner) {CVE-2026-46242}
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: kill __ep_remove() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: split __ep_remove() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) {CVE-2026-46242}
  - file: add fput() cleanup helper (Christian Brauner) {CVE-2026-46242}


author: Ferry Meng <mengferry@linux.alibaba.com> [6.6.102-6.2.an23]
changelog:
  * Tue Jul 21 2026 Ferry Meng <mengferry@linux.alibaba.com> [6.6.102-6.2_rc1.an23]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)


author: Weilin Tong <tongweilin@linux.alibaba.com> [6.6.102-7_rc1.an23]
changelog:
  - anolis: cmdline: enable all mTHP sized anonymous folios (Baolin Wang)
  - lib: packing: Include necessary headers (Nathan Lynch)
  - lib: packing: add pack_fields() and unpack_fields() (Vladimir Oltean)
  - hpfs: fix a crash if hpfs_map_dnode_bitmap fails (Mikulas Patocka)
  - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (Filipe Manana) {CVE-2026-53122}
  - mm/hugetlb: restore reservation on error in hugetlb folio copy paths (David Carlier)
  - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (SeongJae Park)
  - perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains (Sandipan Das)
  - perf doc: Document new IBS capabilities in man page (Ravi Bangoria)
  - perf amd ibs: Decode Streaming-store flag in IBS OP raw dump (Ravi Bangoria)
  - perf amd ibs: Decode Remote-Socket flag in IBS OP raw dump (Ravi Bangoria)
  - perf amd ibs: Make Fetch status bits dependent on PhyAddrValid for newer platforms (Ravi Bangoria)
  - perf amd ibs: Suppress bogus TlbRefillLat and DCPhysAd on Zen4+ (Ravi Bangoria)
  - perf tool ibs: Sync AMD IBS header file (Ravi Bangoria)
  - anolis: mm/lru_gen: dump generation stats on memcg OOM (Weilin Tong)
  - anolis: mm: memcg: make reclaim_wmark robust under dirty pressure (hr567)
  - anolis: configs: classify CONFIG_PERF_GUEST_MEDIATED_PMU to L1 (fuwenxin)
  - KVM: VMX: Fix a wrong MSR update in add_atomic_switch_msr() (Namhyung Kim)
  - KVM: x86/pmu: Don't try to get perf capabilities for hybrid CPUs (Dapeng Mi)
  - module: Account for the build time module name mangling (Peter Zijlstra)
  - KVM: VMX: Initialize vmcs01.VM_EXIT_MSR_STORE_ADDR with list address (Sean Christopherson)
  - KVM: VMX: Dedup code for adding MSR to VMCS's auto list (Sean Christopherson)
  - KVM: VMX: Compartmentalize adding MSRs to host vs. guest auto-load list (Sean Christopherson)
  - KVM: VMX: Set MSR index auto-load entry if and only if entry is "new" (Sean Christopherson)
  - KVM: VMX: Bug the VM if either MSR auto-load list is full (Sean Christopherson)
  - KVM: VMX: Drop unused @entry_only param from add_atomic_switch_msr() (Sean Christopherson)
  - KVM: VMX: Dedup code for removing MSR from VMCS's auto-load list (Sean Christopherson)
  - KVM: nVMX: Don't update msr_autostore count when saving TSC for vmcs12 (Sean Christopherson)
  - KVM: VMX: Drop intermediate "guest" field from msr_autostore (Sean Christopherson)
  - KVM: x86/pmu: Elide WRMSRs when loading guest PMCs if values already match (Sean Christopherson)
  - KVM: x86/pmu: Expose enable_mediated_pmu parameter to user space (Dapeng Mi)
  - KVM: nSVM: Disable PMU MSR interception as appropriate while running L2 (Sean Christopherson)
  - KVM: nVMX: Disable PMU MSR interception as appropriate while running L2 (Mingwei Zhang)
  - KVM: nVMX: Add macros to simplify nested MSR interception setting (Dapeng Mi)
  - KVM: x86/pmu: Handle emulated instruction for mediated vPMU (Dapeng Mi)
  - KVM: x86/pmu: Disallow emulation in the fastpath if mediated PMCs are active (Sean Christopherson)
  - KVM: x86/pmu: Load/put mediated PMU context when entering/exiting guest (Dapeng Mi)
  - KVM: x86/pmu: Always stuff GuestOnly=1,HostOnly=0 for mediated PMCs on AMD (Sandipan Das)
  - KVM: x86/pmu: Reprogram mediated PMU event selectors on event filter updates (Dapeng Mi)
  - KVM: x86/pmu: Introduce eventsel_hw to prepare for pmu event filtering (Mingwei Zhang)
  - KVM: x86/pmu: Bypass perf checks when emulating mediated PMU counter accesses (Dapeng Mi)
  - KVM: x86/pmu: Disable interception of select PMU MSRs for mediated vPMUs (Dapeng Mi)
  - KVM: x86/pmu: Load/save GLOBAL_CTRL via entry/exit fields for mediated PMU (Dapeng Mi)
  - KVM: x86/pmu: Disable RDPMC interception for compatible mediated vPMU (Dapeng Mi)
  - KVM: x86/pmu: Register PMI handler for mediated vPMU (Xiong Zhang)
  - KVM: x86/pmu: Implement AMD mediated PMU requirements (Sean Christopherson)
  - KVM: x86/pmu: Implement Intel mediated PMU requirements and constraints (Dapeng Mi)
  - KVM: x86/pmu: Start stubbing in mediated PMU support (Dapeng Mi)
  - KVM: Add a simplified wrapper for registering perf callbacks (Sean Christopherson)
  - perf: Use EXPORT_SYMBOL_FOR_KVM() for the mediated APIs (Peter Zijlstra)
  - perf: Clean up mediated vPMU accounting (Peter Zijlstra)
  - perf/x86/amd: Support PERF_PMU_CAP_MEDIATED_VPMU for AMD host (Sandipan Das)
  - perf/x86/intel: Support PERF_PMU_CAP_MEDIATED_VPMU (Kan Liang)
  - perf/x86/core: Plumb mediated PMU capability from x86_pmu to x86_pmu_cap (Mingwei Zhang)
  - perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
  - perf/x86/core: Add APIs to switch to/from mediated PMI vector (for KVM) (Sean Christopherson)
  - perf/x86/core: Register a new vector for handling mediated guest PMIs (Sean Christopherson)
  - perf: Add APIs to load/put guest mediated PMU context (Kan Liang)
  - perf: Add a EVENT_GUEST flag (Kan Liang)
  - perf: Clean up perf ctx time (Kan Liang)
  - perf: Add APIs to create/release mediated guest vPMUs (Kan Liang)
  - perf: Add generic exclude_guest support (Kan Liang)
  - perf: Skip pmu_ctx based on event_type (Kan Liang)
  - perf: Optimize context reschedule for single PMU cases (Peter Zijlstra)
  - x86: Restrict KVM-induced symbol exports to KVM modules where obvious/possible (Sean Christopherson)
  - KVM: Export KVM-internal symbols for sub-modules only (Sean Christopherson)
  - module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES (Vlastimil Babka)
  - module: Extend the module namespace parsing (Peter Zijlstra)
  - module: Add module specific symbol namespace support (Peter Zijlstra)
  - KVM: x86/pmu: Restrict GLOBAL_{CTRL,STATUS}, fixed PMCs, and PEBS to PMU v2+ (Sean Christopherson)
  - KVM: x86/pmu: Move initialization of valid PMCs bitmask to common x86 (Sean Christopherson)
  - KVM: x86/pmu: Use BIT_ULL() instead of open coded equivalents (Dapeng Mi)
  - KVM: x86: Use KVM_REQ_RECALC_INTERCEPTS to react to CPUID updates (Sean Christopherson)
  - KVM: VMX: Add helpers to toggle/change a bit in VMCS execution controls (Dapeng Mi)
  - KVM: x86: Rework KVM_REQ_MSR_FILTER_CHANGED into a generic RECALC_INTERCEPTS (Sean Christopherson)
  - KVM: x86/pmu: Move PMU_CAP_{FW_WRITES,LBR_FMT} into msr-index.h header (Dapeng Mi)
  - KVM: x86: Rename vmx_vmentry/vmexit_ctrl() helpers (Dapeng Mi)
  - KVM: x86/pmu: Snapshot host (i.e. perf's) reported PMU capabilities (Sean Christopherson)
  - KVM: SVM: Check pmu->version, not enable_pmu, when getting PMC MSRs (Sean Christopherson)
  - KVM: VMX: Setup canonical VMCS config prior to kvm_x86_vendor_init() (Sean Christopherson)
  - KVM: x86: Add a fastpath handler for INVD (Sean Christopherson)
  - KVM: x86: Push acquisition of SRCU in fastpath into kvm_pmu_trigger_event() (Sean Christopherson)
  - KVM: x86: Add fastpath handling of HLT VM-Exits (Sean Christopherson)
  - KVM: x86/pmu: Rename check_pmu_event_filter() to pmc_is_event_allowed() (Sean Christopherson)
  - KVM: x86/pmu: Drop redundant check on PMC being locally enabled for emulation (Sean Christopherson)
  - KVM: x86/pmu: Drop redundant check on PMC being globally enabled for emulation (Sean Christopherson)
  - KVM: x86/pmu: Open code pmc_event_is_allowed() in its callers (Sean Christopherson)
  - KVM: x86/pmu: Rename pmc_speculative_in_use() to pmc_is_locally_enabled() (Sean Christopherson)
  - KVM: x86/pmu: Calculate set of to-be-emulated PMCs at time of WRMSRs (Sean Christopherson)
  - KVM: x86/pmu: Process only enabled PMCs when emulating events in software (Sean Christopherson)
  - KVM: x86/pmu: Add macros to iterate over all PMCs given a bitmap (Sean Christopherson)
  - KVM: x86/pmu: Snapshot and clear reprogramming bitmap before reprogramming (Sean Christopherson)
  - KVM: x86/pmu: Move pmc_idx => pmc translation helper to common code (Sean Christopherson)
  - KVM: x86/pmu: Add wrappers for counting emulated instructions/branches (Sean Christopherson)
  - KVM: x86/pmu: Move kvm_init_pmu_capability() to pmu.c (Sean Christopherson)
  - KVM: x86/pmu: Introduce distinct macros for GP/fixed counter max number (Dapeng Mi)
  - KVM: x86/pmu: Get eventsel for fixed counters from perf (Sean Christopherson)
  - KVM: x86/pmu: Setup fixed counters' eventsel during PMU initialization (Sean Christopherson)
  - KVM: x86/pmu: Remove KVM's enumeration of Intel's architectural encodings (Sean Christopherson)
  - KVM: x86/pmu: Allow programming events that match unsupported arch events (Sean Christopherson)
  - KVM: x86/pmu: Always treat Fixed counters as available when supported (Sean Christopherson)
  - KVM: x86/pmu: Snapshot event selectors that KVM emulates in software (Sean Christopherson)
  - KVM: x86: Fold WRMSR fastpath helpers into the main handler (Sean Christopherson)
  - KVM: x86: Unconditionally grab data from EDX:EAX in WRMSR fastpath (Sean Christopherson)
  - KVM: x86: Acquire SRCU in WRMSR fastpath iff instruction needs to be skipped (Sean Christopherson)
  - KVM: x86: Unconditionally handle MSR_IA32_TSC_DEADLINE in fastpath exits (Sean Christopherson)
  - KVM: x86: Drop semi-arbitrary restrictions on IPI type in fastpath (Sean Christopherson)
  - KVM: x86: Only allow "fast" IPIs in fastpath WRMSR(X2APIC_ICR) handler (Sean Christopherson)
  - KVM: x86: Add kvm_icr_to_lapic_irq() helper to allow for fastpath IPIs (Sean Christopherson)
  - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (Sean Christopherson)
  - KVM: x86: Simplify userspace filter logic when disabling MSR interception (Sean Christopherson)
  - KVM: SVM: Add a helper to allocate and initialize permissions bitmaps (Sean Christopherson)
  - KVM: nSVM: Merge MSRPM in 64-bit chunks on 64-bit kernels (Sean Christopherson)
  - KVM: SVM: Return -EINVAL instead of MSR_INVALID to signal out-of-range MSR (Sean Christopherson)
  - KVM: nSVM: Access MSRPM in 4-byte chunks only for merging L0 and L1 bitmaps (Sean Christopherson)
  - KVM: SVM: Store MSRPM pointer as "void *" instead of "u32 *" (Sean Christopherson)
  - KVM: SVM: Move svm_msrpm_offset() to nested.c (Sean Christopherson)
  - KVM: SVM: Drop explicit check on MSRPM offset when emulating SEV-ES accesses (Sean Christopherson)
  - KVM: SVM: Merge "after set CPUID" intercept recalc helpers (Sean Christopherson)
  - KVM: SVM: Fold svm_vcpu_init_msrpm() into its sole caller (Sean Christopherson)
  - KVM: SVM: Rename init_vmcb_after_set_cpuid() to make it intercepts specific (Sean Christopherson)
  - KVM: x86: Rename msr_filter_changed() => recalc_msr_intercepts() (Sean Christopherson)
  - KVM: SVM: Manually recalc all MSR intercepts on userspace MSR filter change (Sean Christopherson)
  - KVM: VMX: Manually recalc all MSR intercepts on userspace MSR filter change (Sean Christopherson)
  - KVM: x86: Move definition of X2APIC_MSR() to lapic.h (Sean Christopherson)
  - KVM: SVM: Drop "always" flag from list of possible passthrough MSRs (Sean Christopherson)
  - KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest (Sean Christopherson)
  - KVM: SVM: Implement and adopt VMX style MSR intercepts APIs (Sean Christopherson)
  - KVM: x86: Move MSR_TYPE_{R,W,RW} values from VMX to x86, as enums (Sean Christopherson)
  - KVM: SVM: Add helpers for accessing MSR bitmap that don't rely on offsets (Sean Christopherson)
  - KVM: nSVM: Don't initialize vmcb02 MSRPM with vmcb01's "always passthrough" (Sean Christopherson)
  - KVM: nSVM: Omit SEV-ES specific passthrough MSRs from L0+L1 bitmap merge (Sean Christopherson)
  - KVM: nSVM: Use dedicated array of MSRPM offsets to merge L0 and L1 bitmaps (Sean Christopherson)
  - KVM: SVM: Clean up macros related to architectural MSRPM definitions (Sean Christopherson)
  - KVM: SVM: Massage name and param of helper that merges vmcb01 and vmcb12 MSRPMs (Sean Christopherson)
  - KVM: x86: Use non-atomic bit ops to manipulate "shadow" MSR intercepts (Sean Christopherson)
  - KVM: SVM: Kill the VM instead of the host if MSR interception is buggy (Sean Christopherson)
  - KVM: SVM: Use ARRAY_SIZE() to iterate over direct_access_msrs (Sean Christopherson)
  - KVM: SVM: Tag MSR bitmap initialization helpers with __init (Sean Christopherson)
  - KVM: SVM: Don't BUG if setting up the MSR intercept bitmaps fails (Sean Christopherson)
  - KVM: SVM: Allocate IOPM pages after initial setup in svm_hardware_setup() (Sean Christopherson)
  - KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest (Sean Christopherson)
  - fuse: reject fuse_notify() pagecache ops on directories (Jann Horn)
  - bcache: fix uninitialized closure object (Mingzhe Zou)
  - platform/x86: ISST: Do Not Restore SST MSRs on CPU Online Operation (Srinivas Pandruvada)
  - sched/deadline: Fix task_struct reference leak (Wander Lairson Costa) {CVE-2024-41023}
  - anolis: mm: fix the setting error of memcg min_cache_kbytes (Kaihao Bai)
  - anolis: mm: fix wrong return values of pre oom sysctl (Kaihao Bai)
  - anolis: net/smc: fix gid attribute reference leak (Wen Gu)
  - anolis: x86/rapl: fix potentially NULL pointer access in rapl_cpu_offline. (Kun(llfl))
  - anolis: dmaengine: idxd: Fix descriptor bof flag issue in dmaengine (Xiaochen Shen)
  - selftests: mm: fix conversion specifiers in transact_test() (guanjing)
  - selftests: mm: check return values (Muhammad Usama Anjum)
  - mm/selftests: fix pagemap_ioctl memory map test (Peter Xu)
  - selftests: mm: fix some build warnings (Muhammad Usama Anjum)
  - selftests: mm: skip whole test instead of failure (Muhammad Usama Anjum)
  - fs/proc/task_mmu: move mmu notification mechanism inside mm lock (Muhammad Usama Anjum)
  - mm/pagemap: fix wr-protect even if PM_SCAN_WP_MATCHING not set (Peter Xu)
  - mm/pagemap: fix ioctl(PAGEMAP_SCAN) on vma check (Peter Xu)
  - fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (Kiryl Shutsemau (Meta))
  - fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry() (Kiryl Shutsemau (Meta))
  - fs/proc/task_mmu: check p->vec_buf for NULL (Jakub Acs)
  - userfaultfd: remove UFFD_CLOEXEC, UFFD_NONBLOCK, and UFFD_FLAGS_SET (Tal Zussman)
  - userfaultfd: remove (VM_)BUG_ON()s (Tal Zussman)
  - fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (David Hildenbrand)
  - fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args() (Dan Carpenter)
  - fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry() (Ryan Roberts)
  - fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan (Ryan Roberts)
  - selftests: mm: add pagemap ioctl tests (Muhammad Usama Anjum)
  - mm/pagemap: add documentation of PAGEMAP_SCAN IOCTL (Muhammad Usama Anjum)
  - tools headers UAPI: update linux/fs.h with the kernel sources (Muhammad Usama Anjum)
  - fs/proc/task_mmu: add fast paths to get/clear PAGE_IS_WRITTEN flag (Muhammad Usama Anjum)
  - fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs (Muhammad Usama Anjum)
  - userfaultfd: UFFD_FEATURE_WP_ASYNC (Peter Xu)
  - anolis: Revert "[6.6][feature] mm/userfaultfd: add UFFD_FEATURE_WP_ASYNC" (Weisson)
  - anolis: Revert "[6.6][feature] fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs" (Weisson)
  - anolis: Revert "[6.6][feature] fs/proc/task_mmu: add fast paths to get/clear PAGE_IS_WRITTEN flag" (Weisson)
  - anolis: Revert "[6.6][feature] tools headers UAPI: update linux/fs.h with the kernel sources" (Weisson)
  - anolis: Revert "[6.6][feature] mm/pagemap: add documentation of PAGEMAP_SCAN IOCTL" (Weisson)
  - anolis: Revert "[6.6][feature] selftests: mm: add pagemap ioctl tests" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry()" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio" (Weisson)
  - anolis: Revert "[6.6][bugfix] userfaultfd: convert BUG_ONs to VM_WARN_ON_ONCEs" (Weisson)
  - anolis: Revert "[6.6][bugfix] userfaultfd: remove UFFD_CLOEXEC, UFFD_NONBLOCK, and UFFD_FLAGS_SET" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: check p->vec_buf for NULL" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()" (Weisson)
  - anolis: Revert "[6.6][bugfix] mm/pagemap: fix ioctl(PAGEMAP_SCAN) on vma check" (Weisson)
  - anolis: Revert "[6.6][bugfix] mm/pagemap: fix wr-protect even if PM_SCAN_WP_MATCHING not set" (Weisson)
  - anolis: Revert "[6.6][bugfix] fs/proc/task_mmu: move mmu notification mechanism inside mm lock" (Weisson)
  - anolis: Revert "[6.6][bugfix] selftests: mm: skip whole test instead of failure" (Weisson)
  - anolis: Revert "[6.6][bugfix] selftests: mm: fix some build warnings" (Weisson)
  - anolis: Revert "[6.6][bugfix] mm/selftests: fix pagemap_ioctl memory map test" (Weisson)
  - anolis: Revert "[6.6][bugfix] selftests: mm: check return values" (Weisson)
  - anolis: Revert "[6.6][bugfix] selftests: mm: fix conversion specifiers in transact_test()" (Weisson)
  - mm/huge_memory: update file PMD counter before folio_put() (Yin Tirui)
  - memfd: deny writeable mappings when implying SEAL_WRITE (Pratyush Yadav (Google))
  - ima: verify the previous kernel's IMA buffer lies in addressable RAM (Harshit Mogalapalli)
  - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL (Gil Portnoy)
  - mm/page_alloc: clear page->private in free_pages_prepare() (Mikhail Gavrilov) {CVE-2026-43303}
  - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (Mingyu Wang)
  - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops (Ali Ganiyev)
  - mm/hugetlb: avoid false positive lockdep assertion (Lorenzo Stoakes)
  - ext4: fix NOWAIT semantic violation in DAX extending writes (Baokun Li)
  - ext4: use kiocb_modified instead of file_modified in DIO/DAX write path (Baokun Li)
  - ext4: base unaligned DIO lock decision on partial block zeroing (Baokun Li)
  - ext4: skip overwrite check for aligned non-extending DIO writes (Baokun Li)
  - ext4: drain in-flight DIO before buffered write fallback (Baokun Li)
  - ext4: prevent sleeping allocation in NOWAIT write path (Baokun Li)
  - ext4: remove EXT4_GET_BLOCKS_IO_CREATE_EXT (Zhang Yi)
  - ext4: remove unused unwritten parameter in ext4_dio_write_iter() (Zhang Yi)
  - ext4: remove useless ext4_iomap_overwrite_ops (Zhang Yi)
  - ext4: avoid starting handle when dio writing an unwritten extent (Zhang Yi)
  - ext4: don't split extent before submitting I/O (Zhang Yi)
  - ext4: use reserved metadata blocks when splitting extent on endio (Zhang Yi)
  - x86/cpu: Enable LASS during CPU initialization (Sohil Mehta)
  - selftests/x86: Update the negative vsyscall tests to expect a #GP (Sohil Mehta)
  - x86/traps: Communicate a LASS violation in #GP message (Alexander Shishkin)
  - x86/kexec: Disable LASS during relocate kernel (Sohil Mehta)
  - x86/alternatives: Disable LASS when patching kernel code (Sohil Mehta)
  - x86: use proper 'clac' and 'stac' opcode names (Linus Torvalds)
  - x86/asm: Introduce inline memcpy and memset (Peter Zijlstra (Intel))
  - x86/cpu: Add an LASS dependency on SMAP (Sohil Mehta)
  - x86/cpufeatures: Enumerate the LASS feature bits (Sohil Mehta)
  - dm cache policy smq: check allocation under invalidate lock (Guangshuo Li)
  - cpufreq: intel_pstate: Sync policy->cur during CPU offline (Fushuai Wang)
  - anolis: x86/cpu/hygon: Adjust CPU mitigations MSR handling for newer models (zhangjun)
  - anolis: mm: vmscan: cap kswapd reclaim for high-order allocations when order-0 is balanced (Yuanhe Shu)
  - bonding: fix NULL pointer dereference in actor_port_prio setting (Hangbin Liu)
  - bonding: 3ad: implement proper RCU rules for port->aggregator (Eric Dumazet)
  - bonding: print churn state via netlink (Hangbin Liu)
  - bonding: add support for per-port LACP actor priority (Hangbin Liu)
  - net: bonding: add broadcast_neighbor option for 802.3ad (Tonghao Zhang)
  - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (Jones Syue 薛懷宗)
  - arm64: Delete macro in the ncsnp feature (lishusen)
  - MAINTAINERS: Add vfio debugfs interface doc link (Longfang Liu)
  - Documentation: add debugfs description for vfio (Longfang Liu)
  - vfio/migration: Add debugfs to live migration driver (Longfang Liu)
  - ksmbd: fix durable reconnect error path file lifetime (Junyi Liu) {CVE-2026-53010}
  - ksmbd: fix use-after-free in smb2_open during durable reconnect (Akif) {CVE-2026-53010}
  - arm64: probes: Handle probes on hinted conditional branch instructions (Vladimir Murzin)
  - f2fs: fix data loss caused by incorrect use of nat_entry flag (Yongpeng Yang) {CVE-2026-53017}
  - ARM: integrator: Fix early initialization (Guenter Roeck)
  - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (Sudeep Holla)
  - driver core: platform: use generic driver_override infrastructure (Danilo Krummrich)
  - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" (Sasha Levin)
  - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (Sayali Patil)
  - Revert "x86/vdso: Fix output operand size of RDPID" (Sasha Levin)
  - x86/xen: Fix xen_e820_swap_entry_with_ram() (Juergen Gross)
  - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (SeongJae Park)
  - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint (Xiang Mei)
  - vsock/vmci: fix UAF when peer resets connection during handshake (Minh Nguyen)
  - pds_core: ensure null-termination for firmware version strings (Nikhil P. Rao)
  - pds_core: add an error code check in pdsc_dl_info_get (Su Hui)
  - Bluetooth: btmtk: fix urb->setup_packet leak in error paths (Jiajia Liu)
  - rtnetlink: add missing netlink_ns_capable() check for peer netns (Nikolaos Gkarlis) {CVE-2026-31692}
  - ALSA: ua101: Reject too-short USB descriptors (Cássio Gabriel)
  - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS (David Gow)
  - kunit: config: Enable KUNIT_DEBUGFS by default (David Gow)
  - test_kprobes: clear kprobes between test runs (Martin Kaiser)
  - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (Jiayuan Chen)
  - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (Richard Fitzgerald)
  - LoongArch: Remove unused code to avoid build warning (Huacai Chen)
  - f2fs: avoid reading already updated pages during GC (Jianan Huang) {CVE-2026-53018}
  - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed (Bartosz Golaszewski)
  - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) (Andy Shevchenko)
  - mptcp: pm: ADD_ADDR rtx: free sk if last (Matthieu Baerts (NGI0))
  - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (Matthieu Baerts (NGI0))
  - mptcp: pm: ADD_ADDR rtx: allow ID 0 (Matthieu Baerts (NGI0))
  - wifi: mac80211: check tdls flag in ieee80211_tdls_oper (Deepanshu Kartikey)
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (Yizhou Zhao)
  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Michael Bommarito)
  - batman-adv: bla: fix report_work leak on backbone_gw purge (Sven Eckelmann)
  - tcp: Fix imbalanced icsk_accept_queue count. (Kuniyuki Iwashima)
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (Xiang Mei)
  - net: tls: prevent chain-after-chain in plain text SG (Jakub Kicinski)
  - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Jakub Kicinski)
  - net: phy: DP83TC811: add reading of abilities (Sven Schuchmann)
  - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow (Ferry Meng)
  - phy: tegra: xusb: Fix per-pad high-speed termination calibration (Wayne Chang)
  - qed: fix double free in qed_cxt_tables_alloc() (Dawei Feng)
  - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (Abdun Nihaal)
  - iommu/vt-d: Fix oops due to out of scope access (Zhenzhong Duan) {CVE-2026-52953}
  - greybus: raw: fix use-after-free if write is called after disconnect (Damien Riégel) {CVE-2026-53024}
  - wifi: ath11k: clear shared SRNG pointer state on restart (Kyle Farnung)
  - wifi: ath11k: fix memory leaks in beacon template setup (Zilin Guan) {CVE-2026-53113}
  - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (Harry Wentland)
  - scsi: isci: Fix use-after-free in device removal path (Michael Bommarito)
  - spi: ti-qspi: fix use-after-free after DMA setup failure (Johan Hovold)
  - btrfs: subpage: keep TOWRITE tag until folio is cleaned (Naohiro Aota) {CVE-2025-39779}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (Cássio Gabriel) {CVE-2026-46090}
  - driver core: generalize driver_override in struct device (Danilo Krummrich)
  - swiotlb: reduce area lock contention for non-primary IO TLB pools (Petr Tesarik)
  - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (Viacheslav Dubeyko) {CVE-2026-52961}
  - tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) {CVE-2026-43198}
  - zonefs: handle integer overflow in zonefs_fname_to_fno (Johannes Thumshirn)
  - af_unix: Give up GC if MSG_PEEK intervened. (Kuniyuki Iwashima)
  - Bluetooth: serialize accept_q access (Jiexun Wang)
  - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (Safa Karakuş)
  - netfilter: nf_queue: hold bridge skb->dev while queued (Haoze Xie)
  - ALSA: pcm: Don't setup bogus iov_iter for silencing (Takashi Iwai)
  - ALSA: asihpi: Fix potential OOB array access at reading cache (Takashi Iwai)
  - ALSA: hda: cs35l56: Put ACPI device after setting companion (Shuhao Fu)
  - ALSA: seq: Serialize UMP output teardown with event_input (Zhang Cen)
  - ALSA: seq: ump: Use guard() for locking (Takashi Iwai)
  - ring-buffer: Fix reporting of missed events in iterator (Steven Rostedt)
  - tracing: Do not call map->ops->elt_free() if elt_alloc() fails (Masami Hiramatsu (Google))
  - device property: set fwnode->secondary to NULL in fwnode_init() (Bartosz Golaszewski)
  - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (Filipe Manana)
  - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() (Jianpeng Chang)
  - tracing: Avoid NULL return from hist_field_name() on truncation (David Carlier)
  - string: add mem_is_zero() helper to check if memory area is all zeros (Jani Nikula)
  - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions (Tiezhu Yang)
  - xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang) {CVE-2026-31663}
  - xfrm: hold device only for the asynchronous decryption (Jianbo Liu) {CVE-2026-31663}
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Saeed Mahameed) {CVE-2026-22996}
  - bpf: Do not include stack ptr register in precision backtracking bookkeeping (Yonghong Song) {CVE-2025-38279}
  - bpf: Mark raw_tp arguments with PTR_MAYBE_NULL (Kumar Kartikeya Dwivedi) {CVE-2024-56702}
  - anolis: revert "perf: Skip pmu_ctx based on event_type" (fuwenxin)
  - anolis: revert "perf: Add generic exclude_guest support" (fuwenxin)
  - anolis: revert "perf: Move security_perf_event_free() call to __free_event()" (fuwenxin)
  - anolis: revert "perf: Add APIs to create/release mediated guest vPMUs" (fuwenxin)
  - anolis: revert "perf: Clean up perf ctx time" (fuwenxin)
  - anolis: revert "perf: Add a EVENT_GUEST flag" (fuwenxin)
  - anolis: revert "perf: Add APIs to load/put guest mediated PMU context" (fuwenxin)
  - anolis: revert "perf/x86/core: Register a new vector for handling mediated guest PMIs" (fuwenxin)
  - anolis: revert "perf/x86/core: Add APIs to switch to/from mediated PMI vector (for KVM)" (fuwenxin)
  - anolis: revert "perf/x86/core: Do not set bit width for unavailable counters" (fuwenxin)
  - anolis: revert "perf/x86/core: Plumb mediated PMU capability from x86_pmu to x86_pmu_cap" (fuwenxin)
  - anolis: revert "perf/x86/amd: Support PERF_PMU_CAP_MEDIATED_VPMU for AMD host" (fuwenxin)
  - anolis: revert "KVM: SVM: Implement and adopt VMX style MSR intercepts APIs" (fuwenxin)
  - anolis: revert "KVM: Add a simplified wrapper for registering perf callbacks" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Start stubbing in mediated PMU support" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Move kvm_init_pmu_capability() to pmu.c" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Implement AMD mediated PMU requirements" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Register PMI handler for mediated vPMU" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Disable RDPMC interception for compatible mediated vPMU" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Load/save GLOBAL_CTRL via entry/exit fields for mediated PMU" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Disable interception of select PMU MSRs for mediated vPMUs" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Bypass perf checks when emulating mediated PMU counter accesses" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Introduce eventsel_hw to prepare for pmu event filtering" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Reprogram mediated PMU event selectors on event filter updates" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Always stuff GuestOnly=1,HostOnly=0 for mediated PMCs on AMD" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Load/put mediated PMU context when entering/exiting guest" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Disallow emulation in the fastpath if mediated PMCs are active" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Handle emulated instruction for mediated vPMU" (fuwenxin)
  - anolis: revert "KVM: nSVM: Disable PMU MSR interception as appropriate while running L2" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Expose enable_mediated_pmu parameter to user space" (fuwenxin)
  - anolis: revert "KVM: x86/pmu: Elide WRMSRs when loading guest PMCs if values already match" (fuwenxin)
  - anolis: revert "anolis: configs: classify CONFIG_PERF_GUEST_MEDIATED_PMU to L1" (fuwenxin)
  - mptcp: sync the msk->sndbuf at accept() time (Gang Yan)
  - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Carlier)
  - Bluetooth: bnep: Fix UAF read of dev->name (Jann Horn)
  - Bluetooth: MGMT: validate Add Extended Advertising Data length (Michael Bommarito)
  - phonet/pep: disable BH around forwarded sk_receive_skb() (Zijing Yin)
  - netfilter: ip6t_hbh: reject oversized option lists (Zhengchuan Liang)
  - netfilter: ipset: stop hash:* range iteration at end (Nan Li)
  - vsock/virtio: reset connection on receiving queue overflow (Stefano Garzarella)
  - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (John Walker)
  - batman-adv: mcast: fix use-after-free in orig_node RCU release (Sven Eckelmann)
  - batman-adv: clear current gateway during teardown (Ruijie Li)
  - batman-adv: dat: handle forward allocation error (Sven Eckelmann)
  - batman-adv: fix fragment reassembly length accounting (Ruide Cao)
  - batman-adv: tp_meter: fix race condition in send error reporting (Sven Eckelmann)
  - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown (Sven Eckelmann)
  - batman-adv: tp_meter: avoid use of uninit sender vars (Sven Eckelmann)
  - batman-adv: fix tp_meter counter underflow during shutdown (Luxiao Xu)
  - batman-adv: frag: disallow unicast fragment in fragment (Sven Eckelmann)
  - batman-adv: tt: fix negative last_changeset_len (Sven Eckelmann)
  - batman-adv: tt: fix negative tt_buff_len (Sven Eckelmann)
  - netfilter: x_tables: unregister the templates first (Florian Westphal)
  - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics (Chenguang Zhao)
  - tls: Preserve sk_err across recvmsg() when data has been copied (Chuck Lever)
  - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (Xingwang Xiang)
  - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Ido Schimmel)
  - net: bridge: Flush multicast groups when snooping is disabled (Petr Machata)
  - net: gro: don't merge zcopy skbs (Sabrina Dubroca)
  - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (Michael Bommarito)
  - wifi: ath12k: Fix MSDU buffer types handling in RX error path (Sarika Sharma) {CVE-2025-68729}
  - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers (Gil Portnoy) {CVE-2026-53271}
  - anolis: arm64: sysreg: Fix invalid binary literal in ID_AA64DFR2_EL1 BWE field (Jia He)
  - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter (Fuad Tabba)
  - KVM: arm64: Finalize ID registers only once per VM (Marc Zyngier)
  - KVM: arm64: Fix error path in init_hyp_mode() (Mostafa Saleh)
  - KVM: arm64: Hide S1POE from guests when not supported by the host (Fuad Tabba)
  - KVM: arm64: Ensure TLBI uses correct VMID after changing context (Will Deacon)
  - anolis: Completely backport "KVM: arm64: Remove host FPSIMD saving for non-protected KVM" (Jia He)
  - KVM: arm64: Add predicate for FPMR support in a VM (Marc Zyngier)
  - KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (Marc Zyngier)
  - KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (Marc Zyngier)
  - KVM: arm64: Convert timer offset VA when accessed in HYP code (Marc Zyngier)
  - KVM: arm64: timer: Correctly handle EL1 timer emulation when !FEAT_ECV (Marc Zyngier)
  - KVM: arm64: Make all 32bit ID registers fully writable (Marc Zyngier)
  - KVM: arm64: Mark set_sysreg_masks() as inline to avoid build failure (Marc Zyngier)
  - KVM: arm64: nv: Return correct RES0 bits for FGT registers (Zenghui Yu (Huawei))
  - KVM: arm64: Fix handling of FEAT_GTG for unimplemented granule sizes (Marc Zyngier)
  - KVM: arm64: selftests: Cope with lack of GICv3 in set_id_regs (Oliver Upton)
  - KVM: arm64: Just advertise SEIS as 0 when emulating ICC_CTLR_EL1 (Will Deacon)
  - KVM: arm64: nv: Apply RESx settings to sysreg reset values (Marc Zyngier)
  - KVM: arm64: nv: Always evaluate HCR_EL2 using sanitising accessors (Marc Zyngier)
  - KVM: arm64: nv: Document EL2 timer API (Marc Zyngier)
  - KVM: arm64: Work around x1e's CNTVOFF_EL2 bogosity (Marc Zyngier)
  - KVM: arm64: nv: Sanitise CNTHCTL_EL2 (Marc Zyngier)
  - KVM: arm64: nv: Propagate CNTHCTL_EL2.EL1NV{P,V}CT bits (Marc Zyngier)
  - KVM: arm64: nv: Add trap routing for CNTHCTL_EL2.EL1{NVPCT,NVVCT,TVT,TVCT} (Marc Zyngier)
  - KVM: arm64: Honor trap routing for TCR2_EL1 (Marc Zyngier)
  - KVM: arm64: Handle counter access early in non-HYP context (Marc Zyngier)
  - KVM: arm64: nv: Accelerate EL0 counter accesses from hypervisor context (Marc Zyngier)
  - KVM: arm64: nv: Accelerate EL0 timer read accesses when FEAT_ECV in use (Marc Zyngier)
  - KVM: arm64: nv: Use FEAT_ECV to trap access to EL0 timers (Marc Zyngier)
  - KVM: arm64: nv: Publish emulated timer interrupt state in the in-memory state (Marc Zyngier)
  - KVM: arm64: nv: Sync nested timer state with FEAT_NV2 (Marc Zyngier)
  - KVM: arm64: nv: Add handling of EL2-specific timer registers (Marc Zyngier)
  - KVM: arm64: nv: Reprogram PMU events affected by nested transition (Oliver Upton)
  - KVM: arm64: nv: Apply EL2 event filtering when in hyp context (Oliver Upton)
  - KVM: arm64: nv: Honor MDCR_EL2.HLP (Oliver Upton)
  - KVM: arm64: nv: Honor MDCR_EL2.HPME (Oliver Upton)
  - KVM: arm64: Add helpers to determine if PMC counts at a given EL (Oliver Upton)
  - KVM: arm64: nv: Adjust range of accessible PMCs according to HPMN (Oliver Upton)
  - KVM: arm64: Rename kvm_pmu_valid_counter_mask() (Oliver Upton)
  - KVM: arm64: nv: Describe trap behaviour of MDCR_EL2.HPMN (Oliver Upton)
  - KVM: arm64: nv: Honor MDCR_EL2.{TPM, TPMCR} in Host EL0 (Oliver Upton)
  - KVM: arm64: nv: Reinject traps that take effect in Host EL0 (Oliver Upton)
  - KVM: arm64: nv: Rename BEHAVE_FORWARD_ANY (Oliver Upton)
  - KVM: arm64: Describe RES0/RES1 bits of MDCR_EL2 (Oliver Upton)
  - arm64: sysreg: Add new definitions for ID_AA64DFR0_EL1 (Oliver Upton)
  - arm64/sysreg: Update ID_AA64DFR0_EL1 register (Anshuman Khandual)
  - KVM: arm64: nv: Allow coarse-grained trap combos to use complex traps (Oliver Upton)
  - arm64: sysreg: Describe ID_AA64DFR2_EL1 fields (Oliver Upton)
  - KVM: arm64: Add selftest checking how the absence of GICv3 is handled (Marc Zyngier)
  - KVM: arm64: Unify UNDEF injection helpers (Marc Zyngier)
  - KVM: arm64: Make most GICv3 accesses UNDEF if they trap (Marc Zyngier)
  - KVM: arm64: Honor guest requested traps in GICv3 emulation (Marc Zyngier)
  - KVM: arm64: Add trap routing information for ICH_HCR_EL2 (Marc Zyngier)
  - KVM: arm64: Add ICH_HCR_EL2 to the vcpu state (Marc Zyngier)
  - KVM: arm64: Zero ID_AA64PFR0_EL1.GIC when no GICv3 is presented to the guest (Marc Zyngier)
  - KVM: arm64: Add helper for last ditch idreg adjustments (Marc Zyngier)
  - KVM: arm64: Force GICv3 trap activation when no irqchip is configured on VHE (Marc Zyngier)
  - KVM: arm64: Force SRE traps when SRE access is not enabled (Marc Zyngier)
  - KVM: arm64: Move GICv3 trap configuration to kvm_calculate_traps() (Marc Zyngier)
  - KVM: arm64: Make PAN conditions part of the S1 walk context (Marc Zyngier)
  - KVM: arm64: Get rid of HCRX_GUEST_FLAGS (Marc Zyngier)
  - KVM: arm64: Correctly honor the presence of FEAT_TCRX (Marc Zyngier)
  - KVM: arm64: Define helper for EL2 registers with custom visibility (Mark Brown)
  - KVM: arm64: Add a composite EL2 visibility helper (Marc Zyngier)
  - KVM: arm64: Implement AT S1PIE support (Marc Zyngier)
  - KVM: arm64: Disable hierarchical permissions when S1PIE is enabled (Marc Zyngier)
  - KVM: arm64: Add PIR{,E0}_EL2 to the sysreg arrays (Marc Zyngier)
  - KVM: arm64: Add TCR2_EL2 to the sysreg arrays (Marc Zyngier)
  - KVM: arm64: Extend masking facility to arbitrary registers (Marc Zyngier)
  - KVM: arm64: Split S1 permission evaluation into direct and hierarchical parts (Marc Zyngier)
  - KVM: arm64: Add AT fast-path support for S1PIE (Marc Zyngier)
  - KVM: arm64: nv: Save/Restore vEL2 sysregs (Marc Zyngier)
  - arm64: Remove VNCR definition for PIRE0_EL2 (Marc Zyngier)
  - KVM: arm64: nv: Handle CNTHCTL_EL2 specially (Marc Zyngier)
  - KVM: arm64: nv: Add missing EL2->EL1 mappings in get_el2_to_el1_mapping() (Marc Zyngier)
  - KVM: arm64: nv: Clarify safety of allowing TLBI unmaps to reschedule (Oliver Upton)
  - KVM: arm64: nv: Punt stage-2 recycling to a vCPU request (Oliver Upton)
  - KVM: arm64: nv: Do not block when unmapping stage-2 if disallowed (Oliver Upton)
  - KVM: arm64: nv: Keep reference on stage-2 MMU when scheduled out (Oliver Upton)
  - KVM: arm64: Unregister redistributor for failed vCPU creation (Oliver Upton)
  - KVM: arm64: vgic: Don't hold config_lock while unregistering redistributors (Marc Zyngier)
  - KVM: arm64: Move management of __hyp_running_vcpu to load/put on VHE (Marc Zyngier)
  - KVM: Add a flag to track if a loaded vCPU is scheduled out (Sean Christopherson)
  - KVM: arm64: vgic: Allocate private interrupts on demand (Marc Zyngier)
  - arm64: cpufeature: Handle NV_frac as a synonym of NV2 (Marc Zyngier)
  - Revert "KVM: arm64: nv: Fix RESx behaviour of disabled FGTs with negative polarity" (Oliver Upton)
  - KVM: arm64: Advertise FEAT_ECV when possible (Marc Zyngier)
  - KVM: arm64: Make ID_AA64MMFR4_EL1.NV_frac writable (Marc Zyngier)
  - KVM: arm64: Expose S1PIE to guests (Mark Brown)
  - KVM: arm64: Sanitise ID_AA64MMFR3_EL1 (Joey Gouly)
  - KVM: arm64: Allow userspace to limit NV support to nVHE (Marc Zyngier)
  - KVM: arm64: Move NV-specific capping to idreg sanitisation (Marc Zyngier)
  - KVM: arm64: Enforce NV limits on a per-idregs basis (Marc Zyngier)
  - KVM: arm64: Make ID_REG_LIMIT_FIELD_ENUM() more widely available (Marc Zyngier)
  - KVM: arm64: Consolidate idreg callbacks (Marc Zyngier)
  - KVM: arm64: Advertise NV2 in the boot messages (Marc Zyngier)
  - KVM: arm64: Rationalise KVM banner output (Marc Zyngier)
  - arm64: Fix early handling of FEAT_E2H0 not being implemented (Marc Zyngier)
  - KVM: arm64: Mark HCR.EL2.{NV*,AT} RES0 when ID_AA64MMFR4_EL1.NV_frac is 0 (Marc Zyngier)
  - KVM: arm64: Mark HCR.EL2.E2H RES0 when ID_AA64MMFR1_EL1.VH is zero (Marc Zyngier)
  - KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Marc Zyngier)
  - KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace (Shameer Kolothum)
  - KVM: arm64: nv: Unfudge ID_AA64PFR0_EL1 masking (Oliver Upton)
  - KVM: selftests: arm64: Test writes to CTR_EL0 (Sebastian Ott)
  - KVM: arm64: rename functions for invariant sys regs (Sebastian Ott)
  - KVM: arm64: show writable masks for feature registers (Sebastian Ott)
  - KVM: arm64: Treat CTR_EL0 as a VM feature ID register (Sebastian Ott)
  - KVM: arm64: unify code to prepare traps (Sebastian Ott)
  - KVM: arm64: nv: Use accessors for modifying ID registers (Oliver Upton)
  - KVM: arm64: Add helper for writing ID regs (Oliver Upton)
  - KVM: selftests: arm64: Test vCPU-scoped feature ID registers (Oliver Upton)
  - KVM: selftests: arm64: Test that feature ID regs survive a reset (Oliver Upton)
  - KVM: selftests: arm64: Store expected register value in set_id_regs (Oliver Upton)
  - KVM: selftests: arm64: Rename helper in set_id_regs to imply VM scope (Oliver Upton)
  - KVM: arm64: Only reset vCPU-scoped feature ID regs once (Oliver Upton)
  - KVM: arm64: Make idregs debugfs iterator search sysreg table directly (Oliver Upton)
  - KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() (Oliver Upton)
  - KVM: arm64: Rename is_id_reg() to imply VM scope (Oliver Upton)
  - KVM: arm64: Use read-only helper for reading VM ID registers (Oliver Upton)
  - KVM: arm64: Get sys_reg encoding from descriptor in idregs_debug_show() (Oliver Upton)
  - KVM: arm64: nv: Add additional trap setup for CPTR_EL2 (Marc Zyngier)
