Syzbot CI

Subject	6.18.57-rc1 review
Author	gregkh@linuxfoundation.org
Date	2026-10-13 11:29:56 +0000 UTC
Version
Cc	achill@achill.org akpm@linux-foundation.org broonie@kernel.org conor@kernel.org f.fainelli@gmail.com gregkh@linuxfoundation.org hargar@microsoft.com jonathanh@nvidia.com linux-kernel@vger.kernel.org linux@roeck-us.net lkft-triage@lists.linaro.org patches@kernelci.org patches@lists.linux.dev pavel@nabladev.com rwarsow@gmx.de shuah@kernel.org sr@sladewatkins.com stable@vger.kernel.org sudipm.mukherjee@gmail.com torvalds@linux-foundation.org

Name	Content [All]
[PATCH 6.18 001/621] bnxt_en: fix DMA mapping length for padded small packets	[Body]
[PATCH 6.18 002/621] fs: Free any excess xarray nodes in clear_inode()	[Body]
[PATCH 6.18 003/621] net/mlx5e: Prevent stale XSK buffer release on refill retry	[Body]
[PATCH 6.18 004/621] net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry	[Body]
[PATCH 6.18 005/621] net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()	[Body]
[PATCH 6.18 006/621] net: mana: Skip WQ object destruction for uninitialized RXQ	[Body]
[PATCH 6.18 007/621] netfs: zero the tail of a short DIO/unbuffered read	[Body]
[PATCH 6.18 008/621] doc/netlink: netlink-raw: Add max check	[Body]
[PATCH 6.18 009/621] ynl: fix schema check errors	[Body]
[PATCH 6.18 010/621] accel/amdxdna: Bound the sync_bo flush range to the BO size	[Body]
[PATCH 6.18 011/621] f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()	[Body]
[PATCH 6.18 012/621] f2fs: fix to reset all pinned status during fggc	[Body]
[PATCH 6.18 013/621] net: dsa: mt7530: fix .get_stats64 sleeping in atomic context	[Body]
[PATCH 6.18 014/621] crypto: drbg - Fix ineffective sanity check	[Body]
[PATCH 6.18 015/621] ipv6: Fix redirect exception creation for UDP/RAW sockets	[Body]
[PATCH 6.18 016/621] ipv4: validate checksum_start before completing checksum	[Body]
[PATCH 6.18 017/621] rust_binder: reschedule node refcount update on thread exit	[Body]
[PATCH 6.18 018/621] ipv4: stop PMTU walk when nexthop group shrinks	[Body]
[PATCH 6.18 019/621] ipv4: stop exception dump when nexthop group shrinks	[Body]
[PATCH 6.18 020/621] ipv4: stop route notification sizing when nexthop group shrinks	[Body]
[PATCH 6.18 021/621] ipv4: do not warn on route notification size race	[Body]
[PATCH 6.18 022/621] ipv6: do not warn on route notification size race	[Body]
[PATCH 6.18 023/621] Input: ati_remote2 - fix type confusion in device attribute handlers	[Body]
[PATCH 6.18 024/621] Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox	[Body]
[PATCH 6.18 025/621] Input: xpad - add support for Corsair Novablade Pro	[Body]
[PATCH 6.18 026/621] ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers	[Body]
[PATCH 6.18 027/621] ALSA: hda/tas2781: Accept V1 calibration data without CRC	[Body]
[PATCH 6.18 028/621] arm64: irq: exclude the softirq stack switch from KCOV	[Body]
[PATCH 6.18 029/621] ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)	[Body]
[PATCH 6.18 030/621] btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()	[Body]
[PATCH 6.18 031/621] cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()	[Body]
[PATCH 6.18 032/621] cipso: adjust cached option offsets when removing CIPSO	[Body]
[PATCH 6.18 033/621] dm ioctl: dont let data_start run past the buffer	[Body]
[PATCH 6.18 034/621] usb: f81604: fix struct f81604_int_data size mismatch	[Body]
[PATCH 6.18 035/621] vsock/virtio: account only unread bytes in read_skb()	[Body]
[PATCH 6.18 036/621] wifi: brcmfmac: fix P2P device removal race in brcmf_detach()	[Body]
[PATCH 6.18 037/621] wifi: mt76: mt7603: initialize global station WCID	[Body]
[PATCH 6.18 038/621] wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()	[Body]
[PATCH 6.18 039/621] wireguard: queueing: preserve tstamp_type when encapsulating packet	[Body]
[PATCH 6.18 040/621] wireguard: noise: reject response consumption after intermediate initiation	[Body]
[PATCH 6.18 041/621] workqueue: Fix NULL current_pwq deref in chained work check	[Body]
[PATCH 6.18 042/621] xen/netfront: dont leak the skb when xennet_fill_frags() fails	[Body]
[PATCH 6.18 043/621] tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()	[Body]
[PATCH 6.18 044/621] strparser: make sure __strp_recv isnt running before tearing down the parser	[Body]
[PATCH 6.18 045/621] swiotlb: fix default_swiotlb_limit() for non-growable default pool	[Body]
[PATCH 6.18 046/621] tcp: reject net_iov in zerocopy receive mapping hints	[Body]
[PATCH 6.18 047/621] tipc: destroy topsrv workqueues before closing connections	[Body]
[PATCH 6.18 048/621] tipc: hold a reference to nodes found by link name	[Body]
[PATCH 6.18 049/621] Revert "wifi: libertas: reject short monitor TX frames"	[Body]
[PATCH 6.18 050/621] RISC-V: Clear HSTATUS.HU on CPU initialization	[Body]
[PATCH 6.18 051/621] selinux: fix data race on AVC latest_notif	[Body]
[PATCH 6.18 052/621] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts	[Body]
[PATCH 6.18 053/621] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute	[Body]
[PATCH 6.18 054/621] EDAC/amd64: Mask UMC chip select to the four implemented selects	[Body]
[PATCH 6.18 055/621] gpio: mpsse: fix race when arming the IRQ poll worker	[Body]
[PATCH 6.18 056/621] gpio: xilinx: fix runtime PM leak on request error path	[Body]
[PATCH 6.18 057/621] gve: fix napi_disable deadlock when attempting to disable XSK pools	[Body]
[PATCH 6.18 058/621] gve: fix XSK buffer leak when rings are stopped	[Body]
[PATCH 6.18 059/621] gve: fix XSK buffer leak on error descriptor	[Body]
[PATCH 6.18 060/621] ibmveth: h_free logical LAN on open-fail after register	[Body]
[PATCH 6.18 061/621] ibmveth: fix TX LTB and filter unwind on open-fail	[Body]
[PATCH 6.18 062/621] ice: fix use-after-free in dynamic port cleanup	[Body]
[PATCH 6.18 063/621] ice: fix metadata_dst refcount handling on representor teardown	[Body]
[PATCH 6.18 064/621] keys: finalize persistent keyring timeout after link attempt	[Body]
[PATCH 6.18 065/621] KEYS: Fix add_key() race with keyring restriction	[Body]
[PATCH 6.18 066/621] memstick: core: wait for request completion before freeing card	[Body]
[PATCH 6.18 067/621] memstick: rtsx_usb_ms: complete requests after eject instead of dropping them	[Body]
[PATCH 6.18 068/621] mm: dont schedule deferred kernel page table freeing while booting	[Body]
[PATCH 6.18 069/621] dm-crypt: reject the lmk IV mode with AEAD ciphers	[Body]
[PATCH 6.18 070/621] dm-integrity: fix buffer overflow in inline mode with large tag size	[Body]
[PATCH 6.18 071/621] dm-snap: reject the transient exception store for snapshot-merge	[Body]
[PATCH 6.18 072/621] dm: fix reading free memory in do_resume	[Body]
[PATCH 6.18 073/621] mmc: cavium-octeon: destroy slot platform devices on remove	[Body]
