Syzbot CI

Subject	6.6.160-rc1 review
Author	gregkh@linuxfoundation.org
Date	2026-10-17 15:37:53 +0000 UTC
Version
Cc	achill@achill.org akpm@linux-foundation.org broonie@kernel.org conor@kernel.org f.fainelli@gmail.com gregkh@linuxfoundation.org hargar@microsoft.com jonathanh@nvidia.com linux-kernel@vger.kernel.org linux@roeck-us.net lkft-triage@lists.linaro.org patches@kernelci.org patches@lists.linux.dev pavel@nabladev.com rwarsow@gmx.de shuah@kernel.org sr@sladewatkins.com stable@vger.kernel.org sudipm.mukherjee@gmail.com torvalds@linux-foundation.org

Name	Content [All]
[PATCH 6.6 0001/1674] dma-direct: simplify the use atomic pool logic in dma_direct_alloc	[Body]
[PATCH 6.6 0002/1674] dma-direct: return struct page from dma_direct_alloc_from_pool()	[Body]
[PATCH 6.6 0003/1674] xfrm: prevent policy_hthresh.work from racing with netns teardown	[Body]
[PATCH 6.6 0004/1674] ocfs2: Avoid touching renamed directory if parent does not change	[Body]
[PATCH 6.6 0005/1674] net/mlx5e: Fix netif state handling	[Body]
[PATCH 6.6 0006/1674] net: ena: Add validation for completion descriptors consistency	[Body]
[PATCH 6.6 0007/1674] x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client	[Body]
[PATCH 6.6 0008/1674] apparmor: fix out-of-bounds write when null terminating a label vec	[Body]
[PATCH 6.6 0009/1674] xen/balloon: improve accuracy of initial balloon target for dom0	[Body]
[PATCH 6.6 0010/1674] x86/xen: fix init of balloon stats again	[Body]
[PATCH 6.6 0011/1674] nfsd: fix nfsd_file leak on inter-server COPY setup failure	[Body]
[PATCH 6.6 0012/1674] ceph: properly decrypt filenames in vmalloc() buffers	[Body]
[PATCH 6.6 0013/1674] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()	[Body]
[PATCH 6.6 0014/1674] HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind	[Body]
[PATCH 6.6 0015/1674] HID: universal-pidff: stop the device when force-feedback init fails	[Body]
[PATCH 6.6 0016/1674] ocfs2: validate dx_root extent list fields during block read	[Body]
[PATCH 6.6 0017/1674] ocfs2: validate directory-index entry counts when reading metadata	[Body]
[PATCH 6.6 0018/1674] wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop	[Body]
[PATCH 6.6 0019/1674] udf: Fix data loss when converting inline inodes to out of line	[Body]
[PATCH 6.6 0020/1674] usb: storage: realtek_cr: fix use-after-free on disconnect	[Body]
[PATCH 6.6 0021/1674] staging: rtl8723bs: fix spacing around operators	[Body]
[PATCH 6.6 0022/1674] staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()	[Body]
[PATCH 6.6 0023/1674] ftrace: Take trace_array reference before accessing its ftrace_ops	[Body]
[PATCH 6.6 0024/1674] nvme: add missing SRCU grace period in error path	[Body]
[PATCH 6.6 0025/1674] KVM: s390: Zero initialize data structures for inject_pfault_token	[Body]
[PATCH 6.6 0026/1674] scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak	[Body]
[PATCH 6.6 0027/1674] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking	[Body]
[PATCH 6.6 0028/1674] scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown	[Body]
[PATCH 6.6 0029/1674] scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]	[Body]
[PATCH 6.6 0030/1674] f2fs: validate MOVE_RANGE destination size	[Body]
[PATCH 6.6 0031/1674] f2fs: embed f2fs_gc_kthread in f2fs_sb_info	[Body]
[PATCH 6.6 0032/1674] tracing: Fix memory corruption from a "STACKTRACE" histogram key	[Body]
[PATCH 6.6 0033/1674] Bluetooth: btqcomsmd: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 0034/1674] Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev	[Body]
[PATCH 6.6 0035/1674] genetlink: pin family module during policy dump	[Body]
[PATCH 6.6 0036/1674] io_uring/rw: end write accounting from ->ki_complete	[Body]
[PATCH 6.6 0037/1674] net: bridge: use option bits for CFM/MRP frame handlers	[Body]
[PATCH 6.6 0038/1674] ieee802154: cc2520: fix FIFOP work use-after-free	[Body]
[PATCH 6.6 0039/1674] landlock: Fix use-after-free of the sources parent directory	[Body]
[PATCH 6.6 0040/1674] ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling	[Body]
[PATCH 6.6 0041/1674] ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity	[Body]
[PATCH 6.6 0042/1674] wifi: libipw: reject TKIP frames without a full MIC	[Body]
[PATCH 6.6 0043/1674] smb: mark the new channel addition log as informational log with cifs_info	[Body]
[PATCH 6.6 0044/1674] smb: client: fix use-after-free of iface in cifs_try_adding_channels()	[Body]
[PATCH 6.6 0045/1674] smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()	[Body]
[PATCH 6.6 0046/1674] vlan: require the MAC header to be present in __vlan_insert_inner_tag()	[Body]
[PATCH 6.6 0047/1674] pinctrl: sunxi: keep a shadow copy of the data register output latches	[Body]
[PATCH 6.6 0048/1674] drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability	[Body]
[PATCH 6.6 0049/1674] drm/i915/hdcp: Add encoder check in hdcp2_get_capability	[Body]
[PATCH 6.6 0050/1674] kvm: s390: Reject memory region operations for ucontrol VMs	[Body]
[PATCH 6.6 0051/1674] media: av7110: fix a spectre vulnerability	[Body]
[PATCH 6.6 0052/1674] ethtool: fail closed if we cant get max channel used in indirection tables	[Body]
[PATCH 6.6 0053/1674] KEYS: trusted: Fix TPM teardown ordering	[Body]
[PATCH 6.6 0054/1674] zram: fixup read_block_state()	[Body]
[PATCH 6.6 0055/1674] zram: fix out-of-bounds access in read_block_state()	[Body]
[PATCH 6.6 0056/1674] nfsd: size fh_verify server sockaddr slot by xpt_locallen	[Body]
[PATCH 6.6 0057/1674] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()	[Body]
[PATCH 6.6 0058/1674] nfsd: fix clock domain mismatch in clients_still_reclaiming()	[Body]
[PATCH 6.6 0059/1674] coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior	[Body]
[PATCH 6.6 0060/1674] cpufreq: apple-soc: Fix OPP table cleanup	[Body]
[PATCH 6.6 0061/1674] ACPI: TAD: Rearrange RT data validation checking	[Body]
[PATCH 6.6 0062/1674] ACPI: TAD: Split three functions to untangle runtime PM handling	[Body]
[PATCH 6.6 0063/1674] ACPI: TAD: Add locking around AML evaluations	[Body]
[PATCH 6.6 0064/1674] params: Do not go over the limit when getting the string length	[Body]
[PATCH 6.6 0065/1674] params: Use size_add() for kmalloc()	[Body]
[PATCH 6.6 0066/1674] params: Sort headers	[Body]
[PATCH 6.6 0067/1674] params: Fix multi-line comment style	[Body]
[PATCH 6.6 0068/1674] params: fix charp corruption on allocation failure	[Body]
[PATCH 6.6 0069/1674] ASoC: codecs: aw88261: reduce log spam	[Body]
[PATCH 6.6 0070/1674] ASoC: codecs: aw88261: only check PLL and clock state at power-up	[Body]
[PATCH 6.6 0071/1674] dmaengine: Add devm_dma_request_chan()	[Body]
[PATCH 6.6 0072/1674] i2c: mxs: fix DMA channel leak on probe error	[Body]
[PATCH 6.6 0073/1674] lockd: fix swapped arguments in nlmsvc_match_ip()	[Body]
[PATCH 6.6 0074/1674] mmc: via-sdmmc: cancel card-detect work on remove	[Body]
[PATCH 6.6 0075/1674] platform/x86: ISST: Validate parameter for core power state	[Body]
[PATCH 6.6 0076/1674] platform/x86: ISST: Validate max level for set feature	[Body]
[PATCH 6.6 0077/1674] power: supply: qcom_battmgr: fix use-after-free	[Body]
[PATCH 6.6 0078/1674] hwrng: stm32 - Fix runtime PM cleanup on registration failure	[Body]
[PATCH 6.6 0079/1674] i3c: master: Do not treat master device as a duplicate target	[Body]
[PATCH 6.6 0080/1674] i3c: master: Fix use-after-free of master->this	[Body]
[PATCH 6.6 0081/1674] wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy	[Body]
[PATCH 6.6 0082/1674] usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()	[Body]
[PATCH 6.6 0083/1674] staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()	[Body]
[PATCH 6.6 0084/1674] tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member	[Body]
[PATCH 6.6 0085/1674] ftrace: Synchronize the initialization of ftrace_ops	[Body]
[PATCH 6.6 0086/1674] rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm	[Body]
[PATCH 6.6 0087/1674] nvme-fabrics: fix DHCHAP secret leak on parse failure	[Body]
[PATCH 6.6 0088/1674] clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs	[Body]
[PATCH 6.6 0089/1674] mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP	[Body]
[PATCH 6.6 0090/1674] media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup	[Body]
[PATCH 6.6 0091/1674] media: rkvdec: Propagate platform_get_irq() errors	[Body]
[PATCH 6.6 0092/1674] scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path	[Body]
[PATCH 6.6 0093/1674] scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate	[Body]
[PATCH 6.6 0094/1674] scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs	[Body]
[PATCH 6.6 0095/1674] scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot	[Body]
[PATCH 6.6 0096/1674] scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature	[Body]
[PATCH 6.6 0097/1674] f2fs: limit recovery filename logging to stored length	[Body]
[PATCH 6.6 0098/1674] f2fs: fix dentry folio leak in find_in_level	[Body]
[PATCH 6.6 0099/1674] drm/sysfb: simpledrm: Improve panel-size validation	[Body]
[PATCH 6.6 0100/1674] drm/sysfb: simpledrm: Improve stride validation	[Body]
[PATCH 6.6 0101/1674] drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation	[Body]
[PATCH 6.6 0102/1674] drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug	[Body]
[PATCH 6.6 0103/1674] ipmr: account multicast table and route memory	[Body]
[PATCH 6.6 0104/1674] virtio-mmio: Remove virtqueue list from mmio device	[Body]
[PATCH 6.6 0105/1674] virtio_mmio: disable IRQ wake before free_irq	[Body]
[PATCH 6.6 0106/1674] net/sched: act_api: release all action references on NEWACTION failure	[Body]
[PATCH 6.6 0107/1674] erofs: preserve LZMA decoders on resize failure	[Body]