  - KVM: arm64: nv: Add trap description for CPTR_EL2 (Marc Zyngier)
  - KVM: arm64: nv: Add TCPAC/TTA to CPTR->CPACR conversion helper (Marc Zyngier)
  - KVM: arm64: nv: Honor guest hypervisor's FP/SVE traps in CPTR_EL2 (Oliver Upton)
  - KVM: arm64: nv: Load guest FP state for ZCR_EL2 trap (Oliver Upton)
  - KVM: arm64: nv: Handle CPACR_EL1 traps (Marc Zyngier)
  - KVM: arm64: Spin off helper for programming CPTR traps (Oliver Upton)
  - KVM: arm64: Ensure that SME controls are disabled in protected mode (Fuad Tabba)
  - KVM: arm64: Refactor CPACR trap bit setting/clearing to use ELx format (Fuad Tabba)
  - KVM: arm64: Eagerly restore host fpsimd/sve state in pKVM (Fuad Tabba)
  - KVM: arm64: Consolidate initializing the host data's fpsimd_state/sve in pKVM (Fuad Tabba)
  - KVM: arm64: Allocate memory mapped at hyp for host sve state in pKVM (Fuad Tabba)
  - KVM: arm64: Specialize handling of host fpsimd state on trap (Fuad Tabba)
  - KVM: arm64: Abstract set/clear of CPTR_EL2 bits behind helper (Fuad Tabba)
  - KVM: arm64: Fix prototype for __sve_save_state/__sve_restore_state (Fuad Tabba)
  - KVM: arm64: Reintroduce __sve_save_state (Fuad Tabba)
  - KVM: arm64: nv: Use guest hypervisor's max VL when running nested guest (Oliver Upton)
  - KVM: arm64: nv: Load guest hyp's ZCR into EL1 state (Oliver Upton)
  - KVM: arm64: Use KVM extension checks for allowed protected VM capabilities (Fuad Tabba)
  - KVM: arm64: Initialize the hypervisor's VM state at EL2 (Fuad Tabba)
  - KVM: arm64: Refactor kvm_vcpu_enable_ptrauth() for hyp use (Fuad Tabba)
  - KVM: arm64: Move pkvm_vcpu_init_traps() to init_pkvm_hyp_vcpu() (Fuad Tabba)
  - KVM: arm64: Refactor kvm_reset_cptr_el2() (Fuad Tabba)
  - KVM: arm64: nv: Handle ZCR_EL2 traps (Oliver Upton)
  - KVM: arm64: nv: Forward SVE traps to guest hypervisor (Oliver Upton)
  - KVM: arm64: nv: Forward FP/ASIMD traps to guest hypervisor (Jintack Lim)
  - KVM: arm64: Force injection of a data abort on NISV MMIO exit (Marc Zyngier)
  - KVM: arm64: Restrict supported capabilities for protected VMs (Fuad Tabba)
  - KVM: arm64: Refactor setting the return value in kvm_vm_ioctl_enable_cap() (Fuad Tabba)
  - KVM: arm64: Document the KVM/arm64-specific calls in hypercalls.rst (Will Deacon)
  - KVM: arm64: Rename firmware pseudo-register documentation file (Will Deacon)
  - KVM: arm64: Reformat/beautify PTP hypercall documentation (Will Deacon)
  - KVM: arm64: Add is_pkvm_initialized() helper (Quentin Perret)
  - KVM: arm64: Simplify vgic-v3 hypercalls (Marc Zyngier)
  - KVM: arm64: Move setting the page as dirty out of the critical section (Fuad Tabba)
  - KVM: arm64: Fix comment for __pkvm_vcpu_init_traps() (Fuad Tabba)
  - KVM: arm64: Prevent kmemleak from accessing .hyp.data (Quentin Perret)
  - KVM: arm64: Do not map the host fpsimd state to hyp in pKVM (Fuad Tabba)
  - KVM: arm64: Support TLB invalidation in guest context (Will Deacon)
  - KVM: arm64: Avoid BBM when changing only s/w bits in Stage-2 PTE (Will Deacon)
  - KVM: arm64: Check for PTE validity when checking for executable/cacheable (Marc Zyngier)
  - KVM: arm64: Avoid BUG-ing from the host abort path (Quentin Perret)
  - KVM: arm64: Issue CMOs when tearing down guest s2 pages (Quentin Perret)
  - KVM: arm64: Do not re-initialize the KVM lock (Fuad Tabba)
  - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function (Oleksij Rempel)
  - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference (Ethan Nelson-Moore)
  - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (Gabor Juhos)
  - RDMA/rtrs: Fix use-after-free in path file creation cleanup (Guangshuo Li)
  - spi: sprd: fix error pointer deref after DMA setup failure (Johan Hovold)
  - accel/qaic: Add overflow check to remap_pfn_range during mmap (Zack McKevitt)
  - net: ifb: report ethtool stats over num_tx_queues (Michael Bommarito)
  - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (Osama Abdelkader)
  - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
  - drm/v3d: Skip CSD when it has zeroed workgroups (Maíra Canal) {CVE-2026-53139}
  - drm/amd/display: Bound VBIOS record-chain walk loops (Harry Wentland) {CVE-2026-53138}
  - net: phy: clean the sfp upstream if phy probing fails (Maxime Chevallier) {CVE-2026-53232}
  - team: fix header_ops type confusion with non-Ethernet ports (Jiayuan Chen) {CVE-2026-31502}
  - nvmet-tcp: fix race between ICReq handling and queue teardown (Chaitanya Kulkarni) {CVE-2026-46135}
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Jason Gunthorpe) {CVE-2026-46181}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Stefan Metzmacher) {CVE-2025-39933}
  - s390/debug: Reject zero-length input before trimming a newline (Pengpeng Hou)
  - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (Mingyu Wang)
  - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (Jann Horn) {CVE-2026-53167}
  - fsnotify: fix inode reference leak in fsnotify_recalc_mask() (Amir Goldstein) {CVE-2026-52990}
  - fs/mbcache: cancel shrink work before destroying the cache (HyungJung Joo) {CVE-2026-53129}
  - ksmbd: fix OOB write in QUERY_INFO for compound requests (Asim Viladi Oglu Manizada) {CVE-2026-31432}
  - zram: fix use-after-free in zram_bvec_write_partial() (Cunlong Li) {CVE-2026-53185}
  - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (Sean Shen) {CVE-2026-52944}
  - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) {CVE-2026-46243}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) {CVE-2026-31419}
  - wifi: rtw89: pci: validate sequence number of TX release report (Ping-Ke Shih) {CVE-2026-43213}
  - netconsole: avoid OOB reads, msg is not nul-terminated (Jakub Kicinski) {CVE-2026-43197}
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) {CVE-2025-71273}
  - i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (Adrian Hunter) {CVE-2026-43352}
  - cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (Davidlohr Bueso) {CVE-2026-23327}
  - ksmbd: fix null pointer dereference in compare_guid_key() (Jeremy Laratro)
  - sysfs: don't remove existing directory on update failure (Greg Kroah-Hartman)
  - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (Henrique Carvalho)
  - ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz (Larysa Zaremba) {CVE-2026-23377}
  - scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) (Nitin Rawat) {CVE-2025-68236}
  - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) {CVE-2026-43319}
  - nvmet: move async event work off nvmet-wq (Chaitanya Kulkarni) {CVE-2026-31557}
  - Revert "s390/cio: Update purge function to unregister the unused subchannels" (Sasha Levin)
  - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c (Chris Lu)
  - Bluetooth: btmtk: rename btmediatek_data (Chris Lu)
  - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset (Hao Qin)
  - Bluetooth: btmtk: add the function to get the fw name (Sean Wang)
  - drm/msm/snapshot: fix dumping of the unaligned regions (Dmitry Baryshkov)
  - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 (Maulik Shah)
  - net: ag71xx: check error for platform_get_irq (Rosen Penev)
  - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (Rafael J. Wysocki)
  - net/mlx5: Do not restore destination-less TC rules (Jeroen Massar)
  - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) reject implausible blackbox record_count (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (Abdurrahman Hussain)
  - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (Sudeep Holla)
  - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (Felix Gu)
  - drm/amd/display: Validate GPIO pin LUT table size before iterating (Harry Wentland)
  - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN (Mikko Perttunen)
  - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
  - HID: uclogic: Fix regression of input name assignment (Takashi Iwai)
  - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (Michael Bommarito)
  - net: mana: validate rx_req_idx to prevent out-of-bounds array access (Aditya Garg)
  - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Erni Sri Satya Vennela)
  - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames (Daniel Golle)
  - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw (Arınç ÜNAL)
  - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (Rafael J. Wysocki)
  - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (Abdurrahman Hussain)
  - drm/bridge: megachips: remove bridge when irq request fails (Osama Abdelkader)
  - net: dsa: mt7530: fix FDB entries not aging out with short timeout (Daniel Golle)
  - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (Abdurrahman Hussain)
  - pds_core: fix debugfs_lookup dentry leak and error handling (Nikhil P. Rao)
  - wifi: ath11k: fix error path leaks in some WMI WOW calls (Nicolas Escande)
  - HID: quirks: really enable the intended work around for appledisplay (Lukas Bulwahn)
  - drm/msm/dsi: don't dump registers past the mapped region (Dmitry Baryshkov)
  - net: bcmgenet: keep RBUF EEE/PM disabled (Nicolai Buchwitz)
  - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (Abdurrahman Hussain)
  - spi: qup: fix error pointer deref after DMA setup failure (Johan Hovold)
  - net: ethernet: cortina: Carry over frag counter (Linus Walleij)
  - net: ethernet: cortina: Drop half-assembled SKB (Andreas Haarmann-Thiemann)
  - net: ethernet: cortina: Make RX SKB per-port (Linus Walleij)
  - drivers/base/memory: fix memory block reference leak in poison accounting (Muchun Song)
  - ixgbevf: fix use-after-free in VEPA multicast source pruning (Michael Bommarito)
  - Revert "ice: Remove jumbo_remove step from TX path" (Sasha Levin)
  - Revert "ice: fix double-free of tx_buf skb" (Sasha Levin)
  - efi: Allocate runtime workqueue before ACPI init (Ard Biesheuvel)
  - drm/amd/display: Fix integer overflow in bios_get_image() (Harry Wentland)
  - irqchip/ath79-cpu: Remove unused function (Rosen Penev)
  - wifi: ath11k: fix peer resolution on rx path when peer_id=0 (Matthew Leach)
  - net: lan966x: avoid unregistering netdev on register failure (Myeonghun Pak)
  - drm/virtio: use uninterruptible resv lock for plane updates (Deepanshu Kartikey)
  - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (Nicolas Escande)
  - pds_core: fix error handling in pdsc_devcmd_wait (Nikhil P. Rao)
  - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (Abdurrahman Hussain)
  - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (Abdurrahman Hussain)
  - ice: fix locking in ice_dcb_rebuild() (Bart Van Assche)
  - ice: fix setting promisc mode while adding VID filter (Marcin Szycik)
  - drm/bridge: it66121: acquire reset GPIO in probe (Julien Chauveau)
  - security/keys: fix missed RCU read section on lookup (Linus Torvalds)
  - perf/x86/intel: Update event constraints for DMR (Dapeng Mi)
  - perf/x86/intel: Update event constraints and cache_extra_regsfor SPR (Dapeng Mi)
  - perf/x86/intel: Update event constraints and cache_extra_regsfor ICX (Dapeng Mi)
  - perf/x86/intel: Extend the ref-cycles event to GP counters (Kan Liang)
  - perf/x86/intel: Consolidate MSR_IA32_PERF_CFG_C tracking (Dapeng Mi)
  - perf/x86/intel: Enable auto counter reload for DMR (Dapeng Mi)
  - perf/x86/intel: Only check GP counters for PEBS constraints validation (Dapeng Mi)
  - perf/x86/intel: Fix OMR snoop information parsing issues (Dapeng Mi)
  - perf/x86/intel: Add support for rdpmc user disable feature (Dapeng Mi)
  - perf/x86: Use macros to replace magic numbers in attr_rdpmc (Dapeng Mi)
  - perf/x86/intel: Add core PMU support for DMR (Dapeng Mi)
  - perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR (Dapeng Mi)
  - perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL (Dapeng Mi)
  - perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() (Dapeng Mi)
  - perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Dapeng Mi)
  - perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) (Dapeng Mi)
  - perf/x86/intel: Switch to new Intel CPU model defines (Tony Luck)
  - KVM: x86/pmu: Manipulate FIXED_CTR_CTRL MSR with macros (Dapeng Mi)
  - KVM: x86/pmu: Change ambiguous _mask suffix to _rsvd in kvm_pmu (Dapeng Mi)
  - KVM: x86/pmu: Add common define to capture fixed counters offset (Sean Christopherson)
  - netfs: Fix overrun check in netfs_extract_user_iter() (David Howells)
  - cifs: Fix busy dentry used after unmounting (Zhihao Cheng)
  - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() (Deepanshu Kartikey) {CVE-2026-53027}
  - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close (ChenXiaoSong)
  - ksmbd: close durable scavenger races against m_fp_list lookups (DaeMyung Kang)
  - ksmbd: validate owner of durable handle on reconnect (Namjae Jeon)
  - ksmbd: add durable scavenger timer (Namjae Jeon)
  - ksmbd: avoid reclaiming expired durable opens by the client (Namjae Jeon)
  - mm/list_lru: drain before clearing xarray entry on reparent (Shakeel Butt)
  - mm/list_lru: fix false warning of negative counter (Kairui Song)
  - mm/list_lru: simplify the list_lru walk callback function (Kairui Song)
  - mm/list_lru: split the lock to per-cgroup scope (Kairui Song)
  - mm/list_lru: simplify reparenting and initial allocation (Kairui Song)
  - mm/list_lru: code clean up for reparenting (Kairui Song)
  - mm/list_lru: don't pass unnecessary key parameters (Kairui Song)
  - mm: list_lru: fix UAF for memory cgroup (Muchun Song)
  - mm/list_lru.c: remove unused list_lru_from_kmem() (Andrew Morton)
  - list_lru: allow explicit memcg and NUMA node selection (Nhat Pham)
  - erofs: unify lcn as u64 for 32-bit platforms (Gao Xiang) {CVE-2026-53015}
  - x86/resctrl: Only check Intel systems for SNC (Tony Luck)
  - fs/resctrl: Continue counter allocation after failure (Ben Horgan)
  - fs/resctrl: Disallow the software controller when MBM counters are assignable (Ben Horgan)
  - fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed' (Ben Horgan)
  - x86,fs/resctrl: Create 'event_filter' files read only if they're not configurable (Ben Horgan)
  - fs/resctrl: Tidy up the error path in resctrl_mkdir_event_configs() (Ben Horgan)
  - fs/resctrl: Add "*" shorthand to set io_alloc CBM for all domains (Aaron Tomlin)
  - fs/resctrl: Report invalid domain ID when parsing io_alloc_cbm (Aaron Tomlin)
  - fs/resctrl: Update bit_usage to reflect io_alloc (Babu Moger)
  - fs/resctrl: Add missing return value descriptions (Reinette Chatre)
  - anolis: selinux: Donot free static data in release_secctx (Tianjia Zhang)
  - ksmbd: fix signededness bug in smb_direct_prepare_negotiation() (Nicholas Carlini) {CVE-2026-43185}
  - memcg: avoid dead loop when setting memory.max (Chen Ridong)
  - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (Petr Oros)
  - net: bcmgenet: fix leaking free_bds (Justin Chen)
  - net: bcmgenet: Initialize u64 stats seq counter (Ryo Takakura)
  - net: bcmgenet: fix racing timeout handler (Justin Chen)
  - net: bcmgenet: switch to use 64bit statistics (Zak Kemble)
  - net: bcmgenet: support reclaiming unsent Tx packets (Doug Berger)
  - net: bcmgenet: move DESC_INDEX flow to ring 0 (Doug Berger)
  - net: bcmgenet: add bcmgenet_has_* helpers (Doug Berger)
  - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (Justin Chen)
  - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (Fuad Tabba) {CVE-2026-23383}
  - iommu/vt-d: Improve IOMMU fault information (Guanghui Feng)
  - padata: Put CPU offline callback in ONLINE section to allow failure (Daniel Jordan)
  - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (Timur Kristóf)
  - arm64: cpufeature: Make PMUVer and PerfMon unsigned (James Clark)
  - arm64: kexec: Remove duplicate allocation for trans_pgd (Wang Wensheng)
  - arm64/xor: fix conflicting attributes for xor_block_template (Christoph Hellwig)
  - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace (Mike Leach)
  - perf branch: Avoid incrementing NULL (Ian Rogers)
  - perf util: Kill die() prototype, dead for a long time (Arnaldo Carvalho de Melo)
  - bpf, arm64: Fix off-by-one in check_imm signed range check (Daniel Borkmann)
  - perf arch events: Fix duplicate RISC-V SBI firmware event name (Eric Lin)
  - perf expr: Return -EINVAL for syntax error in expr__find_ids() (Leo Yan)
  - perf lock: Fix option value type in parse_max_stack (Ian Rogers)
  - firmware: dmi: Correct an indexing error in dmi.h (Mario Limonciello (AMD))
  - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n (Petr Pavlu)
  - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (Geert Uytterhoeven)
  - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller (Vladimir Zapolskiy)
  - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes (Vladimir Zapolskiy)
  - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value (Barnabás Czémán)
  - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight (Barnabás Czémán)
  - arm64: dts: qcom: sm8450: Fix GIC_ITS range length (Konrad Dybcio)
  - arm64: dts: qcom: sm8550: Fix GIC_ITS range length (Konrad Dybcio)
  - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes (Vladimir Zapolskiy)
  - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count (Akari Tsuyukusa)
  - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count (Akari Tsuyukusa)
  - arm64: dts: imx8-apalis: Fix LEDs name collision (Francesco Dolcini)
  - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) (Sherry Sun)
  - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual (Xu Yang)
  - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl (Luca Weiss)
  - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot (David Heidelberg)
  - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP (Alexander Koskovich)
  - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT (Peng Fan)
  - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number (Jun Yan)
  - Revert "net/smc: Introduce TCP ULP support" (D. Wythe) {CVE-2026-46330}
  - bpf: Fix tcx/netkit detach permissions when prog fd isn't given (Guillaume Gonnet) {CVE-2026-45932}
  - arm64/scs: Fix potential sign extension issue of advance_loc4 (Wentao Guan)
  - anolis: mm: support light compaction (负途)
  - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) {CVE-2026-43318}
  - iio: frequency: admv1013: fix NULL pointer dereference on str (Antoniu Miclaus) {CVE-2026-46282}
  - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (Aaron Sacks)
  - LoongArch: KVM: Replace eiointc_enable_irq() with eiointc_update_irq() (Bibo Mao)
  - LoongArch: KVM: Use generic function loongarch_eiointc_write() (Bibo Mao)
  - LoongArch: KVM: Use generic function loongarch_eiointc_read() (Bibo Mao)
  - LoongArch: KVM: Use standard bitops API with eiointc (Bibo Mao)
  - LoongArch: KVM: Remove never called default case statement (Bibo Mao)
  - LoongArch: KVM: Remove unused parameter len (Bibo Mao)
  - LoongArch: KVM: Remove unnecessary local variable (Bibo Mao)
  - LoongArch: KVM: Disable updating of "num_cpu" and "feature" (Bibo Mao)
  - LoongArch: KVM: Check validity of "num_cpu" from user space (Bibo Mao)
  - LoongArch: KVM: Check interrupt route from physical CPU (Bibo Mao)
  - LoongArch: KVM: Fix interrupt route update with EIOINTC (Bibo Mao)
  - LoongArch: KVM: Add address alignment check for IOCSR emulation (Bibo Mao)
  - LoongArch: KVM: Avoid overflow with array index (Bibo Mao)
  - anolis: LoongArch: KVM: sync eiointc to upstream (Xianglai Li)
  - anolis: LoongArch: KVM: Delete the kvm mmu interfaces that are no longer in use (Xianglai Li)
  - LoongArch: KVM: Fix VM migration failure with PTW enabled (Bibo Mao)
  - LoongArch: KVM: Do not flush tlb if HW PTW supported (Bibo Mao)
  - LoongArch: KVM: Skip PMU checking on vCPU context switch (Bibo Mao)
  - LoongArch: KVM: Add sign extension with kernel IOCSR read emulation (Bibo Mao)
  - LoongArch: KVM: Add sign extension with kernel MMIO read emulation (Bibo Mao)
  - irqchip/loongson-eiointc: Add multiple interrupt pin routing support (Bibo Mao)
  - irqchip/loongson-eiointc: Add virt extension support (Bibo Mao)
  - irqchip/loongson-eiointc: Route interrupt parsed from bios table (Bibo Mao)
  - LoongArch: KVM: Protect kvm_io_bus_{read,write}() with SRCU (Huacai Chen)
  - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) {CVE-2026-23191}
  - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Li Zhijian) {CVE-2026-46325}
  - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains (Val Packett)
  - clk: qcom: gcc-sc8180x: Use retention for USB power domains (Val Packett)
  - clk: qcom: gcc-sc8180x: Add missing GDSCs (Val Packett)
  - ima: check return value of crypto_shash_final() in boot aggregate (Daniel Hodges)
  - crypto: atmel - Remove cfb and ofb (Herbert Xu)
  - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs (Thorsten Blum)
  - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} (Thorsten Blum)
  - crypto: ccp - copy IV using skcipher ivsize (Paul Moses)
  - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (Yinjie Yao)
  - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (Johan Hovold)
  - anolis: configs: Set default config values for SELinux namespace (Tianjia Zhang)
  - anolis: selinux: Introduce namespace (Stephen Smalley)
  - ASoC: SOF: Intel: hda-dai: remove dspless special case (Pierre-Louis Bossart)
  - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan)
  - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio (Pierre-Louis Bossart)
  - anolis: crypto: ccp: fix host hang when launching QEMU after binding driver (liyabin)
  - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() (Michael Bommarito) {CVE-2026-31706}
  - anolis: configs: classify CONFIG_PERF_GUEST_MEDIATED_PMU to L1 (fuwenxin)
  - KVM: x86/pmu: Elide WRMSRs when loading guest PMCs if values already match (Sean Christopherson)
  - KVM: x86/pmu: Expose enable_mediated_pmu parameter to user space (Dapeng Mi)
  - KVM: nSVM: Disable PMU MSR interception as appropriate while running L2 (Sean Christopherson)
  - KVM: x86/pmu: Handle emulated instruction for mediated vPMU (Dapeng Mi)
  - KVM: x86/pmu: Disallow emulation in the fastpath if mediated PMCs are active (Sean Christopherson)
  - KVM: x86/pmu: Load/put mediated PMU context when entering/exiting guest (Dapeng Mi)
  - KVM: x86/pmu: Always stuff GuestOnly=1,HostOnly=0 for mediated PMCs on AMD (Sandipan Das)
  - KVM: x86/pmu: Reprogram mediated PMU event selectors on event filter updates (Dapeng Mi)
  - KVM: x86/pmu: Introduce eventsel_hw to prepare for pmu event filtering (Mingwei Zhang)
  - KVM: x86/pmu: Bypass perf checks when emulating mediated PMU counter accesses (Dapeng Mi)
  - KVM: x86/pmu: Disable interception of select PMU MSRs for mediated vPMUs (Dapeng Mi)
  - KVM: x86/pmu: Load/save GLOBAL_CTRL via entry/exit fields for mediated PMU (Dapeng Mi)
  - KVM: x86/pmu: Disable RDPMC interception for compatible mediated vPMU (Dapeng Mi)
  - KVM: x86/pmu: Register PMI handler for mediated vPMU (Sean Christopherson)
  - KVM: x86/pmu: Implement AMD mediated PMU requirements (Sean Christopherson)
  - KVM: x86/pmu: Move kvm_init_pmu_capability() to pmu.c (Sean Christopherson)
  - KVM: x86/pmu: Start stubbing in mediated PMU support (Sean Christopherson)
  - KVM: Add a simplified wrapper for registering perf callbacks (Sean Christopherson)
  - KVM: SVM: Implement and adopt VMX style MSR intercepts APIs (Sandipan Das)
  - perf/x86/amd: Support PERF_PMU_CAP_MEDIATED_VPMU for AMD host (Sandipan Das)
  - perf/x86/core: Plumb mediated PMU capability from x86_pmu to x86_pmu_cap (Mingwei Zhang)
  - perf/x86/core: Do not set bit width for unavailable counters (Sandipan Das)
  - perf/x86/core: Add APIs to switch to/from mediated PMI vector (for KVM) (Sean Christopherson)
  - perf/x86/core: Register a new vector for handling mediated guest PMIs (Sean Christopherson)
  - perf: Add APIs to load/put guest mediated PMU context (Kan Liang)
  - perf: Add a EVENT_GUEST flag (Kan Liang)
  - perf: Clean up perf ctx time (Kan Liang)
  - perf: Add APIs to create/release mediated guest vPMUs (Kan Liang)
  - perf: Move security_perf_event_free() call to __free_event() (Sean Christopherson)
  - perf: Add generic exclude_guest support (Kan Liang)
  - perf: Skip pmu_ctx based on event_type (Kan Liang)
  - perf test: Fixes for check branch stack sampling (Ian Rogers)
  - PCI: tegra194: Allow system suspend when the Endpoint link is not up (Vidya Sagar)
  - PCI: tegra194: Don't force the device into the D0 state before L2 (Vidya Sagar)
  - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (Manikanta Maddireddy)
  - platform/x86: dell-wmi-sysman: bound enumeration string aggregation (Pengpeng Hou)
  - netfilter: skip recording stale or retransmitted INIT (Xin Long)
  - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (Sun Jian)
  - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (Feng Yang)
  - bpf: Add CHECKSUM_COMPLETE to bpf test progs (Vadim Fedorenko)
  - s390/bpf: Zero-extend bpf prog return values and kfunc arguments (Ilya Leoshkevich)
  - tracing: Rebuild full_name on each hist_field_name() call (Pengpeng Hou)
  - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT (Puranjay Mohan)
  - hrtimer: Reduce trace noise in hrtimer_start() (Thomas Gleixner)
  - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() (Peter Zijlstra)
  - hrtimers: Update the return type of enqueue_hrtimer() (Richard Clark)
  - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (David Carlier)
  - bpf, devmap: Remove unnecessary if check in for loop (Thorsten Blum)
  - bpf: fix end-of-list detection in cgroup_storage_get_next_key() (Weiming Shi)
  - bpf: Fix stale offload->prog pointer after constant blinding (MingTao Huang)
  - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (Jiayuan Chen)
  - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (Weiming Shi)
  - bpf: Fix RCU stall in bpf_fd_array_map_clear() (Sechang Lim)
  - bpf: Fix OOB in pcpu_init_value (Lang Xu)
  - bpf: Fix NULL deref in map_kptr_match_type for scalar regs (Mykyta Yatsenko)
  - bpf: allow UTF-8 literals in bpf_bprintf_prepare() (Yihan Ding)
  - tracing: branch: Fix inverted check on stat tracer registration (Breno Leitao)
  - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path (Breno Leitao)
  - locking: Fix rwlock support in <linux/spinlock_up.h> (Bart Van Assche)
  - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure (Michal Grzedzicki)
  - cgroup/rdma: fix integer overflow in rdmacg_try_charge() (cuitao)
  - net/sched: sch_choke: annotate data-races in choke_dump_stats() (Eric Dumazet)
  - perf/x86/intel/uncore: Remove extra double quote mark (Zide Chen)
  - perf/x86/intel/uncore: Fix iounmap() leak on global_init failure (Zide Chen)
  - perf pmu: Relax uncore wildcard matching to allow numeric suffix (Zide Chen)
  - perf/x86/intel/uncore: Update DMR uncore constraints preliminarily (Zide Chen)
  - perf/x86/intel/uncore: Support uncore constraint ranges (Zide Chen)
  - perf/x86/intel/uncore: Support IIO free-running counters on DMR (Zide Chen)
  - perf/x86/intel/uncore: Add freerunning event descriptor helper macro (Zide Chen)
  - perf/x86/intel/uncore: Add domain global init callback (Zide Chen)
  - perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids (Zide Chen)
  - perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids (Zide Chen)
  - perf/x86/intel/uncore: Remove has_generic_discovery_table() (Zide Chen)
  - perf/x86/intel/uncore: Support per-platform discovery base devices (Zide Chen)
  - perf/x86/intel/uncore: Move uncore discovery init struct to header (Zide Chen)
  - perf/x86/intel/uncore: Add Panther Lake support (Kan Liang)
  - perf/x86/intel/uncore: Add Lunar Lake support (Kan Liang)
  - perf/x86/intel/uncore: Factor out common MMIO init and ops functions (Kan Liang)
  - perf/x86/intel/uncore: Switch to new Intel CPU model defines (Tony Luck)
  - anolis: Revert "LoongArch: Add ARCH_HAS_SET_MEMORY support" (Kanglong Wang)
  - anolis: Revert "anolis: LoongArch: Enable CONFIG_STRICT_MODULE_RWX" (Kanglong Wang)
  - module: Optimize function definition in include/linux/module.h (Christophe Leroy)
  - [6.6][bugfix] selftests: mm: fix conversion specifiers in transact_test() (Weisson)
  - [6.6][bugfix] selftests: mm: check return values (Weisson)
  - [6.6][bugfix] mm/selftests: fix pagemap_ioctl memory map test (Weisson)
  - [6.6][bugfix] selftests: mm: fix some build warnings (Weisson)
  - [6.6][bugfix] selftests: mm: skip whole test instead of failure (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: move mmu notification mechanism inside mm lock (Weisson)
  - [6.6][bugfix] mm/pagemap: fix wr-protect even if PM_SCAN_WP_MATCHING not set (Weisson)
  - [6.6][bugfix] mm/pagemap: fix ioctl(PAGEMAP_SCAN) on vma check (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry() (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: check p->vec_buf for NULL (Weisson)
  - [6.6][bugfix] userfaultfd: remove UFFD_CLOEXEC, UFFD_NONBLOCK, and UFFD_FLAGS_SET (Weisson)
  - [6.6][bugfix] userfaultfd: convert BUG_ONs to VM_WARN_ON_ONCEs (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args() (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: fix uffd-wp confusion in pagemap_scan_pmd_entry() (Weisson)
  - [6.6][bugfix] fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan (Weisson)
  - [6.6][feature] selftests: mm: add pagemap ioctl tests (Weisson)
  - [6.6][feature] mm/pagemap: add documentation of PAGEMAP_SCAN IOCTL (Weisson)
  - [6.6][feature] tools headers UAPI: update linux/fs.h with the kernel sources (Weisson)
  - [6.6][feature] fs/proc/task_mmu: add fast paths to get/clear PAGE_IS_WRITTEN flag (Weisson)
  - [6.6][feature] fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs (Weisson)
  - [6.6][feature] mm/userfaultfd: add UFFD_FEATURE_WP_ASYNC (Weisson)
  - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (Shengjiu Wang)
  - memory: tegra124-emc: Fix dll_change check (Mikko Perttunen)
  - clk: qcom: dispcc-sc7180: Add missing MDSS resets (Konrad Dybcio)
  - clk: visconti: pll: initialize clk_init_data to zero (Brian Masney)
  - i40e: Cleanup PTP pins on probe failure (Matt Vollrath)
  - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV (Sergio Correia)
  - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (Jiayuan Chen)
  - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (Luiz Augusto von Dentz)
  - net/sched: netem: check for negative latency and jitter (Stephen Hemminger)
  - net/sched: netem: validate slot configuration (Stephen Hemminger)
  - net/sched: netem: fix slot delay calculation overflow (Stephen Hemminger)
  - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 (Matthieu Baerts (NGI0))
  - anolis: iommu: fix iova_to_phys return none-zero after make range failed (yangdepei)
  - LoongArch: KVM: Move unconditional delay into timer clear scenery (Bibo Mao)
  - LoongArch: KVM: Fix HW timer interrupt lost when inject interrupt by software (Bibo Mao)
  - net: skbuff: preserve shared-frag marker during coalescing (William Bowling)
  - net/sched: taprio: fix NULL pointer dereference in class dump (Weiming Shi)
  - netfilter: xt_policy: fix strict mode inbound policy matching (Jiexun Wang)
  - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (Chen Ni)
  - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check (Daniel Borkmann)
  - bpf, sockmap: Take state lock for af_unix iter (Michal Luczaj)
  - bpf, sockmap: Fix af_unix iter deadlock (Michal Luczaj)
  - bpf, sockmap: Fix af_unix null-ptr-deref in proto update (Michal Luczaj)
  - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (Khairul Anuar Romli)
  - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (Yosry Ahmed) {CVE-2026-46071}
  - KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (kbackport) {CVE-2026-46059}
  - KVM: x86: Fix Xen hypercall tracepoint argument assignment (Qiang Ma)
  - dm cache metadata: fix memory leak on metadata abort retry (Ming-Hung Tsai)
  - net/rds: Restrict use of RDS/IB to the initial network namespace (Greg Jumper)
  - net/rds: Optimize rds_ib_laddr_check (Håkon Bugge)
  - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH (Cai Xinchen)
  - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (Chen-Yu Tsai)
  - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (Pei Xiao)
  - selftests/mm: skip migration tests if NUMA is unavailable (AnishMulay)
  - drm/i915: skip __i915_request_skip() for already signaled requests (Sebastian Brzezinka)
  - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (Johan Hovold)
  - drm/gma500/oaktrail_lvds: fix hang on init failure (Johan Hovold)
  - x86/mce, EDAC/mce_amd: Add new SMCA bank types (Yazen Ghannam)
  - x86/mce, EDAC/mce_amd: Update CS bank type naming (Yazen Ghannam)
  - x86/mce, EDAC/mce_amd: Reorder SMCA bank type enums (Yazen Ghannam)
  - x86/MCE/AMD: Add new MA_LLC, USR_DP, and USR_CP bank types (Muralidhara M K)
  - x86/mce/amd, EDAC/mce_amd: Move long names to decoder module (Yazen Ghannam)
  - net/mlx5e: Fix features not applied during netdev registration (Gal Pressman)
  - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (Timur Kristóf)
  - ice: fix double-free of tx_buf skb (Michal Schmidt)
  - ice: Remove jumbo_remove step from TX path (Alice Mikityanska)
  - i40e: don't advertise IFF_SUPP_NOFCS (Kohei Enju)
  - rtc: abx80x: Disable alarm feature if no interrupt attached (Anthony Pighin (Nokia))
  - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (Timur Kristóf)
  - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (Yinjie Yao)
  - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (John Madieu)
  - io-wq: check that the predecessor is hashed in io_wq_remove_pending() (Nicholas Carlini)
  - ublk: fix NULL pointer dereference in ublk_ctrl_set_size() (Mehul Rao)
  - ublk: Add UBLK_U_CMD_UPDATE_SIZE (Omri Mann)
  - net/sched: sch_pie: annotate more data-races in pie_dump_stats() (Eric Dumazet)
  - net/sched: sch_pie: annotate data-races in pie_dump_stats() (Eric Dumazet)
  - dm init: ensure device probing has finished in dm-mod.waitfor= (Guillaume Gonnet)
  - netfilter: xt_socket: enable defrag after all other checks (Florian Westphal)
  - netfilter: nft_fwd_netdev: check ttl/hl before forwarding (Florian Westphal)
  - nexthop: fix IPv6 route referencing IPv4 nexthop (Jiayuan Chen)
  - net/sched: act_ct: Only release RCU read lock after ct_ft (Jamal Hadi Salim)
  - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (Pauli Virtanen)
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (Dudu Lu)
  - sctp: fix missing encap_port propagation for GSO fragments (Xin Long)
  - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (Vinicius Costa Gomes)
  - tcp: annotate data-races around tp->plb_rehash (Eric Dumazet)
  - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) (Eric Dumazet)
  - tcp: annotate data-races around tp->dsack_dups (Eric Dumazet)
  - tcp: annotate data-races around tp->bytes_retrans (Eric Dumazet)
  - tcp: annotate data-races around tp->bytes_sent (Eric Dumazet)
  - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans (Eric Dumazet)
  - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys (Dudu Lu)
  - ipv6: fix possible UAF in icmpv6_rcv() (Eric Dumazet)
  - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Michael Bommarito)
  - openvswitch: cap upcall PID array size and pre-size vport replies (Weiming Shi)
  - netfilter: nft_osf: restrict it to ipv4 (Pablo Neira Ayuso)
  - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Xiang Mei)
  - netfilter: nf_conntrack_sip: get helper before allocating expectation (Li Xiasong)
  - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal)
  - netfilter: conntrack: remove sprintf usage (Florian Westphal)
  - netfilter: xtables: restrict several matches to inet family (Pablo Neira Ayuso)
  - ipvs: fix MTU check for GSO packets in tunnel mode (Yingnan Zhang)
  - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Fernando Fernandez Mancera)
  - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Fernando Fernandez Mancera)
  - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito)
  - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() (Eric Dumazet)
  - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() (Eric Dumazet)
  - net/sched: sch_red: annotate data-races in red_dump_stats() (Eric Dumazet)
  - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() (Eric Dumazet)
  - tipc: fix double-free in tipc_buf_append() (Lee Jones)
  - netfilter: arp_tables: fix IEEE1394 ARP payload parsing (Pablo Neira Ayuso)
  - net/sched: netem: fix probability gaps in 4-state loss model (Stephen Hemminger)
  - net/sched: netem: fix queue limit check to include reordered packets (Stephen Hemminger)
  - net/sched: netem: only reseed PRNG when seed is explicitly provided (Stephen Hemminger)
  - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() (Eric Dumazet)
  - neigh: let neigh_xmit take skb ownership (Florian Westphal)
  - neighbour: add RCU protection to neigh_tables[] (Eric Dumazet)
  - sctp: discard stale INIT after handshake completion (Xin Long)
  - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) (Eric Dumazet)
  - net: tls: fix strparser anchor skb leak on offload RX setup failure (Jakub Kicinski)
  - netfilter: nft_ct: fix missing expect put in obj eval (Li Xiasong)
  - libceph: Fix potential out-of-bounds access in osdmap_decode() (Raphael Zimmer)
  - libceph: handle rbtree insertion error in decode_choose_args() (Raphael Zimmer)
  - libceph: Fix potential null-ptr-deref in decode_choose_args() (Raphael Zimmer)
  - libceph: Fix potential out-of-bounds access in crush_decode() (Raphael Zimmer)
  - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Pablo Neira Ayuso)
  - mptcp: fix rx timestamp corruption on fastopen (Paolo Abeni)
  - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() (Paolo Abeni)
  - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker (Matthieu Baerts (NGI0))
  - mptcp: pm: ADD_ADDR rtx: fix potential data-race (Matthieu Baerts (NGI0))
  - mptcp: pm: prio: skip closed subflows (Matthieu Baerts (NGI0))
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
  - net/rds: reset op_nents when zerocopy page pin fails (Allison Henderson)
  - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (Weiming Shi)
  - ipv6: rename and move ip6_dst_lookup_tunnel() (Beniamino Galvani)
  - ipv4: add new arguments to udp_tunnel_dst_lookup() (Beniamino Galvani)
  - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() (Beniamino Galvani)
  - ipv4: rename and move ip_route_output_tunnel() (Beniamino Galvani)
  - anolis: configs: classify amd-pstate dynamic EPP and refresh platform profile (PVS.NarasimhaRao)
  - platform/x86: thinkpad_acpi: Fix registration of tpacpi platform driver (Mark Pearson)
  - cpufreq/amd-pstate-ut: Disable dynamic_epp after the mode switch (K Prateek Nayak)
  - cpufreq/amd-pstate-ut: Drop policy reference before driver switch (K Prateek Nayak)
  - cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled (K Prateek Nayak)
  - cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset (K Prateek Nayak)
  - cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified (K Prateek Nayak)
  - cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name (K Prateek Nayak)
  - cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp (K Prateek Nayak)
  - cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP (Mario Limonciello)
  - platform/x86: ideapad-laptop: pass a correct pointer to the driver data (Fedor Pchelkin)
  - ACPI: platform_profile: Fix memory leak in profile_class_is_visible() (Kurt Borja)
  - ACPI: platform_profile: Avoid initializing on non-ACPI platforms (Alexandre Ghiti)
  - platform/x86/amd: pmf: Add balanced-performance to hidden choices (Mario Limonciello)
  - platform/x86/amd: pmf: Add 'quiet' to hidden choices (Mario Limonciello)
  - ACPI: platform_profile: Add support for hidden choices (Mario Limonciello)
  - MAINTAINERS: amd-pstate: Step down as maintainer, add Prateek as reviewer (Gautham R. Shenoy)
  - cpufreq/amd-pstate-ut: Add a unit test for raw EPP (Mario Limonciello (AMD))
  - cpufreq/amd-pstate: Add support for raw EPP writes (Mario Limonciello (AMD))
  - cpufreq/amd-pstate: Add static asserts for EPP indices (Mario Limonciello (AMD))
  - cpufreq/amd-pstate: Pass the policy to amd_pstate_update() (K Prateek Nayak)
  - cpufreq: Pass the policy to cpufreq_driver->adjust_perf() (K Prateek Nayak)
  - cpufreq/amd-pstate: Add support for platform profile class (Mario Limonciello (AMD))
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files (Nathan Chancellor)
  - ACPI: platform_profile: Remove platform_profile_handler from exported symbols (Kurt Borja)
  - platform/x86: thinkpad_acpi: Use devm_platform_profile_register() (Kurt Borja)
  - platform/x86: hp-wmi: Use devm_platform_profile_register() (Kurt Borja)
  - platform/x86: ideapad-laptop: Use devm_platform_profile_register() (Kurt Borja)
  - platform/x86: asus-wmi: Use devm_platform_profile_register() (Kurt Borja)
  - platform/x86: amd: pmf: sps: Use devm_platform_profile_register() (Kurt Borja)
  - platform/surface: surface_platform_profile: Use devm_platform_profile_register() (Kurt Borja)
  - ACPI: platform_profile: Add `probe` to platform_profile_ops (Kurt Borja)
  - ACPI: platform_profile: Add `ops` member to handlers (Kurt Borja)
  - ACPI: platform_profile: Remove platform_profile_handler from callbacks (Kurt Borja)
  - ACPI: platform_profile: Let drivers set drvdata to the class device (Kurt Borja)