[PATCH 6.18 074/621] mmc: cavium-thunderx: destroy slot platform devices on remove	[Body]
[PATCH 6.18 075/621] mmc: mtk-sd: Cancel request timeout work on remove	[Body]
[PATCH 6.18 076/621] mmc: sdhci-sprd: disable runtime PM on remove	[Body]
[PATCH 6.18 077/621] net/packet: guard the ll header push in packet_rcv_spkt()	[Body]
[PATCH 6.18 078/621] net/smc: protect clcsock lifetime in smc_getname	[Body]
[PATCH 6.18 079/621] net: bridge: avoid recursive multicast port cleanup	[Body]
[PATCH 6.18 080/621] net: dsa: microchip: fix KSZ8765 fiber detection	[Body]
[PATCH 6.18 081/621] net: skbuff: dont leave stale bytes in skb_copy_and_csum_bits()	[Body]
[PATCH 6.18 082/621] net: sparx5: free the matchall entry on destroy	[Body]
[PATCH 6.18 083/621] net: usb: ax88179_178a: fix rx frame length for non-last packets	[Body]
[PATCH 6.18 084/621] net: team: stop reusing skb after queue override	[Body]
[PATCH 6.18 085/621] net: team: free skb when broadcast has no txable port	[Body]
[PATCH 6.18 086/621] nvme: fix swapped ZRASF zone state values for full and read only	[Body]
[PATCH 6.18 087/621] openvswitch: fix soft lockup in the netlink flow dump	[Body]
[PATCH 6.18 088/621] optee: register TEE devices only once fully initialized	[Body]
[PATCH 6.18 089/621] regulator: ltc3676: dont read the write-only HRST and CLIRQ registers	[Body]
[PATCH 6.18 090/621] regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4	[Body]
[PATCH 6.18 091/621] pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains	[Body]
[PATCH 6.18 092/621] pmdomain: rockchip: dont ignore clock lookup errors on attach	[Body]
[PATCH 6.18 093/621] pmdomain: rockchip: fix clock leak on domain probe failure	[Body]
[PATCH 6.18 094/621] pmdomain: rockchip: propagate subdomain add errors	[Body]
[PATCH 6.18 095/621] scsi: qedi: Initialize callback state before registration	[Body]
[PATCH 6.18 096/621] riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp	[Body]
[PATCH 6.18 097/621] riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE	[Body]
[PATCH 6.18 098/621] riscv: fix load_unaligned_zeropad() fixup for RV32	[Body]
[PATCH 6.18 099/621] riscv: futex: untag the user pointer before the atomic access	[Body]
[PATCH 6.18 100/621] riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header	[Body]
[PATCH 6.18 101/621] Bluetooth: btintel_pcie: use managed IRQ teardown	[Body]
[PATCH 6.18 102/621] Bluetooth: hci_sock: Serialize dead-device detachment	[Body]
[PATCH 6.18 103/621] Bluetooth: hci_sync: Fix command skb lifetime during scan setup	[Body]
[PATCH 6.18 104/621] Bluetooth: ISO: Reject concurrent BIS listener setup	[Body]
[PATCH 6.18 105/621] Bluetooth: ISO: Serialize concurrent connect calls	[Body]
[PATCH 6.18 106/621] Bluetooth: MGMT: Fix status of pending commands flushed on power off	[Body]
[PATCH 6.18 107/621] Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()	[Body]
[PATCH 6.18 108/621] Bluetooth: RFCOMM: free the skb when the DLC has no owner	[Body]
[PATCH 6.18 109/621] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown	[Body]
[PATCH 6.18 110/621] drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN	[Body]
[PATCH 6.18 111/621] drm/gud: dont keep a connector without a CRTC as connector_state	[Body]
[PATCH 6.18 112/621] drm/i915/gem: Prevent overstepping exec array boundary	[Body]
[PATCH 6.18 113/621] drm/i915/gt: Unmask interrupts only when ACTIVE is true	[Body]
[PATCH 6.18 114/621] drm/imagination: Size page table preallocation by device address	[Body]
[PATCH 6.18 115/621] drm/vc4: drain the hangcheck timer and works on V3D unbind	[Body]
[PATCH 6.18 116/621] drm/vc4: Fix firmware reference leak in vc4_drm_bind()	[Body]
[PATCH 6.18 117/621] drm/vmwgfx: validate pitch coming from userspace	[Body]
[PATCH 6.18 118/621] drm/xe: Fix shrinker accounting double-subtraction on nested external pins	[Body]
[PATCH 6.18 119/621] drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin	[Body]
[PATCH 6.18 120/621] drm/amdkfd: align SDMA doorbell base for shader doorbell writes	[Body]
[PATCH 6.18 121/621] drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info	[Body]
[PATCH 6.18 122/621] drm/amdgpu: serialize vblank counter reads against GPU reset	[Body]
[PATCH 6.18 123/621] drm/amdgpu: make Mac FB workaround generic	[Body]
[PATCH 6.18 124/621] drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks	[Body]
[PATCH 6.18 125/621] drm/amdgpu/userq: only accept doorbell BOs as queue doorbell	[Body]
[PATCH 6.18 126/621] drm/amdgpu/userq: return the memdup_user() error for the user MQD	[Body]
[PATCH 6.18 127/621] drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs	[Body]
[PATCH 6.18 128/621] mount: keep a copied mount unbindable	[Body]
[PATCH 6.18 129/621] fs: dont silently unmount busy mounts	[Body]
[PATCH 6.18 130/621] namespace: reset the old parents ->overmount in mnt_change_mountpoint()	[Body]
[PATCH 6.18 131/621] namespace: dont inherit MNT_UMOUNT in clone_mnt()	[Body]
[PATCH 6.18 132/621] namespace: dont copy an unmounted mount tree	[Body]
[PATCH 6.18 133/621] fs: refuse fspick() on internal superblocks	[Body]
[PATCH 6.18 134/621] namespace: check the target before walking it in do_mount_setattr()	[Body]
[PATCH 6.18 135/621] namespace: queue a mount only once for mount notifications	[Body]
[PATCH 6.18 136/621] namespace: check a submount for references right before unmounting it	[Body]
[PATCH 6.18 137/621] namespace: check a recursive bind mount for mount namespace loops	[Body]
[PATCH 6.18 138/621] namespace: look at the topmost mount for a mount namespace file	[Body]
[PATCH 6.18 139/621] namespace: remove the fsnotify marks of a mount namespace in process context	[Body]
[PATCH 6.18 140/621] namespace: check the mounts before reading their parents in pivot_root()	[Body]
[PATCH 6.18 141/621] dcache: dont put a mountpoint on a dentry thats being removed	[Body]
[PATCH 6.18 142/621] namespace: dont let a pseudo dentry become the root of a mount	[Body]
[PATCH 6.18 143/621] namespace: unhash a dentry before detaching the mounts on it	[Body]
[PATCH 6.18 144/621] namei: dont reveal overmounted entries in refwalk	[Body]
[PATCH 6.18 145/621] fcntl: refuse F_SET_RW_HINT on an immutable inode	[Body]
[PATCH 6.18 146/621] namespace: refuse an automount below a mount that is in no namespace	[Body]
[PATCH 6.18 147/621] namespace: never expire a locked mount	[Body]
[PATCH 6.18 148/621] namespace: handle mount locking for automounts correctly	[Body]
[PATCH 6.18 149/621] ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands	[Body]
[PATCH 6.18 150/621] accel/amdxdna: Enhance runtime power management	[Body]
[PATCH 6.18 151/621] accel/amdxdna: Add hardware specific attributes	[Body]