[PATCH 6.6 0108/1674] erofs: add sysfs feature entry for xattr prefixes	[Body]
[PATCH 6.6 0109/1674] mptcp: pm: drop match in userspace_pm_append_new_local_addr	[Body]
[PATCH 6.6 0110/1674] sock: add sock_kmemdup helper	[Body]
[PATCH 6.6 0111/1674] mptcp: use sock_kmemdup for address entry	[Body]
[PATCH 6.6 0112/1674] mptcp: pm: userspace: fix address ID overflow	[Body]
[PATCH 6.6 0113/1674] mptcp: pm: reset retrans_time when ADD_ADDR entry is reused	[Body]
[PATCH 6.6 0114/1674] mptcp: do not reschedule the RTX timer for fallback sockets	[Body]
[PATCH 6.6 0115/1674] smb: client: fix cifsFileInfo reference leak in deferred close	[Body]
[PATCH 6.6 0116/1674] btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()	[Body]
[PATCH 6.6 0117/1674] hwmon: (pwm-fan) Stop RPM timer before freeing tach data	[Body]
[PATCH 6.6 0118/1674] wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown	[Body]
[PATCH 6.6 0119/1674] smb/client: send lease break ACKs thru correct session for multiuser mounts	[Body]
[PATCH 6.6 0120/1674] smb: client: fix reparse buffer bounds in cifs_query_reparse_point()	[Body]
[PATCH 6.6 0121/1674] bna: prevent IOC timer rearm during teardown	[Body]
[PATCH 6.6 0122/1674] tcp: prevent collapsing skbs across boundary in rtx queue	[Body]
[PATCH 6.6 0123/1674] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities	[Body]
[PATCH 6.6 0124/1674] drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()	[Body]
[PATCH 6.6 0125/1674] drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM	[Body]
[PATCH 6.6 0126/1674] mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish	[Body]
[PATCH 6.6 0127/1674] mm/hugetlb: preserve mremap address delta when skipping page tables	[Body]
[PATCH 6.6 0128/1674] net/sched: act_ct: fix helper UAF due to extensions realloc	[Body]
[PATCH 6.6 0129/1674] net/sched: act_ct: avoid modifying shared unconfirmed ct entry	[Body]
[PATCH 6.6 0130/1674] openvswitch: prepare for stolen verdict coming from conntrack and nat engine	[Body]
[PATCH 6.6 0131/1674] net: openvswitch: conntrack: remove add_helper dead code	[Body]
[PATCH 6.6 0132/1674] net: openvswitch: conntrack: fix helper UAF due to extensions realloc	[Body]
[PATCH 6.6 0133/1674] RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()	[Body]
[PATCH 6.6 0134/1674] RISC-V: KVM: Serialize IMSIC attributes with vCPU migration	[Body]
[PATCH 6.6 0135/1674] super: make iterate_supers_type() deletion-safe	[Body]
[PATCH 6.6 0136/1674] PCI: Fix Resizable BAR restore order	[Body]
[PATCH 6.6 0137/1674] PCI: Fix BAR resize for devices on a root bus	[Body]
[PATCH 6.6 0138/1674] net: ipconfig: Remove outdated comment and indent code block	[Body]
[PATCH 6.6 0139/1674] net: ipconfig: bound DHCP option construction	[Body]
[PATCH 6.6 0140/1674] perf: Supply task information to sched_task()	[Body]
[PATCH 6.6 0141/1674] perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()	[Body]
[PATCH 6.6 0142/1674] perf/core: Allow list_del during perf_event_overflow()	[Body]
[PATCH 6.6 0143/1674] perf/core: Run sched_task() for PMUs with only CPU-wide events	[Body]
[PATCH 6.6 0144/1674] net: ena: Remove autopolling mode	[Body]
[PATCH 6.6 0145/1674] net: ena: fix MMIO read buffer leak on probe failure	[Body]
[PATCH 6.6 0146/1674] netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST	[Body]
[PATCH 6.6 0147/1674] netfilter: nf_tables: skip expired catchall elements on insert and delete	[Body]
[PATCH 6.6 0148/1674] perf/x86/intel: Update event constraints and cache_extra_regsfor ADL	[Body]
[PATCH 6.6 0149/1674] perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification	[Body]
[PATCH 6.6 0150/1674] smb: client: use finish_no_open() for non-regular inodes	[Body]
[PATCH 6.6 0151/1674] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op	[Body]
[PATCH 6.6 0152/1674] RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()	[Body]
[PATCH 6.6 0153/1674] bpf, xdp: move offload check into dev_xdp_install()	[Body]
[PATCH 6.6 0154/1674] Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table	[Body]
[PATCH 6.6 0155/1674] HID: core: remove #ifdef CONFIG_PM from hid_driver	[Body]
[PATCH 6.6 0156/1674] HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM	[Body]
[PATCH 6.6 0157/1674] HID: alps: unregister DualPoint Stick input device on remove	[Body]
[PATCH 6.6 0158/1674] smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()	[Body]
[PATCH 6.6 0159/1674] smb/client: pass cifs_open_info_data to SMB2_open()	[Body]
[PATCH 6.6 0160/1674] smb: client: close handle after create-context parsing failure	[Body]
[PATCH 6.6 0161/1674] smb: client: close completed creates on compound wait errors	[Body]
[PATCH 6.6 0162/1674] xfs: fix cursor and pointer handling when recovering iunlink buckets	[Body]
[PATCH 6.6 0163/1674] mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()	[Body]
[PATCH 6.6 0164/1674] ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices	[Body]
[PATCH 6.6 0165/1674] audit: fix exe mark UAF in kill_rules()	[Body]
[PATCH 6.6 0166/1674] kprobes: Skip disarmed probes when checking optkprobe overlap	[Body]
[PATCH 6.6 0167/1674] of/irq: Fix remaining refcount leaks in of_irq_init()	[Body]
[PATCH 6.6 0168/1674] of/overlay: put property on deadprops only after changeset add succeeds	[Body]
[PATCH 6.6 0169/1674] of/overlay: only treat a positive changeset id as registered	[Body]
[PATCH 6.6 0170/1674] net: fix checksum offsets in skb_splice_from_iter()	[Body]
[PATCH 6.6 0171/1674] netfilter: nft_flow_offload: drop flowtable reference on init error path	[Body]
[PATCH 6.6 0172/1674] net/packet: prevent TX_RING byte count overflow	[Body]
[PATCH 6.6 0173/1674] rtc: ac100: Assign .num before accessing .hws	[Body]
[PATCH 6.6 0174/1674] rtc: spear: initialize IRQ state before requesting alarm IRQ	[Body]
[PATCH 6.6 0175/1674] sctp: check RCV_SHUTDOWN after the sendmsg connect wait	[Body]
[PATCH 6.6 0176/1674] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions	[Body]
[PATCH 6.6 0177/1674] scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr	[Body]
[PATCH 6.6 0178/1674] scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info	[Body]
[PATCH 6.6 0179/1674] wifi: cfg80211: avoid double free if updating BSS fails	[Body]
[PATCH 6.6 0180/1674] rds_tcp: close NULL deref window in rds_tcp_set_callbacks	[Body]
[PATCH 6.6 0181/1674] vt: skip screen update for DEC alignment test on backgroup consoles	[Body]
[PATCH 6.6 0182/1674] ALSA: caiaq: unregister the input device when probe fails	[Body]
[PATCH 6.6 0183/1674] ALSA: line6: reject oversized playback packets	[Body]
[PATCH 6.6 0184/1674] mm/secretmem: properly account locked pages	[Body]
[PATCH 6.6 0185/1674] perf/core: Fix WARN in perf_sigtrap()	[Body]
[PATCH 6.6 0186/1674] mm/damon/core: dont skip damos_adjust_quota() while esz is not zero	[Body]
[PATCH 6.6 0187/1674] iio: accel: kionix-kx022a: Fix array boundary check	[Body]
[PATCH 6.6 0188/1674] mtd: core: call _get_device() with the master MTD	[Body]
[PATCH 6.6 0189/1674] nvmet: preserve device path on allocation failure	[Body]
[PATCH 6.6 0190/1674] of/overlay: dont leak fragment references when changeset init fails	[Body]
[PATCH 6.6 0191/1674] of/overlay: dont create "//" paths for fragments targeting the root	[Body]
[PATCH 6.6 0192/1674] ASoC: wm8903: Move the DRC QR threshold to the register that holds it	[Body]
[PATCH 6.6 0193/1674] wifi: wfx: validate MIB read length before copying to caller	[Body]
[PATCH 6.6 0194/1674] ASoC: tegra: Fix ASRC Stream6 input threshold control	[Body]
[PATCH 6.6 0195/1674] wifi: ath11k: reset ar->num_stations on hardware start	[Body]
[PATCH 6.6 0196/1674] rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak	[Body]
[PATCH 6.6 0197/1674] rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()	[Body]
[PATCH 6.6 0198/1674] wifi: cfg80211: preserve hidden-group beacon IE ownership	[Body]
[PATCH 6.6 0199/1674] wifi: mac80211: Add multicast to unicast support for 802.3 path	[Body]
[PATCH 6.6 0200/1674] wifi: mac80211: Add 802.3 multicast encapsulation offload support	[Body]
[PATCH 6.6 0201/1674] wifi: mac80211: prevent AP VLAN tx from other interfaces	[Body]
[PATCH 6.6 0202/1674] ASoC: codecs: rt286: Revert delay value for jack setup	[Body]
[PATCH 6.6 0203/1674] ASoC: codecs: rt274: Fix format setting for 44100 rate	[Body]
[PATCH 6.6 0204/1674] Bluetooth: hci_core: free the HCI ID if naming fails	[Body]
[PATCH 6.6 0205/1674] Bluetooth: btintel: validate DDC record lengths	[Body]
[PATCH 6.6 0206/1674] net/mctp: publish the mctp_dev only after it is initialised	[Body]
[PATCH 6.6 0207/1674] net/sched: cls_api: reclaim an empty proto on the error path	[Body]
[PATCH 6.6 0208/1674] ipv6: fix prefix route expiry in modify_prefix_route()	[Body]
[PATCH 6.6 0209/1674] netfilter: ipset: do not update comments from kernel-side adds	[Body]
[PATCH 6.6 0210/1674] Bluetooth: hci_sync: dont drain cmd_sync backlog on unregister	[Body]
[PATCH 6.6 0211/1674] net: systemport: Fix buffer overflow in bcm_sysport_get_stats()	[Body]
[PATCH 6.6 0212/1674] net: systemport: Fix RUNT MIB counter register offset calculation	[Body]
[PATCH 6.6 0213/1674] octeontx2-af: mcs: Fix SC resource cleanup loop	[Body]
[PATCH 6.6 0214/1674] tipc: prevent GCM nonce reuse on peer key changes	[Body]
[PATCH 6.6 0215/1674] net/sched: fq_codel: match the no-drop threshold to the packet size	[Body]
[PATCH 6.6 0216/1674] net/sched: sch_codel: match the no-drop threshold to the packet size	[Body]
[PATCH 6.6 0217/1674] net: bcmgenet: fix NULL dereference in set_coalesce before first open	[Body]
[PATCH 6.6 0218/1674] net: ethernet: mtk_eth_soc: allocate dummy netdev sooner	[Body]
[PATCH 6.6 0219/1674] tcp: refresh TS.Recent for accepted old ACKs	[Body]