  - ACPI: platform_profile: Replace *class_dev member with class_dev (Kurt Borja)
  - ACPI: platform_profile: Add devm_platform_profile_register() (Kurt Borja)
  - ACPI: platform_profile: Allow multiple handlers (Mario Limonciello)
  - ACPI: platform_profile: Notify class device from platform_profile_notify() (Mario Limonciello)
  - ACPI: platform_profile: Check all profile handler to calculate next (Mario Limonciello)
  - ACPI: platform_profile: Make sure all profile handlers agree on profile (Mario Limonciello)
  - ACPI: platform_profile: Add concept of a "custom" profile (Mario Limonciello)
  - ACPI: platform_profile: Only show profiles common for all handlers (Mario Limonciello)
  - ACPI: platform_profile: Notify change events on register and unregister (Mario Limonciello)
  - ACPI: platform_profile: Add profile attribute for class interface (Mario Limonciello)
  - ACPI: platform_profile: Add choices attribute for class interface (Mario Limonciello)
  - ACPI: platform_profile: Add name attribute to class interface (Mario Limonciello)
  - ACPI: platform_profile: Create class for ACPI platform profile (Mario Limonciello)
  - anolis: Revert "ACPI: platform-profile: Fix CFI violation when accessing sysfs files" (PVS.NarasimhaRao)
  - ACPI: platform_profile: Use `scoped_cond_guard` (Mario Limonciello)
  - ACPI: platform_profile: Use guard(mutex) for register/unregister (Mario Limonciello)
  - ACPI: platform_profile: Move matching string for new profile out of mutex (Mario Limonciello)
  - ACPI: platform_profile: Move sanity check out of the mutex (Mario Limonciello)
  - ACPI: platform_profile: Pass the profile handler into platform_profile_notify() (Mario Limonciello)
  - ACPI: platform_profile: Add platform handler argument to platform_profile_remove() (Mario Limonciello)
  - ACPI: platform_profile: Add device pointer into platform profile handler (Mario Limonciello)
  - ACPI: platform-profile: Add a name member to handlers (Mario Limonciello)
  - ACPI: add missing MODULE_DESCRIPTION() macros (Jeff Johnson)
  - ACPI: platform-profile: add platform_profile_cycle() (Gergo Koteles)
  - cpufreq/amd-pstate: add kernel command line to override dynamic epp (Mario Limonciello (AMD))
  - Documentation: introduce amd-pstate preferrd core mode kernel command line options (Meng Li)
  - Documentation: amd-pstate: introduce amd-pstate preferred core (Meng Li)
  - cpufreq/amd-pstate: Add dynamic energy performance preference (Mario Limonciello (AMD))
  - cpufreq/amd-pstate: Use sysfs_match_string() for epp (Mario Limonciello (AMD))
  - Documentation: amd-pstate: fix dead links in the reference section (Ninad Naik)
  - cpufreq/amd-pstate: Cache the max frequency in cpudata (Mario Limonciello (AMD))
  - Documentation/amd-pstate: Add documentation for amd_pstate_floor_{freq,count} (Gautham R. Shenoy)
  - Documentation/amd-pstate: List amd_pstate_prefcore_ranking sysfs file (Gautham R. Shenoy)
  - Documentation/amd-pstate: List amd_pstate_hw_prefcore sysfs file (Gautham R. Shenoy)
  - amd-pstate-ut: Add a testcase to validate the visibility of driver attributes (Gautham R. Shenoy)
  - amd-pstate-ut: Add module parameter to select testcases (Gautham R. Shenoy)
  - amd-pstate: Introduce a tracepoint trace_amd_pstate_cppc_req2() (Gautham R. Shenoy)
  - amd-pstate: Add sysfs support for floor_freq and floor_count (Gautham R. Shenoy)
  - cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate (Mario Limonciello (AMD))
  - cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume (Mario Limonciello (AMD))
  - amd-pstate: Add support for CPPC_REQ2 and FLOOR_PERF (Gautham R. Shenoy)
  - bitfield: Add FIELD_MODIFY() helper (Luo Jie)
  - cpufreq: ACPI: Simplify MSR read on the boot CPU (Chang S. Bae)
  - x86/cpufeatures: Add AMD CPPC Performance Priority feature. (Gautham R. Shenoy)
  - amd-pstate: Make certain freq_attrs conditionally visible (Gautham R. Shenoy)
  - amd-pstate: Update cppc_req_cached in fast_switch case (Gautham R. Shenoy)
  - amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (Gautham R. Shenoy)
  - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (Maurizio Lombardi)
  - netfilter: bridge: make ebt_snat ARP rewrite writable (Yiming Qian)
  - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
  - params: Replace __modinit with __init_or_module (Petr Pavlu)
  - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Sebastian Andrzej Siewior)
  - powerpc/crash: fix backup region offset update to elfcorehdr (Sourabh Jain)
  - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 (Josua Mayer)
  - ASoC: sti: use managed regmap_field allocations (Sander Vanheule)
  - ASoC: sti: Return errors from regmap_field_alloc() (Sander Vanheule)
  - padata: Remove cpu online check from cpu add and removal (Chuyi Zhou)
  - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (Lei Huang)
  - ALSA: core: Validate compress device numbers without dynamic minors (Cássio Gabriel)
  - ARM: dts: mediatek: mt7623: fix efuse fallback compatible (Rafał Miłecki)
  - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX (Aaro Koskinen)
  - ASoC: SOF: Intel: hda: Place check before dereference (Ethan Tidmore)
  - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended (Frank Li)
  - ASoC: fsl_micfil: Add access property for "VAD Detected" (Shengjiu Wang)
  - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (Shengjiu Wang)
  - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (Shengjiu Wang)
  - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (Shengjiu Wang)
  - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (Shengjiu Wang)
  - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (Shengjiu Wang)
  - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (Shengjiu Wang)
  - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic (Junrui Luo)
  - ASoC: fsl_easrc: Change the type for iec958 channel status controls (Shengjiu Wang)
  - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (Shengjiu Wang)
  - powerpc/warp: Fix error handling in pika_dtm_thread (Ma Ke)
  - ASoC: qcom: qdsp6: topology: check widget type before accessing data (Srinivas Kandagatla)
  - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (Denis Rastyogin)
  - ALSA: scarlett2: Add missing sentinel initializer field (Panagiotis Petrakopoulos)
  - ASoC: SOF: compress: return the configured codec from get_params (Cássio Gabriel)
  - ALSA: sc6000: Keep the programmed board state in card-private data (Cássio Gabriel)
  - ALSA: sc6000: Use standard print API (Takashi Iwai)
  - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range (Geert Uytterhoeven)
  - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs (Val Packett)
  - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets (Konrad Dybcio)
  - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (Takashi Iwai)
  - ASoC: codecs: ab8500: Fix casting of private data (Christian A. Ehrhardt)
  - ALSA: hda/conexant: Fix missing error check for jack detection (wangdicheng)
  - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (wangdicheng)
  - ALSA: hda/conexant: fix some typos (Oldherl Oh)
  - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (Amit Machhiwal)
  - selftests/powerpc: Re-order *FLAGS to follow lib.mk (Madhavan Srinivasan)
  - audit: fix incorrect inheritable capability in CAPSET records (Sergio Correia)
  - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (Cássio Gabriel)
  - ALSA: usb-audio: Bound MIDI endpoint descriptor scans (Cássio Gabriel)
  - selftest: memcg: skip memcg_sock test if address family not supported (Waiman Long)
  - ktest: Avoid undef warning when WARNINGS_FILE is unset (Ricardo B. Marlière)
  - ktest: Run POST_KTEST hooks on failure and cancellation (Ricardo B. Marlière)
  - ktest: Honor empty per-test option overrides (Ricardo B. Marlière)
  - net: phy: move at803x PHY driver to dedicated directory (Christian Marangi)
  - net: phy: add Rust Asix PHY driver (FUJITA Tomonori)
  - net: phy: aquantia: move to separate directory (Christian Marangi)
  - pppoe: drop PFC frames (Qingfang Deng)
  - f2fs: fix to bail out in get_new_segment() (Chao Yu) {CVE-2025-38333}
  - spi: microchip-core-qspi: control built-in cs manually (Conor Dooley) {CVE-2026-46148}
  - drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range (Hersen Wu) {CVE-2024-46808}
  - iommufd: vfio compatibility extension check for noiommu mode (Jacob Pan)
  - mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (Harini T) {CVE-2025-40180}
  - drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (Ville Syrjälä) {CVE-2026-31767}
  - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (Kohei Enju) {CVE-2026-31505}
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Justin Tee) {CVE-2024-46842}
  - drbd: Balance RCU calls in drbd_adm_dump_devices() (Bart Van Assche)
  - kbuild: use $(obj)/ instead of $(src)/ for common pattern rules (Masahiro Yamada)
  - crypto: jitterentropy - replace long-held spinlock with mutex (Haixin Xu)
  - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Herbert Xu)
  - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (Yinjie Yao)
  - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet (Kevin Hao) {CVE-2026-43219}
  - drm/amd/display: Fix dc_link NULL handling in HPD init (Srinivasan Shanmugam) {CVE-2026-46245}
  - i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (kbackport) {CVE-2026-43353}
  - eth: bnxt: fix truesize for mb-xdp-pass case (Taehee Yoo) {CVE-2025-21961}
  - spi: mpc52xx: fix use-after-free on registration failure (Johan Hovold) {CVE-2026-46241}
  - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (Christian König) {CVE-2025-40289}
  - ice: fix Rx page leak on multi-buffer frames (Jacob Keller) {CVE-2025-39948}
  - wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() (Tamizh Chelvam Raja) {CVE-2025-38605}
  - soc/tegra: pmc: Fix unsafe generic_handle_irq() call (Prathamesh Shete) {CVE-2026-43311}
  - drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer (Srinivasan Shanmugam) {CVE-2024-49918}
  - iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Naval Alcalá)
  - drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection (Nicholas Kazlauskas) {CVE-2024-47662}
  - ipmi: ssif_bmc: change log level to dbg in irq callback (Jian Zhang)
  - ipmi: ssif_bmc: fix message desynchronization after truncated response (Jian Zhang)
  - tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) {CVE-2026-46320}
  - sfc: fix error code in efx_devlink_info_running_versions() (Dan Carpenter)
  - vrf: Fix a potential NPD when removing a port from a VRF (Ido Schimmel)
  - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (Frank Li)
  - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (Rafael J. Wysocki)
  - HID: asus: do not abort probe when not necessary (Denis Benato)
  - pmdomain: core: Fix detach procedure for virtual devices in genpd (Ulf Hansson)
  - spi: sifive: fix controller deregistration (Johan Hovold)
  - spi: sifive: Simplify clock handling with devm_clk_get_enabled() (Pei Xiao)
  - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (Dmitry Baryshkov)
  - soc: qcom: ocmem: register reasons for probe deferrals (Dmitry Baryshkov)
  - soc: qcom: ocmem: use scoped device node handling to simplify error paths (Krzysztof Kozlowski)
  - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (Richard Genoud)
  - memory: tegra30-emc: Fix dll_change check (Mikko Perttunen)
  - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (Dmitry Baryshkov)
  - mailbox: mailbox-test: initialize struct earlier (Wolfram Sang)
  - mailbox: mailbox-test: don't free the reused channel (Wolfram Sang)
  - mailbox: mailbox-test: free channels on probe error (Wolfram Sang)
  - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (Andy Shevchenko)
  - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk (Val Packett)
  - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (Manikanta Maddireddy)
  - PCI: tegra194: Increase LTSSM poll time on surprise link down (Manikanta Maddireddy)
  - PCI: tegra194: Fix polling delay for L2 state (Vidya Sagar)
  - PCI: Enable AtomicOps only if Root Port supports them (Gerd Bayer)
  - platform/chrome: chromeos_tbmc: Drop wakeup source on remove (Rafael J. Wysocki)
  - drm/amd/pm/ci: Fill DW8 fields from SMC (Timur Kristóf)
  - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n (Cai Xinchen)
  - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (Rafael J. Wysocki)
  - ACPI: x86: cmos_rtc: Clean up address space handler driver (Rafael J. Wysocki)
  - soc: qcom: ocmem: make the core clock optional (Dmitry Baryshkov)
  - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() (Felix Gu)
  - pinctrl: cy8c95x0: Avoid returning positive values to user space (Andy Shevchenko)
  - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() (Andy Shevchenko)
  - pinctrl: cy8c95x0: remove duplicate error message (Andy Shevchenko)
  - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (Timur Kristóf)
  - wifi: brcmfmac: Fix error pointer dereference (Ethan Tidmore)
  - drm/msm/a6xx: Fix HLSQ register dumping (Rob Clark)
  - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (Timur Kristóf)
  - ACPI: AGDI: fix missing newline in error message (Haoyu Lu)
  - drm/msm/dpu: fix mismatch between power and frequency (Yuanjie Yang)
  - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (Alexey Velichayshiy)
  - HID: usbhid: fix deadlock in hid_post_reset() (Oliver Neukum)
  - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (Gyeyoung Baek)
  - iavf: wait for PF confirmation before removing VLAN filters (Petr Oros)
  - iavf: stop removing VLAN filters from PF on interface down (Petr Oros)
  - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (Petr Oros)
  - thermal/drivers/spear: Fix error condition for reading st,thermal-flags (Gopi Krishna Menon)
  - net: phy: dp83869: fix setting CLK_O_SEL field. (Heiko Schocher)
  - fbdev: offb: fix PCI device reference leak on probe failure (Yuho Choi)
  - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) {CVE-2026-46322}
  - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (Chaitanya Kumar Borah)
  - r8152: fix incorrect register write to USB_UPHY_XTAL (Chih Kai Hsu)
  - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers (White Lewis)
  - drm/i915/wm: Verify the correct plane DDB entry (Ville Syrjälä)
  - soc/tegra: cbb: Set ERD on resume for err interrupt (Sumit Gupta)
  - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (Christian König)
  - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (Sean Wang)
  - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (Brian Masney)
  - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (Duoming Zhou)
  - quota: Fix race of dquot_scan_active() with quota deactivation (Jan Kara)
  - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() (DaeMyung Kang)
  - ocfs2: fix listxattr handling when the buffer is full (ZhengYuan Huang)
  - nvme-pci: fix missed admin queue sq doorbell write (Keith Busch)
  - f2fs: fix incorrect file address mapping when inline inode is unwritten (Yongpeng Yang)
  - ocfs2: validate group add input before caching (ZhengYuan Huang)
  - f2fs: fix false alarm of lockdep on cp_global_sem lock (Chao Yu)
  - btrfs: fix double free in create_space_info_sub_group() error path (Guangshuo Li)
  - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() (Filipe Manana)
  - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine (Joshua Klinesmith)
  - smb/client: fix possible infinite loop and oob read in symlink_data() (Ye Bin)
  - smb: client: fix OOB reads parsing symlink error response (Greg Kroah-Hartman)
  - smb: client: correctly handle ErrorContextData as a flexible array (Liang Jie)
  - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() (Deepanshu Kartikey)
  - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() (Gui-Dong Han)
  - debugfs: check for NULL pointer in debugfs_create_str() (Gui-Dong Han)
  - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() (Mark Harmstone)
  - mm: multi-gen LRU: reuse some legacy trace events (Jaewon Kim)
  - loop: fix partition scan race between udev and loop_reread_partitions() (Daan De Meyer)
  - net: phy: qcom: at803x: Use the correct bit to disable extended next page (Maxime Chevallier)
  - ACPI: thermal: Rename structure fields holding temperature in deci-Kelvin (Rafael J. Wysocki)
  - ACPI: thermal: Drop critical_valid and hot_valid trip flags (Rafael J. Wysocki)
  - ACPI: thermal: Do not use trip indices for cooling device binding (Rafael J. Wysocki)
  - thermal: core: Allow trip pointers to be used for cooling device binding (Rafael J. Wysocki)
  - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() (Daan De Meyer)
  - clk: xgene: Fix mapping leak in xgene_pllclk_init() (Geert Uytterhoeven)
  - mailbox: add sanity check for channel array (Wolfram Sang)
  - drm/v3d: Reject empty multisync extension to prevent infinite loop (Ashutosh Desai)
  - PCI: tegra194: Disable direct speed change for Endpoint mode (Vidya Sagar)
  - soc: qcom: llcc: fix v1 SB syndrome register offset (Alok Tiwari)
  - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (Harikrishna Shenoy)
  - drm/i915: Loop over all active pipes in intel_mbus_dbox_update (Stanislav Lisovskiy)
  - mtd: physmap_of_gemini: Fix disabled pinctrl state check (Chen Ni)
  - RDMA/core: Prefer NLA_NUL_STRING (Florian Westphal)
  - drm/amd/display: Allow DCE link encoder without AUX registers (Timur Kristóf)
  - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (Fedor Pchelkin)
  - e1000e: Unroll PTP in probe error handling (Matt Vollrath)
  - tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) {CVE-2026-46321}
  - gfs2: add some missing log locking (Andreas Gruenbacher)
  - gfs2: prevent NULL pointer dereference during unmount (Andreas Gruenbacher)
  - ocfs2: validate bg_bits during freefrag scan (ZhengYuan Huang)
  - fs/ntfs3: terminate the cached volume label after UTF-8 conversion (Pengpeng Hou)
  - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (Abdun Nihaal)
  - drm/sysfb: ofdrm: fix PCI device reference leaks (Yuho Choi)
  - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (Cosmin Tanislav)
  - clk: imx8mq: Correct the CSI PHY sels (Sebastian Krzyszkowiak)
  - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks (Val Packett)
  - crypto: sa2ul - Fix AEAD fallback algorithm names (T Pratham)
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros)
  - efi/capsule-loader: fix incorrect sizeof in phys array reallocation (Thomas Huth)
  - spi: fsl-qspi: Use reinit_completion() for repeated operations (Felix Gu)
  - HID: asus: make asus_resume adhere to linux kernel coding standards (Denis Benato)
  - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (Morduan Zang)
  - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (Zhan Jun)
  - clk: qoriq: avoid format string warning (Arnd Bergmann)
  - dm cache: fix dirty mapping checking in passthrough mode switching (Ming-Hung Tsai)
  - dm cache: support shrinking the origin device (Ming-Hung Tsai)
  - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open (DaeMyung Kang)
  - Documentation: fix a hugetlbfs reservation statement (Jane Chu)
  - smb: client: Use FullSessionKey for AES-256 encryption key derivation (Piyush Sachdeva)
  - KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) (Tina Zhang)
  - KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235 (Maxim Levitsky)
  - KVM: SVM: Add enable_ipiv param, never set IsRunning if disabled (Maxim Levitsky)
  - KVM: VMX: Move enable_ipiv knob to common x86 (Sean Christopherson)
  - drm/amd/display: Implement bounds check for stream encoder creation in DCN401 (Srinivasan Shanmugam) {CVE-2024-49970}
  - mailbox: mailbox-test: make data_ready a per-instance variable (Wolfram Sang)
  - scsi: sg: Resolve soft lockup issue when opening /dev/sgX (Yang Erkun)
  - scsi: sg: Fix sysctl sg-big-buff register during sg_init() (Yang Erkun)
  - scsi: sg: Make sg_sysfs_class constant (Ricardo B. Marliere)
  - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source (Dmitry Baryshkov)
  - drm/komeda: fix integer overflow in AFBC framebuffer size check (Alexander Konyukhov)
  - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (Dudu Lu)
  - wifi: mt76: mt7915: fix use_cts_prot support (Ryder Lee)
  - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (Cosmin Tanislav)
  - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (Pei Xiao)
  - slip: bound decode() reads against the compressed packet length (Weiming Shi)
  - slip: reject VJ receive packets on instances with no rstate array (Weiming Shi)
  - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Taegu Ha)
  - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (Jian Zhang)
  - ksmbd: validate response sizes in ipc_validate_msg() (Michael Bommarito)
  - ksmbd: add support for supplementary groups (Namjae Jeon)
  - dm cache: fix write path cache coherency in passthrough mode (Ming-Hung Tsai)
  - ksmbd: validate inherited ACE SID length (Shota Zaizen)
  - ksmbd: destroy async_ida in ksmbd_conn_free() (DaeMyung Kang)
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (Yinjie Yao)
  - netconsole: avoid out-of-bounds access on empty string in trim_newline() (Breno Leitao)
  - netconsole: propagate device name truncation in dev_name_store() (Breno Leitao)
  - net: netconsole: move newline trimming to function (Matthew Wood)
  - devres: fix missing node debug info in devm_krealloc() (Danilo Krummrich)
  - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() (Felix Gu)
  - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() (Gustavo Sousa)
  - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (Manikanta Maddireddy)
  - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (Timur Kristóf)
  - drm/amdgpu: fix spelling typos (Alexandre Demers)
  - spi: st-ssc4: fix controller deregistration (Johan Hovold)
  - spi: st-ssc4: switch to use modern name (Yang Yingliang)
  - crypto: qat - use swab32 macro (Giovanni Cabiddu)
  - drm/panel: simple: Correct G190EAN01 prepare timing (Sebastian Reichel)
  - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (Mashiro Chen)
  - 6pack: propagage new tty types (Jiri Slaby (SUSE))
  - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (Junrui Luo)
  - dm cache policy smq: fix missing locks in invalidating cache blocks (Ming-Hung Tsai)
  - anolis: ublk: remove segment count limit (Joseph Qi)
  - dm cache: fix missing return in invalidate_committed's error path (Ming-Hung Tsai)
  - dm cache: fix write hang in passthrough mode (Ming-Hung Tsai)
  - dm cache: fix null-deref with concurrent writes in passthrough mode (Ming-Hung Tsai)
  - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (Jackie Liu)
  - RDMA/mana: Validate rx_hash_key_len (Jason Gunthorpe)
  - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (Cole Leavitt)
  - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (Guoniu Zhou)
  - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (Jayesh Choudhary)
  - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (Alok Tiwari)
  - drm/msm/dsi: add the missing parameter description (Pengyu Luo)
  - leds: lgm-sso: Remove duplicate assignments for priv->mmap (Chen Ni)
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Gal Pressman)
  - NFC: trf7970a: Ignore antenna noise when checking for RF field (Paul Geurts)
  - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (StanleyYP Wang)
  - net: dsa: realtek: rtl8365mb: fix mode mask calculation (Mieczyslaw Nalewaj)
  - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (Alexander Koskovich)
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (Yinjie Yao)
  - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ (Luca Weiss)
  - netdevsim: zero initialize struct iphdr in dummy sk_buff (Nikola Z. Ivanov)
  - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (Duoming Zhou)
  - s390/cio: use generic driver_override infrastructure (Danilo Krummrich)
  - s390/cio: convert sprintf()/snprintf() to sysfs_emit() (Li Zhijian)
  - s390/cio: make sch->lock spinlock pointer a member (Halil Pasic)
  - platform/surface: surfacepro3_button: Drop wakeup source on remove (Rafael J. Wysocki)
  - drm/amd/display: Read EDID from VBIOS embedded panel info (Timur Kristóf)
  - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (Timur Kristóf)
  - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (Shiji Yang)
  - net: bcmgenet: Remove custom ndo_poll_controller() (Florian Fainelli)
  - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (Jason Gunthorpe)
  - pinctrl: abx500: Fix type of 'argument' variable (Yu-Chun Lin)
  - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() (Kohei Enju)
  - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (Jonathan Rissanen)
  - wifi: mt76: mt7615: fix use_cts_prot support (Ryder Lee)
  - macvlan: annotate data-races around port->bc_queue_len_used (Eric Dumazet)
  - pmdomain: ti: omap_prm: Fix a reference leak on device node (Felix Gu)
  - drm/amdgpu: Add default case in DVI mode validation (Srinivasan Shanmugam)
  - drm/sun4i: Fix resource leaks (Ethan Tidmore)
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (Yinjie Yao)
  - drm/i915: Simplify watermark state checker calling convention (Ville Syrjälä)
  - drm/i915: Constify watermark state checker (Ville Syrjälä)
  - scsi: target: core: Fix integer overflow in UNMAP bounds check (Junrui Luo)
  - drm/msm/shrinker: Fix can_block() logic (Rob Clark)
  - soc: qcom: aoss: compare against normalized cooling state (Alok Tiwari)
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (Yinjie Yao)
  - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (Yinjie Yao)
  - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (Jayesh Choudhary)
  - Revert "crypto: nx - Migrate to scomp API" (Sasha Levin)
  - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" (Sasha Levin)
  - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" (Sasha Levin)
  - drm/amdgpu/gfx10: look at the right prop for gfx queue priority (Alex Deucher)
  - PCI: tegra194: Use DWC IP core version (Manikanta Maddireddy)
  - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (Timur Kristóf)
  - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() (Felix Gu)
  - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (Yinjie Yao)
  - soundwire: cadence: Clear message complete before signaling waiting thread (Richard Fitzgerald)
  - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled (Zoran Ilievski)
  - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (Zilin Guan)
  - PCMCIA: Fix garbled log messages for KERN_CONT (René Rebe)
  - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls (Alexey Kodanev)
  - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (Haibo Chen)
  - net/sched: cls_flower: revert unintended changes (Paolo Abeni)
  - net: mctp i2c: check length before marking flow active (William A. Kennington III)
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t (Alex Hung) {CVE-2024-47661}
  - pinctrl: pinctrl-pic32: Fix resource leak (Ethan Tidmore)
  - drm/msm/a6xx: Use barriers while updating HFI Q headers (Akhil P Oommen)
  - drm/sun4i: backend: fix error pointer dereference (Ethan Tidmore)
  - tty: hvc_iucv: fix off-by-one in number of supported devices (Randy Dunlap)
  - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" (Vidya Sagar)
  - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG (Luca Weiss)
  - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation (Jonas Gorski)
  - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook (Takahiro Kuwano)
  - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook (Takahiro Kuwano)
  - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (Billy Tsai)
  - tools headers: Update the x86 headers with the kernel sources (Namhyung Kim)
  - crypto: ccp - narrow scope of snp_range_list (Tycho Andersen (AMD))
  - crypto: ccp: Make snp_range_list static (Borislav Petkov (AMD))
  - KVM: SVM: Drop the module param to control SEV-ES DebugSwap (Sean Christopherson)
  - KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (Yan Zhao)
  - KVM: SEV: Enforce minimum GHCB version requirement for SEV-SNP guests (Nikunj A Dadhania)
  - KVM: SEV: Drop GHCB_VERSION_DEFAULT and open code it (Nikunj A Dadhania)
  - KVM: selftests: Add SEV-ES shutdown test (Peter Gonda)
  - KVM: selftests: Explicitly close guest_memfd files in some gmem tests (Dongli Zhang)
  - anolis: bugfix: skip flushing .bss..decrypted section for SNP guest (PVS.NarasimhaRao)
  - KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (Sean Christopherson)
  - KVM: Add member to struct kvm_gfn_range to indicate private/shared (Isaku Yamahata)
  - KVM: SVM: Fix SNP AP destroy race with VMRUN (Tom Lendacky)
  - KVM: SVM: Simplify request+kick logic in SNP AP Creation handling (Sean Christopherson)
  - crypto: ccp - Fix locking on alloc failure handling (Alexey Kardashevskiy)
  - KVM: SVM: Add missing member in SNP_LAUNCH_START command structure (Nikunj A Dadhania)
  - KVM: Allow CPU to reschedule while setting per-page memory attributes (Liam Merwick)
  - KVM: x86/mmu: Check and free obsolete roots in kvm_mmu_reload() (Yan Zhao)
  - KVM: x86: Check that the high 32bits are clear in kvm_arch_vcpu_ioctl_run() (Dan Carpenter)
  - crypto: ccp - Fix uAPI definitions of PSP errors (Dionna Glaze)
  - KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected (Paolo Bonzini)
  - KVM: selftests: Fix printf() format goof in SEV smoke test (Sean Christopherson)
  - KVM: SVM: Require AP's "requested" SEV_FEATURES to match KVM's view (Sean Christopherson)
  - KVM: SVM: Don't change target vCPU state on AP Creation VMGEXIT error (Sean Christopherson)
  - KVM: SVM: Refuse to attempt VRMUN if an SEV-ES+ guest has an invalid VMSA (Sean Christopherson)
  - KVM: x86: Exit to userspace if fastpath triggers one on instruction skip (Sean Christopherson)
  - KVM: x86: Dedup fastpath MSR post-handling logic (Sean Christopherson)
  - KVM: x86: Re-enter guest if WRMSR(X2APIC_ICR) fastpath is successful (Sean Christopherson)
  - KVM: SVM: Save host DR masks on CPUs with DebugSwap (Sean Christopherson)
  - KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (Nikunj A Dadhania)
  - KVM: SVM: Macrofy SEV=n versions of sev_xxx_guest() (Sean Christopherson)
  - x86/kexec: Export e820_table_kexec[] to sysfs (Dave Young)
  - x86/sev: Fix broken SNP support with KVM module built-in (Ashish Kalra)
  - x86/sev: Add full support for a segmented RMP table (Tom Lendacky)
  - x86/sev: Treat the contiguous RMP table as a single RMP segment (Tom Lendacky)
  - x86/sev: Map only the RMP table entries instead of the full RMP range (Tom Lendacky)
  - x86/sev: Move the SNP probe routine out of the way (Tom Lendacky)
  - x86/sev: Add support for the RMPREAD instruction (Tom Lendacky)
  - x86/sev: Prepare for using the RMPREAD instruction to access the RMP (Tom Lendacky)
  - iommu/amd: Do not enable SNP when V2 page table is enabled (Vasant Hegde)
  - KVM: SVM: Disable AVIC on SNP-enabled system without HvInUseWrAllowed feature (Suravee Suthikulpanit)
  - kvm: svm: Fix gctx page leak on invalid inputs (Dionna Glaze)
  - KVM: SVM: Propagate error from snp_guest_req_init() to userspace (Sean Christopherson)
  - KVM: selftests: fix unintentional noop test in guest_memfd_test.c (Patrick Roy)
  - Documentation: Improve crash_kexec_post_notifiers description (Guilherme G. Piccoli)
  - x86/sev: Ensure that RMP table fixups are reserved (Ashish Kalra)
  - KVM: x86: don't fall through case statements without annotations (Linus Torvalds)
  - crypto: ccp - do not request interrupt on cmd completion when irqs disabled (Amit Shah)
  - KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM (Tom Dohrmann)
  - KVM: SEV: Update KVM_AMD_SEV Kconfig entry and mention SEV-SNP (Vitaly Kuznetsov)
  - KVM: x86/mmu: Check that root is valid/loaded when pre-faulting SPTEs (Sean Christopherson)
  - KVM: x86: Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX) (Sean Christopherson)
  - KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with KVM_MEM_READONLY (Sean Christopherson)
  - KVM: x86: hyper-v: Remove unused inline function kvm_hv_free_pa_page() (Yue Haibing)
  - KVM: SVM: Fix an error code in sev_gmem_post_populate() (Dan Carpenter)
  - KVM: SVM: Fix uninitialized variable bug (Dan Carpenter)
  - KVM: x86/mmu: fix determination of max NPT mapping level for private pages (Ackerley Tng)
  - KVM: guest_memfd: abstract how prepared folios are recorded (Paolo Bonzini)
  - KVM: guest_memfd: let kvm_gmem_populate() operate only on private gfns (Paolo Bonzini)
  - KVM: extend kvm_range_has_memory_attributes() to check subset of attributes (Paolo Bonzini)
  - KVM: cleanup and add shortcuts to kvm_range_has_memory_attributes() (Paolo Bonzini)
  - KVM: guest_memfd: move check for already-populated page to common code (Paolo Bonzini)
  - KVM: remove kvm_arch_gmem_prepare_needed() (Paolo Bonzini)
  - KVM: guest_memfd: make kvm_gmem_prepare_folio() operate on a single struct kvm (Paolo Bonzini)
  - pstore/ram: fix resource leak when ioremap() fails (Cole Leavitt)
  - btrfs: fix missing last_unlink_trans update when removing a directory (Filipe Manana)
  - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() (Filipe Manana)
  - btrfs: use inode already stored in local variable at btrfs_rmdir() (Filipe Manana)
  - ntfs: ->d_compare() must not block (Al Viro)
  - netfs: Fix potential uninitialised var in netfs_extract_user_iter() (David Howells)
  - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() (Thorsten Blum)
  - eventfs: Use list_add_tail_rcu() for SRCU-protected children list (David Carlier)
  - dm log: fix out-of-bounds write due to region_count overflow (Junrui Luo)
  - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() (Yongpeng Yang)
  - f2fs: Use sysfs_emit_at() to simplify code (Christophe JAILLET)
  - dm cache: fix concurrent write failure in passthrough mode (Ming-Hung Tsai)
  - netfs: fix error handling in netfs_extract_user_iter() (Paulo Alcantara)
  - ocfs2/dlm: validate qr_numregions in dlm_match_regions() (Junrui Luo)
  - fs/adfs: validate nzones in adfs_validate_bblk() (Bae Yeonju)
  - ksmbd: scope conn->binding slowpath to bound sessions only (Hyunwoo Kim)
  - blk-cgroup: wait for blkcg cleanup before initializing new disk (Ming Lei)
  - ceph: fix a buffer leak in __ceph_setxattr() (Viacheslav Dubeyko)
  - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() (Andy Shevchenko)
  - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher)
  - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START (HyungJung Joo)
  - anolis: iommu: Should drop ictx reference if cannot finish (Zelin Deng)
  - anolis: tools: selftests: Adapt iommu liveupdate test to do retrieve (Zelin Deng)
  - anolis: tools: selftests: Adapt vfio pci liveupdate test for iommufd preserved (Zelin Deng)
  - vfio: selftests: Add support of creating iommus from iommufd (Samiullah Khawaja)
  - iommu: Allow replacing restored domain (Samiullah Khawaja)
  - iommu: Transfer device ownership after liveupdate (Samiullah Khawaja)
  - iommufd: Implement iommufd liveupdate finish logic (Samiullah Khawaja)
  - iommufd-lu: Add ioctl to let userspace restore an HWPT (Samiullah Khawaja)
  - iommufd: Implement basic prepare/cancel/finish/retrieve using folios (YiFei Zhu)
  - iommu: Add API to keep track of iommu domain attachments (Samiullah Khawaja)
  - iommufd: split alloc and domain assign from iommufd_hwpt_paging_alloc (YiFei Zhu)
  - iommufd: Allow HWPTs to have a NULL IOAS (YiFei Zhu)
  - riscv: add hardware error trap handler support (Lu Peng)
  - net: mctp: ensure our nlmsg responses are initialised (Jeremy Kerr) {CVE-2026-45930}
  - netfilter: nft_counter: serialize reset with spinlock (Brian Witte) {CVE-2026-45897}
  - ipvs: skip ipv6 extension headers for csum checks (Julian Anastasov) {CVE-2026-45850}
  - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc (Kumar Kartikeya Dwivedi)
  - bpf: handle fake register spill to stack with BPF_ST_MEM instruction (Andrii Nakryiko)
  - bpf: track aligned STACK_ZERO cases as imprecise spilled registers (Andrii Nakryiko)
  - bpf: preserve constant zero when doing partial register restore (Andrii Nakryiko)
  - bpf: preserve STACK_ZERO slots on partial reg spills (Andrii Nakryiko)
  - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (David Carlier)
  - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o (Sourabh Jain)
  - selftests/bpf: validate fake register spill/fill precision backtracking logic (Andrii Nakryiko)
  - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam)
  - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam)
  - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam)
  - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam)
  - KVM: arm64: Wake-up from WFI when iqrchip is in userspace (Marc Zyngier)
  - bpf: support non-r10 register spill/fill to/from stack in precision tracking (Andrii Nakryiko)
  - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros (Andrii Nakryiko)
  - selftests/bpf: validate zero preservation for sub-slot loads (Andrii Nakryiko)
  - net/smc: avoid early lgr access in smc_clc_wait_msg (Ruijie Li)
  - crypto: caam - guard HMAC key hex dumps in hash_digest_key (Thorsten Blum)
  - batman-adv: fix integer overflow on buff_pos (Lyes Bourennani)
  - x86/shstk: Prevent deadlock during shstk sigreturn (Rick Edgecombe)
  - x86: shadow stacks: proper error handling for mmap lock (Linus Torvalds)
  - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() (Anshuman Khandual)
  - sched: Use u64 for bandwidth ratio calculations (Joseph Salisbury)
  - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup (Huacai Chen)
  - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values (SeongJae Park)
  - anolis: arm64: mm: explicitly zero pgtable pages in split_*_mapping() paths (Kaihao Bai)
  - anolis: configs: disable Hisilicon crypto accelerator drivers on arm64 (Shuai Xue)
  - [6.6][bugfix] KVM: arm64: Fix hisi_virt.o compilation dependency (zhangxinghao)
  - macsec: use rcu_work to defer TX SA crypto cleanup out of softirq (Jinliang Zheng)
  - macsec: use rcu_work to defer RX SA crypto cleanup out of softirq (Jinliang Zheng)
  - macsec: introduce dedicated workqueue for SA crypto cleanup (Jinliang Zheng)
  - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values (SeongJae Park)
  - mm/damon/core: implement damon_kdamond_pid() (SeongJae Park)
  - mm/hugetlb_cma: round up per_node before logging it (Sang-Heon Jeon)
  - mm/damon/core: disallow time-quota setting zero esz (SeongJae Park)
  - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (SeongJae Park)
  - mm/damon/core: use time_in_range_open() for damos quota window start (SeongJae Park)
  - anolis: configs: enable CONFIG_PVPANIC_MMIO and CONFIG_PVPANIC_PCI (Tianchen Ding)
  - dmaengine: idxd: Add Max SGL Size Support for DSA3.0 (Yi Sun)
  - dmaengine: idxd: Expose DSA3.0 capabilities through sysfs (Yi Sun)
  - dmaengine: idxd: Add new DSA and IAA device IDs for Diamond Rapids platform (Fenghua Yu)
  - anolis: perf cpumap: Fix buffer overflow in cpu_map__snprint() (Tianchen Ding)
  - iommu: Warn on premature unblock during DMA aliased sibling reset (Nicolin Chen)
  - iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset (Nicolin Chen)
  - iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid() (Nicolin Chen)
  - iommu: Fix nested pci_dev_reset_iommu_prepare/done() (Nicolin Chen)
  - iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done() (Nicolin Chen)
  - iommu: Replace per-group resetting_domain with per-gdev blocked flag (Nicolin Chen)
  - iommu: Fix kdocs of pci_dev_reset_iommu_done() (Nicolin Chen)
  - iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done() (Nicolin Chen)
  - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (Sean Christopherson)
  - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT (Yosry Ahmed)
  - KVM: arm64: Read PMUVer as unsigned (James Clark)
  - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() (Ma Ke)
  - KVM: arm64: PMU: Reload when resetting (Akihiko Odaki)
  - KVM: arm64: PMU: Reload when user modifies registers (Akihiko Odaki)
  - KVM: arm64: PMU: Fix SET_ONE_REG for vPMC regs (Akihiko Odaki)
  - KVM: arm64: PMU: Set raw values from user to PM{C,I}NTEN{SET,CLR}, PMOVS{SET,CLR} (Akihiko Odaki)
  - arm64: Fix usage of new shifted MDCR_EL2 values (James Clark)
  - perf/x86/rapl: Fix the energy-pkg event for AMD CPUs (Dhananjay Ugwekar)
  - perf/x86/intel: Improve validation and configuration of ACR masks (Dapeng Mi)
  - perf/x86/intel: Add missing branch counters constraint apply (Dapeng Mi)
  - perf/x86/intel: Fix bitmask of OCR and FRONTEND events for LNC (Kan Liang)
  - perf/x86/intel: Fix event constraints for LNC (Kan Liang)
  - perf/x86: Fix potential bad container_of in intel_pmu_hw_config (Ian Rogers)
  - perf/x86/intel: Disable PMI for self-reloaded ACR events (Dapeng Mi)
  - perf/x86/intel: Always reprogram ACR events to prevent stale masks (Dapeng Mi)
  - perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() (Dapeng Mi)
  - perf/x86/amd/uncore: Avoid a false positive warning about snprintf truncation in amd_uncore_umc_ctx_init (Jean Delvare)
  - perf/x86/amd/uncore: Prevent UMC counters from saturating (Sandipan Das)
  - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq (Adrian Hunter)
  - perf/x86/intel/ds: Fix counter backwards of non-precise events counters-snapshotting (Kan Liang)
  - x86/events, x86/insn-eval: Remove incorrect current->active_mm references (Andy Lutomirski)
  - x86/perf: Make sure to program the counter value for stopped events on migration (Peter Zijlstra)
  - perf/x86: Move event pointer setup earlier in x86_pmu_enable() (Breno Leitao)
  - selftests/bpf: validate STACK_ZERO is preserved on subreg spill (Andrii Nakryiko)
  - selftests/bpf: add stack access precision test (Andrii Nakryiko)
  - LoongArch: Add spectre boundry for syscall dispatch table (Greg Kroah-Hartman)
  - ALSA: 6fire: Fix input volume change detection (Cássio Gabriel)
  - tpm: avoid -Wunused-but-set-variable (Arnd Bergmann)
  - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei)
  - ACPI: video: force native backlight on HP OMEN 16 (8A44) (Shivam Kalra)
  - clk: microchip: mpfs-ccc: fix out of bounds access during output registration (Conor Dooley)
  - net: mctp: fix don't require received header reserved bits to be zero (Yuan Zhaoming)
  - printk: add print_hex_dump_devel() (Thorsten Blum)
  - tracing/probes: Limit size of event probe to 3K (Steven Rostedt)
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)
  - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells)
  - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells)
  - rxrpc: Fix potential UAF after skb_unshare() failure (David Howells)
  - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() (Wentao Guan)
  - exit: Sleep at TASK_IDLE when waiting for application core dump (Paul E. McKenney)
  - exit: prevent preemption of oopsing TASK_DEAD task (Jann Horn)
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)
  - randomize_kstack: Maintain kstack_offset per task (Ryan Roberts)
  - mmc: block: use single block write in retry (Bin Liu)
  - LoongArch: Show CPU vulnerabilites correctly (Huacai Chen)
  - net: ks8851: Avoid excess softirq scheduling (Marek Vasut)
  - net: ks8851: Reinstate disabling of BHs around IRQ handler (Marek Vasut)
  - rxrpc: Fix re-decryption of RESPONSE packets (David Howells)
  - rxrpc: Fix rxkad crypto unalignment handling (David Howells)
  - ALSA: seq: Fix UMP group 16 filtering (Cássio Gabriel)
  - ALSA: seq: Notify client and port info changes (Takashi Iwai)
  - ALSA: core: Serialize deferred fasync state checks (Cássio Gabriel)
  - ALSA: misc: Use guard() for spin locks (Takashi Iwai)
  - ALSA: core: Fix potential data race at fasync handling (Takashi Iwai)
  - ALSA: hda: cs35l56: Propagate ASP TX source control errors (Cássio Gabriel)
  - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (Thorsten Blum)
  - ALSA: aoa: i2sbus: clear stale prepared state (Cássio Gabriel)
  - ALSA: aoa: Use guard() for mutex locks (Takashi Iwai)
  - lib: test_hmm: evict device pages on file close to avoid use-after-free (Alistair Popple)
  - lib/scatterlist: fix temp buffer in extract_user_to_sg() (Christian A. Ehrhardt)
  - lib/scatterlist: fix length calculations in extract_kvec_to_sg (Christian A. Ehrhardt)
  - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (Lukas Wunner)
  - ASoC: qcom: q6apm: remove child devices when apm is removed (Srinivas Kandagatla)
  - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (Srinivas Kandagatla)
  - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (Srinivas Kandagatla)
  - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (Cássio Gabriel)
  - ASoC: fsl_easrc: fix comment typo (Joseph Salisbury)
  - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (Tommaso Soncin)
  - sound: ua101: fix division by zero at probe (SeungJu Cheon)
  - ALSA: firewire-tascam: Do not drop unread control events (Cássio Gabriel)
  - ALSA: usb-audio: Fix UAC3 cluster descriptor size check (Cássio Gabriel)
  - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (Takashi Iwai)
  - ALSA: usb-audio: midi2: Restart output URBs on resume (Cássio Gabriel)
  - ASoC: SOF: Don't allow pointer operations on unconfigured streams (Mark Brown)
  - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey)
  - ALSA: caiaq: Don't abort when no input device is available (Takashi Iwai)
  - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai)
  - ALSA: caiaq: Handle probe errors properly (Takashi Iwai)
  - ktest: Fix the month in the name of the failure directory (Steven Rostedt)
  - taskstats: set version in TGID exit notifications (Yiyang Chen)
  - ALSA: caiaq: Fix control_put() result and cache rollback (Cássio Gabriel)
  - tools/accounting: handle truncated taskstats netlink messages (Yiyang Chen)
  - selftests/mqueue: Fix incorrectly named file (Simon Liebold)
  - parisc: _llseek syscall is only available for 32-bit userspace (Helge Deller)
  - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (Cássio Gabriel)
  - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee)
  - ALSA: aoa: i2sbus: fix OF node lifetime handling (Cássio Gabriel)
  - lib/ts_kmp: fix integer overflow in pattern length calculation (Josh Law)
  - Revert "ALSA: usb: Increase volume range that triggers a warning" (Rong Zhang)
  - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)
  - ALSA: usb-audio: Evaluate packsize caps at the right place (Takashi Iwai)
  - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (Cássio Gabriel)
  - ALSA: usb-audio: Avoid false E-MU sample-rate notifications (Cássio Gabriel)
  - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cássio Gabriel)
  - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (Luiz Augusto von Dentz)
  - vsock/virtio: fix length and offset in tap skb for split packets (Stefano Garzarella)
  - vsock/virtio: fix accept queue count leak on transport mismatch (Dudu Lu)
  - vsock: fix buffer size clamping order (Norbert Szetei)
  - batman-adv: tp_meter: fix tp_num leak on kmalloc failure (Sven Eckelmann)
  - batman-adv: stop tp_meter sessions during mesh teardown (Jiexun Wang)
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (Siwei Zhang)
  - Bluetooth: hci_conn: fix potential UAF in create_big_sync (David Carlier)
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek)
  - xfrm: ah: account for ESN high bits in async callbacks (Michael Bommarito)
  - net: ipv6: stop checking crypto_ahash_alignmask (Eric Biggers)
  - net: ipv4: stop checking crypto_ahash_alignmask (Eric Biggers)
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang)
  - batman-adv: bla: put backbone reference on failed claim hash insert (Sven Eckelmann)
  - batman-adv: bla: only purge non-released claims (Sven Eckelmann)
  - batman-adv: bla: prevent use-after-free when deleting claims (Sven Eckelmann)
  - batman-adv: stop caching unowned originator pointers in BAT IV (Jiexun Wang)
  - batman-adv: reject new tp_meter sessions during teardown (Jiexun Wang)
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (Ben Morris)
  - mptcp: fix scheduling with atomic in timestamp sockopt (Gang Yan)
  - mptcp: sockopt: set timestamp flags on subflow socket, not msk (Gang Yan)
  - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure (Shardul Bankar)
  - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure (Shardul Bankar)
  - mptcp: fastclose msk when linger time is 0 (Matthieu Baerts (NGI0))
  - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets)
  - libceph: Fix slab-out-of-bounds access in auth message processing (Raphael Zimmer)
  - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer)
  - hv_sock: fix ARM64 support (Hamza Mahfooz)
  - af_unix: Reject SIOCATMARK on non-stream sockets (Jiexun Wang)
  - net/rds: handle zerocopy send cleanup before the message is queued (Nan Li)
  - ip6_gre: Use cached t->net in ip6erspan_changelink(). (Maoyi Xie)
  - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (Kai Zen)
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (Siwei Zhang)
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (Siwei Zhang)
  - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (Luiz Augusto von Dentz)
  - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (Yilin Zhu)
  - xfrm: provide message size for XFRM_MSG_MAPPING (Ruijie Li)
  - wifi: mac80211: remove station if connection prep fails (Johannes Berg)
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (Catherine)
  - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (Jamal Hadi Salim)
  - flow_dissector: do not dissect PPPoE PFC frames (Qingfang Deng)
  - net: Fix icmp host relookup triggering ip_rt_bug (Dong Chenchen)
  - netfilter: reject zero shift in nft_bitwise (Kai Ma)
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer)
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman)
  - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode (Andrea Mayer)
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey)
  - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu)
  - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao)
  - net: rds: fix MR cleanup on copy error (Ao Zhou)
  - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam)
  - rxrpc: Fix memory leaks in rxkad_verify_response() (David Howells)
  - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu)
  - net: caif: clear client service pointer on teardown (Zhengchuan Liang)
  - padata: Remove comment for reorder_work (Herbert Xu)
  - padata: Fix pd UAF once and for all (Herbert Xu)
  - anolis: security: lua-lsm: avoid softirq reentry during lazy kvcache init (Zongyao Chen)
  - anolis: security: lua-lsm: gate inactive cleanup after policy load (Zongyao Chen)
  - anolis: security: lua-lsm: skip inactive hook dispatch earlier (Zongyao Chen)
  - anolis: security: lua-lsm: initialize kvcache dictionaries lazily (Zongyao Chen)
  - anolis: security: lua-lsm: allocate task VM state on first use (Zongyao Chen)
  - KVM: x86: Defer non-architectural deliver of exception payload to userspace read (Sean Christopherson)
  - KVM: nSVM: Add missing consistency check for nCR3 validity (Yosry Ahmed)
  - KVM: x86: check for nEPT/nNPT in slow flush hypercalls (Paolo Bonzini)
  - perf/x86/intel/uncore: Fix die ID init and look up bugs (Zide Chen) {CVE-2026-43344}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)
  - KVM: SVM: check validity of VMCB controls when returning from SMM (Paolo Bonzini)
  - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (Yosry Ahmed)
  - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (Yosry Ahmed)
  - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed)
  - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT (Yosry Ahmed)
  - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS (Yosry Ahmed)
  - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (Yosry Ahmed)
  - KVM: selftests: Add timing_info bit support in vmx_pmu_caps_test (fuwenxin)
  - anolis: selftests/cgroup: Fix the time window management logic in the test_cpu_identity. (Qihang Zhou)
  - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (Sean Wang)
  - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (Sean Wang)
  - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (Thorsten Blum)
  - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (Pavitra Jha)
  - can: ucan: fix devres lifetime (Johan Hovold)
  - spi: qup: fix controller deregistration (Johan Hovold)
  - regulator: act8945a: fix OF node reference imbalance (Johan Hovold)
  - crypto: atmel-tdes - fix DMA sync direction (Thorsten Blum)
  - media: omap3isp: drop the use count of v4l2 pipeline (Haoxiang Li)
  - hwmon: (ltc2992) Fix u32 overflow in power read path (Sanman Pradhan)
  - hwmon: (ltc2992) Clamp threshold writes to hardware range (Sanman Pradhan)
  - parisc: Fix IRQ leak in LASI driver (Hongling Zeng)
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman)
  - extcon: ptn5150: handle pending IRQ events during system resume (Xu Yang)
  - clk: imx: imx8-acm: fix flags for acm clocks (Stefan Eichenberger)
  - PCI/AER: Stop ruling out unbound devices as error source (Lukas Wunner)
  - regulator: mt6357: fix OF node reference imbalance (Johan Hovold)
  - staging: media: atomisp: Disallow all private IOCTLs (Sakari Ailus)
  - md/raid5: validate payload size before accessing journal metadata (Junrui Luo)
  - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (Junrui Luo)
  - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (Eric Biggers)
  - btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (Boris Burkov) {CVE-2026-45934}
  - net: txgbe: fix RTNL assertion warning when remove module (Jiawen Wu)
  - drm/arcpgu: fix device node leak (Luca Ceresoli)
  - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (Quan Zhou)
  - drm/amdkfd: Add upper bound check for num_of_nodes (Alysa Liu)
  - power: supply: axp288_charger: Do not cancel work before initializing it (Krzysztof Kozlowski)
  - crypto: hisilicon - Fix dma_unmap_single() direction (Thomas Fourier)
  - IB/core: Fix zero dmac race in neighbor resolution (Chen Zhao)
  - wifi: rsi: fix kthread lifetime race between self-exit and external-stop (Jeongjun Park)
  - spi: bcm63xx: fix controller deregistration (Johan Hovold)
  - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (Chen Ni)
  - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() (Tyllis Xu)
  - leds: qcom-lpg: Check for array overflow when selecting the high resolution (Greg Kroah-Hartman)
  - spi: fsl: fix controller deregistration (Johan Hovold)
  - riscv: cpufeature: avoid uninitialized variable in has_thead_homogeneous_vlenb() (zzx01475749)
  - riscv: vector: Fix context save/restore with xtheadvector (zzx01475749)
  - anolis: configs: add L2-OPTIONAL declaration for RISCV_USER_CFI (zzx01475749)
  - anolis: configs: add L2-OPTIONAL declarations for xtheadvector Kconfig symbols (zzx01475749)
  - anolis: riscv: ptrace: include linux/const.h for _BITUL in uapi header (zzx01475749)
  - riscv: Add xtheadvector instruction definitions (Charlie Jenkins)
  - riscv: csr: Add CSR encodings for CSR_VXRM/CSR_VXSAT (Charlie Jenkins)
  - RISC-V: define the elements of the VCSR vector CSR (Heiko Stuebner)
  - arch: Reserve map_shadow_stack() syscall number for all architectures (Sohil Mehta)
  - selftests: riscv: Add license to cfi selftest (Charlie Jenkins)
  - prctl: cfi: change the branch landing pad prctl()s to be more descriptive (Paul Walmsley)
  - riscv: cfi: clear CFI lock status in start_thread() (Zong Li)
  - riscv: ptrace: cfi: expand "SS" references to "shadow stack" in uapi headers (Paul Walmsley)
  - prctl: rename branch landing pad implementation functions to be more explicit (Paul Walmsley)
  - riscv: ptrace: expand "LP" references to "branch landing pads" in uapi headers (Paul Walmsley)
  - riscv: ptrace: cfi: fix "PRACE" typo in uapi header (Paul Walmsley)
  - mman: Add map_shadow_stack() flags (Mark Brown)
  - prctl: arch-agnostic prctl for shadow stack (Mark Brown)
  - prctl: add arch-agnostic prctl()s for indirect branch tracking (Deepak Gupta)
  - riscv/mm: ensure PROT_WRITE leads to VM_READ | VM_WRITE (Deepak Gupta)
  - dt-bindings: riscv: document zicfilp and zicfiss in extensions.yaml (Deepak Gupta)
  - mm: add VM_SHADOW_STACK definition for riscv (Deepak Gupta)
  - riscv: add Zicfiss / Zicfilp extension CSR and bit definitions (Deepak Gupta)
  - kselftest/riscv: add kselftest for user mode CFI (Deepak Gupta)
  - riscv: add documentation for shadow stack (Deepak Gupta)
  - riscv: add documentation for landing pad / indirect branch tracking (Deepak Gupta)
  - riscv: create a Kconfig fragment for shadow stack and landing pad support (Deepak Gupta)
  - arch/riscv: add dual vdso creation logic and select vdso based on hw (Deepak Gupta)
  - arch/riscv: compile vdso with landing pad and shadow stack note (Jim Shu)
  - riscv: Check that vdso does not contain any dynamic relocations (Alexandre Ghiti)
  - RISC-V: vDSO: Correct inline assembly constraints in the getrandom syscall wrapper (Xi Ruoyao)
  - RISC-V: vDSO: Wire up getrandom() vDSO implementation (Xi Ruoyao)
  - riscv: enable kernel access to shadow stack memory via the FWFT SBI call (Deepak Gupta)
  - riscv: add kernel command line option to opt out of user CFI (Deepak Gupta)
  - riscv/hwprobe: add zicfilp / zicfiss enumeration in hwprobe (zzx01475749)
  - riscv: hwprobe: add support for RISCV_HWPROBE_KEY_IMA_EXT_1 (zzx01475749)
  - riscv/ptrace: expose riscv CFI status and state via ptrace and in core files (Deepak Gupta)
  - riscv/kernel: update __show_regs() to print shadow stack register (Deepak Gupta)
  - riscv/signal: save and restore the shadow stack on a signal (Deepak Gupta)
  - riscv: signal: fix some warnings reported by sparse (Paul Walmsley)
  - riscv: signal: abstract header saving for setup_sigcontext (Andy Chiu)
  - riscv: vector: Support xtheadvector save/restore (Charlie Jenkins)
  - riscv: vector: Use vlenb from DT for thead (Charlie Jenkins)
  - riscv: Add thead and xtheadvector as a vendor extension (Charlie Jenkins)
  - riscv/traps: Introduce software check exception and uprobe handling (Deepak Gupta)
  - riscv: Implement indirect branch tracking prctls (Deepak Gupta)
  - riscv: Implement arch-agnostic shadow stack prctls (Deepak Gupta)
  - riscv/shstk: If needed allocate a new shadow stack on clone (Deepak Gupta)
  - riscv/mm: Implement map_shadow_stack() syscall (Deepak Gupta)
  - riscv/mm: update write protect to work on shadow stacks (Deepak Gupta)
  - riscv/mm: teach pte_mkwrite to manufacture shadow stack PTEs (Deepak Gupta)
  - riscv/mm: manufacture shadow stack ptes (Deepak Gupta)
  - riscv: Add usercfi state for task and save/restore of CSR_SSP on trap entry/exit (Deepak Gupta)
  - riscv: zicfiss / zicfilp enumeration (Deepak Gupta)
  - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng)
  - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (Yosry Ahmed)
  - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (Yosry Ahmed)
  - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 (Yosry Ahmed)
  - iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs (Joerg Roedel)
  - iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs (Guanghui Feng)
  - iommu/amd: Fix illegal device-id access in IOMMU debugfs (Guanghui Feng)
  - iommu/amd: Fix clone_alias() to use the original device's devid (Vasant Hegde)
  - iommu/amd: Invalidate IRT cache for DMA aliases (Magnus Kalland)
  - iommu/amd: Fix alias device DTE setting (Vasant Hegde)
  - iommu/amd: Fix error path in amd_iommu_probe_device() (Vasant Hegde)
  - iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() (Jinhui Guo)
  - iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() (Zhen Ni)
  - iommu/amd: Use core's primary handler and set IRQF_ONESHOT (Sebastian Andrzej Siewior)
  - iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Jose Fernandez (Anthropic))
  - anolis: security: lua-lsm: disable stats by default (Zongyao Chen)
  - x86/CPU/AMD: Extend Zen6 model range (Borislav Petkov (AMD))
  - x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (Mario Limonciello)
  - x86/CPU/AMD: Add CPUID faulting support (Borislav Petkov (AMD))
  - f2fs: fix fsck inconsistency caused by FGGC of node block (Yongpeng Yang) {CVE-2026-46175}
  - anolis: configs: classify KVM memory attributes as L1 scope (PVS.NarasimhaRao)
  - KVM: guest_memfd: delay kvm_gmem_prepare_folio() until the memory is passed to the guest (Paolo Bonzini)
  - KVM: guest_memfd: return locked folio from __kvm_gmem_get_pfn (Paolo Bonzini)
  - KVM: rename CONFIG_HAVE_KVM_GMEM_* to CONFIG_HAVE_KVM_ARCH_GMEM_* (Paolo Bonzini)
  - KVM: guest_memfd: do not go through struct page (Paolo Bonzini)
  - KVM: guest_memfd: delay folio_mark_uptodate() until after successful preparation (Paolo Bonzini)
  - KVM: guest_memfd: return folio from __kvm_gmem_get_pfn() (Paolo Bonzini)
  - KVM: x86: disallow pre-fault for SNP VMs before initialization (Paolo Bonzini)
  - KVM: SEV: Provide support for SNP_EXTENDED_GUEST_REQUEST NAE event (Michael Roth)
  - x86/sev: Move sev_guest.h into common SEV header (Michael Roth)
  - KVM: SEV: Provide support for SNP_GUEST_REQUEST NAE event (Brijesh Singh)
  - KVM: x86: Implement kvm_arch_vcpu_pre_fault_memory() (Paolo Bonzini)
  - KVM: x86/mmu: Make kvm_mmu_do_page_fault() return mapped level (Paolo Bonzini)
  - KVM: x86/mmu: Account pf_{fixed,emulate,spurious} in callers of "do page fault" (Sean Christopherson)
  - KVM: Add KVM_PRE_FAULT_MEMORY vcpu ioctl to pre-populate guest memory (Isaku Yamahata)
  - KVM: Document KVM_PRE_FAULT_MEMORY ioctl (Isaku Yamahata)
  - mm, virt: merge AS_UNMOVABLE and AS_INACCESSIBLE (Paolo Bonzini)
  - x86/sev: Do RMP memory coverage check after max_pfn has been set (Tom Lendacky)
  - KVM: SEV-ES: Fix svm_get_msr()/svm_set_msr() for KVM_SEV_ES_INIT guests (Michael Roth)
  - KVM: interrupt kvm_gmem_populate() on signals (Paolo Bonzini)
  - virt: guest_memfd: fix reference leak on hwpoisoned page (Paolo Bonzini)
  - crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_locked (Kim Phillips)
  - KVM: selftests: Fix shift of 32 bit unsigned int more than 32 bits (Colin Ian King)
  - KVM: SNP: Fix LBR Virtualization for SNP guest (Ravi Bangoria)
  - KVM: SEV-ES: Prevent MSR access post VMSA encryption (Nikunj A Dadhania)
  - KVM: SVM: Remove the need to trigger an UNBLOCK event on AP creation (Tom Lendacky)
  - KVM: SEV: Don't WARN() if RMP lookup fails when invalidating gmem pages (Paolo Bonzini)
  - KVM: SEV: Automatically switch reclaimed pages to shared (Michael Roth)
  - tools headers UAPI: Sync kvm headers with the kernel sources (Arnaldo Carvalho de Melo)
  - KVM: PPC: Fix documentation for ppc mmu caps (Joel Stanley)
  - KVM: SVM: Add module parameter to enable SEV-SNP (Brijesh Singh)
  - KVM: SEV: Avoid WBINVD for HVA-based MMU notifications for SNP (Ashish Kalra)
  - KVM: x86: Implement hook for determining max NPT mapping level (Michael Roth)
  - KVM: SEV: Implement gmem hook for invalidating private pages (Michael Roth)
  - KVM: SEV: Implement gmem hook for initializing private pages (Michael Roth)
  - KVM: SEV: Support SEV-SNP AP Creation NAE event (Tom Lendacky)
  - KVM: SEV: Add support to handle RMP nested page faults (Brijesh Singh)
  - KVM: SEV: Add support to handle Page State Change VMGEXIT (Michael Roth)
  - KVM: SEV: Add support to handle MSR based Page State Change VMGEXIT (Michael Roth)
  - KVM: SEV: Add support to handle GHCB GPA register VMGEXIT (Brijesh Singh)
  - KVM: SEV: Add KVM_SEV_SNP_LAUNCH_FINISH command (Brijesh Singh)
  - KVM: SEV: Add KVM_SEV_SNP_LAUNCH_UPDATE command (Brijesh Singh)
  - KVM: SEV: Add KVM_SEV_SNP_LAUNCH_START command (Brijesh Singh)
  - KVM: SEV: Add initial SEV-SNP support (Brijesh Singh)
  - KVM: SEV: Select KVM_GENERIC_PRIVATE_MEM when CONFIG_KVM_AMD_SEV=y (Michael Roth)
  - KVM: MMU: Disable fast path if KVM_EXIT_MEMORY_FAULT is needed (Michael Roth)
  - KVM: x86: Add hook for determining max NPT mapping level (Michael Roth)
  - KVM: guest_memfd: Add hook for invalidating memory (Michael Roth)
  - KVM: guest_memfd: Add interface for populating gmem pages with user data (Paolo Bonzini)
  - KVM: guest_memfd: extract __kvm_gmem_get_pfn() (Paolo Bonzini)
  - KVM: guest_memfd: Add hook for initializing memory (Paolo Bonzini)
  - KVM: guest_memfd: limit overzealous WARN (Paolo Bonzini)
  - KVM: guest_memfd: pass error up from filemap_grab_folio (Paolo Bonzini)
  - KVM: guest_memfd: Use AS_INACCESSIBLE when creating guest_memfd inode (Michael Roth)
  - mm: Introduce AS_INACCESSIBLE for encrypted/confidential memory (Michael Roth)
  - KVM: SEV: Allow per-guest configuration of GHCB protocol version (Michael Roth)
  - KVM: SEV: Add GHCB handling for termination requests (Michael Roth)
  - KVM: SEV: Add GHCB handling for Hypervisor Feature Support requests (Brijesh Singh)
  - KVM: SEV: Add support to handle AP reset MSR protocol (Tom Lendacky)
  - KVM: x86: Fully re-initialize supported_vm_types on vendor module load (Sean Christopherson)
  - KVM: x86/mmu: check for invalid async page faults involving private memory (Paolo Bonzini)
  - KVM: x86/mmu: Use synthetic page fault error code to indicate private faults (Sean Christopherson)
  - KVM: x86/mmu: Pass full 64-bit error code when handling page faults (Isaku Yamahata)
  - KVM: x86: Move synthetic PFERR_* sanity checks to SVM's #NPF handler (Sean Christopherson)
  - KVM: x86: Define more SEV+ page fault error bits/flags for #NPF (Sean Christopherson)
  - KVM: x86: Remove separate "bit" defines for page fault error code masks (Sean Christopherson)
  - x86/sev: Add callback to apply RMP table fixups for kexec (Ashish Kalra)
  - x86/e820: Add a new e820 table update helper (Ashish Kalra)
  - x86/kexec: Do not update E820 kexec table for setup_data (Dave Young)
  - x86/sev: Move sev_setup_arch() to mem_encrypt.c (Alexander Shishkin)
  - x86/sev: Make the VMPL0 checking more straight forward (Tom Lendacky)
  - x86/sev: Rename snp_init() in boot/compressed/sev.c (Tom Lendacky)
  - x86/sev: Shorten struct name snp_secrets_page_layout to snp_secrets_page (Tom Lendacky)
  - anolis: crypto: ccp: Restore Hygon PSP mutex handling in SEV/SNP shutdown path (PVS.NarasimhaRao)
  - anolis: x86/sev: Restore IBPB-on-Entry SNP feature lost in Dump SEV_STATUS (PVS.NarasimhaRao)
  - s390/debug: Reject zero-length input in debug_input_flush_fn() (Vasily Gorbik)
  - md/raid10: cleanup skip handling in raid10_sync_request (Li Nan)
  - selftests: netfilter: Stabilize rpath.sh (Phil Sutter)
  - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value (Douglas Anderson)
  - driver core: Don't let a device probe until it's ready (Douglas Anderson)
  - anolis: mm: allow coldpgs slab reclaim with mglru enabled (Weilin Tong)
  - anolis: mm: allow kidled slab scan with mglru enabled (Weilin Tong)
  - regulator: core: fix locking in regulator_resolve_supply() error path (André Draszik) {CVE-2026-46252}
  - anolis: config: make CONFIG_SELINUX_AVC_HASH_BITS visible (Tianjia Zhang)
  - selinux: shrink critical section in sel_write_load() (Stephen Smalley)
  - selinux: allow multiple opens of /sys/fs/selinux/policy (Stephen Smalley)
  - selinux: prune /sys/fs/selinux/user (Stephen Smalley)
  - selinux: prune /sys/fs/selinux/disable (Stephen Smalley)
  - selinux: prune /sys/fs/selinux/checkreqprot (Stephen Smalley)
  - selinux: fix avdcache auditing (Stephen Smalley)
  - selinux: don't reserve xattr slot when we won't fill it (David Windsor)
  - selinux: use sk blob accessor in socket permission helpers (Zongyao Chen)
  - selinux: annotate intentional data race in inode_doinit_with_dentry() (Christian Göttsche)
  - selinux: drop the BUG() in cred_has_capability() (Paul Moore)
  - selinux: move the selinux_blob_sizes struct (Paul Moore)
  - selinuxfs: new helper for attaching files to tree (Al Viro)
  - selinuxfs: don't stash the dentry of /policy_capabilities (Al Viro)
  - selinux: improve bucket distribution uniformity of avc_hash() (Hongru Zhang)
  - selinux: Move avtab_hash() to a shared location for future reuse (Hongru Zhang)
  - selinux: Introduce a new config to make avc cache slot size adjustable (Hongru Zhang)
  - selinux: rename the cred_security_struct variables to "crsec" (Paul Moore)
  - selinux: move avdcache to per-task security struct (Stephen Smalley)
  - selinux: rename task_security_struct to cred_security_struct (Stephen Smalley)
  - security_dentry_init_security(): constify qstr argument (Al Viro)
  - selinux: enable per-file labeling for functionfs (Neill Kapron)
  - selinux: fix sel_read_bool() allocation and error handling (Stephen Smalley)
  - selinux: Remove redundant __GFP_NOWARN (Qianfeng Rong)
  - selinux: use a consistent method to get full socket from skb (Tianjia Zhang)
  - selinux: Remove unused function selinux_policycap_netif_wildcard() (Yue Haibing)
  - selinux: don't bother with selinuxfs_info_free() on failures (Al Viro)
  - selinux: add __GFP_NOWARN to hashtab_init() allocations (Paul Moore)
  - selinux: optimize selinux_inode_getattr/permission() based on neveraudit|permissive (Stephen Smalley)
  - selinux: introduce neveraudit types (Stephen Smalley)
  - selinux: add a 5 second sleep to /sys/fs/selinux/user (Paul Moore)
  - selinux: change security_compute_sid to return the ssid or tsid on match (Stephen Smalley)
  - selinux: fix the kdoc header for task_avdcache_update (Paul Moore)
  - selinux: remove a duplicated include (Paul Moore)
  - selinux: reduce path walk overhead (Paul Moore)
  - selinux: support wildcard match in genfscon (Takaya Saeki)
  - selinux: drop copy-paste comment (Christian Göttsche)
  - selinux: unify OOM handling in network hashtables (Christian Göttsche)
  - selinux: add likely hints for fast paths (Christian Göttsche)
  - selinux: contify network namespace pointer (Christian Göttsche)
  - selinux: constify network address pointer (Christian Göttsche)
  - selinux: get netif_wildcard policycap from policy instead of cache (Christian Göttsche)
  - selinux: support wildcard network interface names (Christian Göttsche)
  - selinux: add permission checks for loading other kinds of kernel files (Kipp N. Davis)
  - selinux: always check the file label in selinux_kernel_read_file() (Paul Moore)
  - selinux: fix spelling error (Tanya Agarwal)
  - selinux: make more use of str_read() when loading the policy (Christian Göttsche)
  - selinux: avoid unnecessary indirection in struct level_datum (Christian Göttsche)
  - selinux: use known type instead of void pointer (Christian Göttsche)
  - selinux: rename comparison functions for clarity (Christian Göttsche)
  - selinux: rework match_ipv6_addrmask() (Christian Göttsche)
  - selinux: constify and reconcile function parameter names (Christian Göttsche)
  - selinux: avoid using types indicating user space interaction (Christian Göttsche)
  - selinux: supply missing field initializers (Christian Göttsche)
  - selinux: add netlink nlmsg_type audit message (Thiébaud Weksteen)
  - selinux: add support for xperms in conditional policies (Christian Göttsche)
  - selinux: Fix SCTP error inconsistency in selinux_socket_bind() (Mikhail Ivanov)
  - selinux: use native iterator types (Christian Göttsche)
  - selinux: add generated av_permissions.h to targets (Thomas Weißschuh)
  - selinux: match extended permissions to their base permissions (Thiébaud Weksteen)
  - selinux: use sk_to_full_sk() in selinux_ip_output() (Eric Dumazet)
  - security: replace memcpy() with get_task_comm() (Yafang Shao)
  - selinux: Deprecate /sys/fs/selinux/user (Stephen Smalley)
  - selinux: apply clang format to security/selinux/nlmsgtab.c (Paul Moore)
  - selinux: streamline selinux_nlmsg_lookup() (Paul Moore)
  - selinux: Add netlink xperm support (Thiébaud Weksteen)
  - selinux: move genheaders to security/selinux/ (Masahiro Yamada)
  - selinux: do not include <linux/*.h> headers from host programs (Masahiro Yamada)
  - security: Update file_set_fowner documentation (Mickaël Salaün)
  - lsm: Refactor return value of LSM hook vm_enough_memory (Xu Kuohai)
  - selinux: fix style problems in security/selinux/include/audit.h (Paul Moore)
  - selinux: simplify avc_xperms_audit_required() (Zhen Lei)
  - selinux: mark both IPv4 and IPv6 accepted connection sockets as labeled (Guido Trentalancia)
  - selinux: replace kmem_cache_create() with KMEM_CACHE() (Eric Suen)
  - selinux: annotate false positive data race to avoid KCSAN warnings (Stephen Smalley)
  - selinux: refactor code to return ERR_PTR in selinux_netlbl_sock_genattr (Gaosheng Cui)
  - selinux: Streamline type determination in security_compute_sid (Canfeng Guo)
  - selinux,smack: remove the capability checks in the removexattr hooks (Paul Moore)
  - selinux: Use 1UL for EBITMAP_BIT to match maps type (Canfeng Guo)
  - selinux: constify source policy in cond_policydb_dup() (Christian Göttsche)
  - selinux: avoid printk_ratelimit() (Christian Göttsche)
  - selinux: pre-allocate the status page (Christian Göttsche)
  - selinux: clarify return code in filename_trans_read_helper_compat() (Ondrej Mosnacek)
  - selinux: use u32 as bit position type in ebitmap code (Christian Göttsche)
  - selinux: improve symtab string hashing (Christian Göttsche)
  - selinux: dump statistics for more hash tables (Christian Göttsche)
  - selinux: make more use of current_sid() (Christian Göttsche)
  - selinux: update numeric format specifiers for ebitmaps (Christian Göttsche)
  - selinux: cleanup selinux_lsm_getattr() (Paul Moore)
  - selinux: reject invalid ebitmaps (Christian Göttsche)
  - anolis: iommu: Guard intel iommu liveupdate by CONFIG_INTEL_IOMMU (Zelin Deng)
  - anolis: configs: Update KEXEC_HANDOVER config (Zelin Deng)
  - anolis: selftests: liveupdate: Adapt vfio pci test (Zelin Deng)
  - selftests/liveupdate: add test cases for LIVEUPDATE_SESSION_GET_NAME (Luca Boccassi)
  - liveupdate: add LIVEUPDATE_SESSION_GET_NAME ioctl (Luca Boccassi)
  - selftests/liveupdate: add test cases for LIVEUPDATE_IOCTL_CREATE_SESSION calls with invalid length (Luca Boccassi)
  - liveupdate: reject LIVEUPDATE_IOCTL_CREATE_SESSION with invalid name length (Luca Boccassi)
  - selftests: kho: test with deferred struct page init (Michal Clapinski)
  - kho: make preserved pages compatible with deferred struct page init (Evangelos Petrongonas)
  - kho: fix deferred initialization of scratch areas (Michal Clapinski)
  - anolis: selftests: fix memfd_create() undefined issue (Zelin Deng)
  - kho: fix order calculation for kho_unpreserve_pages() (Pratyush Yadav (Google))
  - kho: fix KHO_TREE_MAX_DEPTH for non-4KB page sizes (George Guo)
  - mm/memfd_luo: report error when restoring a folio fails mid-loop (David Carlier)
  - kho: skip KHO for crash kernel (Evangelos Petrongonas)
  - kho: fix error handling in kho_add_subtree() (Breno Leitao)
  - liveupdate: fix return value on session allocation failure (Pasha Tatashin)
  - kho: document kexec-metadata tracking feature (Breno Leitao)
  - kho: kexec-metadata: track previous kernel chain (Breno Leitao)
  - kho: fix kho_in_debugfs_init() to handle non-FDT blobs (Breno Leitao)
  - kho: persist blob size in KHO FDT (Breno Leitao)
  - kho: rename fdt parameter to blob in kho_add/remove_subtree() (Breno Leitao)
  - kho: add size parameter to kho_add_subtree() (Breno Leitao)
  - kho: drop restriction on maximum page order (Pratyush Yadav)
  - kho: make sure preservations do not span multiple NUMA nodes (Pratyush Yadav (Google))
  - kho: fix KASAN support for restored vmalloc regions (Pasha Tatashin)
  - mm/vmalloc: export clear_vm_uninitialized_flag() (Pasha Tatashin)
  - kho: remove finalize state and clients (Jason Miu)
  - kho: adopt radix tree for preserved memory tracking (Jason Miu)
  - anolis: security: lua-lsm: fix lazy VM first-use publication (Zongyao Chen)
  - anolis: security: lua-lsm: hide xfrm_state_pol_flow_match hook (Zongyao Chen)
  - anolis: security: lua-lsm: separate dispatch failures from hook results (Zongyao Chen)
  - anolis: security: lua-lsm: avoid lazy VM creation during unregister (Zongyao Chen)
  - anolis: security: lua-lsm: fail hook dispatch when lazy VM allocation fails (Zongyao Chen)
  - anolis: security: lua-lsm: build per-task Lua VM lazily on first dispatch (Zongyao Chen)
  - anolis: security: lua-lsm: skip hook dispatch when no modules are live (Zongyao Chen)
  - anolis: security: lua-lsm: drop redundant size args for file data hooks (Zongyao Chen)
  - anolis: security: lua-lsm: expose kernel file load ids to Lua hooks (Zongyao Chen)
  - anolis: security: lua-lsm: add userns support for capable hook (Zongyao Chen)
  - anolis: security: lua-lsm: reset dirty VMs on task exit (Zongyao Chen)
  - anolis: security: lua-lsm: add inode_setattr attributes (Zongyao Chen)
  - anolis: security: lua-lsm: skip empty kvcache dict free (Zongyao Chen)
  - anolis: security: lua-lsm: wait for SRCU readers before freeing module (Zongyao Chen)
  - anolis: security: lua-lsm: fix length handling for Lua string buffers (Zongyao Chen)
  - anolis: security: lua-lsm: don't store filp_open errors in file userdata (Zongyao Chen)
  - anolis: security: lua-lsm: return nil for missing wrapped objects (Zongyao Chen)
  - anolis: security: lua-lsm: validate numeric capability arguments (Zongyao Chen)
  - anolis: security: lua-lsm: put looked-up task after descendant walk (Zongyao Chen)
  - anolis: security: lua-lsm: document OCFS2 xattr name lifetime issue (Zongyao Chen)
  - anolis: security: lua-lsm: own inode_init_security xattr name storage (Zongyao Chen)
  - anolis: security: lua-lsm: validate inode_init_security xattr output (Zongyao Chen)
  - anolis: bpf, lsm: drop stale inode_xattr_skipcap BTF ID (Zongyao Chen)
  - anolis: fs/resctrl: Fix io_alloc_init() placement in resctrl_init() (Qinyun Tan)
  - device property: Make modifications of fwnode "flags" thread safe (Douglas Anderson)
  - net: txgbe: fix firmware version check (Jiawen Wu)
  - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() (Quentin Perret)
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang)
  - Bluetooth: MGMT: Fix possible UAFs (Luiz Augusto von Dentz)
  - media: rc: ttusbir: fix inverted error logic (Oliver Neukum)
  - selftests: net: change shebang to bash in amt.sh (Taehee Yoo)
  - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (Junrui Luo)
  - selinux: fix style issues in security/selinux/ss/symtab.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/symtab.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/sidtab.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/sidtab.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/services.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/policydb.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/policydb.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/mls_types.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/mls.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/mls.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/hashtab.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/hashtab.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/ebitmap.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/ebitmap.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/context.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/context.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/constraint.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/conditional.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/conditional.h (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/avtab.c (Paul Moore)
  - selinux: fix style issues in security/selinux/ss/avtab.h (Paul Moore)
  - selinux: only filter copy-up xattrs following initialization (David Disseldorp)
  - selinux: correct return values in selinux_socket_getpeersec_dgram() (Paul Moore)
  - selinux: reduce the object class calculations at inode init time (Paul Moore)
  - selinux: fix style issues in security/selinux/include/initial_sid_to_string.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/xfrm.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/security.h (Paul Moore)
  - selinux: fix style issues with security/selinux/include/policycap_names.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/policycap.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/objsec.h (Paul Moore)
  - selinux: fix style issues with security/selinux/include/netlabel.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/netif.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/ima.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/conditional.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/classmap.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/avc_ss.h (Paul Moore)
  - selinux: align avc_has_perm_noaudit() prototype with definition (Paul Moore)
  - selinux: fix style issues in security/selinux/include/avc.h (Paul Moore)
  - selinux: fix style issues in security/selinux/include/audit.h (Paul Moore)
  - selinux: remove the wrong comment about multithreaded process handling (Munehisa Kamata)
  - selinux: introduce an initial SID for early boot processes (Ondrej Mosnacek)
  - selinux: refactor avtab_node comparisons (Jacob Satterfield)
  - selinux: update filenametr_hash() to use full_name_hash() (Paul Moore)
  - selinux: saner handling of policy reloads (Al Viro)
  - lsm: fix a spelling mistake (Paul Moore)
  - lsm: constify 'sb' parameter in security_sb_kern_mount() (Khadija Kamran)
  - lsm: constify 'bprm' parameter in security_bprm_committed_creds() (Khadija Kamran)
  - lsm: constify 'bprm' parameter in security_bprm_committing_creds() (Khadija Kamran)
  - lsm: constify 'sb' parameter in security_quotactl() (Khadija Kamran)
  - selinux: simplify avtab_insert_node() prototype (Jacob Satterfield)
  - selinux: hweight optimization in avtab_read_item (Jacob Satterfield)
  - selinux: improve role transition hashing (Christian Göttsche)
  - selinux: simplify avtab slot calculation (Christian Göttsche)
  - selinux: improve debug configuration (Christian Göttsche)
  - selinux: print sum of chain lengths^2 for hash tables (Christian Göttsche)
  - selinux: Annotate struct sidtab_str_cache with __counted_by (Kees Cook)
  - selinux: convert to new timestamp accessors (Jeff Layton)
  - gfs2: fix memory leaks in gfs2_fill_super error path (Deepanshu Kartikey) {CVE-2026-45961}
  - selftests: bpf: adjust rx_dropped xskxceiver's test to respect tailroom (Maciej Fijalkowski)
  - selftests: bpf: introduce a common routine for reading procfs (Maciej Fijalkowski)