[PATCH 6.18 152/621] accel/amdxdna: Fix potential NULL pointer dereference in context cleanup	[Body]
[PATCH 6.18 153/621] PCI: Add WQ_PERCPU to alloc_workqueue() users	[Body]
[PATCH 6.18 154/621] PCI: endpoint: Add missing NULL check for alloc_workqueue()	[Body]
[PATCH 6.18 155/621] accel/amdxdna: Fix NULL pointer dereference of mgmt_chann	[Body]
[PATCH 6.18 156/621] blktrace: fix __this_cpu_read/write in preemptible context	[Body]
[PATCH 6.18 157/621] ice: remove legacy Rx and construct SKB	[Body]
[PATCH 6.18 158/621] ice: drop page splitting and recycling	[Body]
[PATCH 6.18 159/621] ice: fix crash in ethtool offline loopback test	[Body]
[PATCH 6.18 160/621] ice: fix rxq info registering in mbuf packets	[Body]
[PATCH 6.18 161/621] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz	[Body]
[PATCH 6.18 162/621] ti: icssg: convert to ndo_hwtstamp API	[Body]
[PATCH 6.18 163/621] net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues	[Body]
[PATCH 6.18 164/621] net: ti: icssg-prueth: Make emac_run_xdp function independent of page	[Body]
[PATCH 6.18 165/621] net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path	[Body]
[PATCH 6.18 166/621] Bluetooth: hci_event: move wake reason storage into validated event handlers	[Body]
[PATCH 6.18 167/621] ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()	[Body]
[PATCH 6.18 168/621] ALSA: ctxfi: Use explicit output flag for DAIO resources	[Body]
[PATCH 6.18 169/621] ALSA: ctxfi: Refactor resource alloc for sparse mappings	[Body]
[PATCH 6.18 170/621] ALSA: ctxfi: Check the error for index mapping	[Body]
[PATCH 6.18 171/621] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists	[Body]
[PATCH 6.18 172/621] static_call: allow using STATIC_CALL_TRAMP_STR() from assembly	[Body]
[PATCH 6.18 173/621] mshv: Refactor and rename memory region handling functions	[Body]
[PATCH 6.18 174/621] mshv: Centralize guest memory region destruction	[Body]
[PATCH 6.18 175/621] mshv: Move region management to mshv_regions.c	[Body]
[PATCH 6.18 176/621] mshv: Fix error handling in mshv_region_pin	[Body]
[PATCH 6.18 177/621] srcu: Use irq_work to start GP in tiny SRCU	[Body]
[PATCH 6.18 178/621] drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock	[Body]
[PATCH 6.18 179/621] drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35	[Body]
[PATCH 6.18 180/621] ASoC: qcom: q6asm: handle the responses after closing	[Body]
[PATCH 6.18 181/621] ASoC: qcom: q6asm: drop DSP responses for closed data streams	[Body]
[PATCH 6.18 182/621] hfs: Replace BUG_ON with error handling for CNID count checks	[Body]
[PATCH 6.18 183/621] btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()	[Body]
[PATCH 6.18 184/621] btrfs: remove reserved argument from btrfs_pin_extent()	[Body]
[PATCH 6.18 185/621] btrfs: dont BUG() on unexpected delayed ref type in run_one_delayed_ref()	[Body]
[PATCH 6.18 186/621] media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure	[Body]
[PATCH 6.18 187/621] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC	[Body]
[PATCH 6.18 188/621] soc/tegra: pmc: Fix unsafe generic_handle_irq() call	[Body]
[PATCH 6.18 189/621] scsi: qla2xxx: Completely fix fcport double free	[Body]
[PATCH 6.18 190/621] ASoC: amd: acp-mach-common: Add missing error check for clock acquisition	[Body]
[PATCH 6.18 191/621] gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit	[Body]
[PATCH 6.18 192/621] gfs2: Clean up quotad timeout handling	[Body]
[PATCH 6.18 193/621] gfs2: Add clean argument to lm_unmount hook	[Body]
[PATCH 6.18 194/621] gfs2: Asynchronous withdraw	[Body]
[PATCH 6.18 195/621] gfs2: Get rid of delayed withdraws	[Body]
[PATCH 6.18 196/621] gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn	[Body]
[PATCH 6.18 197/621] gfs2: fix memory leaks in gfs2_fill_super error path	[Body]
[PATCH 6.18 198/621] udf: fix partition descriptor append bookkeeping	[Body]
[PATCH 6.18 199/621] KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT	[Body]
[PATCH 6.18 200/621] media: iris: turn platform caps into constants	[Body]
[PATCH 6.18 201/621] media: iris: fix use-after-free of fmt_src during MBPF check	[Body]
[PATCH 6.18 202/621] drm/amd/display: Fix dc_link NULL handling in HPD init	[Body]
[PATCH 6.18 203/621] papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()	[Body]
[PATCH 6.18 204/621] pseries/papr-hvpipe: Fix race with interrupt handler	[Body]
[PATCH 6.18 205/621] drm/amdgpu/userq: fix access to stale wptr mapping	[Body]
[PATCH 6.18 206/621] Revert "net/smc: Introduce TCP ULP support"	[Body]
[PATCH 6.18 207/621] drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure	[Body]
[PATCH 6.18 208/621] drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure	[Body]
[PATCH 6.18 209/621] libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()	[Body]
[PATCH 6.18 210/621] ceph: put folios not suitable for writeback	[Body]
[PATCH 6.18 211/621] ice: reshuffle and group Rx and Tx queue fields by cachelines	[Body]
[PATCH 6.18 212/621] ice: fix race condition in TX timestamp ring cleanup	[Body]
[PATCH 6.18 213/621] ice: fix potential NULL pointer deref in error path of ice_set_ringparam()	[Body]
[PATCH 6.18 214/621] ice: fix double-free of tx_buf skb	[Body]
[PATCH 6.18 215/621] f2fs: fix data loss caused by incorrect use of nat_entry flag	[Body]
[PATCH 6.18 216/621] greybus: raw: fix use-after-free on cdev close	[Body]
[PATCH 6.18 217/621] powerpc/64s: Fix unmap race with PMD migration entries	[Body]
[PATCH 6.18 218/621] ublk: reset per-IO canceled flag on each fetch	[Body]
[PATCH 6.18 219/621] ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware	[Body]
[PATCH 6.18 220/621] ptp: ocp: fix resource freeing order	[Body]
[PATCH 6.18 221/621] wifi: cfg80211: enforce HE/EHT cap/oper consistency	[Body]
[PATCH 6.18 222/621] drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED	[Body]
[PATCH 6.18 223/621] net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind	[Body]
[PATCH 6.18 224/621] workqueue: devres: Add device-managed allocate workqueue	[Body]
[PATCH 6.18 225/621] power: supply: max77705: Drop duplicated IRQ error message	[Body]
[PATCH 6.18 226/621] power: supply: max77705: Free allocated workqueue and fix removal order	[Body]
[PATCH 6.18 227/621] fbdev: omap2: fix inconsistent lock returns in omapfb_mmap	[Body]
[PATCH 6.18 228/621] fbdev: omap2: fix use-after-free in omapfb_mmap	[Body]
[PATCH 6.18 229/621] f2fs: read COW data with the original inode during atomic write	[Body]
[PATCH 6.18 230/621] netfilter: nf_tables: add hook transactions for device deletions	[Body]
[PATCH 6.18 231/621] drm/amdgpu: fix amdgpu_hmm_range_get_pages	[Body]
[PATCH 6.18 232/621] KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor	[Body]
[PATCH 6.18 233/621] net: Introduce skb tc depth field to track packet loops	[Body]