[PATCH 6.6 0220/1674] ipvs: fix missing counter decrement in lblc	[Body]
[PATCH 6.6 0221/1674] ipvs: do not create invisible templates	[Body]
[PATCH 6.6 0222/1674] ipvs: filter some flags received in the backup server	[Body]
[PATCH 6.6 0223/1674] netfilter: bpf: reject invalid NAT manipulation types	[Body]
[PATCH 6.6 0224/1674] netfilter: conntrack: remove skb argument from nf_ct_refresh	[Body]
[PATCH 6.6 0225/1674] netfilter: conntrack: rework offload nf_conn timeout extension logic	[Body]
[PATCH 6.6 0226/1674] netfilter: flowtable: generalize pending status bit	[Body]
[PATCH 6.6 0227/1674] net: microchip: vcap: stop scanning after deleting key field	[Body]
[PATCH 6.6 0228/1674] net: sparx5: make ports inherit the switch base mac address type	[Body]
[PATCH 6.6 0229/1674] net: add and use skb_get_hash_net	[Body]
[PATCH 6.6 0230/1674] ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()	[Body]
[PATCH 6.6 0231/1674] i2c: at91: release DMA channels when probe defers	[Body]
[PATCH 6.6 0232/1674] perf: Fix race between perf_event_exit_task() and perf_pending_task()	[Body]
[PATCH 6.6 0233/1674] ALSA: core: Define auto-cleanup for snd_card_free()	[Body]
[PATCH 6.6 0234/1674] ALSA: ice1712: Fix the error handling via auto-cleanup at probe	[Body]
[PATCH 6.6 0235/1674] PCI: Accept AtomicOps already enabled by the hypervisor	[Body]
[PATCH 6.6 0236/1674] drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC	[Body]
[PATCH 6.6 0237/1674] drm/amd/pm/si: Fix updating clock limits on AC/DC	[Body]
[PATCH 6.6 0238/1674] drm/amdgpu/gfx6: fix firmware leak on teardown	[Body]
[PATCH 6.6 0239/1674] drm/radeon: Read the VRAM VBIOS signature with readb()	[Body]
[PATCH 6.6 0240/1674] drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device	[Body]
[PATCH 6.6 0241/1674] drm/mediatek: Fix ovl adaptor platform device leak	[Body]
[PATCH 6.6 0242/1674] drm/mediatek: Fix pdev reference leak in mtk_drm_bind()	[Body]
[PATCH 6.6 0243/1674] drm/amdgpu: fix IP instance memory leak on kobject add failure	[Body]
[PATCH 6.6 0244/1674] drm/amdgpu: fix ACP MFD device leak on init failure	[Body]
[PATCH 6.6 0245/1674] binder: fix is_failure flag for superseded transaction cleanup	[Body]
[PATCH 6.6 0246/1674] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede	[Body]
[PATCH 6.6 0247/1674] kgdboc: Fix tty driver reference leak in configure_kgdboc()	[Body]
[PATCH 6.6 0248/1674] Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11	[Body]
[PATCH 6.6 0249/1674] Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410	[Body]
[PATCH 6.6 0250/1674] Input: s6sy761 - fix resume ordering and restore sensing	[Body]
[PATCH 6.6 0251/1674] Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490	[Body]
[PATCH 6.6 0252/1674] Input: synaptics - limit T440p InterTouch quirk to LEN0036	[Body]
[PATCH 6.6 0253/1674] nitro_enclaves: fix use-after-free on SLOT_ALLOC failure	[Body]
[PATCH 6.6 0254/1674] soc: qcom: geni-se: Correct QUP Core ICC vote constants	[Body]
[PATCH 6.6 0255/1674] USB: cdc-acm: fix racy TIOCMIWAIT implementation	[Body]
[PATCH 6.6 0256/1674] USB: cdc-acm: skip URB restart in port_shutdown if disconnected	[Body]
[PATCH 6.6 0257/1674] USB: serial: fix port tear down use-after-free	[Body]
[PATCH 6.6 0258/1674] usb: storage: sierra_ms: reject short SWoC info transfers	[Body]
[PATCH 6.6 0259/1674] usb: hub: use shorter 120ms post resume hold for SS root hubs	[Body]
[PATCH 6.6 0260/1674] usb: octeon-hcd: fix the FIFO-flush timeout computation	[Body]
[PATCH 6.6 0261/1674] usb: ohci-da8xx: disable controller wakeup on cleanup	[Body]
[PATCH 6.6 0262/1674] usb: ohci-s3c2410: disable controller wakeup on removal	[Body]
[PATCH 6.6 0263/1674] usb: ohci-st: disable controller wakeup on removal	[Body]
[PATCH 6.6 0264/1674] usb: gadget: midi2: Fix the jack descriptor array sizes	[Body]
[PATCH 6.6 0265/1674] usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd	[Body]
[PATCH 6.6 0266/1674] usb: typec: anx7411 - stop the IRQ before destroying the workqueue	[Body]
[PATCH 6.6 0267/1674] usb: dwc3: am62: Fix runtime PM usage count leak on probe error path	[Body]
[PATCH 6.6 0268/1674] usb: gadget: aspeed-vhub: cancel wake work on device removal	[Body]
[PATCH 6.6 0269/1674] USB: gadget: dummy-hcd: Fix wait for outstanding request completions	[Body]
[PATCH 6.6 0270/1674] usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC	[Body]
[PATCH 6.6 0271/1674] usb: chipidea: tegra: disable runtime PM on resume failure	[Body]
[PATCH 6.6 0272/1674] usb: core: clear both ep_in and ep_out for non-ep0 control endpoints	[Body]
[PATCH 6.6 0273/1674] usb: typec: tcpm: recover after failure to start the frs ams	[Body]
[PATCH 6.6 0274/1674] usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()	[Body]
[PATCH 6.6 0275/1674] usb: typec: ucsi: Get the connector fwnode based on reg value	[Body]
[PATCH 6.6 0276/1674] usb: typec: ucsi: displayport: Current CAM OOB index fixup	[Body]
[PATCH 6.6 0277/1674] usb: cdns3: fix use-after-free in cdns3_gadget_exit()	[Body]
[PATCH 6.6 0278/1674] usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe	[Body]
[PATCH 6.6 0279/1674] tty: vt: fix memory leak in vc_allocate()	[Body]
[PATCH 6.6 0280/1674] tty: amiserial: fix broken TIOCMIWAIT	[Body]
[PATCH 6.6 0281/1674] tty: vcc: zero-initialize control packet in vcc_send_ctl()	[Body]
[PATCH 6.6 0282/1674] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup	[Body]
[PATCH 6.6 0283/1674] tty: serial: qcom_geni_serial: Keep console RX functional after deep idle	[Body]
[PATCH 6.6 0284/1674] tty: abort break signalling on hangup	[Body]
[PATCH 6.6 0285/1674] serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()	[Body]
[PATCH 6.6 0286/1674] serial: tegra: dont clear the Tx FIFO on an Rx-only reset	[Body]
[PATCH 6.6 0287/1674] serial: vt8500: Fix clock reference leak in vt8500_serial_probe()	[Body]
[PATCH 6.6 0288/1674] ASoC: codecs: max98363: fix uninitialized stream_config->type	[Body]
[PATCH 6.6 0289/1674] ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type	[Body]
[PATCH 6.6 0290/1674] ASoC: qcom: lpass-cpu: use DAI table index for playback constraints	[Body]
[PATCH 6.6 0291/1674] ALSA: seq: Serialize compat port-info ioctls	[Body]
[PATCH 6.6 0292/1674] ALSA: ua101: reject mismatched capture/playback packet sizes	[Body]
[PATCH 6.6 0293/1674] i2c: xiic: dont clobber msg->len to signal block-read completion	[Body]
[PATCH 6.6 0294/1674] Bluetooth: RFCOMM: Fix initial port reference race	[Body]
[PATCH 6.6 0295/1674] Bluetooth: hci_sync: Fix inquiry cache use-after-free	[Body]
[PATCH 6.6 0296/1674] Bluetooth: hci_conn: Lock parent access during enhanced SCO setup	[Body]
[PATCH 6.6 0297/1674] Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems	[Body]
[PATCH 6.6 0298/1674] Bluetooth: hci_core: Serialize ACL scheduling with channel deletion	[Body]
[PATCH 6.6 0299/1674] Bluetooth: hci_core: Serialize fragmented ISO packet queueing	[Body]
[PATCH 6.6 0300/1674] Bluetooth: btintel: fix buffer over-read in btintel_hw_error()	[Body]
[PATCH 6.6 0301/1674] ipvs: bound LBLCR and LBLC cache growth	[Body]
[PATCH 6.6 0302/1674] HID: multitouch: stop the release timer from being rearmed on remove	[Body]
[PATCH 6.6 0303/1674] net: extend IPv6 exthdr detection of tunneled packets	[Body]
[PATCH 6.6 0304/1674] net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules	[Body]
[PATCH 6.6 0305/1674] nvme-multipath: fix underflow in ANA log bounds checks	[Body]
[PATCH 6.6 0306/1674] nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT	[Body]
[PATCH 6.6 0307/1674] nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()	[Body]
[PATCH 6.6 0308/1674] mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ	[Body]
[PATCH 6.6 0309/1674] mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB	[Body]
[PATCH 6.6 0310/1674] mtd: spinand: fix zero oobavail when no ECC engine is used	[Body]
[PATCH 6.6 0311/1674] KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy	[Body]
[PATCH 6.6 0312/1674] wifi: cw1200: fix TX padding OOB read leaking heap data to device	[Body]
[PATCH 6.6 0313/1674] wifi: iwlegacy: 3945: free EEPROM data on remove	[Body]
[PATCH 6.6 0314/1674] wifi: mac80211: drain PS delivery work during station teardown	[Body]
[PATCH 6.6 0315/1674] wifi: mac80211: account proxy paths against the mesh path limit	[Body]
[PATCH 6.6 0316/1674] wifi: mac80211: minstrel_ht: validate fixed rate index	[Body]
[PATCH 6.6 0317/1674] wifi: mac80211: release mesh path quota on failed additions	[Body]
[PATCH 6.6 0318/1674] wifi: mac80211: fix mesh fast xmit path deletion UAF	[Body]
[PATCH 6.6 0319/1674] wifi: mac80211: handle empty FILS association request payload	[Body]
[PATCH 6.6 0320/1674] USB: serial: cp210x: add Corsair AX1500i Power Supply	[Body]
[PATCH 6.6 0321/1674] USB: serial: quatech2: fix baud rate overflow	[Body]
[PATCH 6.6 0322/1674] USB: serial: ssu100: fix baud rate overflow	[Body]
[PATCH 6.6 0323/1674] USB: serial: fix dynamic id driver deregistration race	[Body]
[PATCH 6.6 0324/1674] USB: serial: fix driver deregistration order	[Body]
[PATCH 6.6 0325/1674] USB: serial: fix ioctl hangup race	[Body]
[PATCH 6.6 0326/1674] USB: serial: option: add support for SIMCom SIM8260C	[Body]
[PATCH 6.6 0327/1674] USB: serial: option: add Quectel EG060W	[Body]
[PATCH 6.6 0328/1674] USB: serial: option: add Compal EXM-G1x support	[Body]
[PATCH 6.6 0329/1674] USB: serial: option: add Quectel RG660QB	[Body]
[PATCH 6.6 0330/1674] USB: serial: option: add Compal EXC-T1 support	[Body]
[PATCH 6.6 0331/1674] thunderbolt: Fix KASAN reported use-after-free when request is canceled	[Body]
[PATCH 6.6 0332/1674] thunderbolt: Disable CL states for the Anker Prime TB5 dock	[Body]
[PATCH 6.6 0333/1674] thunderbolt: Reject oversized XDomain properties responses	[Body]