  - anolis: Revert "virtio: break and reset virtio devices on device_shutdown()" (Jingbo Xu)
  - anolis: Revert "virtgpu: don't reset on shutdown" (Jingbo Xu)
  - anolis: Revert "anolis: drm/virtio: implement virtio_gpu_shutdown" (Jingbo Xu)
  - gfs2: Fix slab-use-after-free in qd_put (Andreas Gruenbacher) {CVE-2026-45861}
  - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev)
  - io_uring/timeout: check unused sqe fields (Pavel Begunkov)
  - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey)
  - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo)
  - cifs: abort open_cached_dir if we don't request leases (Shyam Prasad N)
  - block: relax pgmap check in bio_add_page for compatible zone device pages (Naman Jain)
  - block: add pgmap check to biovec_phys_mergeable (Naman Jain)
  - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) {CVE-2026-46089}
  - anolis: configs: classify CONFIG_KVM_HYPERV as L1 for appropriate scope (PVS.NarasimhaRao)
  - tools/include: Sync x86 asm/msr-index.h with the kernel sources (Namhyung Kim)
  - tools/include: Sync uapi/linux/kvm.h and asm/kvm.h with the kernel sources (Namhyung Kim)
  - selftests: kvm: add test for transferring FPU state into VMSA (Paolo Bonzini)
  - selftests: kvm: split "launch" phase of SEV VM creation (Paolo Bonzini)
  - selftests: kvm: switch to using KVM_X86_*_VM (Paolo Bonzini)
  - selftests: kvm: add tests for KVM_SEV_INIT2 (Paolo Bonzini)
  - KVM: SEV: allow SEV-ES DebugSwap again (Paolo Bonzini)
  - KVM: SEV: introduce KVM_SEV_INIT2 operation (Paolo Bonzini)
  - KVM: SEV: sync FPU and AVX state at LAUNCH_UPDATE_VMSA time (Paolo Bonzini)
  - KVM: SEV: define VM types for SEV and SEV-ES (Paolo Bonzini)
  - KVM: SEV: introduce to_kvm_sev_info (Paolo Bonzini)
  - KVM: x86: Add supported_vm_types to kvm_caps (Paolo Bonzini)
  - KVM: x86: add fields to struct kvm_arch for CoCo features (Paolo Bonzini)
  - KVM: SEV: store VMSA features in kvm_sev_info (Paolo Bonzini)
  - KVM: SEV: publish supported VMSA features (Paolo Bonzini)
  - KVM: introduce new vendor op for KVM_GET_DEVICE_ATTR (Paolo Bonzini)
  - KVM: x86: use u64_to_user_ptr() (Paolo Bonzini)
  - KVM: SVM: Compile sev.c if and only if CONFIG_KVM_AMD_SEV=y (Paolo Bonzini)
  - KVM: SVM: Invert handling of SEV and SEV_ES feature flags (Sean Christopherson)
  - x86/CPU/AMD: Track SNP host status with cc_platform_*() (Borislav Petkov (AMD))
  - x86/cc: Add cc_platform_set/_clear() helpers (Borislav Petkov (AMD))
  - x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM (Borislav Petkov (AMD))
  - Documentation: kvm/sev: clarify usage of KVM_MEMORY_ENCRYPT_OP (Paolo Bonzini)
  - Documentation: kvm/sev: separate description of firmware (Paolo Bonzini)
  - KVM: SEV: fix compat ABI for KVM_MEMORY_ENCRYPT_OP (Paolo Bonzini)
  - KVM: selftests: Add a basic SEV-ES smoke test (Sean Christopherson)
  - KVM: selftests: Add a basic SEV smoke test (Peter Gonda)
  - KVM: selftests: Add library for creating and interacting with SEV guests (Peter Gonda)
  - KVM: selftests: Allow tagging protected memory in guest page tables (Peter Gonda)
  - KVM: selftests: Explicitly ucall pool from shared memory (Peter Gonda)
  - KVM: selftests: Add support for protected vm_vaddr_* allocations (Michael Roth)
  - KVM: selftests: Add support for allocating/managing protected guest memory (Peter Gonda)
  - KVM: selftests: Add a macro to iterate over a sparsebit range (Ackerley Tng)
  - KVM: selftests: Make sparsebit structs const where appropriate (Michael Roth)
  - KVM: selftests: Extend VM creation's @shape to allow control of VM subtype (Sean Christopherson)
  - x86/sev: Dump SEV_STATUS (Borislav Petkov (AMD))
  - KVM: selftests: Create GUEST_MEMFD for relevant invalid flags testcases (Sean Christopherson)
  - KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU (Sean Christopherson)
  - treewide: replace or remove redundant def_bool in Kconfig files (Masahiro Yamada)
  - crypto: ccp - Have it depend on AMD_IOMMU (Borislav Petkov (AMD))
  - KVM: x86: move x86-specific structs to uapi/asm/kvm.h (Paolo Bonzini)
  - KVM: remove more traces of device assignment UAPI (Paolo Bonzini)
  - kvm: x86: use a uapi-friendly macro for BIT (Dionna Glaze)
  - iommu/amd: Fix failure return from snp_lookup_rmpentry() (Ashish Kalra)
  - Documentation: virt: Fix up pre-formatted text block for SEV ioctls (Michael Roth)
  - crypto: ccp: Add the SNP_SET_CONFIG command (Brijesh Singh)
  - crypto: ccp: Add the SNP_COMMIT command (Tom Lendacky)
  - crypto: ccp: Add the SNP_PLATFORM_STATUS command (Brijesh Singh)
  - x86/cpufeatures: Enable/unmask SEV-SNP CPU feature (Michael Roth)
  - KVM: SEV: Make AVIC backing, VMSA and VMCB memory allocation SNP safe (Brijesh Singh)
  - crypto: ccp: Add panic notifier for SEV/SNP firmware shutdown on kdump (Ashish Kalra)
  - iommu/amd: Clean up RMP entries for IOMMU pages during SNP shutdown (Ashish Kalra)
  - crypto: ccp: Handle legacy SEV commands when SNP is enabled (Brijesh Singh)
  - crypto: ccp: Handle non-volatile INIT_EX data when SNP is enabled (Tom Lendacky)
  - crypto: ccp: Handle the legacy TMR allocation when SNP is enabled (Brijesh Singh)
  - x86/sev: Introduce an SNP leaked pages list (Ashish Kalra)
  - crypto: ccp: Provide an API to issue SEV and SNP commands (Brijesh Singh)
  - crypto: ccp: Add support to initialize the AMD-SP for SEV-SNP (Brijesh Singh)
  - crypto: ccp: Define the SEV-SNP commands (Brijesh Singh)
  - x86/sev: Adjust the directmap to avoid inadvertent RMP faults (Michael Roth)
  - x86/sev: Add helper functions for RMPUPDATE and PSMASH instruction (Brijesh Singh)
  - x86/fault: Dump RMP table information when RMP page faults occur (Michael Roth)
  - x86/traps: Define RMP violation #PF error code (Brijesh Singh)
  - x86/fault: Add helper for dumping RMP entries (Brijesh Singh)
  - x86/sev: Add RMP entry lookup helpers (Brijesh Singh)
  - x86/mtrr: Don't print errors if MtrrFixDramModEn is set when SNP enabled (Ashish Kalra)
  - x86/sev: Add SEV-SNP host initialization support (Brijesh Singh)
  - x86/speculation: Do not enable Automatic IBRS if SEV-SNP is enabled (Kim Phillips)
  - x86/mm: Fix memory encryption features advertisement (Kirill A. Shutemov)
  - tools headers UAPI: Sync kvm headers with the kernel sources (Arnaldo Carvalho de Melo)
  - KVM: guest-memfd: fix unused-function warning (Paolo Bonzini)
  - KVM x86/xen: add an override for PVCLOCK_TSC_STABLE_BIT (Paul Durrant)
  - KVM: x86: Make Hyper-V emulation optional (Vitaly Kuznetsov)
  - Bluetooth: virtio_bt: clamp rx length before skb_put (Michael Bommarito)
  - Bluetooth: virtio_bt: validate rx pkt_type header length (Michael Bommarito)
  - ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei) {CVE-2025-22039}
  - anolis: mm: fix semaphore leak in pre_oom_leave() (Kaihao Bai)
  - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (Jinjie Ruan)
  - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li)
  - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (Rajat Gupta)
  - net: libwx: fix VF illegal register access (Jiawen Wu)
  - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (Jason Gunthorpe)
  - f2fs: fix fiemap boundary handling when read extent cache is incomplete (Yongpeng Yang)
  - x86/cpu: Disable FRED when PTI is forced on (Dave Hansen)
  - x86/fred: Remove kernel log message when initializing exceptions (Sohil Mehta)
  - x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (Borislav Petkov (AMD))
  - x86/fred: Correct speculative safety in fred_extint() (Andrew Cooper)
  - x86/fred: Fix 64bit identifier in fred_ss (Andrew Cooper)
  - x86/entry/fred: Push __KERNEL_CS directly (Xin Li (Intel))
  - x86/fred: Remove ENDBR64 from FRED entry points (Xin Li (Intel))
  - x86/fred/signal: Prevent immediate repeat of single step trap on return from SIGTRAP handler (Xin Li (Intel))
  - x86/fred: Play nice with invoking asm_fred_entry_from_kvm() on non-FRED hardware (Josh Poimboeuf)
  - x86/fred: Install system vector handlers even if FRED isn't fully enabled (Sean Christopherson)
  - x86/fred: KVM: VMX: Always use FRED for IRQs when CONFIG_X86_FRED=y (Sean Christopherson)
  - x86/fred: Fix system hang during S4 resume with FRED enabled (Xin Li (Intel))
  - x86/fred: Fix the FRED RSP0 MSR out of sync with its per-CPU cache (Xin Li (Intel))
  - x86/entry: Set FRED RSP0 on return to userspace instead of context switch (Xin Li (Intel))
  - x86/msr: Switch between WRMSRNS and WRMSR with the alternatives mechanism (Andrew Cooper)
  - x86/entry: Test ti_work for zero before processing individual bits (Xin Li (Intel))
  - x86/fred: Set SS to __KERNEL_DS when enabling FRED (Xin Li (Intel))
  - arm64: Expose ID_AA64ISAR1_EL1.XS to sanitised feature consumers (Marc Zyngier)
  - KVM: arm64: nv: Fix ATS12 handling of single-stage translation (Marc Zyngier)
  - KVM: arm64: Enforce dependency on an ARMv8.4-aware toolchain (Marc Zyngier)
  - KVM: arm64: Ensure canonical IPA is hugepage-aligned when handling fault (Oliver Upton)
  - KVM: arm64: Fix S1/S2 combination when FWB==1 and S2 has Device memory type (Marc Zyngier)
  - KVM: arm64: free kvm->arch.nested_mmus with kvfree() (Danilo Krummrich)
  - KVM: arm64: Mark freed S2 MMUs as invalid (Marc Zyngier)
  - KVM: arm64: Fix nested S2 MMU structures reallocation (Marc Zyngier)
  - KVM: arm64: Introduce and use predicates that check for protected VMs (Fuad Tabba)
  - KVM: arm64: Refactor checks for FP state ownership (Fuad Tabba)
  - KVM: arm64: Move guest_owns_fp_regs() to increase its scope (Fuad Tabba)
  - KVM: arm64: nv: Add support for FEAT_ATS1A (Marc Zyngier)
  - KVM: arm64: nv: Plumb handling of AT S1* traps from EL2 (Marc Zyngier)
  - KVM: arm64: nv: Make AT+PAN instructions aware of FEAT_PAN3 (Marc Zyngier)
  - KVM: arm64: nv: Sanitise SCTLR_EL1.EPAN according to VM configuration (Marc Zyngier)
  - KVM: arm64: nv: Add SW walker for AT S1 emulation (Marc Zyngier)
  - arm64: mm: Wire up TCR.DS bit to PTE shareability fields (Ard Biesheuvel)
  - arm64: Use Signed/Unsigned enums for TGRAN{4,16,64} and VARange (Marc Zyngier)
  - KVM: arm64: nv: Make ps_to_output_size() generally available (Marc Zyngier)
  - KVM: arm64: nv: Add emulation of AT S12E{0,1}{R,W} (Marc Zyngier)
  - KVM: arm64: nv: Add basic emulation of AT S1E2{R,W} (Marc Zyngier)
  - KVM: arm64: nv: Add basic emulation of AT S1E1{R,W}P (Marc Zyngier)
  - KVM: arm64: nv: Add basic emulation of AT S1E{0,1}{R,W} (Marc Zyngier)
  - KVM: arm64: nv: Honor absence of FEAT_PAN2 (Marc Zyngier)
  - KVM: arm64: nv: Turn upper_attr for S2 walk into the full descriptor (Marc Zyngier)
  - KVM: arm64: nv: Enforce S2 alignment when contiguous bit is set (Marc Zyngier)
  - arm64: Add ESR_ELx_FSC_ADDRSZ_L() helper (Marc Zyngier)
  - arm64/mm: Stop using ESR_ELx_FSC_TYPE during fault (Anshuman Khandual)
  - arm64: Add ESR decoding for exceptions involving translation level -1 (Ard Biesheuvel)
  - arm64: Add system register encoding for PSTATE.PAN (Marc Zyngier)
  - arm64: Add PAR_EL1 field description (Marc Zyngier)
  - arm64: Add missing APTable and TCR_ELx.HPD masks (Marc Zyngier)
  - KVM: arm64: Make kvm_at() take an OP_AT_* (Joey Gouly)
  - KVM: arm64: nv: Use GFP_KERNEL_ACCOUNT for sysreg_masks allocation (Oliver Upton)
  - KVM: arm64: nv: Add handling of NXS-flavoured TLBI operations (Marc Zyngier)
  - KVM: arm64: nv: Add handling of range-based TLBI operations (Marc Zyngier)
  - KVM: arm64: nv: Add handling of outer-shareable TLBI operations (Marc Zyngier)
  - KVM: arm64: nv: Invalidate TLBs based on shadow S2 TTL-like information (Marc Zyngier)
  - KVM: arm64: nv: Tag shadow S2 entries with guest's leaf S2 level (Marc Zyngier)
  - KVM: arm64: nv: Handle FEAT_TTL hinted TLB operations (Marc Zyngier)
  - KVM: arm64: nv: Handle TLBI IPAS2E1{,IS} operations (Marc Zyngier)
  - KVM: arm64: nv: Handle TLBI ALLE1{,IS} operations (Marc Zyngier)
  - KVM: arm64: nv: Handle TLBI VMALLS12E1{,IS} operations (Marc Zyngier)
  - KVM: arm64: nv: Handle TLB invalidation targeting L2 stage-1 (Marc Zyngier)
  - KVM: arm64: nv: Handle EL2 Stage-1 TLB invalidation (Marc Zyngier)
  - KVM: arm64: nv: Add Stage-1 EL2 invalidation primitives (Marc Zyngier)
  - KVM: arm64: Rename __tlb_switch_to_{guest,host}() in VHE (Fuad Tabba)
  - KVM: arm64: nv: Unmap/flush shadow stage 2 page tables (Christoffer Dall)
  - KVM: arm64: nv: Handle shadow stage 2 page faults (Marc Zyngier)
  - KVM: arm64: nv: Implement nested Stage-2 page table walk logic (Christoffer Dall)
  - KVM: arm64: nv: Support multiple nested Stage-2 mmu structures (Marc Zyngier)
  - KVM: arm64: Fix out-of-IPA space translation fault handling (Wujie Duan)
  - KVM: arm64: Initialize trap register values in hyp in pKVM (Fuad Tabba)
  - KVM: arm64: Use helpers to classify exception types reported via ESR (Ard Biesheuvel)
  - KVM: selftests: arm64: Support P52V48 4K and 16K guest_modes (Ryan Roberts)
  - arm64/mm: Add FEAT_LPA2 specific ID_AA64MMFR0.TGRAN[2] (Anshuman Khandual)
  - KVM: selftests: arm64: Determine max ipa size per-page size (Ryan Roberts)
  - KVM: arm64: Allow guests with >48-bit IPA size on FEAT_LPA2 systems (Ryan Roberts)
  - KVM: arm64: Support up to 5 levels of translation in kvm_pgtable (Ryan Roberts)
  - KVM: arm64: Convert translation level parameter to s8 (Ryan Roberts)
  - KVM: arm64: Use LPA2 page-tables for stage2 and hyp stage1 (Ryan Roberts)
  - arm64: Add ARM64_HAS_LPA2 CPU capability (Ryan Roberts)
  - KVM: arm64: Add new (V)TCR_EL2 field definitions for FEAT_LP2 (Ryan Roberts)
  - KVM: arm64: nv: Fix RESx behaviour of disabled FGTs with negative polarity (Marc Zyngier)
  - KVM: arm64: nv: Expose BTI and CSV_frac to a guest hypervisor (Marc Zyngier)
  - KVM: arm64: nv: Fix relative priorities of exceptions generated by ERETAx (Marc Zyngier)
  - KVM: arm64: nv: Work around lack of pauth support in old toolchains (Marc Zyngier)
  - KVM: arm64: Drop trapping of PAuth instructions/keys (Marc Zyngier)
  - KVM: arm64: nv: Advertise support for PAuth (Marc Zyngier)
  - KVM: arm64: nv: Handle ERETA[AB] instructions (Marc Zyngier)
  - KVM: arm64: nv: Add emulation for ERETAx instructions (Marc Zyngier)
  - KVM: arm64: nv: Add kvm_has_pauth() helper (Marc Zyngier)
  - KVM: arm64: nv: Reinject PAC exceptions caused by HCR_EL2.API==0 (Marc Zyngier)
  - KVM: arm64: nv: Handle HCR_EL2.{API,APK} independently (Marc Zyngier)
  - KVM: arm64: nv: Honor HFGITR_EL2.ERET being set (Marc Zyngier)
  - KVM: arm64: nv: Fast-track 'InHost' exception returns (Marc Zyngier)
  - KVM: arm64: nv: Add trap forwarding for ERET and SMC (Marc Zyngier)
  - KVM: arm64: Handle AArch32 SPSR_{irq,abt,und,fiq} as RAZ/WI (Marc Zyngier)
  - KVM: arm64: Do not let a L1 hypervisor access the *32_EL2 sysregs (Marc Zyngier)
  - KVM: arm64: Refine _EL2 system register list that require trap reinjection (Miguel Luis)
  - KVM: arm64: nv: Configure HCR_EL2 for FEAT_NV2 (Marc Zyngier)
  - KVM: arm64: Constraint PAuth support to consistent implementations (Marc Zyngier)
  - KVM: arm64: Add helpers for ESR_ELx_ERET_ISS_ERET* (Marc Zyngier)
  - KVM: arm64: Harden __ctxt_sys_reg() against out-of-range values (Marc Zyngier)
  - arm64: cpufeatures: Fix FEAT_NV check when checking for FEAT_NV1 (Marc Zyngier)
  - arm64: cpufeatures: Only check for NV1 if NV is present (Marc Zyngier)
  - KVM: arm64: Get rid of vCPU-scoped feature bitmap (Oliver Upton)
  - KVM: arm64: Remove unused return value from kvm_reset_vcpu() (Oliver Upton)
  - KVM: arm64: Hoist NV+SVE check into KVM_ARM_VCPU_INIT ioctl handler (Oliver Upton)
  - KVM: arm64: Prevent NV feature flag on systems w/o nested virt (Oliver Upton)
  - KVM: arm64: Hoist PAuth checks into KVM_ARM_VCPU_INIT ioctl (Oliver Upton)
  - KVM: arm64: Hoist SVE check into KVM_ARM_VCPU_INIT ioctl handler (Oliver Upton)
  - KVM: arm64: Hoist PMUv3 check into KVM_ARM_VCPU_INIT ioctl handler (Oliver Upton)
  - KVM: arm64: Add generic check for system-supported vCPU features (Oliver Upton)
  - KVM: arm64: Fix kvm_has_feat*() handling of negative features (Marc Zyngier)
  - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (Michal Pecio)
  - fanotify: fix false positive on permission events (Miklos Szeredi)
  - smb/client: fix out-of-bounds read in symlink_data() (Zisen Ye)
  - gpio: of: clear OF_POPULATED on hog nodes in remove path (Bartosz Golaszewski)
  - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (Jason Gunthorpe)
  - spi: atmel: fix controller deregistration (Johan Hovold)
  - udf: reject descriptors with oversized CRC length (Michael Bommarito)
  - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao)
  - f2fs: fix node_cnt race between extent node destroy and writeback (Yongpeng Yang)
  - cifs: change_conf needs to be called for session setup (Shyam Prasad N)
  - ntfs3: add buffer boundary checks to run_unpack() (Tobias Gaertner)
  - crypto: ccree - fix a memory leak in cc_mac_digest() (Haoxiang Li)
  - power: supply: max17042: avoid overflow when determining health (André Draszik)
  - ibmasm: fix OOB reads in command_file_write due to missing size checks (Tyllis Xu)
  - spi: fix resource leaks on device setup failure (Johan Hovold)
  - regulator: bd9571mwv: fix OF node reference imbalance (Johan Hovold)
  - isofs: validate block number from NFS file handle in isofs_export_iget (Michael Bommarito)
  - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() (Cen Zhang)
  - smb/client: fix out-of-bounds read in smb2_compound_op() (Zisen Ye)
  - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang)
  - ntfs3: fix integer overflow in run_unpack() volume boundary check (Tobias Gaertner)
  - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() (Yongpeng Yang)
  - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE (Jens Axboe)
  - regset: use kvzalloc() for regset_get_alloc() (Douglas Anderson)
  - f2fs: fix to detect potential corrupted nid in free_nid_list (Chao Yu)
  - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info (Thomas Zimmermann)
  - io_uring/poll: fix signed comparison in io_poll_get_ownership() (Longxuan Yu)
  - media: rc: xbox_remote: heed DMA restrictions (Oliver Neukum)
  - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (Jason Gunthorpe)
  - media: saa7164: add ioremap return checks and cleanups (Wang Jun)
  - spi: sprd: fix controller deregistration (Johan Hovold)
  - clk: rk808: fix OF node reference imbalance (Johan Hovold)
  - cpuidle: powerpc: avoid double clear when breaking snooze (Shrikanth Hegde)
  - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (David Lechner)
  - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (Chaitanya Kulkarni)
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (Jason Gunthorpe)
  - spi: syncuacer: fix controller deregistration (Johan Hovold)
  - spi: synquacer: switch to use modern name (Yang Yingliang)
  - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (Thorsten Blum)
  - wifi: b43: enforce bounds check on firmware key index in b43_rx() (Tristan Madani)
  - spi: rspi: fix controller deregistration (Johan Hovold)
  - ACPI: scan: Use acpi_dev_put() in object add error paths (Guangshuo Li)
  - hwmon: (corsair-psu) Close HID device on probe errors (Myeonghun Pak)
  - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (Thorsten Blum)
  - platform/x86: hp-wmi: Ignore backlight and FnLock events (Krishna Chomal)
  - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (Greg Kroah-Hartman)
  - ipmi:si: Return state to normal if message allocation fails (Corey Minyard)
  - PCI/AER: Clear only error bits in PCIe Device Status (Shuai Xue)
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (Junrui Luo)
  - wifi: ath5k: do not access array OOB (Jiri Slaby (SUSE))
  - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (Thorsten Blum)
  - dmaengine: idxd: Fix leaking event log memory (Vinicius Costa Gomes)
  - dmaengine: idxd: Fix crash when the event log is disabled (Vinicius Costa Gomes)
  - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu)
  - spi: lantiq-ssc: fix controller deregistration (Johan Hovold)
  - spi: topcliff-pch: fix use-after-free on unbind (Johan Hovold)
  - usb: usblp: fix heap leak in IEEE 1284 device ID via short response (Greg Kroah-Hartman)
  - crypto: atmel-ecc - Release client on allocation failure (Thorsten Blum)
  - USB: omap_udc: DMA: Don't enable burst 4 mode (Aaro Koskinen)
  - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (Marek Szyprowski)
  - wifi: mt76: mt7921: fix a potential clc buffer length underflow (Leon Yen)
  - media: rc: streamzap: Error handling in probe (Oliver Neukum)
  - wifi: b43legacy: enforce bounds check on firmware key index in RX path (Tristan Madani)
  - spi: orion: fix clock imbalance on registration failure (Johan Hovold)
  - ibmveth: Disable GSO for packets with small MSS (Mingming Cao)
  - spi: at91-usart: fix controller deregistration (Johan Hovold)
  - media: uvcvideo: Enable VB2_DMABUF for metadata stream (Ricardo Ribalda)
  - nvme-apple: drop invalid put of admin queue reference count (Fedor Pchelkin)
  - HID: playstation: Clamp num_touch_reports (T.J. Mercier)
  - spi: rockchip: fix controller deregistration (Johan Hovold)
  - staging: vme_user: fix root device leak on init failure (Johan Hovold)
  - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (Tudor Ambarus)
  - iommufd: Fix a race with concurrent allocation and unmap (Sina Hassani)
  - spi: imx: fix use-after-free on unbind (Johan Hovold)
  - media: pci: zoran: fix potential memory leak in zoran_probe() (Abdun Nihaal)
  - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (Amir Shetaia)
  - media: rc: ttusbir: respect DMA coherency rules (Oliver Neukum)
  - spi: dln2: fix controller deregistration (Johan Hovold)
  - regulator: rk808: fix OF node reference imbalance (Johan Hovold)
  - ibmasm: fix heap over-read in ibmasm_send_i2o_message() (Tyllis Xu)
  - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' (Nathan Chancellor)
  - anolis: cpufreq/amd-pstate: Fix misplaced boost_supported assignment in CPPC enable rework (PVS.NarasimhaRao)
  - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) {CVE-2026-46079}
  - anolis: kabi: Do not occupy KABI reserved fields (Zelin Deng)
  - anolis: iommu: vfio: Fix incorrect symbol namespece import issue (Zelin Deng)
  - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs (Luke Wang)
  - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (David Woodhouse)
  - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins (Francesco Dolcini)
  - usb: chipidea: otg: not wait vbus drop if use role_switch (Xu Yang)
  - RDMA/rxe: Reject unknown opcodes before ICRC processing (Michael Bommarito)
  - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (hkbinbin)
  - drm/amdgpu: fix zero-size GDS range init on RDNA4 (Arjan van de Ven)
  - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki)
  - anolis: locking: Add sysctl to disable reader optimistic lock stealing (Peng Wang)
  - anolis: configs: enable config for EDAC_IMH (Zhang Rui)
  - EDAC/imh: Setup 'imh_test' debugfs testing node (Qiuxu Zhuo)
  - EDAC/{skx_comm,imh}: Detect 2-level memory configuration (Qiuxu Zhuo)
  - EDAC/skx_common: Extend the maximum number of DRAM chip row bits (Qiuxu Zhuo)
  - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers (Qiuxu Zhuo)
  - EDAC/skx_common: Prepare for skx_set_hi_lo() (Qiuxu Zhuo)
  - EDAC/skx_common: Prepare for skx_get_edac_list() (Qiuxu Zhuo)
  - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev (Qiuxu Zhuo)
  - EDAC/{skx_common,skx}: Use configuration data, not global macros (Qiuxu Zhuo)
  - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang)
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu)
  - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu)
  - anolis: sched: balance cg_nr_iowait across sched_class switches (Tianchen Ding)
  - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (Greg Kroah-Hartman)
  - ipmi: Check event message buffer response for bad data (Corey Minyard)
  - ipmi: Add limits to event and receive message requests (Corey Minyard)
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (Ashutosh Desai)
  - drm/amdkfd: validate SVM ioctl nattr against buffer size (Alysa Liu)
  - drm/amdgpu: zero-initialize GART table on allocation (Philip Yang)
  - media: i2c: imx412: Assert reset GPIO during probe (Wenmeng Liu)
  - firmware: google: framebuffer: Do not mark framebuffer as busy (Thomas Zimmermann)
  - spi: sh-hspi: fix controller deregistration (Johan Hovold)
  - spi: zynqmp-gqspi: fix controller deregistration (Johan Hovold)
  - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse.Zhang)
  - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array (Tvrtko Ursulin)
  - spi: bcmbca-hsspi: fix controller deregistration (Johan Hovold)
  - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin)
  - spi: coldfire-qspi: fix controller deregistration (Johan Hovold)
  - of: unittest: fix use-after-free in testdrv_probe() (Wentao Liang)
  - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges)
  - media: amphion: Fix race between m2m job_abort and device_run (Ming Qian)
  - spi: img-spfi: fix controller deregistration (Johan Hovold)
  - firmware: google: framebuffer: Do not unregister platform device (Thomas Zimmermann)
  - net: stmmac: Prevent NULL deref when RX memory exhausted (Sam Edwards)
  - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() (Russell King (Oracle))
  - net: stmmac: avoid shadowing global buf_sz (Russell King (Oracle))
  - ALSA: pcmtest: Fix resource leaks in module init error paths (Cássio Gabriel)
  - ALSA: pcmtest: fix reference leak on failed device registration (Guangshuo Li)
  - spi: orion: fix runtime pm leak on unbind (Johan Hovold)
  - media: rc: igorplugusb: heed coherency rules (Oliver Neukum)
  - wifi: rtl8xxxu: fix potential use of uninitialized value (Yi Cong)
  - spi: tegra114: fix controller deregistration (Johan Hovold)
  - spi: tegra20-sflash: fix controller deregistration (Johan Hovold)
  - spi: uniphier: fix controller deregistration (Johan Hovold)
  - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (Pei Xiao)
  - spi: uniphier: switch to use modern name (Yang Yingliang)
  - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (Janne Grunau)
  - um: drivers: call kernel_strrchr() explicitly in cow_user.c (Michael Bommarito)
  - rtc: ntxec: fix OF node reference imbalance (Johan Hovold)
  - spi: s3c64xx: fix controller deregistration (Johan Hovold)
  - spi: s3c64xx: fix NULL-deref on driver unbind (Johan Hovold)
  - spi: fsl-espi: fix controller deregistration (Johan Hovold)
  - spi: omap2-mcspi: fix controller deregistration (Johan Hovold)
  - spi: mtk-nor: fix controller deregistration (Johan Hovold)
  - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (Fan Wu)
  - spi: microchip-core-qspi: fix controller deregistration (Johan Hovold)
  - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() (Li Zetao)
  - fbcon: Avoid OOB font access if console rotation fails (Thomas Zimmermann)
  - bonding: fix use-after-free due to enslave fail after slave array update (Nikolay Aleksandrov)
  - usb: typec: tcpm: reset internal port states on soft reset AMS (Amit Sunil Dhamne)
  - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (Marek Vasut)
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation (Yussuf Khalil)
  - pwm: imx-tpm: Count the number of enabled channels in probe (Viorel Suman (OSS))
  - USB: serial: option: add Telit Cinterion LE910Cx compositions (Fabio Porcedda)
  - spi: sun4i: fix controller deregistration (Johan Hovold)
  - spi: sun4i: switch to use modern name (Yang Yingliang)
  - iio: adc: ad7768-1: fix one-shot mode data acquisition (Jonathan Santos)
  - drm/amdgpu/pm: align Hawaii mclk workaround with radeon (Alex Deucher)
  - drm/amdgpu/pm: add missing revision check for CI (Alex Deucher)
  - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Michael Bommarito)
  - wifi: mt76: connac: introduce helper for mt7925 chipset (Deren Wu)
  - spi: meson-spicc: Fix double-put in remove path (Felix Gu)
  - spi: ti-qspi: fix controller deregistration (Johan Hovold)
  - spi: spi-ti-qspi: switch to use modern name (Yang Yingliang)
  - spi: spi-ti-qspi: Convert to platform remove callback returning void (Uwe Kleine-König)
  - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (Robert Beckett)
  - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (Shawn Lin)
  - mtd: spi-nor: sst: Fix SST write failure (Amit Kumar Mahapatra)
  - mtd: spi-nor: sst: Fix write enable before AAI sequence (Sanjaikumar V S)
  - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` (Bence Csókás)
  - regulator: max77650: fix OF node reference imbalance (Johan Hovold)
  - spi: mpc52xx: fix use-after-free on unbind (Johan Hovold)
  - media: i2c: ov8856: free control handler on error in ov8856_init_controls() (Alexander Koskovich)
  - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set (Robert Beckett)
  - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (Daniel Hodges)
  - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Benjamin Cheng)
  - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Benjamin Cheng)
  - media: staging: imx: request mbus_config in csi_start (Michael Tretter)
  - spi: sun6i: fix controller deregistration (Johan Hovold)
  - spi: sun6i: switch to use modern name (Yang Yingliang)
  - crypto: talitos - rename first/last to first_desc/last_desc (Paul Louvel)
  - crypto: talitos - fix SEC1 32k ahash request limitation (Paul Louvel)
  - remoteproc: xlnx: Only access buffer information if IPI is buffered (Ben Levinsky)
  - ipmi:ssif: Clean up kthread on errors (Corey Minyard)
  - ipmi:ssif: Fix a shutdown race (Corey Minyard)
  - spi: zynq-qspi: fix controller deregistration (Johan Hovold)
  - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (Pei Xiao)
  - spi: zynq-qspi: switch to use modern name (Yang Yingliang)
  - drm/radeon: add missing revision check for CI (Alex Deucher)
  - crypto: nx - fix context leak in nx842_crypto_free_ctx (Thorsten Blum)
  - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (Thorsten Blum)
  - crypto: nx - Migrate to scomp API (Ard Biesheuvel)
  - crypto: nx - Avoid -Wflex-array-member-not-at-end warning (Gustavo A. R. Silva)
  - usb: dwc3: Move GUID programming after PHY initialization (Selvarasu Ganesan)
  - tpm: tpm_tis: stop transmit if retries are exhausted (Jacqueline Wong)
  - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (Koichiro Den)
  - tpm: tpm_tis: add error logging for data transfer (Jacqueline Wong)
  - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (John B. Moore)
  - spi: cadence: fix unclocked access on unbind (Johan Hovold)
  - spi: cadence: fix controller deregistration (Johan Hovold)
  - drm/amdgpu: Add bounds checking to ib_{get,set}_value (Benjamin Cheng)
  - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Benjamin Cheng)
  - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Benjamin Cheng)
  - mtd: docg3: fix use-after-free in docg3_release() (James Kim)
  - mtd: docg3: Convert to platform remove callback returning void (Uwe Kleine-König)
  - spi: imx: fix runtime pm leak on probe deferral (Johan Hovold)
  - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang)
  - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt)
  - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe)
  - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama)
  - btrfs: fix double free in create_space_info() error path (Guangshuo Li)
  - dm-thin: fix metadata refcount underflow (Mikulas Patocka)
  - dm: don't report warning when doing deferred remove (Mikulas Patocka)
  - isofs: validate Rock Ridge CE continuation extent against volume size (Michael Bommarito)
  - dm: fix a buffer overflow in ioctl processing (Mikulas Patocka)
  - eventfs: Hold eventfs_mutex and SRCU when remount walks events (David Carlier)
  - dm-verity-fec: correctly reject too-small FEC devices (Eric Biggers)
  - dm-verity-fec: correctly reject too-small hash devices (Eric Biggers)
  - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() (DaeMyung Kang)
  - ksmbd: replace connection list with hash table (Namjae Jeon)
  - ksmbd: use msleep instaed of schedule_timeout_interruptible() (Namjae Jeon)
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito)
  - ksmbd: require minimum ACE size in smb_check_perm_dacl() (Michael Bommarito)
  - smb: common: change the data type of num_aces to le16 (Namjae Jeon)
  - smb: move some duplicate definitions to common/smbacl.h (ChenXiaoSong)
  - smb: client: validate dacloffset before building DACL pointers (Michael Bommarito)
  - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() (Yongpeng Yang)
  - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally (Chao Yu)
  - udf: fix partition descriptor append bookkeeping (Seohyeon Maeng)
  - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li)
  - hfsplus: fix held lock freed on hfsplus_fill_super() (Zilin Guan)
  - hfsplus: fix uninit-value by validating catalog record size (Deepanshu Kartikey)
  - media: i2c: ov08d10: fix image vertical start setting (Matthias Fend)
  - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger (Namjae Jeon)
  - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Xu Yang)
  - userfaultfd: allow registration of ranges below mmap_min_addr (Denis M. Karpov)
  - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak (Yochai Eisenrich)
  - drm/amdgpu/vce: Prevent partial address patches (Benjamin Cheng)
  - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann)
  - media: dib8000: avoid division by 0 in dib8000_set_dds() (Sergey Shtylyov)
  - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Benjamin Cheng)
  - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (John B. Moore)
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Bjoern Doebel)
  - ext4: get rid of ppath in convert_initialized_extent() (Baokun Li)
  - ext4: get rid of ppath in ext4_force_split_extent_at() (Baokun Li)
  - ext4: get rid of ppath in get_ext_path() (Baokun Li)
  - dm-stripe: fix a possible integer overflow (Mikulas Patocka) {CVE-2025-39940}
  - x86/fred: Enable FRED right after init_mem_mapping() (Xin Li (Intel))
  - x86/fred: Move FRED RSP initialization into a separate function (Xin Li (Intel))
  - x86/fred: Parse cmdline param "fred=" in cpu_parse_early_param() (Xin Li (Intel))
  - anolis: sched/sli: account nice/irq/softirq/guest fields in cgroup v2 cpu.exstat (Qihang Zhou)
  - riscv: lib: add strrchr() implementation (Feng Jiang)
  - riscv: lib: add strchr() implementation (Feng Jiang)
  - riscv: lib: add strnlen() implementation (Feng Jiang)
  - riscv: Omit optimized string routines when using KASAN (Samuel Holland)
  - lib/string_kunit: extend benchmarks to strnlen() and chr searches (Feng Jiang)
  - lib/string_kunit: add performance benchmark for strlen() (Feng Jiang)
  - lib/string_kunit: add correctness test for strrchr() (Feng Jiang)
  - lib/string_kunit: add correctness test for strnlen() (Feng Jiang)
  - lib/string_kunit: add correctness test for strlen() (Feng Jiang)
  - anolis: config: Update string selftest config (Gao Rui)
  - MAINTAINERS: adjust entries in FORTIFY_SOURCE and KERNEL HARDENING (Lukas Bulwahn)
  - selftests: find_symbol: Actually use load_mod() parameter (Geert Uytterhoeven)
  - selftests: kallsyms: fix and clarify current test boundaries (Luis Chamberlain)
  - selftests: kallsyms: fix double build stupidity (Luis Chamberlain)
  - selftests: kallsyms: add MODULE_DESCRIPTION (Arnd Bergmann)
  - lib: Move KUnit tests into tests/ subdirectory (Kees Cook)
  - selftests: add new kallsyms selftests (Luis Chamberlain)
  - string_kunit: Move strtomem KUnit test to string_kunit.c (Kees Cook)
  - string.h: Introduce memtostr() and memtostr_pad() (Kees Cook)
  - string: Convert KUnit test names to standard convention (Kees Cook)
  - string: Merge strcat KUnit tests into string_kunit.c (Kees Cook)
  - string: Prepare to merge strcat KUnit tests into string_kunit.c (Kees Cook)
  - string: Merge strscpy KUnit tests into string_kunit.c (Kees Cook)
  - string: Prepare to merge strscpy_kunit.c into string_kunit.c (Kees Cook)
  - string_kunit: Add test cases for str*cmp functions (Ivan Orlov)
  - string: Convert helpers selftest to KUnit (Kees Cook)
  - string: Convert selftest to KUnit (Kees Cook)
  - lib/string_helpers: Add flags param to string_get_size() (Andy Shevchenko)
  - RISC-V: KVM: Remove unnecessary 'ret' assignment (Qiang Ma)
  - RISC-V: KVM: Upgrade the supported SBI version to 3.0 (Atish Patra)
  - RISC-V: KVM: Implement get event info function (Atish Patra)
  - RISC-V: KVM: No need of explicit writable slot check (Atish Patra)
  - drivers/perf: riscv: Export PMU event info function (Atish Patra)
  - drivers/perf: riscv: Implement PMU event info function (Atish Patra)
  - RISC-V: KVM: Add support for Raw event v2 (Atish Patra)
  - drivers/perf: riscv: Add raw event v2 support (Atish Patra)
  - drivers/perf: riscv: Add SBI v3.0 flag (Atish Patra)
  - drivers/perf: riscv: Do not allow invalid raw event config (Atish Patra)
  - drivers/perf: riscv: Return error for default case (Atish Patra)
  - drivers/perf: riscv: Fix Platform firmware event data (Atish Patra)
  - drivers/perf: riscv: Align errno for unsupported perf event (Pu Lehui)
  - perf: RISC-V: Check standard event availability (Samuel Holland)
  - perf/riscv-sbi: Add platform specific firmware event handling (Mayuresh Chitale)
  - RISC-V: KVM: Correct kvm_riscv_check_vcpu_requests() comment (Quan Zhou)
  - anolis: config: Enable HAVE_KVM_DIRTY_RING_ACQ_REL for risc-v (Wang Yechao)
  - RISC-V: KVM: Enable ring-based dirty memory tracking (Quan Zhou)
  - KVM: riscv: Support enabling dirty log gradually in small (Dong Yang)
  - KVM: riscv: Fix Spectre-v1 in PMU counter access (Lukas Gerlach)
  - KVM: riscv: Fix Spectre-v1 in floating-point register access (Lukas Gerlach)
  - KVM: riscv: Fix Spectre-v1 in AIA CSR access (Lukas Gerlach)
  - KVM: riscv: Fix Spectre-v1 in ONE_REG register access (Lukas Gerlach)
  - KVM: riscv: Fix Spectre-v1 in APLIC interrupt handling (Lukas Gerlach)
  - RISC-V: KVM: Fix potential UAF in kvm_riscv_aia_imsic_has_attr() (Jiakai Xu)
  - RISC-V: KVM: Fix use-after-free in kvm_riscv_aia_aplic_has_attr() (Jiakai Xu)
  - RISC-V: KVM: Fix null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei() (Jiakai Xu)
  - RISC-V: KVM: fix off-by-one array access in SBI PMU (Radim Krčmář)
  - RISC-V: KVM: Check host Ssaia extension when creating AIA irqchip (Anup Patel)
  - RISC-V: KVM: Skip IMSIC update if vCPU IMSIC state is not initialized (Jiakai Xu)
  - RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() (Jiakai Xu)
  - RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() (Jiakai Xu)
  - anolis: config: Enable MPXY and RPMI for risc-v (Gao Rui)
  - irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe() (Felix Gu)
  - ACPI: property: Fix argument order in __acpi_node_get_property_reference() (Sunil V L)
  - clk: COMMON_CLK_RPMI should depend on RISCV (Geert Uytterhoeven)
  - mailbox: Improve RISCV_SBI_MPXY_MBOX guidance (Geert Uytterhoeven)
  - selftests/powerpc: Fix load_unaligned_zeropad build failure (Michael Ellerman)
  - MAINTAINERS: Add entry for RISC-V RPMI and MPXY drivers (Anup Patel)
  - RISC-V: Enable GPIO keyboard and event device in RV64 defconfig (Anup Patel)
  - irqchip/riscv-rpmi-sysmsi: Add ACPI support (Sunil V L)
  - mailbox/riscv-sbi-mpxy: Add ACPI support (Sunil V L)
  - irqchip/irq-riscv-imsic-early: Export imsic_acpi_get_fwnode() (Sunil V L)
  - ACPI: RISC-V: Add RPMI System MSI to GSI mapping (Sunil V L)
  - ACPI: RISC-V: Add support to update gsi range (Sunil V L)
  - ACPI: RISC-V: Create interrupt controller list in sorted order (Sunil V L)
  - ACPI: scan: Update honor list for RPMI System MSI (Sunil V L)
  - ACPI: Add support for nargs_prop in acpi_fwnode_get_reference_args() (Sunil V L)
  - ACPI: property: Refactor acpi_fwnode_get_reference_args() to support nargs_prop (Sunil V L)
  - irqchip: Add driver for the RPMI system MSI service group (Anup Patel)
  - dt-bindings: Add RPMI system MSI interrupt controller bindings (Anup Patel)
  - dt-bindings: Add RPMI system MSI message proxy bindings (Anup Patel)
  - clk: Add clock driver for the RISC-V RPMI clock service group (Rahul Pathak)
  - dt-bindings: clock: Add RPMI clock service controller bindings (Anup Patel)
  - dt-bindings: clock: Add RPMI clock service message proxy bindings (Anup Patel)
  - mailbox: Add RISC-V SBI message proxy (MPXY) based mailbox driver (Anup Patel)
  - byteorder: Add memcpy_to_le32() and memcpy_from_le32() (Anup Patel)
  - mailbox: Add common header for RPMI messages sent via mailbox (Anup Patel)
  - RISC-V: Add defines for the SBI message proxy extension (Anup Patel)
  - dt-bindings: mailbox: Add bindings for RISC-V SBI MPXY extension (Anup Patel)
  - dt-bindings: mailbox: Add bindings for RPMI shared memory transport (Anup Patel)
  - mailbox: Use guard/scoped_guard for spinlock (Peng Fan)
  - driver core: Split devres APIs to device/devres.h (Andy Shevchenko)
  - kernel.h: removed REPEAT_BYTE from kernel.h (Tanzir Hasan)
  - dev_printk: add new dev_err_probe() helpers (Nuno Sa)
  - Documentation: ACPI: Use all-string data node references (Sakari Ailus)
  - ACPI: property: Support using strings in reference properties (Rafael J. Wysocki)
  - anolis: sched/sli: fix block_latency and nr_uninterruptible not accounting for non-iowait D state (Qihang Zhou)