[PATCH 6.18 234/621] net/sched: fix packet loop on netem when duplicate is on	[Body]
[PATCH 6.18 235/621] ACPI: button: Adjust event notification routines	[Body]
[PATCH 6.18 236/621] ACPI: button: Convert the driver to a platform one	[Body]
[PATCH 6.18 237/621] ACPI: button: Tweak acpi_button_remove()	[Body]
[PATCH 6.18 238/621] ACPI: button: Fix ACPI GPE handler leak during removal	[Body]
[PATCH 6.18 239/621] nvme-pci: fix dma mapping leak on data setup error	[Body]
[PATCH 6.18 240/621] nvme-pci: fix dma_vecs leak on p2p memory	[Body]
[PATCH 6.18 241/621] cachefiles: Fix error return when vfs_mkdir() fails	[Body]
[PATCH 6.18 242/621] afs: Fix the locking used by afs_get_link()	[Body]
[PATCH 6.18 243/621] netfs: Fix missing barriers when accessing stream->subrequests locklessly	[Body]
[PATCH 6.18 244/621] netfilter: x_tables: allow initial table replace without emitting audit log message	[Body]
[PATCH 6.18 245/621] netfilter: x_tables: allocate hook ops while under mutex	[Body]
[PATCH 6.18 246/621] wifi: mac80211: fix missing RX bitrate update for mesh forwarding path	[Body]
[PATCH 6.18 247/621] wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb	[Body]
[PATCH 6.18 248/621] net: hsr: defer node table free until after RCU readers	[Body]
[PATCH 6.18 249/621] erofs: fix metabuf leak in inode xattr initialization	[Body]
[PATCH 6.18 250/621] drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()	[Body]
[PATCH 6.18 251/621] netfs: Fix zeropoint update where i_size > remote_i_size	[Body]
[PATCH 6.18 252/621] KVM: guest_memfd: Treat memslot binding offset+size as unsigned values	[Body]
[PATCH 6.18 253/621] wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon	[Body]
[PATCH 6.18 254/621] smb/client: fix chown/chgrp with SMB3 POSIX Extensions	[Body]
[PATCH 6.18 255/621] ksmbd: prevent path traversal bypass by restricting caseless retry	[Body]
[PATCH 6.18 256/621] drm/amdgpu: Fix kernel panic during driver load failure	[Body]
[PATCH 6.18 257/621] drm/i915/gt: Fix NULL deref on sched_engine alloc failure	[Body]
[PATCH 6.18 258/621] idpf: fix max_vport related crash on allocation error during init	[Body]
[PATCH 6.18 259/621] LoongArch: BPF: Zero-extend signed ALU32 div/mod results	[Body]
[PATCH 6.18 260/621] drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers	[Body]
[PATCH 6.18 261/621] cifs: prevent readdir from changing file size due to stale directory metadata	[Body]
[PATCH 6.18 262/621] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths	[Body]
[PATCH 6.18 263/621] tipc: serialize udp bearer replicast list updates	[Body]
[PATCH 6.18 264/621] fwctl/bnxt_en: Refactor aux bus functions to be more generic	[Body]
[PATCH 6.18 265/621] bnxt_en: Handle partially initialized auxiliary devices	[Body]
[PATCH 6.18 266/621] drm/xe/guc: Hold device ref until queue teardown completes	[Body]
[PATCH 6.18 267/621] drm/xe/guc: Keep scheduler timeline name alive	[Body]
[PATCH 6.18 268/621] bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c	[Body]
[PATCH 6.18 269/621] bpf: Fix UAF in sock clone early bailouts	[Body]
[PATCH 6.18 270/621] wifi: cfg80211: use wiphy work for socket owner autodisconnect	[Body]
[PATCH 6.18 271/621] drm/amd/display: use kvzalloc to allocate struct dc	[Body]
[PATCH 6.18 272/621] net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains	[Body]
[PATCH 6.18 273/621] wifi: mac80211: validate extension-frame layout before RX	[Body]
[PATCH 6.18 274/621] ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC	[Body]
[PATCH 6.18 275/621] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD	[Body]
[PATCH 6.18 276/621] accel/amdxdna: reject user command submission without a command BO	[Body]
[PATCH 6.18 277/621] net/liquidio: drop cached VF pci_dev LUT	[Body]
[PATCH 6.18 278/621] accel/amdxdna: Fill invalid payload for failed command	[Body]
[PATCH 6.18 279/621] accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval	[Body]
[PATCH 6.18 280/621] accel/amdxdna: Fix VMA access race	[Body]
[PATCH 6.18 281/621] Bluetooth: 6lowpan: avoid untracked enable work	[Body]
[PATCH 6.18 282/621] net/mlx5: LAG, Fix off-by-one in single-FDB error rollback	[Body]
[PATCH 6.18 283/621] iomap: release pages on atomic dio size mismatch	[Body]
[PATCH 6.18 284/621] xen/pvcalls: bound backend response req_id before indexing rsp[]	[Body]
[PATCH 6.18 285/621] drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock	[Body]
[PATCH 6.18 286/621] tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()	[Body]
[PATCH 6.18 287/621] bpf: net: netfilter: drop dead NULL checks	[Body]
[PATCH 6.18 288/621] bpf: Guard conntrack opts error writes	[Body]
[PATCH 6.18 289/621] md/raid10: fix writes_pending leak on write request failures	[Body]
[PATCH 6.18 290/621] md/raid1: fix writes_pending and barrier reference leaks on write failures	[Body]
[PATCH 6.18 291/621] i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()	[Body]
[PATCH 6.18 292/621] fs/ntfs3: Reformat code and update terminology	[Body]
[PATCH 6.18 293/621] fs/ntfs3: call _ntfs_bad_inode() when failing to rename	[Body]
[PATCH 6.18 294/621] net: optimize enqueue_to_backlog() for the fast path	[Body]
[PATCH 6.18 295/621] net: fully inline backlog_unlock_irq_restore()	[Body]
[PATCH 6.18 296/621] net: serialize netif_running() check in enqueue_to_backlog()	[Body]
[PATCH 6.18 297/621] RDMA/bnxt_re: Add a max slot check for SQ	[Body]
[PATCH 6.18 298/621] RDMA/bnxt_re: Free CQ toggle page after firmware teardown	[Body]
[PATCH 6.18 299/621] netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding	[Body]
[PATCH 6.18 300/621] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path	[Body]
[PATCH 6.18 301/621] netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them	[Body]
[PATCH 6.18 302/621] cxl/region: Block region delete during region creation	[Body]
[PATCH 6.18 303/621] iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path	[Body]
[PATCH 6.18 304/621] ext4: add mext_check_validity() to do basic check	[Body]
[PATCH 6.18 305/621] ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT	[Body]
[PATCH 6.18 306/621] ixgbe: do not configure xps for XDP queues	[Body]
[PATCH 6.18 307/621] wifi: ieee80211: split S1G definitions out	[Body]
[PATCH 6.18 308/621] wifi: mac80211: bound S1G TIM PVB walk to the TIM element	[Body]
[PATCH 6.18 309/621] bpf: Reject sleepable BPF_LSM_CGROUP programs at load time	[Body]
[PATCH 6.18 310/621] ocfs2: validate fast symlink target during inode read	[Body]
[PATCH 6.18 311/621] wifi: ath12k: fix inconsistent arvif state in vdev_create error paths	[Body]
[PATCH 6.18 312/621] wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()	[Body]
[PATCH 6.18 313/621] md: replace wait loop with wait_event() in md_handle_request()	[Body]