[PATCH 6.6 0334/1674] smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races	[Body]
[PATCH 6.6 0335/1674] iio: accel: kxcjk-1013: reject duplicate event disable	[Body]
[PATCH 6.6 0336/1674] iio: accel: sca3000: fix frequency divider condition check	[Body]
[PATCH 6.6 0337/1674] iio: adc: stm32-adc: fix check on internal channel availability	[Body]
[PATCH 6.6 0338/1674] iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure	[Body]
[PATCH 6.6 0339/1674] iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls	[Body]
[PATCH 6.6 0340/1674] iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind	[Body]
[PATCH 6.6 0341/1674] iio: buffer: serialize buffer teardown with mode claims	[Body]
[PATCH 6.6 0342/1674] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.	[Body]
[PATCH 6.6 0343/1674] iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()	[Body]
[PATCH 6.6 0344/1674] iio: gyro: adis16136: fix unprotected debugfs reads	[Body]
[PATCH 6.6 0345/1674] iio: imu: adis16400: fix unprotected debugfs reads	[Body]
[PATCH 6.6 0346/1674] iio: imu: adis16480: fix unprotected debugfs reads	[Body]
[PATCH 6.6 0347/1674] iio: light: gp2ap020a00f: drain irq_work after free_irq	[Body]
[PATCH 6.6 0348/1674] iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup	[Body]
[PATCH 6.6 0349/1674] iio: proximity: isl29501: Fix return type of isl29501_register_write	[Body]
[PATCH 6.6 0350/1674] iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure	[Body]
[PATCH 6.6 0351/1674] iio: proximity: sx9324: Correct proximity channel resolution	[Body]
[PATCH 6.6 0352/1674] iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler	[Body]
[PATCH 6.6 0353/1674] iio: trigger: cancel reenable_work before freeing trigger	[Body]
[PATCH 6.6 0354/1674] jfs: fix array-index-out-of-bounds read in add_missing_indices	[Body]
[PATCH 6.6 0355/1674] KVM: arm64: vgic-its: Dont dereference a NULL collection on ITT save	[Body]
[PATCH 6.6 0356/1674] drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read	[Body]
[PATCH 6.6 0357/1674] SUNRPC: fix gssx_dec_option_array error path bugs	[Body]
[PATCH 6.6 0358/1674] SUNRPC: reject duplicate CREDS_VALUE options	[Body]
[PATCH 6.6 0359/1674] vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF	[Body]
[PATCH 6.6 0360/1674] mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages	[Body]
[PATCH 6.6 0361/1674] tcp: introduce icsk->icsk_keepalive_timer	[Body]
[PATCH 6.6 0362/1674] mptcp: prevent race between disconnect() and rtx	[Body]
[PATCH 6.6 0363/1674] wifi: wlcore: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 0364/1674] wifi: wlcore: Fix runtime PM leak in wlcore_remove()	[Body]
[PATCH 6.6 0365/1674] net: usb: qmi_wwan: add Quectel EG120K-EA	[Body]
[PATCH 6.6 0366/1674] serial: imx: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 0367/1674] serial: imx: serialize imx_uart_ports[] lifetime	[Body]
[PATCH 6.6 0368/1674] usb: gadget: at91_udc: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 0369/1674] usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed	[Body]
[PATCH 6.6 0370/1674] USB: gadget: ffs: fix mm lifetime handling	[Body]
[PATCH 6.6 0371/1674] usb: gadget: f_fs: Fix Use-After-Free in AIO error path	[Body]
[PATCH 6.6 0372/1674] usb: typec: tcpm: fix debug accessory mode detection for sink ports	[Body]
[PATCH 6.6 0373/1674] usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling	[Body]
[PATCH 6.6 0374/1674] xen/netfront: drop RX packets with a short Ethernet header	[Body]
[PATCH 6.6 0375/1674] fs,fsverity: reject size changes on fsverity files in setattr_prepare	[Body]
[PATCH 6.6 0376/1674] fs,fsverity: remove check for fsverity being enabled in setattr_prepare()	[Body]
[PATCH 6.6 0377/1674] drm/amd/display: Fix fast updates on DCE 8.1	[Body]
[PATCH 6.6 0378/1674] usb: dwc3: gadget: fix IRQ storm on invalid event buffer count	[Body]
[PATCH 6.6 0379/1674] tty: fix saved termios reset race	[Body]
[PATCH 6.6 0380/1674] perf: Require kernel access for text poke events	[Body]
[PATCH 6.6 0381/1674] arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems	[Body]
[PATCH 6.6 0382/1674] Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown	[Body]
[PATCH 6.6 0383/1674] Bluetooth: Serialize SMP remote OOB data access	[Body]
[PATCH 6.6 0384/1674] arm64: errata: Factor out broken AMU const counter cap	[Body]
[PATCH 6.6 0385/1674] arm64: errata: Add Cortex-A725 erratum 3821522 workaround	[Body]
[PATCH 6.6 0386/1674] KVM: arm64: Dont use the VMA to size stage-2 block mappings for VM_PFNMAP	[Body]
[PATCH 6.6 0387/1674] fsverity: add dependency on 64K or smaller pages	[Body]
[PATCH 6.6 0388/1674] drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend	[Body]
[PATCH 6.6 0389/1674] drm/amdgpu: reset VI ASIC on MacBookPro15,1	[Body]
[PATCH 6.6 0390/1674] drm/amdgpu: reset VI ASIC on MacBookPro14,3	[Body]
[PATCH 6.6 0391/1674] usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()	[Body]
[PATCH 6.6 0392/1674] usb: ohci-spear: disable controller wakeup on removal	[Body]
[PATCH 6.6 0393/1674] USB: dwc2: shut down wakeup timer before freeing HCD state	[Body]
[PATCH 6.6 0394/1674] drm/amd/display: Preserve eDP mode on initial ASSR failure	[Body]
[PATCH 6.6 0395/1674] usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41	[Body]
[PATCH 6.6 0396/1674] tty: tty_port: restore TTY_IO_ERROR on activation failure	[Body]
[PATCH 6.6 0397/1674] tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2	[Body]
[PATCH 6.6 0398/1674] tty: serial: max3100: shut down timer before freeing port	[Body]
[PATCH 6.6 0399/1674] serial: fix TIOCMIWAIT race	[Body]
[PATCH 6.6 0400/1674] serial: ma35d1: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 0401/1674] serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()	[Body]
[PATCH 6.6 0402/1674] ALSA: hda/tegra: Re-enable SDO workaround for Tegra194	[Body]
[PATCH 6.6 0403/1674] i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode	[Body]
[PATCH 6.6 0404/1674] i2c: xiic: preserve PEC byte length in SMBus block read setup	[Body]
[PATCH 6.6 0405/1674] drm/amd/display: Mark DCE 6.4 as not APU	[Body]
[PATCH 6.6 0406/1674] AppArmor: Allow apparmor to handle unaligned dfa tables	[Body]
[PATCH 6.6 0407/1674] apparmor: Fix & Optimize table creation from possibly unaligned memory	[Body]
[PATCH 6.6 0408/1674] mtd: spinand: fix NULL pointer dereference with no ECC engine	[Body]
[PATCH 6.6 0409/1674] wifi: mac80211: shut down RX BA session timer on teardown	[Body]
[PATCH 6.6 0410/1674] wifi: mac80211: keep fallback association elements alive	[Body]
[PATCH 6.6 0411/1674] mtd: block2mtd: Convert to bdev_open_by_dev/path()	[Body]
[PATCH 6.6 0412/1674] block2mtd: prevent direct access of bd_inode	[Body]
[PATCH 6.6 0413/1674] mtd: block2mtd: Fix divide error when erase_size is zero	[Body]
[PATCH 6.6 0414/1674] mtd: spinand: Enable QE on all dies	[Body]
[PATCH 6.6 0415/1674] bnxt_en: fix DMA mapping length for padded small packets	[Body]
[PATCH 6.6 0416/1674] tty: port: fix tty_port_tty_vhangup() race	[Body]
[PATCH 6.6 0417/1674] ASoC: SOF: topology: Parse DAI type token for dspless mode	[Body]
[PATCH 6.6 0418/1674] ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers	[Body]
[PATCH 6.6 0419/1674] erofs: avoid infinite loops due to corrupted subpage compact indexes	[Body]
[PATCH 6.6 0420/1674] erofs: unify lcn as u64 for 32-bit platforms	[Body]
[PATCH 6.6 0421/1674] fbdev: hyperv_fb: Simplify hvfb_putmem	[Body]
[PATCH 6.6 0422/1674] fbdev: hyperv_fb: Allow graceful removal of framebuffer	[Body]
[PATCH 6.6 0423/1674] firmware: arm_scmi: Publish channel state before callbacks	[Body]
[PATCH 6.6 0424/1674] firmware: arm_scmi: Unwind TX receiver mailbox setup failure	[Body]
[PATCH 6.6 0425/1674] gpio: rockchip: teardown bugs and resource leaks	[Body]
[PATCH 6.6 0426/1674] gpio: rockchip: fix generic IRQ chip leak on remove	[Body]
[PATCH 6.6 0427/1674] jbd2: check need_resched() when skipping busy checkpoint buffers	[Body]
[PATCH 6.6 0428/1674] jbd2: bound shrinker scans by examined checkpoint buffers	[Body]
[PATCH 6.6 0429/1674] wifi: mac80211: keep paired old chanctx alive	[Body]
[PATCH 6.6 0430/1674] wifi: mac80211: count only matching reservations in reserved switch	[Body]
[PATCH 6.6 0431/1674] iio: core: add accessors masklength	[Body]
[PATCH 6.6 0432/1674] iio: health: max30102: fix NULL dereference in interrupt handler	[Body]
[PATCH 6.6 0433/1674] fs: Free any excess xarray nodes in clear_inode()	[Body]
[PATCH 6.6 0434/1674] net/mlx5e: Prevent stale XSK buffer release on refill retry	[Body]
[PATCH 6.6 0435/1674] net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry	[Body]
[PATCH 6.6 0436/1674] net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()	[Body]
[PATCH 6.6 0437/1674] net: mana: Skip WQ object destruction for uninitialized RXQ	[Body]
[PATCH 6.6 0438/1674] net: mana: remove double CQ cleanup in mana_create_rxq error path	[Body]
[PATCH 6.6 0439/1674] mm/hugetlb: fix avoid_reserve to allow taking folio from subpool	[Body]
[PATCH 6.6 0440/1674] KVM: SVM: Use the active VMCBs MSR bitmap when checking if MSR is intercepted	[Body]
[PATCH 6.6 0441/1674] wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()	[Body]
[PATCH 6.6 0442/1674] wifi: mac80211: set info->band for 802.3 encap offload frames	[Body]
[PATCH 6.6 0443/1674] smb: client: discard post-EOF pagecache when extending a file via zero range	[Body]
[PATCH 6.6 0444/1674] iio: adc: ad_sigma_delta: fix use-after-free on unbind	[Body]
[PATCH 6.6 0445/1674] iio: adc: aspeed: Simplify with dev_err_probe	[Body]
[PATCH 6.6 0446/1674] iio: adc: aspeed: propagate reset deassert errors	[Body]
[PATCH 6.6 0447/1674] iio: adc: max1363: sign-extend bipolar differential channel reads	[Body]