author: Tianchen Ding <dtcccc@linux.alibaba.com> [6.6.102-7_rc2.an23]
changelog:
  - anolis: changelog: sync and consolidate historical changelogs (Tianchen Ding)
  - io_uring: fix retry handling off iowq (Pavel Begunkov)
  - io_uring/rw: ensure reissue path is correctly handled for IOPOLL (Jens Axboe)
  - io_uring/rw: don't gate retry on completion context (Jens Axboe)
  - io_uring/rw: handle -EAGAIN retry at IO completion time (Jens Axboe)
  - anolis: io_uring/rw: fix imu union misuse in is_kbuf check (Ferry Meng)
  - io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs (Caleb Sander Mateos)
  - io_uring/rsrc: don't rely on user vaddr alignment (Pavel Begunkov)
  - io_uring/rsrc: fix folio unpinning (Pavel Begunkov)
  - io_uring: fix potential page leak in io_sqe_buffer_register() (Penglei Jiang)
  - io_uring/ublk: report error when unregister operation fails (Caleb Sander Mateos)
  - io_uring: add support for kernel registered bvecs (Keith Busch)
  - io_uring/rsrc: change ubuf->ubuf_end to length tracking (Jens Axboe)
  - io_uring/rsrc: get rid of io_mapped_ubuf->folio_mask (Jens Axboe)
  - io_uring/rsrc: add reference count to struct io_mapped_ubuf (Jens Axboe)
  - io_uring/rsrc: clear 'slot' entry upfront (Jens Axboe)
  - io_uring/rsrc: enable multi-hugepage buffer coalescing (Chenliang Li)
  - io_uring/rsrc: store folio shift and mask into imu (Chenliang Li)
  - anolis: mm: pagecache_limit: use rate-limited stats flush to reduce lock contention (Weilin Tong)
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) {CVE-2026-46242}
  - eventpoll: move epi_fget() up (Christian Brauner) {CVE-2026-46242}
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: kill __ep_remove() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: split __ep_remove() (Christian Brauner) {CVE-2026-46242}
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) {CVE-2026-46242}
  - file: add fput() cleanup helper (Christian Brauner) {CVE-2026-46242}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) {CVE-2026-53166}
  - anolis: virtio_net: align virtnet_rq_dma to cache line for DMA address alignment (Wen Gu)
  - anolis: x86/stacktrace: Mark arch_stack_walk() and unwinder functions notrace (Yuanhe Shu)
  - anolis: selftest/cgroup: fix spurious test_cpuset_prs.sh failure due to timing (Tianchen Ding)
  - anolis: selftests: iommu: fix macro redefinition warnings (Tianchen Ding)
  - vfio: selftests: Drop <uapi/linux/types.h> includes (David Matlack)
  - tools include: Add definitions for __aligned_{l,b}e64 (David Matlack)
  - selftests/hid: ensure we can compile the tests on kernels pre-6.3 (Benjamin Tissoires)
  - dt: dt-extract-compatibles: Add flag for driver matching compatibles (Nícolas F. R. A. Prado)