[PATCH 6.18 314/621] md/raid1,raid10: fix deadlock in read error recovery path	[Body]
[PATCH 6.18 315/621] md/raid1,raid10: fix bio accounting for split md cloned bios	[Body]
[PATCH 6.18 316/621] md/raid1,raid10: fix error-path detection with md_cloned_bio()	[Body]
[PATCH 6.18 317/621] drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport	[Body]
[PATCH 6.18 318/621] s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code	[Body]
[PATCH 6.18 319/621] s390/zcrypt: Rework domain processing within zcrypt device driver	[Body]
[PATCH 6.18 320/621] s390/zcrypt: Close speculative mem read possibility	[Body]
[PATCH 6.18 321/621] octeontx2-af: Block VFs from clobbering special CGX PKIND state	[Body]
[PATCH 6.18 322/621] Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback	[Body]
[PATCH 6.18 323/621] hdlc_ppp: fix potential null pointer in ppp_cp_event logging	[Body]
[PATCH 6.18 324/621] net: Convert proto_ops bind() callbacks to use sockaddr_unsized	[Body]
[PATCH 6.18 325/621] Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs	[Body]
[PATCH 6.18 326/621] Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback	[Body]
[PATCH 6.18 327/621] netfs: Fix folio_queue ENOMEM in writeback by adding a mempool	[Body]
[PATCH 6.18 328/621] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds	[Body]
[PATCH 6.18 329/621] xsk: provide sufficient space in pool->tx_descs	[Body]
[PATCH 6.18 330/621] xsk: reclaim invalid Tx descriptors in ZC batch path	[Body]
[PATCH 6.18 331/621] nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush	[Body]
[PATCH 6.18 332/621] nexthop: take nh->lock for f6i_list walks in replace check and notify	[Body]
[PATCH 6.18 333/621] KVM: arm64: vgic: Fix race between LPI release and re-registration	[Body]
[PATCH 6.18 334/621] btrfs: split btrfs_fs_closing() and change return type to bool	[Body]
[PATCH 6.18 335/621] btrfs: only invalidate btree inode pages after all ebs are released	[Body]
[PATCH 6.18 336/621] btrfs: warn about extent buffer that can not be released	[Body]
[PATCH 6.18 337/621] btrfs: skip global block reserve accounting for rescue mounts	[Body]
[PATCH 6.18 338/621] eventfs: Use children field for rcu head and add memory barriers	[Body]
[PATCH 6.18 339/621] vhost_iotlb: bound map allocation in add_range	[Body]
[PATCH 6.18 340/621] bpf: Fix netns reference imbalance in conntrack kfuncs	[Body]
[PATCH 6.18 341/621] accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()	[Body]
[PATCH 6.18 342/621] accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()	[Body]
[PATCH 6.18 343/621] btrfs: lzo: reject inline extents without valid headers	[Body]
[PATCH 6.18 344/621] soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read	[Body]
[PATCH 6.18 345/621] gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock	[Body]
[PATCH 6.18 346/621] eth: bnxt: decrease indent in bnxt_request_irq()	[Body]
[PATCH 6.18 347/621] eth: bnxt: avoid deadlock when canceling IRQ affinity notifier	[Body]
[PATCH 6.18 348/621] ipvs: revalidate ihl to prevent out-of-bounds access	[Body]
[PATCH 6.18 349/621] ovpn: defer key slot crypto freeing to workqueue	[Body]
[PATCH 6.18 350/621] scsi: core: pair EH runtime PM get and put	[Body]
[PATCH 6.18 351/621] optee: ffa: Add NULL check in optee_ffa_lend_protmem	[Body]
[PATCH 6.18 352/621] btrfs: lzo: reject compressed segment that overflows the compressed input	[Body]
[PATCH 6.18 353/621] netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag	[Body]
[PATCH 6.18 354/621] drivers: firmware: xilinx: Add unique family code for all platforms	[Body]
[PATCH 6.18 355/621] drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info()	[Body]
[PATCH 6.18 356/621] soc: xilinx: Fix race condition in event registration	[Body]
[PATCH 6.18 357/621] Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks	[Body]
[PATCH 6.18 358/621] idpf: bound interrupt-vector register fill to the allocated array	[Body]
[PATCH 6.18 359/621] dmaengine: idxd: fix double free of wq, engine, and group structs	[Body]
[PATCH 6.18 360/621] drm/amd/display: check if dml21_add_phantom_plane() is successful	[Body]
[PATCH 6.18 361/621] bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie	[Body]
[PATCH 6.18 362/621] drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length	[Body]
[PATCH 6.18 363/621] drm/amdkfd: Add bounds check for CRAT subtype length	[Body]
[PATCH 6.18 364/621] fbdev: Wrap user-invoked calls to fb_set_var() in helper	[Body]
[PATCH 6.18 365/621] tipc: avoid busy looping in tipc_exit_net()	[Body]
[PATCH 6.18 366/621] NTB: core: Add .get_dma_dev() callback to ntb_dev_ops	[Body]
[PATCH 6.18 367/621] NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers	[Body]
[PATCH 6.18 368/621] ntb: Store original DMA address for future release	[Body]
[PATCH 6.18 369/621] KVM: riscv: Fix Spectre-v1 in PMU counter access	[Body]
[PATCH 6.18 370/621] RISC-V: KVM: Fix PMU event info array size overflow	[Body]
[PATCH 6.18 371/621] svcrdma: Add Write chunk WRs to the RPCs Send WR chain	[Body]
[PATCH 6.18 372/621] svcrdma: wake sq waiters when the transport closes	[Body]
[PATCH 6.18 373/621] svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails	[Body]
[PATCH 6.18 374/621] SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx	[Body]
[PATCH 6.18 375/621] SUNRPC: Add errno-to-GSS status conversion helper	[Body]
[PATCH 6.18 376/621] SUNRPC: Prepare crypto/krb5 encryption and checksum handles	[Body]
[PATCH 6.18 377/621] SUNRPC: Switch wrap token encryption to crypto/krb5	[Body]
[PATCH 6.18 378/621] SUNRPC: Switch wrap token decryption to crypto/krb5	[Body]
[PATCH 6.18 379/621] SUNRPC: Switch MIC token generation to crypto/krb5	[Body]
[PATCH 6.18 380/621] SUNRPC: Switch MIC token verification to crypto/krb5	[Body]
[PATCH 6.18 381/621] SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2	[Body]
[PATCH 6.18 382/621] kho: fix size calculation in kho_preserved_memory_reserve()	[Body]
[PATCH 6.18 383/621] ext2: Fix lost inode updates for IS_SYNC inodes	[Body]
[PATCH 6.18 384/621] cifs: call pagecache_isize_extended() in cifs_setsize() when extending	[Body]
[PATCH 6.18 385/621] ceph: fix UAF in check_new_map() on session freed during unlock	[Body]
[PATCH 6.18 386/621] nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths	[Body]
[PATCH 6.18 387/621] lockd, nfsd: RCU-protect nlmsvc_ops dispatch	[Body]
[PATCH 6.18 388/621] zram: fix out-of-bounds access in writeback_store()	[Body]
[PATCH 6.18 389/621] drm/amdgpu: force complete the MES ring fences on reset	[Body]
[PATCH 6.18 390/621] drm/amdgpu: force complete the KIQ ring fences on reset	[Body]
[PATCH 6.18 391/621] media: chips-media: wave5: Resume device before setting EOS flag	[Body]
[PATCH 6.18 392/621] LoongArch: KVM: Get VM PMU capability from HW GCFG register	[Body]