[PATCH 6.6 0448/1674] iio: adc: axp288: Add TS bias override for Haier HV103H	[Body]
[PATCH 6.6 0449/1674] iio: adc: stm32-adc: fix possible division by zero in processed channel	[Body]
[PATCH 6.6 0450/1674] smb: client: only require read lease for size-extending preallocate	[Body]
[PATCH 6.6 0451/1674] iio: cdc: ad7150: fix OF matching and publish module aliases	[Body]
[PATCH 6.6 0452/1674] wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()	[Body]
[PATCH 6.6 0453/1674] HID: core: introduce hid_safe_input_report()	[Body]
[PATCH 6.6 0454/1674] HID: uhid: convert to hid_safe_input_report()	[Body]
[PATCH 6.6 0455/1674] f2fs: fix to reclaim space in f2fs_allocate_pinning_section()	[Body]
[PATCH 6.6 0456/1674] f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()	[Body]
[PATCH 6.6 0457/1674] f2fs: fix to reset all pinned status during fggc	[Body]
[PATCH 6.6 0458/1674] mm/damon/core: do non-safe region walk on kdamond_apply_schemes()	[Body]
[PATCH 6.6 0459/1674] mm/damon/core: fix unconditionally skip last region	[Body]
[PATCH 6.6 0460/1674] Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING	[Body]
[PATCH 6.6 0461/1674] netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting	[Body]
[PATCH 6.6 0462/1674] crypto: drbg - Fix ineffective sanity check	[Body]
[PATCH 6.6 0463/1674] ipv4: stop PMTU walk when nexthop group shrinks	[Body]
[PATCH 6.6 0464/1674] ipv4: stop route notification sizing when nexthop group shrinks	[Body]
[PATCH 6.6 0465/1674] ipv4: do not warn on route notification size race	[Body]
[PATCH 6.6 0466/1674] ipv6: do not warn on route notification size race	[Body]
[PATCH 6.6 0467/1674] Input: xpad - add support for Corsair Novablade Pro	[Body]
[PATCH 6.6 0468/1674] arm64: irq: exclude the softirq stack switch from KCOV	[Body]
[PATCH 6.6 0469/1674] ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)	[Body]
[PATCH 6.6 0470/1674] btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()	[Body]
[PATCH 6.6 0471/1674] dm ioctl: dont let data_start run past the buffer	[Body]
[PATCH 6.6 0472/1674] usb: f81604: fix struct f81604_int_data size mismatch	[Body]
[PATCH 6.6 0473/1674] wifi: brcmfmac: fix P2P device removal race in brcmf_detach()	[Body]
[PATCH 6.6 0474/1674] wireguard: queueing: preserve tstamp_type when encapsulating packet	[Body]
[PATCH 6.6 0475/1674] wireguard: noise: reject response consumption after intermediate initiation	[Body]
[PATCH 6.6 0476/1674] workqueue: Fix NULL current_pwq deref in chained work check	[Body]
[PATCH 6.6 0477/1674] xen/netfront: dont leak the skb when xennet_fill_frags() fails	[Body]
[PATCH 6.6 0478/1674] strparser: make sure __strp_recv isnt running before tearing down the parser	[Body]
[PATCH 6.6 0479/1674] swiotlb: fix default_swiotlb_limit() for non-growable default pool	[Body]
[PATCH 6.6 0480/1674] tipc: destroy topsrv workqueues before closing connections	[Body]
[PATCH 6.6 0481/1674] tipc: hold a reference to nodes found by link name	[Body]
[PATCH 6.6 0482/1674] Revert "wifi: libertas: reject short monitor TX frames"	[Body]
[PATCH 6.6 0483/1674] selinux: fix data race on AVC latest_notif	[Body]
[PATCH 6.6 0484/1674] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts	[Body]
[PATCH 6.6 0485/1674] sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute	[Body]
[PATCH 6.6 0486/1674] EDAC/amd64: Mask UMC chip select to the four implemented selects	[Body]
[PATCH 6.6 0487/1674] gpio: xilinx: fix runtime PM leak on request error path	[Body]
[PATCH 6.6 0488/1674] ibmveth: h_free logical LAN on open-fail after register	[Body]
[PATCH 6.6 0489/1674] ibmveth: fix TX LTB and filter unwind on open-fail	[Body]
[PATCH 6.6 0490/1674] keys: finalize persistent keyring timeout after link attempt	[Body]
[PATCH 6.6 0491/1674] KEYS: Fix add_key() race with keyring restriction	[Body]
[PATCH 6.6 0492/1674] memstick: core: wait for request completion before freeing card	[Body]
[PATCH 6.6 0493/1674] memstick: rtsx_usb_ms: complete requests after eject instead of dropping them	[Body]
[PATCH 6.6 0494/1674] dm-crypt: reject the lmk IV mode with AEAD ciphers	[Body]
[PATCH 6.6 0495/1674] dm-snap: reject the transient exception store for snapshot-merge	[Body]
[PATCH 6.6 0496/1674] dm: fix reading free memory in do_resume	[Body]
[PATCH 6.6 0497/1674] mmc: cavium-octeon: destroy slot platform devices on remove	[Body]
[PATCH 6.6 0498/1674] mmc: cavium-thunderx: destroy slot platform devices on remove	[Body]
[PATCH 6.6 0499/1674] mmc: mtk-sd: Cancel request timeout work on remove	[Body]
[PATCH 6.6 0500/1674] mmc: sdhci-sprd: disable runtime PM on remove	[Body]
[PATCH 6.6 0501/1674] net/packet: guard the ll header push in packet_rcv_spkt()	[Body]
[PATCH 6.6 0502/1674] net/smc: protect clcsock lifetime in smc_getname	[Body]
[PATCH 6.6 0503/1674] net: bridge: avoid recursive multicast port cleanup	[Body]
[PATCH 6.6 0504/1674] net: dsa: microchip: fix KSZ8765 fiber detection	[Body]
[PATCH 6.6 0505/1674] net: usb: ax88179_178a: fix rx frame length for non-last packets	[Body]
[PATCH 6.6 0506/1674] nvme: fix swapped ZRASF zone state values for full and read only	[Body]
[PATCH 6.6 0507/1674] openvswitch: fix soft lockup in the netlink flow dump	[Body]
[PATCH 6.6 0508/1674] regulator: ltc3676: dont read the write-only HRST and CLIRQ registers	[Body]
[PATCH 6.6 0509/1674] regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4	[Body]
[PATCH 6.6 0510/1674] pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains	[Body]
[PATCH 6.6 0511/1674] pmdomain: rockchip: dont ignore clock lookup errors on attach	[Body]
[PATCH 6.6 0512/1674] pmdomain: rockchip: fix clock leak on domain probe failure	[Body]
[PATCH 6.6 0513/1674] pmdomain: rockchip: propagate subdomain add errors	[Body]
[PATCH 6.6 0514/1674] iio: light: Drop ROHM BU27034	[Body]
[PATCH 6.6 0515/1674] scsi: qedi: Initialize callback state before registration	[Body]
[PATCH 6.6 0516/1674] Bluetooth: hci_sock: Serialize dead-device detachment	[Body]
[PATCH 6.6 0517/1674] Bluetooth: MGMT: Fix status of pending commands flushed on power off	[Body]
[PATCH 6.6 0518/1674] Bluetooth: RFCOMM: free the skb when the DLC has no owner	[Body]
[PATCH 6.6 0519/1674] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown	[Body]
[PATCH 6.6 0520/1674] drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN	[Body]
[PATCH 6.6 0521/1674] drm/gud: dont keep a connector without a CRTC as connector_state	[Body]
[PATCH 6.6 0522/1674] drm/i915/gem: Prevent overstepping exec array boundary	[Body]
[PATCH 6.6 0523/1674] drm/i915/gt: Unmask interrupts only when ACTIVE is true	[Body]
[PATCH 6.6 0524/1674] drm/vc4: drain the hangcheck timer and works on V3D unbind	[Body]
[PATCH 6.6 0525/1674] drm/amdkfd: align SDMA doorbell base for shader doorbell writes	[Body]
[PATCH 6.6 0526/1674] drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info	[Body]
[PATCH 6.6 0527/1674] drm/amdgpu: serialize vblank counter reads against GPU reset	[Body]
[PATCH 6.6 0528/1674] drm/amdgpu: make Mac FB workaround generic	[Body]
[PATCH 6.6 0529/1674] drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks	[Body]
[PATCH 6.6 0530/1674] drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs	[Body]
[PATCH 6.6 0531/1674] fs: refuse fspick() on internal superblocks	[Body]
[PATCH 6.6 0532/1674] namespace: check a submount for references right before unmounting it	[Body]
[PATCH 6.6 0533/1674] dcache: dont put a mountpoint on a dentry thats being removed	[Body]
[PATCH 6.6 0534/1674] namei: dont reveal overmounted entries in refwalk	[Body]
[PATCH 6.6 0535/1674] namespace: refuse an automount below a mount that is in no namespace	[Body]
[PATCH 6.6 0536/1674] drm/dp: dont mark the AUX backlight enabled when enabling failed	[Body]
[PATCH 6.6 0537/1674] gpio: exar: initialize the ID before registering its cleanup	[Body]
[PATCH 6.6 0538/1674] drm/aspeed: Balance the display clock enable on teardown	[Body]
[PATCH 6.6 0539/1674] drm/vc4: Free the BO cache size list on teardown	[Body]
[PATCH 6.6 0540/1674] net/sched: em_text: reject unterminated algo before autoload	[Body]
[PATCH 6.6 0541/1674] amt: send the relays General Query directly from the receive path	[Body]
[PATCH 6.6 0542/1674] cxgb4/ch_ktls: disable softirqs around tid_list erases	[Body]
[PATCH 6.6 0543/1674] nvmet: use the local P2P device on metadata allocation failure	[Body]
[PATCH 6.6 0544/1674] btrfs: fix xattr replace when multiple xattrs are packed in the same item	[Body]
[PATCH 6.6 0545/1674] wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit	[Body]
[PATCH 6.6 0546/1674] wifi: mt76: mt792x: pick the SAR table layout from the table itself	[Body]
[PATCH 6.6 0547/1674] ASoC: adau1372: allow sleepy powerdown GPIOs	[Body]
[PATCH 6.6 0548/1674] ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes	[Body]
[PATCH 6.6 0549/1674] ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM	[Body]
[PATCH 6.6 0550/1674] flow_dissector: avoid u16 truncation of skb->len when computing thoff	[Body]
[PATCH 6.6 0551/1674] net/sched: cls_route: reject change with no routing attribute	[Body]
[PATCH 6.6 0552/1674] flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()	[Body]
[PATCH 6.6 0553/1674] veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down	[Body]
[PATCH 6.6 0554/1674] net/mlx5e: Order ICOSQ cc update after CQ doorbell	[Body]
[PATCH 6.6 0555/1674] mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()	[Body]
[PATCH 6.6 0556/1674] net: openvswitch: validate transport header presence in set_ipv6_addr	[Body]
[PATCH 6.6 0557/1674] netfilter: conntrack: fix erronous removal of offload bit	[Body]
[PATCH 6.6 0558/1674] netfilter: flowtable: fix offloaded ct timeout never being extended	[Body]