author: Tianchen Ding <dtcccc@linux.alibaba.com> [6.6.102-7_rc2.1.an23]
changelog:
  - anolis: sched: fix some bugs of group balancer (CruzZhao)
  - anolis: mm: pagecache_limit: fix unit mismatch of reclaim_bytes (Weilin Tong)
  - anolis: mm: pagecache_limit: make reclaim work under MGLRU (Weilin Tong)
  - perf/x86/amd: Reject branch stack for IBS events (Namhyung Kim)
  - mm/page_alloc: avoid direct compaction for costly __GFP_NORETRY allocations (Yuanhe Shu)
  - xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) {CVE-2026-64600}
  - perf vendor events: Update Sapphirerapids events/metrics (Ian Rogers)
  - perf jevents: Drop or simplify small integer values (Ian Rogers)
  - anolis: security: lua-lsm: drop eager kvcache dict init in task_blob_init (Zongyao Chen)
  - anolis: security: lua-lsm: keep the idle hook path frame-free (Zongyao Chen)
  - anolis: security: lua-lsm: drop eager kvcache dict init (Zongyao Chen)
  - anolis: security: lua-lsm: hide more unsupported hooks (Zongyao Chen)
  - anolis: security: lua-lsm: add file_mprotect VMA object (Zongyao Chen)
  - anolis: mm: shrinker: fix invalid kfree and async UAF for old KAPI shrinkers (Yuanhe Shu)
  - anolis: mm: shrinker: fix UAF in old KAPI register_shrinker_prepared() (Yuanhe Shu)
  - mm: do not install PMD mappings when handling a COW fault (Zhang Yi)
  - perf: arm_pmuv3: Use BR_RETIRED for HW branch event if enabled (Ilkka Koskinen)
  - ACPI: processor: idle: Fix NULL pointer dereference in hotplug path (Huisong Li)
  - ACPI: processor: idle: Add missing bounds check in flatten_lpi_states() (Jingkai Tan)
  - cpufreq: conservative: Simplify frequency limit handling (Lifeng Zheng)
  - cpufreq: Avoid redundant target() calls for unchanged limits (Viresh Kumar)
  - cpufreq: Fix typo in comment (Viresh Kumar)
  - arm64: smp: Do not mark secondary CPUs possible under nosmp (Pengjie Zhang)
  - drivers/perf: hisi: Add cacheable option for L3C PMU (Yicong Yang)
  - gpio: hisi: Fix format specifier (Devyn Liu)
  - cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost (Lifeng Zheng)
  - anolis: configs: classify CONFIG_HAVE_KVM_READONLY_MEM as L2 for appropriate scope (PVS.NarasimhaRao)
  - anolis: sw_64/kvm: select HAVE_KVM_READONLY_MEM (PVS.NarasimhaRao)
  - kvm: replace __KVM_HAVE_READONLY_MEM with Kconfig symbol (Paolo Bonzini)
  - anolis: mm/page_alloc: fix __SetPageInited missing tail page in __free_pages_core (Weilin Tong)
  - anolis: mm/page_reporting: fix suitable_free_pages missing order-10 in threshold calculation (Weilin Tong)