[PATCH 6.18 393/621] LoongArch: KVM: Validate MSI data before routing it to EIOINTC	[Body]
[PATCH 6.18 394/621] KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped	[Body]
[PATCH 6.18 395/621] netfilter: nf_tables: skip double clone set expressions on element insert	[Body]
[PATCH 6.18 396/621] octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()	[Body]
[PATCH 6.18 397/621] net: mana: Cap MSI-X vectors to the device MSI-X table size	[Body]
[PATCH 6.18 398/621] Bluetooth: do not leak an hci_conn when a second LE connect is rejected	[Body]
[PATCH 6.18 399/621] Bluetooth: L2CAP: access chan->conn safely in get/setsockopt	[Body]
[PATCH 6.18 400/621] fuse: Fix the condition to enable over-io-uring	[Body]
[PATCH 6.18 401/621] net/sched: account classifier filter allocations to memcg	[Body]
[PATCH 6.18 402/621] NFSv4.1: zero referring call lists before decoding	[Body]
[PATCH 6.18 403/621] vxlan: fix reading neigh ha	[Body]
[PATCH 6.18 404/621] net: bridge: arp/nd proxy: fix reading neigh ha	[Body]
[PATCH 6.18 405/621] ip6mr: do not clone dst in ip6mr_cache_report()	[Body]
[PATCH 6.18 406/621] irqchip/gic-v5: Clear per-CPU IRS data on teardown	[Body]
[PATCH 6.18 407/621] virtio_net: Fix resize of the RX ring	[Body]
[PATCH 6.18 408/621] dpll: fix NULL deref in dpll_device_ops() during teardown race	[Body]
[PATCH 6.18 409/621] ksmbd: scope session state changes to bound connections	[Body]
[PATCH 6.18 410/621] ksmbd: detach blocked lock requests before freeing	[Body]
[PATCH 6.18 411/621] ksmbd: safely discard unregistered deferred locks	[Body]
[PATCH 6.18 412/621] ksmbd: defer publishing granted locks to prevent UAF/double-free race	[Body]
[PATCH 6.18 413/621] ksmbd: serialize oplock close with pending break ownership	[Body]
[PATCH 6.18 414/621] ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()	[Body]
[PATCH 6.18 415/621] bpf: Check pointer type for all atomic RMW paths	[Body]
[PATCH 6.18 416/621] blk-cgroup: delay freeing policy data after rcu grace period	[Body]
[PATCH 6.18 417/621] blk-iocost: clear delay state when freeing policy data	[Body]
[PATCH 6.18 418/621] blk-iolatency: clear delay state when freeing policy data	[Body]
[PATCH 6.18 419/621] nvmet: fix max_qid race between configfs and controller allocation	[Body]
[PATCH 6.18 420/621] clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type	[Body]
[PATCH 6.18 421/621] bpf, s390: Clear fetch destination on faulting arena atomic	[Body]
[PATCH 6.18 422/621] bpf: Compare iterator types during state pruning	[Body]
[PATCH 6.18 423/621] NFS: Return a delegation the client fails to record	[Body]
[PATCH 6.18 424/621] iommu: Pass in old domain to attach_dev callback functions	[Body]
[PATCH 6.18 425/621] iommu/vt-d: Fix iopf_refcount leak on RID domain replacement	[Body]
[PATCH 6.18 426/621] btrfs: zoned: flush active metadata block group at btree_writepages() start	[Body]
[PATCH 6.18 427/621] btrfs: apply the AUTO_K(V)FREE macros throughout the code	[Body]
[PATCH 6.18 428/621] btrfs: check if root is readonly when setting posix acl	[Body]
[PATCH 6.18 429/621] scsi: core: Pass a struct scsi_driver to scsi_{,un}register_driver()	[Body]
[PATCH 6.18 430/621] scsi: core: sysfs: Make use of bus callbacks	[Body]
[PATCH 6.18 431/621] scsi: sd: Convert to SCSI bus methods	[Body]
[PATCH 6.18 432/621] scsi: sd: Move the sd_remove() function definition	[Body]
[PATCH 6.18 433/621] scsi: sd: Move the sd_config_discard() function definition	[Body]
[PATCH 6.18 434/621] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails	[Body]
[PATCH 6.18 435/621] coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable	[Body]
[PATCH 6.18 436/621] drm/amd/display: disable replay when crc source is enabled	[Body]
[PATCH 6.18 437/621] drm/amd/display: Resize MST HDCP per-connector arrays to 32	[Body]
[PATCH 6.18 438/621] bpf: Factor callchain_store function from __bpf_get_stack	[Body]
[PATCH 6.18 439/621] bpf: Factor callchain_finalize function from __bpf_get_stack	[Body]
[PATCH 6.18 440/621] bpf: Remove trace_in argument from __bpf_get_stack	[Body]
[PATCH 6.18 441/621] bpf: Clear buf on error in __bpf_get_task_stack	[Body]
[PATCH 6.18 442/621] ocfs2/heartbeat: fix slot mapping rollback leaks on error paths	[Body]
[PATCH 6.18 443/621] ocfs2: o2hb: quiesce negotiate handlers and timeout work	[Body]
[PATCH 6.18 444/621] thermal: hwmon: Remove hwmon class device along with its parent	[Body]
[PATCH 6.18 445/621] PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers	[Body]
[PATCH 6.18 446/621] bpf: Invalidate RCU pointers after final spin unlock	[Body]
[PATCH 6.18 447/621] ublk: validate auto buf reg before taking uring_cmd	[Body]
[PATCH 6.18 448/621] HID: logitech-hidpp: Fix FF device cleanup on init failure	[Body]
[PATCH 6.18 449/621] tty: skip cdev_del() when no cdev is registered	[Body]
[PATCH 6.18 450/621] serial: core: clear freed pointers on uart_register_driver() failure	[Body]
[PATCH 6.18 451/621] serial: core: do fallible allocations before the console can be registered	[Body]
[PATCH 6.18 452/621] wifi: brcmfmac: fix P2P action frame handling without device vif	[Body]
[PATCH 6.18 453/621] wifi: nl80211: clean up color-change beacon data on errors	[Body]
[PATCH 6.18 454/621] arm64: ptrace: Keep orig_x0 in-sync with x0 on syscall entry	[Body]
[PATCH 6.18 455/621] wifi: mt76: mt7996: clear stale link state on full reset	[Body]
[PATCH 6.18 456/621] bpf: Reject >8 byte return values on return-reading trampoline paths	[Body]
[PATCH 6.18 457/621] wifi: mt76: cancel reset and rc work on device unregister	[Body]
[PATCH 6.18 458/621] wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete	[Body]
[PATCH 6.18 459/621] wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()	[Body]
[PATCH 6.18 460/621] md: remove REQ_NOWAIT support from raid1/10/456	[Body]
[PATCH 6.18 461/621] wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()	[Body]
[PATCH 6.18 462/621] drm/panthor: Add vm_bind region with kbo range overlap check	[Body]
[PATCH 6.18 463/621] nvmet: fix return status of RMI log page on allocation failure	[Body]
[PATCH 6.18 464/621] RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()	[Body]
[PATCH 6.18 465/621] PCI: Make pci_match_one_device() match on ID instead of device	[Body]
[PATCH 6.18 466/621] PCI: Fix dyn_id add TOCTOU	[Body]
[PATCH 6.18 467/621] PCI: Fix UAF when probe runs concurrent to dyn ID removal	[Body]
[PATCH 6.18 468/621] iommu/tegra241-cmdqv: Dont fall back to a freed smmu after devm_krealloc()	[Body]
[PATCH 6.18 469/621] scsi: ufs: core: Convert string descriptor format macros to enum	[Body]
[PATCH 6.18 470/621] scsi: ufs: core: Validate string descriptors	[Body]
[PATCH 6.18 471/621] pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip	[Body]