[PATCH 6.6 0559/1674] wifi: mt76: mt7603: initialize global station WCID	[Body]
[PATCH 6.6 0560/1674] dlm: validate length in dlm_search_rsb_tree	[Body]
[PATCH 6.6 0561/1674] can: fix unique skb identifier regression under RPS	[Body]
[PATCH 6.6 0562/1674] drm/amd/display: Dont replace a sink mode that shares the native totals	[Body]
[PATCH 6.6 0563/1674] HID: hid-steam: Make client_opened a counter	[Body]
[PATCH 6.6 0564/1674] HID: steam: Fully unregister controller when hidraw is opened	[Body]
[PATCH 6.6 0565/1674] HID: steam: Rearrange teardown sequence	[Body]
[PATCH 6.6 0566/1674] HID: steam: Refactor registration	[Body]
[PATCH 6.6 0567/1674] HID: steam: Clean up locking	[Body]
[PATCH 6.6 0568/1674] tracing: Set the trace clock before registering the histogram trigger	[Body]
[PATCH 6.6 0569/1674] ip6_gre: remove obsolete ERSPAN PMTU update	[Body]
[PATCH 6.6 0570/1674] ice: fix metadata_dst refcount handling on representor teardown	[Body]
[PATCH 6.6 0571/1674] mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP	[Body]
[PATCH 6.6 0572/1674] mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge	[Body]
[PATCH 6.6 0573/1674] llist: add interface to check if a node is on a list.	[Body]
[PATCH 6.6 0574/1674] nvme-tcp: sanitize request list handling	[Body]
[PATCH 6.6 0575/1674] ALSA: pcm: oss: Fix setup list UAF on proc write error	[Body]
[PATCH 6.6 0576/1674] ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger	[Body]
[PATCH 6.6 0577/1674] ALSA: mixer: oss: Add card disconnect checkpoints	[Body]
[PATCH 6.6 0578/1674] apparmor: fix cred UAF caused by begin_current_label_crit_section()	[Body]
[PATCH 6.6 0579/1674] netfilter: nf_tables: fix bidirectional offload regression	[Body]
[PATCH 6.6 0580/1674] net: team: Remove unused team_mode_op, port_enabled	[Body]
[PATCH 6.6 0581/1674] net: team: Rename port_disabled team mode op to port_tx_disabled	[Body]
[PATCH 6.6 0582/1674] net: team: fix NULL pointer dereference in team_xmit during mode change	[Body]
[PATCH 6.6 0583/1674] net: team: stop reusing skb after queue override	[Body]
[PATCH 6.6 0584/1674] Bluetooth: hci_sync: Fix command skb lifetime during scan setup	[Body]
[PATCH 6.6 0585/1674] Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex	[Body]
[PATCH 6.6 0586/1674] drm/vmwgfx: validate pitch coming from userspace	[Body]
[PATCH 6.6 0587/1674] Bluetooth: ISO: Serialize concurrent connect calls	[Body]
[PATCH 6.6 0588/1674] namespace: dont inherit MNT_UMOUNT in clone_mnt()	[Body]
[PATCH 6.6 0589/1674] namespace: check the mounts before reading their parents in pivot_root()	[Body]
[PATCH 6.6 0590/1674] most: core: fix resource leak in most_register_interface error paths	[Body]
[PATCH 6.6 0591/1674] most: core: fix leak on early registration failure	[Body]
[PATCH 6.6 0592/1674] net/mlx5e: Dont store mlx5e_priv in mlx5e_dev devlink priv	[Body]
[PATCH 6.6 0593/1674] net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv	[Body]
[PATCH 6.6 0594/1674] ACPI: processor_idle: Mark LPI enter functions as __cpuidle	[Body]
[PATCH 6.6 0595/1674] ALSA: control: Dont add invalid kcontrols to LED layer	[Body]
[PATCH 6.6 0596/1674] ASoC: hdac_hda: Fix hlink refcount leak on component registration failure	[Body]
[PATCH 6.6 0597/1674] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params	[Body]
[PATCH 6.6 0598/1674] wifi: ath12k: fix reusing m3 memory	[Body]
[PATCH 6.6 0599/1674] wifi: ath12k: copy M3 firmware when reusing the buffer	[Body]
[PATCH 6.6 0600/1674] optee: register TEE devices only once fully initialized	[Body]
[PATCH 6.6 0601/1674] scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ	[Body]
[PATCH 6.6 0602/1674] scsi: ch: Do not keep references to data transfer element devices	[Body]
[PATCH 6.6 0603/1674] scsi: ufs: mcq: Remove unused parameters	[Body]
[PATCH 6.6 0604/1674] scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()	[Body]
[PATCH 6.6 0605/1674] scsi: ufs: core: Add debug log for MCQ command timeout	[Body]
[PATCH 6.6 0606/1674] scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()	[Body]
[PATCH 6.6 0607/1674] scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()	[Body]
[PATCH 6.6 0608/1674] drm/vc4: Fix firmware reference leak in vc4_drm_bind()	[Body]
[PATCH 6.6 0609/1674] namespace: unhash a dentry before detaching the mounts on it	[Body]
[PATCH 6.6 0610/1674] namespace: dont copy an unmounted mount tree	[Body]
[PATCH 6.6 0611/1674] namespace: check the target before walking it in do_mount_setattr()	[Body]
[PATCH 6.6 0612/1674] fcntl: refuse F_SET_RW_HINT on an immutable inode	[Body]
[PATCH 6.6 0613/1674] namespace: handle mount locking for automounts correctly	[Body]
[PATCH 6.6 0614/1674] tty: add break_wait kernel-doc	[Body]
[PATCH 6.6 0615/1674] drm/msm/dpu: shift IRQ indices by 1	[Body]
[PATCH 6.6 0616/1674] drm/msm/dpu: Add mutex lock in control vblank irq	[Body]
[PATCH 6.6 0617/1674] net: nexthop: Have all NH notifiers carry NH ID	[Body]
[PATCH 6.6 0618/1674] net: nexthop: Increase weight to u16	[Body]
[PATCH 6.6 0619/1674] drm/amdgpu: change vm->task_info handling	[Body]
[PATCH 6.6 0620/1674] sched/deadline: Fix task_struct reference leak	[Body]
[PATCH 6.6 0621/1674] sched: fix warning in sched_setaffinity	[Body]
[PATCH 6.6 0622/1674] bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()	[Body]
[PATCH 6.6 0623/1674] bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()	[Body]
[PATCH 6.6 0624/1674] ice: Dont process extts if PTP is disabled	[Body]
[PATCH 6.6 0625/1674] drm/amdgpu: fix double free err_addr pointer warnings	[Body]
[PATCH 6.6 0626/1674] ice: Fix improper extts handling	[Body]
[PATCH 6.6 0627/1674] s390/pkey: harmonize pkey s390 debug feature calls	[Body]
[PATCH 6.6 0628/1674] s390/pkey: Wipe copies of protected- and secure-keys	[Body]
[PATCH 6.6 0629/1674] gve: Account for stopped queues when reading NIC stats	[Body]
[PATCH 6.6 0630/1674] mm/thp: fix "mm: thp: kill __transhuge_page_enabled()"	[Body]
[PATCH 6.6 0631/1674] mm: simplify thp_vma_allowable_order	[Body]
[PATCH 6.6 0632/1674] mm/huge_memory: avoid PMD-size page cache if needed	[Body]
[PATCH 6.6 0633/1674] PCI: endpoint: pci-epf-test: Make use of cached epc_features in pci_epf_test_core_init()	[Body]
[PATCH 6.6 0634/1674] serial: sc16is7xx: fix TX fifo corruption	[Body]
[PATCH 6.6 0635/1674] pktgen: use cpus_read_lock() in pg_net_init()	[Body]
[PATCH 6.6 0636/1674] drm/amd/display: Use kcalloc() instead of kzalloc()	[Body]
[PATCH 6.6 0637/1674] drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range	[Body]
[PATCH 6.6 0638/1674] scsi: lpfc: Fix failure to delete vports when discovery is in progress	[Body]
[PATCH 6.6 0639/1674] scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs	[Body]
[PATCH 6.6 0640/1674] scsi: lpfc: Change nlp state statistic counters into atomic_t	[Body]
[PATCH 6.6 0641/1674] scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock	[Body]
[PATCH 6.6 0642/1674] scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask	[Body]
[PATCH 6.6 0643/1674] drm/amd/display: Avoid overflow from uint32_t to uint8_t	[Body]
[PATCH 6.6 0644/1674] bpf: Prevent tailcall infinite loop caused by freplace	[Body]
[PATCH 6.6 0645/1674] slub, kasan: improve interaction of KASAN and slub_debug poisoning	[Body]
[PATCH 6.6 0646/1674] mm/slub: avoid zeroing outside-object freepointer for single free	[Body]
[PATCH 6.6 0647/1674] mm, slub: avoid zeroing kmalloc redzone	[Body]
[PATCH 6.6 0648/1674] bpf: Fix a sdiv overflow issue	[Body]
[PATCH 6.6 0649/1674] drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer	[Body]
[PATCH 6.6 0650/1674] drm/amd/display: Check null pointers before multiple uses	[Body]
[PATCH 6.6 0651/1674] drm/amd/display: Check null pointers before used	[Body]
[PATCH 6.6 0652/1674] l2tp: prevent possible tunnel refcount underflow	[Body]
[PATCH 6.6 0653/1674] net/ncsi: Disable the ncsi work before freeing the associated structure	[Body]
[PATCH 6.6 0654/1674] drm/amd/display: Implement bounds check for stream encoder creation in DCN401	[Body]
[PATCH 6.6 0655/1674] afs: Fix lock recursion	[Body]
[PATCH 6.6 0656/1674] exfat: convert to new timestamp accessors	[Body]
[PATCH 6.6 0657/1674] exfat: fix out-of-bounds access of directory entries	[Body]
[PATCH 6.6 0658/1674] io_uring: check for overflows in io_pin_pages	[Body]
[PATCH 6.6 0659/1674] drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe	[Body]
[PATCH 6.6 0660/1674] fuse: Fix missing FOLL_PIN for direct-io	[Body]
[PATCH 6.6 0661/1674] virtiofs: use pages instead of pointer for kernel direct IO	[Body]
[PATCH 6.6 0662/1674] udmabuf: change folios array from kmalloc to kvmalloc	[Body]
[PATCH 6.6 0663/1674] udmabuf: fix memory leak on last export_udmabuf() error path	[Body]
[PATCH 6.6 0664/1674] vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()	[Body]
[PATCH 6.6 0665/1674] scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs	[Body]
[PATCH 6.6 0666/1674] PCI: imx6: Fix suspend/resume support on i.MX6QDL	[Body]
[PATCH 6.6 0667/1674] RDMA/siw: Remove direct link to net_device	[Body]
[PATCH 6.6 0668/1674] udp: Deal with race between UDP socket address change and rehash	[Body]
[PATCH 6.6 0669/1674] powerpc/iommu: Move pSeries specific functions to pseries/iommu.c	[Body]
[PATCH 6.6 0670/1674] powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW	[Body]
[PATCH 6.6 0671/1674] PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()	[Body]
[PATCH 6.6 0672/1674] rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy	[Body]
[PATCH 6.6 0673/1674] net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue	[Body]
[PATCH 6.6 0674/1674] mm: clear uffd-wp PTE/PMD state on mremap()	[Body]