author: Tianchen Ding <dtcccc@linux.alibaba.com> [6.6.102-7.an23]
changelog:
  - perf pmu: Skip test on Arm64 when #slots is zero (Leo Yan)
  - riscv: ftrace: Properly acquire text_mutex to fix a race condition (Alexandre Ghiti)


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 7.1-1
changelog:
  - Update to 7.1-1 from 7.0-1
  - Add bash completion support for filestreaminfo, keys, gettconinfo
    [Patches cherry-pick from c10s. Original changelog:
     - Update to version 7.1]


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 8.4.0-6
changelog:
  - cherry-pick fix CVE-2024-2004 and add Epoch for requires and provides
  - Fix CVE-2023-46218 and CVE-2023-46219


author: lzq11122 <lzq02303433@alibaba-inc.com> - 8.4.0-13
changelog:
  - Add patch to fix CVE-2025-15224,CVE-2025-14017,CVE-2025-14819,CVE-2025-14524,CVE-2025-15079,CVE-2025-10966


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 2.90-1
changelog:
  - Update to 2.90-1 from 2.89-1
  - Migrated to SPDX license
  - Remove patch which already exist in code


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 2.5.0-3
changelog:
  - to #IAGL53:CVE-2023-52425
  - add patch to fix CVE-2023-52425
  - Project: TC2024080204
  - Signed-off-by: mgb01105731 mgb01105731@alibaba-inc.com


author: wh02252983 <wh02252983@alibaba-inc.com> - 2.5.0-4
changelog:
  - add patch to Fix cve-2024-45490 and cve-2024-45491 and cve-2024-45492
  - add patch to Fix cve-2024-50602 and cve-2024-28757


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 14.2-1
changelog:
  - Update to 14.2 from 13.2
  - Delete patches by the reason of the existence of similar fixes upstream and
    IA64 support drop and the new version of tarball already includes changes.
  - Add patches to fix .gdb_index sections are not reproducible and 
    move gdbpy_gil into python-internal.h and 
    avoid use of _PyOS_ReadlineTState and
    Fix -Walloc-size warnings and 
    Fix workaround for GCC 14 problem and
    Add arch14 record/replay support and
    Add support for Power11 options and
    Update x86 disassembler and 
    Fix installer expects xxgdb on disk1 but it is on disk2
    [Patches cherry-pick from c10s. Original changelog:
    - Fixup broken tests in existing patches(14.2-4)]


author: zjl002254423 <zjl02254423@alibaba-inc.com> -2.12-15
changelog:
  - Fix CVE-2024-56738,CVE-2024-56737,CVE-2024-45774,CVE-2024-45775,CVE-2024-45776,CVE-2024-45777,CVE-2024-45778,CVE-2024-45779,CVE-2024-45780,CVE-2024-45781,CVE-2024-45782,CVE-2024-45783,CVE-2025-0622,CVE-2025-0624,CVE-2025-0677,CVE-2025-0678,CVE-2025-0684,CVE-2025-0685,CVE-2025-0686,CVE-2025-0689,CVE-2025-0690,CVE-2025-1118,CVE-2025-1125


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 1.24.10-1
changelog:
  - to  #IBB1O6 , #IBGORE , #IBGORH , #IBGORK , #IBGORQ , #IBGORT , #IBGORZ , #IBGOS7
  - New version 1.24.10 for gstreamer1-plugins-base 1.24.10
  - Project: TC2024080204
  - Signed-off-by: mgb01105731 mgb01105731@alibaba-inc.com


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1.28.1-1
changelog:
  - Update to 1.28.1
  - Fix CVE-2026-3086, CVE-2026-3085, CVE-2026-3081, CVE-2026-2922, CVE-2026-2921,
  - CVE-2026-2920, CVE-2026-3082, CVE-2026-3083


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1.26.4-1
changelog:
  - Update to 1.26.4 to fix CVE-2025-6663
  - CVE-2025-3887 has been fixed in this release, remove the patch


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1.28.5-1
changelog:
  - Update to 1.28.5
  - Fix CVE-2026-59691, CVE-2026-52722, CVE-2026-52721, CVE-2026-14935, CVE-2026-12891, CVE-2026-3085
  - Remove CVE patches that have been included in this version


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 1.24.10-1
changelog:
  - New versino 1.24.10 for CVE-2024-4453,CVE-2024-47835,CVE-2024-47538,CVE-2024-47600,CVE-2024-47615,CVE-2024-47607,CVE-2024-47541,CVE-2024-47542


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 1.24.10-1
changelog:
  - New version 1.24.10 for CVE-2024-47778,CVE-2024-47776,CVE-2024-47613,CVE-2024-47777,CVE-2024-47834,CVE-2024-47602,CVE-2024-47603,CVE-2024-47606,CVE-2024-47775,CVE-2024-47774,CVE-2024-47599,CVE-2024-47598,CVE-2024-47601,CVE-2024-47546,CVE-2024-47544,CVE-2024-47545,CVE-2024-47543,CVE-2024-47539,CVE-2024-47596,CVE-2024-47540,CVE-2024-47597


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1.8.2-1
changelog:
  - Update to 1.8.2
  - Fix CVE-2026-54679, CVE-2026-49839, CVE-2026-47770
  - Remove patches because the changes already exist upstream


author: ali-inspur <shenzhongli@inspur.com> - 2.0.8-1
changelog:
  - Update to 2.0.8
  - Fix CVE-2026-56002 CVE-2026-56003
  - Remove cve patch that are already been included in this version


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 5.1-1
changelog:
  - Update to 5.1 from 4.12
  - Add patches to first try blanc password to avoid uselessly prompting
  - Add patches to refcnt struct secret_pubkey_stuff when passing to helper thread
    [Patches cherry-picked from c10s. Original changelog:
    - ipsec: fix duplicate --ctlsocket option for whack(5.1-6)]


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1.11.1-1
changelog:
  - Update to 1.11.1 and add patches to fix CVE-2025-15661
  - Fix CVE-2025-15661 (out-of-bounds read in sftp_symlink on malformed packets) 
  - - by backporting the upstream fix commit 2dae3024 along with its prerequisite 
  - - dependency commits from libssh2 1.11.1.
  - Update CVE-2026-7598 patch 
  - - (out-of-bounds write risk from missing username_len bounds checking in userauth.c)
  - - by backporting the upstream fix commit 256d04b6 along with its prerequisite 
  - - dependency commits from commit 2dae3024.
  - Update CVE-2026-55199 patch
  - - (unbounded loop from unchecked _libssh2_get_string() return values
  - - in the EXT_INFO handler) by backporting the upstream fix commit 17626857 along
  - - with its prerequisite dependency commits from commit 256d04b6.
  - Drop libssh2-1.11.0-strict-modes.patch, now redundant since the backported
  - - CVE fixes already carry an equivalent "StrictModes no" fix in test_sshd.test.
  - Rebase libssh2-1.11.1-update-rpath-format.patch onto m4/lib-link.m4 and switch
  - - autoreconf to -fv (drop -i), so the rpath fix survives the autoreconf run
  - - added to regenerate the build system for the CVE patches.


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 4.6.0-1
changelog:
  - Update to 4.6.0 from 4.5.1
  - Remove libtiff-opengl by reason of tiffgt been removed
  - Fix CVE-2023-52355
  - Add patches to fix CVE-2024-7006
  - Remove patch as the new version of tarball already includes changes.
  - Remove patches as this version removes a big number of utilities that 
    have suffered from lack of maintenance over the years
    [Patches cherry-pick from c10s. Original changelog:
    - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo(4.6.0-4)]


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 4.6.0-2
changelog:
  - to #IAGL52
  - Add patch to fix CVE-2023-52356
  - project: TC2024080204
  - Signed-off-by: mgb01105731 <mgb01105731@alibaba-inc.com>


author: Zhou Yunfei <yunfei_zhou@linux.alibaba.com> - 1.2.13-6
changelog:
  - inflate rvv chunkcopy use runtime vector length, fix decompression
    corruption when running on hardware with VLEN larger than build-time
    assumption (e.g. vlen128 build on vlen256 core)
  - adler32 rvv fix uint16 weighted-sum overflow on VLEN>=1024


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 1.25.0-1
changelog:
  - to #IBHCKY , #IAGL3S , #IAGL3Y
  - update version 1.25.0 for CVE-2024-46657,CVE-2023-51106,CVE-2023-51107
  - Project: TC2024080204
  - Signed-off-by: mgb01105731 mgb01105731@alibaba-inc.com


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1:1.30.4-1
changelog:
  - Update to 1.30.4
  - Fix CVE-2026-60005, CVE-2026-56434, CVE-2026-42533
  - Remove CVE patches that are fixed in 1.30.4


author: lzq11122 <lzq02303433@alibaba-inc.com> - 1:22.22.0-1
changelog:
  - Update to 22.22.0 to fix CVE-2025-59465,CVE-2025-55131,CVE-2025-59466,CVE-2026-21637,CVE-2025-55130,CVE-2025-55132


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1:22.23.0-1
changelog:
  - Update to 22.23.0
  - Fix CVE-2026-48937, CVE-2026-48935, CVE-2026-48934, CVE-2026-48933, CVE-2026-48931, CVE-2026-48930, CVE-2026-48928, CVE-2026-48619, CVE-2026-48618, CVE-2026-48617, CVE-2026-48615, CVE-2026-2581, CVE-2026-1528
  - Remove CVE patches that are useless


author: Cheng Yang <yc02267530@alibaba-inc.com> - 9.6p1-1
changelog:
  - update to 9.6p1
  - The patch was removed because the new version already included the patch content


author: taifu.gc <taifu.gc@linux.alibaba.com> - 9.6p1-10
changelog:
  - Support OpenSSL 3.5.x and 4.x versions in configure (upstream commit 54abadd)
  - Fix build failure: Unknown/unsupported OpenSSL version 3.5.4


author: ali-inspur <shenzhongli@inspur.com> - 1.47-1
changelog:
  - Update to 1.47 to fix CVE-2026-57076
  - Remove cves patch that are already been included in this version


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 8.3.15-1
changelog:
  - Update to 8.3.15-1 from 8.2.27-1
  - Migrated to SPDX license
  - Remove patches which already exist in code
  - enable command history in phpdbg, add internal UTC if tzdata is missing and backport Argon2 password hashing in OpenSSL ext
    [Patches cherry-pick from c10s. Original changelog:
    - rebase to 8.3.7
      backport Argon2 password hashing in OpenSSL ext
    - update to 8.3.0RC3 https://fedoraproject.org/wiki/Changes/php83
      add internal UTC if tzdata is missing
      bump to final API/ABI
      switch to nikic/php-parser version 5
      openssl: always warn about missing curve_name
    - rebase to 8.3.12
      enable command history in phpdbg
  ]


author: tomcruiseqi <tomcruiseqi@inspur.com> - 8.3.31-1
changelog:
  - Update to 8.3.31
  - Fix CVE-2026-7568, CVE-2026-7262, CVE-2026-6735, CVE-2026-6722
  - Remove patches that are already been merged


author: ali-inspur <shenzhongli@inspur.com> - 12.3.0-1
changelog:
  - Update to 12.3.0 to fix CVE-2026-55379 CVE-2026-54059 CVE-2026-54060
  - Remove cves patch that are already been included in this version


author: lzq11122 <lzq02303433@alibaba-inc.com> - 6.5.6-1
changelog:
  - Update to 6.5.6 to fix CVE-2026-49853,CVE-2026-49854,CVE-2026-49855
  - Remove patch new version included


author: tomcruiseqi <tomcruiseqi@inspur.com> - 0.23.0-1
changelog:
  - Update to 0.23.0
  - Fix CVE-2025-48431, CVE-2026-43870, CVE-2026-43869, CVE-2026-41636, CVE-2026-41607, CVE-2026-41606, CVE-2026-41605, CVE-2026-41604, CVE-2026-41603, CVE-2026-41602
  - Exclude loongarch64 for build errors


author: tomcruiseqi <tomcruiseqi@inspur.com> - 0.24.0-1
changelog:
  - Update to 0.24.0
  - Fix CVE-2026-66053, CVE-2026-58389, CVE-2026-55970, CVE-2026-55969, CVE-2026-55968, CVE-2026-49158, CVE-2026-48586, CVE-2026-48145, CVE-2026-48144, CVE-2026-45112, CVE-2026-43871, CVE-2026-41608


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 1.17.1-3
changelog:
  - to #IBGLMU
  - add patch to fix CVE-2024-33655
  - Project: TC2024080204
  - Signed-off-by: mgb01105731 mgb01105731@alibaba-inc.com


author: lzq11122 <lzq02303433@alibaba-inc.com> - 1.17.1-11
changelog:
  - Add patch to fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1.17.1-14
changelog:
  - Fix CVE-2026-44690,CVE-2026-50251,CVE-2026-50046,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416,CVE-2026-50248,CVE-2026-50243


author: tomcruiseqi <tomcruiseqi@inspur.com> - 3.10.20-1
changelog:
  - Update to 3.10.20
  - Fix CVE-2026-9669, CVE-2026-7774
  - Remove patches that has been fixed in this version.


author: Bo Ren <rb01097748@alibaba-inc.com> - 3.11.6-9
changelog:
  - fix CVE-2024-9287
  - fix CVE-2024-0450
  - fix CVE-2024-4032
  - fix CVE-2025-4517
  - fix CVE-2024-3219
  - fix CVE-2024-7592
  - fix CVE-2024-8088
  - fix CVE-2023-27043
  - fix CVE-2024-6232
  - fix CVE-2024-6923


author: lzq11122 <lzq02303433@alibaba-inc.com> - 3.11.6-14
changelog:
  - Add patch to fix CVE-2025-15367,CVE-2025-15366,CVE-2026-0672,CVE-2026-1299,CVE-2026-0865,CVE-2025-15282


author: wangzhe <wanglan.wz@alibaba-inc.com> - 0.8.3-2
changelog:
  - update to 0.8.3
  - support mc event stat
  - support poison stat
  - support log level
  - support nvgpu event


author: zhangxinghao <zhangxinghao@kunlunit.com> - 0.8.3-3
changelog:
  - update the supported modules in the HiSilicon common section and
    a fix in the ras-events.c for the CPU isolatation


author: lzq11122 <lzq02303433@alibaba-inc.com> - 7.2.14-1
changelog:
  - Update to 7.2.14 to fix CVE-2026-23479,CVE-2026-25243,CVE-2026-23631
  - Remove patch new version fixed


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 1.8.0.2-1
changelog:
  - to #IBHDBL
  - update to 1.8.0.2 for CVE-2024-54661
  - Project: TC2024080204
  - Signed-off-by: mgb01105731 mgb01105731@alibaba-inc.com


author: Weisson <Weisson@linux.alibaba.com> - 2:1.35-1
changelog:
  - Update to 1.35 from 1.34
  - Remove patches that exist in the new version
  - Fix spurious diagnostic during extraction of . with  --keep-newer-files
  - Add exclude17 and exclude18 tests which were forgotten by
  - Revert "Fix savannah bug #63567"
   [Patches cherry-picked from c10s. Original changelog:
     - Revert "Fix savannah bug #63567" (1.35-5)]


author: zjl002254423 <zjl02254423@alibaba-inc.com> -3:9.0.2092-8
changelog:
  - Add patch to fix CVE-2025-22134,CVE-2025-26603,CVE-2024-1215,CVE-2025-29768,CVE-2024-41957,CVE-2024-41965


author: lzq11122 <lzq02303433@alibaba-inc.com> - 3:9.0.2092-10
changelog:
  - Add patch to fix CVE-2026-25749,CVE-2026-26269,CVE-2026-28421,CVE-2026-28419,CVE-2026-28420,CVE-2026-28422,CVE-2026-28418


author: Chang Gao <gc-taifu@linux.alibaba.com> - 1.24.5-1
changelog:
  - Fix CVE-2024-38428
  - Remove patch which already exist in upstream
  - Add patches to fix some bugs
    [Patches cherry-picked from c10s. Original changelog:
    - Revert back to using GnuTLS as the TLS backend
    - Use bundled implementation of MD4 for NTLM (1.24.5-5)]


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1:4.4.15-1
changelog:
  - Update to 4.4.15
  - Fix CVE-2026-7379, CVE-2026-7378, CVE-2026-7376, CVE-2026-7375, CVE-2026-6870, CVE-2026-6869, CVE-2026-6868, CVE-2026-6867, CVE-2026-6538, CVE-2026-6537, CVE-2026-6535, CVE-2026-6534, CVE-2026-6533, CVE-2026-6532, CVE-2026-6531, CVE-2026-6530, CVE-2026-6529, CVE-2026-6527, CVE-2026-6524, CVE-2026-6523, CVE-2026-6522, CVE-2026-6521, CVE-2026-6520, CVE-2026-6519, CVE-2026-5657, CVE-2026-5656, CVE-2026-5654, CVE-2026-5653, CVE-2026-5409, CVE-2026-5408, CVE-2026-5407, CVE-2026-5406, CVE-2026-5405, CVE-2026-5404, CVE-2026-5403, CVE-2026-5401, CVE-2026-5299
  - Remove patches that are already been included


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1:4.4.17-1
changelog:
  - Update to 4.4.17
  - Fix CVE-2026-15174, CVE-2026-15172, CVE-2026-15171, CVE-2026-15170, CVE-2026-15169, CVE-2026-15167, CVE-2026-15166, CVE-2026-15164


author: wenxin <wx02272781@alibaba-inc.com> - 1:1.20.14-19
changelog:
  - Add patches to fix CVE-2025-26594,CVE-2025-26595,CVE-2025-26596,
    CVE-2025-26597,CVE-2025-26598,CVE-2025-26600,CVE-2025-26601


author: wenyuzifang <lzx02244079@alibaba-inc.com> - 23.2.5-3
changelog:
  - fix CVE-2024-9632
  - fix CVE-2025-26601
  - fix CVE-2025-26596
  - fix CVE-2025-26594
  - fix CVE-2025-26597
  - fix CVE-2025-26598
  - fix CVE-2025-26600
  - fix CVE-2025-26595
  - fix CVE-2025-26599


author: mgb01105731 <mgb01105731@alibaba-inc.com> - 23.2.5-4
changelog:
  - Add patches to fix CVE-2025-49175,CVE-2025-49176,CVE-2025-49177,
    CVE-2025-49178,CVE-2025-49179,CVE-2025-49180


author: tomcruiseqi <tomcruiseqi@inspur.com> - 1:0.10.6-1
changelog:
  - Update to 0.10.6
  - Fix CVE-2026-35512, CVE-2026-33689, CVE-2026-33516, CVE-2026-33145, CVE-2026-32624, CVE-2026-32623, CVE-2026-32107, CVE-2026-32105
  - Remove patches that are already included
  - Update patches and add some patches for 0.10.x