[PATCH 6.18 472/621] bpf: Fix WARNING in bpf_tracing_link_release	[Body]
[PATCH 6.18 473/621] ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()	[Body]
[PATCH 6.18 474/621] firmware: arm_scmi: Clear SystemPower flag on create failure	[Body]
[PATCH 6.18 475/621] firmware: arm_scmi: Fix OF node reference handling	[Body]
[PATCH 6.18 476/621] firmware: arm_scmi: Fix SCMI device destroy lifetimes	[Body]
[PATCH 6.18 477/621] cxl/features: Serialize multi-part Get/Set Feature transfers	[Body]
[PATCH 6.18 478/621] fs/resctrl: Fix UAF from worker threads when domains are removed	[Body]
[PATCH 6.18 479/621] RDMA/rvt: Return NULL after port allocation failure	[Body]
[PATCH 6.18 480/621] esp: do not unref managed frag pages in esp_ssg_unref()	[Body]
[PATCH 6.18 481/621] platform/x86: asus-wmi: fix resource leaks on probe failure	[Body]
[PATCH 6.18 482/621] usb: gadget: uac: validate rate list length before storing	[Body]
[PATCH 6.18 483/621] bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max	[Body]
[PATCH 6.18 484/621] platform/x86: dell-wmi-base: Fix handling of ultra performance key	[Body]
[PATCH 6.18 485/621] bpf: Reject writes through untrusted BTF pointers	[Body]
[PATCH 6.18 486/621] bpf: Reject MEM_ALLOC BTF accesses past object bounds	[Body]
[PATCH 6.18 487/621] uprobes/x86: Move optimized uprobe from nop5 to nop10	[Body]
[PATCH 6.18 488/621] dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout	[Body]
[PATCH 6.18 489/621] drm/amd/display: Fix dangling pointer in CRTC reset function	[Body]
[PATCH 6.18 490/621] drm/amd/display: Fix dangling pointer in plane reset function	[Body]
[PATCH 6.18 491/621] dm-pcache: validate seg_id fields from persistent memory	[Body]
[PATCH 6.18 492/621] nfsd: use workqueue enable/disable APIs for v4_end_grace sync	[Body]
[PATCH 6.18 493/621] nfsd: convert nfsd_net boolean flags to unsigned long flags word	[Body]
[PATCH 6.18 494/621] drm/xe: dont WARN on kernel job timeout when device already wedged	[Body]
[PATCH 6.18 495/621] ACPI: bus: Introduce acpi_bus_get_primary_device()	[Body]
[PATCH 6.18 496/621] powerpc/xive: add error return value to xive_smp_probe()	[Body]
[PATCH 6.18 497/621] powerpc/xive: propagate IPI init errors to prevent use-after-free	[Body]
[PATCH 6.18 498/621] remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3	[Body]
[PATCH 6.18 499/621] ksmbd: remove redundant DACL check in smb_check_perm_dacl	[Body]
[PATCH 6.18 500/621] ksmbd: fix maximum allowed access checks	[Body]
[PATCH 6.18 501/621] smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()	[Body]
[PATCH 6.18 502/621] smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid	[Body]
[PATCH 6.18 503/621] drm/amdgpu: skip the VMID 0 flush for VRAM	[Body]
[PATCH 6.18 504/621] tracing: Take trace_array reference when opening a tracer options file	[Body]
[PATCH 6.18 505/621] vhost: invalidate vring access on IOTLB transitions	[Body]
[PATCH 6.18 506/621] vduse: validate virtqueue alignment	[Body]
[PATCH 6.18 507/621] virtio_ring: fix stale descriptor flags after a failed packed add	[Body]
[PATCH 6.18 508/621] iommu/riscv: Serialize command queue publishing	[Body]
[PATCH 6.18 509/621] bpf: mark a NULL call argument precise	[Body]
[PATCH 6.18 510/621] tracing: Fix subbuf resize races with trace_pipe_raw readers	[Body]
[PATCH 6.18 511/621] bpf: Preserve inner map identity in callback frames	[Body]
[PATCH 6.18 512/621] bpf: Mark NULL kptr stores precise	[Body]
[PATCH 6.18 513/621] bpf: Keep refcount_acquire nullable for borrowed RCU kptrs	[Body]
[PATCH 6.18 514/621] bpf: Dont infer non-NULL from a pointer with an unbounded offset	[Body]
[PATCH 6.18 515/621] bpf: dont rewrite bpf_fastcall patterns entered by a jump	[Body]
[PATCH 6.18 516/621] bpf: zero extend the result of an arena 32-bit cmpxchg	[Body]
[PATCH 6.18 517/621] ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer	[Body]
[PATCH 6.18 518/621] ring-buffer: Add checking nr_subbufs to persistent ring buffer validation	[Body]
[PATCH 6.18 519/621] bpf: Mark syscall helpers as sleepable	[Body]
[PATCH 6.18 520/621] bpf: backtracking shouldnt clear outer frame R1-R5 for callbacks	[Body]
[PATCH 6.18 521/621] bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge	[Body]
[PATCH 6.18 522/621] ipv6: mcast: annotate data-races around mca_users	[Body]
[PATCH 6.18 523/621] ipv6: mcast: use rcu_assign_pointer() for __rcu list updates	[Body]
[PATCH 6.18 524/621] net: stmmac: fix dma mapping leak in stmmac_tso_xmit()	[Body]
[PATCH 6.18 525/621] bpf: check_cond_jmp_op(): properly infer if register is null	[Body]
[PATCH 6.18 526/621] printk: Dont WARN on kthread_run failure.	[Body]
[PATCH 6.18 527/621] ksmbd: convert tree_conns_lock to rw_semaphore	[Body]
[PATCH 6.18 528/621] smb/server: fix tree connection leak in smb2_tree_connect()	[Body]
[PATCH 6.18 529/621] arm64: dts: lx2160a: fix incorrect pinmux	[Body]
[PATCH 6.18 530/621] arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single	[Body]
[PATCH 6.18 531/621] arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value	[Body]
[PATCH 6.18 532/621] mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount	[Body]
[PATCH 6.18 533/621] fs: move mntput_no_expire() slowpath into a dedicated routine	[Body]
[PATCH 6.18 534/621] fs: dont let a migrating task hide its reference from do_umount()	[Body]
[PATCH 6.18 535/621] Bluetooth: btintel_pcie: fix TX descriptor bounds check	[Body]
[PATCH 6.18 536/621] Bluetooth: btintel_pcie: Add shared HW reset for clean start	[Body]
[PATCH 6.18 537/621] drm/dp: dont mark the AUX backlight enabled when enabling failed	[Body]
[PATCH 6.18 538/621] gpio: exar: initialize the ID before registering its cleanup	[Body]
[PATCH 6.18 539/621] drm/aspeed: Balance the display clock enable on teardown	[Body]
[PATCH 6.18 540/621] drm/vc4: Free the BO cache size list on teardown	[Body]
[PATCH 6.18 541/621] net/sched: em_text: reject unterminated algo before autoload	[Body]
[PATCH 6.18 542/621] amt: send the relays General Query directly from the receive path	[Body]
[PATCH 6.18 543/621] cxgb4/ch_ktls: disable softirqs around tid_list erases	[Body]
[PATCH 6.18 544/621] tee: optee: fix kernel-doc warnings	[Body]
[PATCH 6.18 545/621] tee: optee: ffa: support shared memory offsets on large-page kernels	[Body]
[PATCH 6.18 546/621] ice: Restore Ordered MMIO Writes for Tx Doorbells	[Body]
[PATCH 6.18 547/621] nvmet: return Invalid Field for invalid NSIDs feature 82h	[Body]
[PATCH 6.18 548/621] nvmet: use the local P2P device on metadata allocation failure	[Body]
[PATCH 6.18 549/621] arm64/boot: Dont set PMUv3p9 FGT2 bits without PMUv3	[Body]
[PATCH 6.18 550/621] zloop: zero out only the unread tail of short reads	[Body]