[PATCH 6.6 0675/1674] RDMA/mlx5: Fix implicit ODP use after free	[Body]
[PATCH 6.6 0676/1674] nilfs2: do not force clear folio if buffer is referenced	[Body]
[PATCH 6.6 0677/1674] scsi: mpi3mr: Fix possible crash when setting up bsg fails	[Body]
[PATCH 6.6 0678/1674] wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion	[Body]
[PATCH 6.6 0679/1674] net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels	[Body]
[PATCH 6.6 0680/1674] net: ravb: Fix missing rtnl lock in suspend/resume path	[Body]
[PATCH 6.6 0681/1674] btrfs: do proper folio cleanup when run_delalloc_nocow() failed	[Body]
[PATCH 6.6 0682/1674] btrfs: do proper folio cleanup when cow_file_range() failed	[Body]
[PATCH 6.6 0683/1674] bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT	[Body]
[PATCH 6.6 0684/1674] RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers	[Body]
[PATCH 6.6 0685/1674] RDMA/mlx5: Fix a WARN during dereg_mr for DM type	[Body]
[PATCH 6.6 0686/1674] RDMA/mlx5: Fix the recovery flow of the UMR QP	[Body]
[PATCH 6.6 0687/1674] nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()	[Body]
[PATCH 6.6 0688/1674] eth: bnxt: fix truesize for mb-xdp-pass case	[Body]
[PATCH 6.6 0689/1674] net: mctp: unshare packets when reassembling	[Body]
[PATCH 6.6 0690/1674] fs/9p: convert mkdir to use get_new_inode	[Body]
[PATCH 6.6 0691/1674] fs/9p: fix NULL pointer dereference on mkdir	[Body]
[PATCH 6.6 0692/1674] bnxt_en: Put the TX producer information in the TX BD opaque field	[Body]
[PATCH 6.6 0693/1674] bnxt_en: Add completion ring pointer in TX and RX ring structures	[Body]
[PATCH 6.6 0694/1674] bnxt_en: Modify TX ring indexing logic.	[Body]
[PATCH 6.6 0695/1674] bnxt_en: Mask the bd_cnt field in the TX BD properly	[Body]
[PATCH 6.6 0696/1674] ax25: Remove broken autobind	[Body]
[PATCH 6.6 0697/1674] ext4: define ext4_journal_destroy wrapper	[Body]
[PATCH 6.6 0698/1674] ext4: avoid journaling sb update on error if journal is destroying	[Body]
[PATCH 6.6 0699/1674] btrfs: fix block group refcount race in btrfs_create_pending_block_groups()	[Body]
[PATCH 6.6 0700/1674] f2fs: convert f2fs_handle_page_eio() to use folio	[Body]
[PATCH 6.6 0701/1674] f2fs: fix potential deadloop in prepare_compress_overwrite()	[Body]
[PATCH 6.6 0702/1674] wifi: ath11k: add support to select 6 GHz regulatory type	[Body]
[PATCH 6.6 0703/1674] wifi: ath11k: fix misspelling of "dma" in num_rxmda_per_pdev	[Body]
[PATCH 6.6 0704/1674] wifi: ath11k: update channel list in reg notifier instead reg worker	[Body]
[PATCH 6.6 0705/1674] RISC-V: KVM: Add kvm_vcpu_config	[Body]
[PATCH 6.6 0706/1674] RISC-V: KVM: Teardown riscv specific bits after kvm_exit	[Body]
[PATCH 6.6 0707/1674] wifi: ath12k: Remove unnecessary (void*) conversions	[Body]
[PATCH 6.6 0708/1674] wifi: ath12k: avoid explicit mac id argument in Rxdma replenish	[Body]
[PATCH 6.6 0709/1674] wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish	[Body]
[PATCH 6.6 0710/1674] wifi: ath12k: avoid explicit HW conversion argument in Rxdma replenish	[Body]
[PATCH 6.6 0711/1674] wifi: ath12k: refactor DP Rxdma ring structure	[Body]
[PATCH 6.6 0712/1674] wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info	[Body]
[PATCH 6.6 0713/1674] wifi: ath12k: fix incorrect TID updation in DP monitor status path	[Body]
[PATCH 6.6 0714/1674] wifi: ath12k: Avoid explicit type cast in monitor status parse handler	[Body]
[PATCH 6.6 0715/1674] wifi: ath12k: Avoid memory leak while enabling statistics	[Body]
[PATCH 6.6 0716/1674] perf: Fix hang while freeing sigtrap event	[Body]
[PATCH 6.6 0717/1674] smb: client: allocate crypto only for primary server	[Body]
[PATCH 6.6 0718/1674] smb: client: fix UAF in decryption with multichannel	[Body]
[PATCH 6.6 0719/1674] ublk: fix handling recovery & reissue in ublk_abort_queue()	[Body]
[PATCH 6.6 0720/1674] fs/ntfs3: Use function file_inode to get inode from file	[Body]
[PATCH 6.6 0721/1674] fs/ntfs3: Separete common code for file_read/write iter/splice	[Body]
[PATCH 6.6 0722/1674] fs/ntfs3: Keep write operations atomic	[Body]
[PATCH 6.6 0723/1674] bpf: Fix kmemleak warning for percpu hashmap	[Body]
[PATCH 6.6 0724/1674] btrfs: allow to run delayed refs by bytes to be released instead of count	[Body]
[PATCH 6.6 0725/1674] btrfs: reserve space for delayed refs on a per ref basis	[Body]
[PATCH 6.6 0726/1674] btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release()	[Body]
[PATCH 6.6 0727/1674] btrfs: stop doing excessive space reservation for csum deletion	[Body]
[PATCH 6.6 0728/1674] btrfs: remove pointless loop from btrfs_update_block_group()	[Body]
[PATCH 6.6 0729/1674] btrfs: stop reserving excessive space for block group item updates	[Body]
[PATCH 6.6 0730/1674] btrfs: stop reserving excessive space for block group item insertions	[Body]
[PATCH 6.6 0731/1674] btrfs: harden block_group::bg_list against list_del() races	[Body]
[PATCH 6.6 0732/1674] sfc: Implement ndo_hwtstamp_(get\|set)	[Body]
[PATCH 6.6 0733/1674] sfc: rip out MDIO support	[Body]
[PATCH 6.6 0734/1674] sfc: fix NULL dereferences in ef100_process_design_param()	[Body]
[PATCH 6.6 0735/1674] scsi: mpi3mr: Split off bus_reset function from host_reset	[Body]
[PATCH 6.6 0736/1674] scsi: mpi3mr: Debug ability improvements	[Body]
[PATCH 6.6 0737/1674] scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue	[Body]
[PATCH 6.6 0738/1674] drm/amd/display: prevent hang on link training fail	[Body]
[PATCH 6.6 0739/1674] um: fix time-travel syscall scheduling hack	[Body]
[PATCH 6.6 0740/1674] um: work around sched_yield not yielding in time-travel mode	[Body]
[PATCH 6.6 0741/1674] kasan: avoid sleepable page allocation from atomic context	[Body]
[PATCH 6.6 0742/1674] clk: sunxi-ng: h616: Reparent CPU clock during frequency changes	[Body]
[PATCH 6.6 0743/1674] clk: sunxi-ng: h616: Reparent GPU clock during frequency changes	[Body]
[PATCH 6.6 0744/1674] dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn	[Body]
[PATCH 6.6 0745/1674] bpf: copy_verifier_state() should copy loop_entry field	[Body]
[PATCH 6.6 0746/1674] virtio: make virtio_bus const	[Body]
[PATCH 6.6 0747/1674] driver core: bus: add irq_get_affinity callback to bus_type	[Body]
[PATCH 6.6 0748/1674] virtio: hookup irq_get_affinity callback	[Body]
[PATCH 6.6 0749/1674] virtio: break and reset virtio devices on device_shutdown()	[Body]
[PATCH 6.6 0750/1674] PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops	[Body]
[PATCH 6.6 0751/1674] wifi: iwlwifi: dont warn when if there is a FW error	[Body]
[PATCH 6.6 0752/1674] coresight: holding cscfg_csdev_lock while removing cscfg from csdev	[Body]
[PATCH 6.6 0753/1674] riscv: save the SR_SUM status over switches	[Body]
[PATCH 6.6 0754/1674] bpf: Do not include stack ptr register in precision backtracking bookkeeping	[Body]
[PATCH 6.6 0755/1674] wifi: ath12k: fix invalid access to memory	[Body]
[PATCH 6.6 0756/1674] Bluetooth: eir: Fix possible crashes on eir_create_adv_data	[Body]
[PATCH 6.6 0757/1674] s390/mm: Fix in_atomic() handling in do_secure_storage_access()	[Body]
[PATCH 6.6 0758/1674] wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850	[Body]
[PATCH 6.6 0759/1674] RDMA/hns: Fix double destruction of rsv_qp	[Body]
[PATCH 6.6 0760/1674] drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port	[Body]
[PATCH 6.6 0761/1674] wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()	[Body]
[PATCH 6.6 0762/1674] rv: Use strings in da monitors tracepoints	[Body]
[PATCH 6.6 0763/1674] wifi: iwlwifi: return ERR_PTR from opmode start()	[Body]
[PATCH 6.6 0764/1674] wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()	[Body]
[PATCH 6.6 0765/1674] drm/amd/pm: fix null pointer access	[Body]
[PATCH 6.6 0766/1674] habanalabs: fix UAF in export_dmabuf()	[Body]
[PATCH 6.6 0767/1674] net/sched: Fix backlog accounting in qdisc_dequeue_internal	[Body]
[PATCH 6.6 0768/1674] drm/amd/display: switch DC over to the new DRM logging macros	[Body]
[PATCH 6.6 0769/1674] drm/amd/display: fix a Null pointer dereference vulnerability	[Body]
[PATCH 6.6 0770/1674] wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data handling	[Body]
[PATCH 6.6 0771/1674] wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()	[Body]
[PATCH 6.6 0772/1674] wifi: ath10k: replace ENOTSUPP with EOPNOTSUPP	[Body]
[PATCH 6.6 0773/1674] wifi: ath10k: shutdown driver when hardware is unreliable	[Body]
[PATCH 6.6 0774/1674] mm/smaps: fix race between smaps_hugetlb_range and migration	[Body]
[PATCH 6.6 0775/1674] crypto: x86/aegis128 - eliminate some indirect calls	[Body]
[PATCH 6.6 0776/1674] crypto: x86/aegis128 - optimize length block preparation using SSE4.1	[Body]
[PATCH 6.6 0777/1674] crypto: x86/aegis128 - improve assembly function prototypes	[Body]
[PATCH 6.6 0778/1674] crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT	[Body]
[PATCH 6.6 0779/1674] crypto: x86/aegis - Add missing error checks	[Body]
[PATCH 6.6 0780/1674] bnxt_en: Fix memory corruption when FW resources change during ifdown	[Body]
[PATCH 6.6 0781/1674] trace/fgraph: Fix the warning caused by missing unregister notifier	[Body]
[PATCH 6.6 0782/1674] vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects	[Body]
[PATCH 6.6 0783/1674] vxlan: Fix NPD when refreshing an FDB entry with a nexthop object	[Body]
[PATCH 6.6 0784/1674] ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog	[Body]
[PATCH 6.6 0785/1674] wifi: mt76: mt7915: fix list corruption after hardware restart	[Body]
[PATCH 6.6 0786/1674] mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()	[Body]
[PATCH 6.6 0787/1674] ceph: fix race condition validating r_parent before applying state	[Body]
[PATCH 6.6 0788/1674] smb: client: let recv_done verify data_offset, data_length and remaining_data_length	[Body]