[PATCH 6.18 551/621] btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio	[Body]
[PATCH 6.18 552/621] btrfs: free iov when btrfs_uring_read_extent() fails	[Body]
[PATCH 6.18 553/621] btrfs: unlock inode and extent in caller when io_uring read extent fails	[Body]
[PATCH 6.18 554/621] btrfs: fix xattr replace when multiple xattrs are packed in the same item	[Body]
[PATCH 6.18 555/621] btrfs: fix lost error return value in btrfs_listxattr()	[Body]
[PATCH 6.18 556/621] drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums	[Body]
[PATCH 6.18 557/621] net: make dev_xdp_sb_prog_count() see programs attached through a link	[Body]
[PATCH 6.18 558/621] riscv: vector: Fix data pointer constraints in context save/restore	[Body]
[PATCH 6.18 559/621] riscv: vector: Fix output operands in context save	[Body]
[PATCH 6.18 560/621] wifi: mt76: dont return TXQ when exceeding max non-AQL packets	[Body]
[PATCH 6.18 561/621] wifi: mac80211: add AQL support for multicast packets	[Body]
[PATCH 6.18 562/621] wifi: mac80211: add ieee80211_txq_aql_pending()	[Body]
[PATCH 6.18 563/621] wifi: mt76: add PS buffering support for HW-managed TIM drivers	[Body]
[PATCH 6.18 564/621] wifi: mt76: account non-AQL frames per peer rather than per link	[Body]
[PATCH 6.18 565/621] wifi: mt76: route nullfunc frames to PSD/ALTX queue	[Body]
[PATCH 6.18 566/621] wifi: mt76: use ALTX queue for packets to disassociated stations	[Body]
[PATCH 6.18 567/621] wifi: mt76: mt7925: restore the legacy BSS after MLO teardown	[Body]
[PATCH 6.18 568/621] wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout	[Body]
[PATCH 6.18 569/621] wifi: mt76: mt7915: disable rx napi when removing device	[Body]
[PATCH 6.18 570/621] wifi: mt76: mt7925: dont put the band auto marker in TGID	[Body]
[PATCH 6.18 571/621] wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit	[Body]
[PATCH 6.18 572/621] wifi: mt76: mt792x: pick the SAR table layout from the table itself	[Body]
[PATCH 6.18 573/621] Revert "wifi: ath12k: add panic handler"	[Body]
[PATCH 6.18 574/621] ASoC: adau1372: allow sleepy powerdown GPIOs	[Body]
[PATCH 6.18 575/621] ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes	[Body]
[PATCH 6.18 576/621] ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM	[Body]
[PATCH 6.18 577/621] spi: sg2044-nor: Return transfer errors	[Body]
[PATCH 6.18 578/621] spi: sg2044-nor: Honor SPI clock limits	[Body]
[PATCH 6.18 579/621] cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()	[Body]
[PATCH 6.18 580/621] flow_dissector: avoid u16 truncation of skb->len when computing thoff	[Body]
[PATCH 6.18 581/621] net: sparx5: start the TOD counters on non-PTP lan969x variants	[Body]
[PATCH 6.18 582/621] devlink: fix devlink_rel reference leak when notify work is pending	[Body]
[PATCH 6.18 583/621] net/sched: cls_route: reject change with no routing attribute	[Body]
[PATCH 6.18 584/621] Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"	[Body]
[PATCH 6.18 585/621] net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET	[Body]
[PATCH 6.18 586/621] pfcp: make sure the SEID is linear before reading it	[Body]
[PATCH 6.18 587/621] bnxt_en: Add bnxt_clear_bars() helper	[Body]
[PATCH 6.18 588/621] bnxt_en: Fix driver init in kdump kernel	[Body]
[PATCH 6.18 589/621] bnxt_en: Delay for 5 seconds after AER DPC for all chips	[Body]
[PATCH 6.18 590/621] bnxt_en: Drop pci_save_state() after pci_restore_state()	[Body]
[PATCH 6.18 591/621] bnxt_en: Re-write the BARs following any type of PCIe errors	[Body]
[PATCH 6.18 592/621] flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()	[Body]
[PATCH 6.18 593/621] drm/imagination: Fix reference and vm_bo handling in remap()	[Body]
[PATCH 6.18 594/621] veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down	[Body]
[PATCH 6.18 595/621] net/mlx5e: Order ICOSQ cc update after CQ doorbell	[Body]
[PATCH 6.18 596/621] mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()	[Body]
[PATCH 6.18 597/621] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb	[Body]
[PATCH 6.18 598/621] ptp: ocp: fix PCIe delay estimation calculation	[Body]
[PATCH 6.18 599/621] net: openvswitch: validate transport header presence in set_ipv6_addr	[Body]
[PATCH 6.18 600/621] vsock: Fix memory leak in vmci_transport_recv_dgram_cb()	[Body]
[PATCH 6.18 601/621] drm/vc4: Fix binner slot allocation failing on an idle GPU	[Body]
[PATCH 6.18 602/621] x86/CPU/AMD: Fix AMD TLBI Erratum #1718	[Body]
[PATCH 6.18 603/621] drm/panthor: validate userspace queue count against initialized firmware slot count	[Body]
[PATCH 6.18 604/621] btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock	[Body]
[PATCH 6.18 605/621] cifs: consolidate time_last_write stamp into _cifsFileInfo_put()	[Body]
[PATCH 6.18 606/621] netfs, afs: Fix symlink reading	[Body]
[PATCH 6.18 607/621] media: verisilicon: Fix kernel panic due to __initconst misuse	[Body]
[PATCH 6.18 608/621] net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT	[Body]
[PATCH 6.18 609/621] netfs: Fix missing alloc tagging of direct mempool allocations	[Body]
[PATCH 6.18 610/621] workqueue: fix devm_alloc_workqueue() va_list misuse	[Body]
[PATCH 6.18 611/621] ice: fix broken Rx on VFs	[Body]
[PATCH 6.18 612/621] s390/zcrypt: Improve CCA CPRB length and overflow checks	[Body]
[PATCH 6.18 613/621] s390/zcrypt: Improve EP11 CPRB length and overflow checks	[Body]
[PATCH 6.18 614/621] s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing	[Body]
[PATCH 6.18 615/621] s390/zcrypt: Pad trailing CCA or EP11 message with zeros	[Body]
[PATCH 6.18 616/621] accel/amdxdna: Resume power for creating and destroying hardware context	[Body]
[PATCH 6.18 617/621] accel/amdxdna: Fix race condition when checking rpm_on	[Body]
[PATCH 6.18 618/621] accel/amdxdna: Fix crash when destroying a suspended hardware context	[Body]
[PATCH 6.18 619/621] workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)	[Body]
[PATCH 6.18 620/621] ACPI: scan: Do not mark button ACPI devices as wakeup-capable	[Body]
[PATCH 6.18 621/621] ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons	[Body]

ID (for dev)	db80aedf-b58e-4a04-a44b-9f4f97cfd6f3
Status	finished
Triaged	OK [Log]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	17ad2612c11a748b50d32eefc681344b26fea946 [Config]		passed [Log]
[KASAN] Boot test: Base	17ad2612c11a748b50d32eefc681344b26fea946 [Config]		passed [Log]
[KASAN] Build Patched		17ad2612c11a748b50d32eefc681344b26fea946 [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		17ad2612c11a748b50d32eefc681344b26fea946 [Config] [patched]	passed [Log]
[KASAN] Fuzz	17ad2612c11a748b50d32eefc681344b26fea946 [Config]	17ad2612c11a748b50d32eefc681344b26fea946 [Config] [patched]	passed [Log] [Artifacts]

Patches (621)

Series Summary

Sessions

Session 2026-10-14