[PATCH 6.6 0789/1674] dm-verity: provide dma_alignment limit in io_hints	[Body]
[PATCH 6.6 0790/1674] dm: stop using blk_limits_io_{min,opt}	[Body]
[PATCH 6.6 0791/1674] dm-stripe: limit chunk_sectors to the stripe size	[Body]
[PATCH 6.6 0792/1674] dm-stripe: fix a possible integer overflow	[Body]
[PATCH 6.6 0793/1674] ice: fix Rx page leak on multi-buffer frames	[Body]
[PATCH 6.6 0794/1674] iommu/s390: Make attach succeed when the device was surprise removed	[Body]
[PATCH 6.6 0795/1674] bpf: improve error message for unsupported helper	[Body]
[PATCH 6.6 0796/1674] bpf: add a get_helper_proto() utility function	[Body]
[PATCH 6.6 0797/1674] bpf: Check the helper function is valid in get_helper_proto	[Body]
[PATCH 6.6 0798/1674] ptp: Replace timestamp event queue with linked list	[Body]
[PATCH 6.6 0799/1674] ptp: Add a upper bound on max_vclocks	[Body]
[PATCH 6.6 0800/1674] RISC-V: KVM: Write hgatp register with valid mode bits	[Body]
[PATCH 6.6 0801/1674] tcp_metrics: use dst_dev_net_rcu()	[Body]
[PATCH 6.6 0802/1674] crypto: hisilicon/qm - request reserved interrupt for virtual function	[Body]
[PATCH 6.6 0803/1674] ipv6: use RCU in ip6_output()	[Body]
[PATCH 6.6 0804/1674] net: use dst_dev_rcu() in sk_setup_caps()	[Body]
[PATCH 6.6 0805/1674] mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning	[Body]
[PATCH 6.6 0806/1674] mailbox: zynqmp: Move of_match structure closer to usage	[Body]
[PATCH 6.6 0807/1674] mailbox: zynqmp: Move buffered IPI setup to of_match selected routine	[Body]
[PATCH 6.6 0808/1674] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop	[Body]
[PATCH 6.6 0809/1674] Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete	[Body]
[PATCH 6.6 0810/1674] drm/amdgpu: Show vram vendor only if available	[Body]
[PATCH 6.6 0811/1674] drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM	[Body]
[PATCH 6.6 0812/1674] md/raid10: wait barrier before returning discard request with REQ_NOWAIT	[Body]
[PATCH 6.6 0813/1674] ASoC: Intel: avs: Do not share the name pointer between components	[Body]
[PATCH 6.6 0814/1674] sysfs: Introduce a mechanism to hide static attribute_groups	[Body]
[PATCH 6.6 0815/1674] sysfs: check visibility before changing group attribute ownership	[Body]
[PATCH 6.6 0816/1674] media: nxp: imx8-isi: Fix streaming cleanup on release	[Body]
[PATCH 6.6 0817/1674] tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()	[Body]
[PATCH 6.6 0818/1674] drm/amdgpu: remove two invalid BUG_ON()s	[Body]
[PATCH 6.6 0819/1674] mlx5: Fix default values in create CQ	[Body]
[PATCH 6.6 0820/1674] drm/amdgpu: Restore partition mode after reset	[Body]
[PATCH 6.6 0821/1674] drm/amdgpu: fix gpu page fault after hibernation on PF passthrough	[Body]
[PATCH 6.6 0822/1674] scsi: ufs: qcom : Refactor phy_power_on/off calls	[Body]
[PATCH 6.6 0823/1674] scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)	[Body]
[PATCH 6.6 0824/1674] serial: ip22zilog: Use port lock wrappers	[Body]
[PATCH 6.6 0825/1674] tty: serial: ip22zilog: Use platform device for probing	[Body]
[PATCH 6.6 0826/1674] scsi: imm: Fix use-after-free bug caused by unfinished delayed work	[Body]
[PATCH 6.6 0827/1674] gfs2: Prevent recursive memory reclaim	[Body]
[PATCH 6.6 0828/1674] md: fix stopping sync thread	[Body]
[PATCH 6.6 0829/1674] md: fix rcu protection in md_wakeup_thread	[Body]
[PATCH 6.6 0830/1674] coresight: ETR: Fix ETR buffer use-after-free issue	[Body]
[PATCH 6.6 0831/1674] bpf: Fix stackmap overflow check in __bpf_get_stackid()	[Body]
[PATCH 6.6 0832/1674] wifi: ath12k: Fix MSDU buffer types handling in RX error path	[Body]
[PATCH 6.6 0833/1674] scsi: qla2xxx: Clear cmds after chip reset	[Body]
[PATCH 6.6 0834/1674] usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal	[Body]
[PATCH 6.6 0835/1674] Input: alps - fix use-after-free bugs caused by dev3_register_work	[Body]
[PATCH 6.6 0836/1674] shmem: fix recovery on rename failures	[Body]
[PATCH 6.6 0837/1674] Input: lkkbd - disable pending work before freeing device	[Body]
[PATCH 6.6 0838/1674] usb: gadget: Support already-mapped DMA SGs	[Body]
[PATCH 6.6 0839/1674] usb: gadget: functionfs: Factorize wait-for-endpoint code	[Body]
[PATCH 6.6 0840/1674] functionfs, gadgetfs: use simple_recursive_removal()	[Body]
[PATCH 6.6 0841/1674] functionfs: fix the open/removal races	[Body]
[PATCH 6.6 0842/1674] MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits	[Body]
[PATCH 6.6 0843/1674] md: add new helpers to suspend/resume array	[Body]
[PATCH 6.6 0844/1674] md: add new helpers to suspend/resume and lock/unlock array	[Body]
[PATCH 6.6 0845/1674] md: suspend array while updating raid_disks via sysfs	[Body]
[PATCH 6.6 0846/1674] wifi: mac80211: dont WARN for connections on invalid channels	[Body]
[PATCH 6.6 0847/1674] wifi: rtw88: debugfs: support multiple adapters debugging	[Body]
[PATCH 6.6 0848/1674] wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()	[Body]
[PATCH 6.6 0849/1674] net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels	[Body]
[PATCH 6.6 0850/1674] PCI: endpoint: Add missing NULL check for alloc_workqueue()	[Body]
[PATCH 6.6 0851/1674] bpf: Mark bpf_refcount field as unique	[Body]
[PATCH 6.6 0852/1674] staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths	[Body]
[PATCH 6.6 0853/1674] of: unittest: Fix memory leak in unittest_data_add()	[Body]
[PATCH 6.6 0854/1674] spi: tegra210-quad: Protect curr_xfer check in IRQ handler	[Body]
[PATCH 6.6 0855/1674] ALSA: usb-audio: Prevent excessive number of frames	[Body]
[PATCH 6.6 0856/1674] drm/amd/pm: Disable MMIO access during SMU Mode 1 reset	[Body]
[PATCH 6.6 0857/1674] btrfs: reject new transactions if the fs is fully read-only	[Body]
[PATCH 6.6 0858/1674] ksmbd: add chann_lock to protect ksmbd_chann_list xarray	[Body]
[PATCH 6.6 0859/1674] tcp: secure_seq: add back ports to TS offset	[Body]
[PATCH 6.6 0860/1674] net: add xmit recursion limit to tunnel xmit functions	[Body]
[PATCH 6.6 0861/1674] cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()	[Body]
[PATCH 6.6 0862/1674] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry	[Body]
[PATCH 6.6 0863/1674] sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting	[Body]
[PATCH 6.6 0864/1674] ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz	[Body]
[PATCH 6.6 0865/1674] bpf, arm64: Enable the inline of bpf_kptr_xchg()	[Body]
[PATCH 6.6 0866/1674] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing	[Body]
[PATCH 6.6 0867/1674] serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN	[Body]
[PATCH 6.6 0868/1674] fs: super_set_uuid()	[Body]
[PATCH 6.6 0869/1674] ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION	[Body]
[PATCH 6.6 0870/1674] drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API	[Body]
[PATCH 6.6 0871/1674] drm/amdgpu: prevent immediate PASID reuse case	[Body]
[PATCH 6.6 0872/1674] spi: use generic driver_override infrastructure	[Body]
[PATCH 6.6 0873/1674] iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()	[Body]
[PATCH 6.6 0874/1674] net: bcmasp: fix double free of WoL irq	[Body]
[PATCH 6.6 0875/1674] cxl/port: Fix use after free of parent_port in cxl_detach_ep()	[Body]
[PATCH 6.6 0876/1674] ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()	[Body]
[PATCH 6.6 0877/1674] nvmet: move async event work off nvmet-wq	[Body]
[PATCH 6.6 0878/1674] spi: spi-dw-dma: fix print error log when wait finish transaction	[Body]
[PATCH 6.6 0879/1674] s390/mm: Add missing secure storage access fixups for donated memory	[Body]
[PATCH 6.6 0880/1674] KVM: SEV: Use long-term pin when registering encrypted memory regions	[Body]
[PATCH 6.6 0881/1674] KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock	[Body]
[PATCH 6.6 0882/1674] usb: gadget: f_hid: dont call cdev_init while cdev in use	[Body]
[PATCH 6.6 0883/1674] rxrpc: proc: size address buffers for %pISpc output	[Body]
[PATCH 6.6 0884/1674] net: lan966x: fix page pool leak in error paths	[Body]
[PATCH 6.6 0885/1674] net: adopt skb_network_offset() and similar helpers	[Body]
[PATCH 6.6 0886/1674] xfrm: hold device only for the asynchronous decryption	[Body]
[PATCH 6.6 0887/1674] xfrm: hold dev ref until after transport_finish NF_HOOK	[Body]
[PATCH 6.6 0888/1674] crypto: af_alg - limit RX SG extraction by receive buffer budget	[Body]
[PATCH 6.6 0889/1674] ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()	[Body]
[PATCH 6.6 0890/1674] usb: gadget: f_rndis: Fix net_device lifecycle with device_move	[Body]
[PATCH 6.6 0891/1674] usb: gadget: f_subset: Fix net_device lifecycle with device_move	[Body]
[PATCH 6.6 0892/1674] usb: gadget: f_eem: Fix net_device lifecycle with device_move	[Body]
[PATCH 6.6 0893/1674] usb: gadget: f_ecm: Fix net_device lifecycle with device_move	[Body]
[PATCH 6.6 0894/1674] drm/i915/dsi: Dont do DSC horizontal timing adjustments in command mode	[Body]
[PATCH 6.6 0895/1674] Bluetooth: hci_event: move wake reason storage into validated event handlers	[Body]
[PATCH 6.6 0896/1674] ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()	[Body]
[PATCH 6.6 0897/1674] ALSA: ctxfi: Use explicit output flag for DAIO resources	[Body]
[PATCH 6.6 0898/1674] ALSA: ctxfi: Refactor resource alloc for sparse mappings	[Body]
[PATCH 6.6 0899/1674] ALSA: ctxfi: Check the error for index mapping	[Body]
[PATCH 6.6 0900/1674] bpf: Fix incorrect pruning due to atomic fetch precision tracking	[Body]
[PATCH 6.6 0901/1674] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists	[Body]
[PATCH 6.6 0902/1674] net: use skb_header_pointer() for TCPv4 GSO frag_off check	[Body]
[PATCH 6.6 0903/1674] mpls: add seqcount to protect the platform_label{,s} pair	[Body]
[PATCH 6.6 0904/1674] HID: core: Add reserved item tag for main items	[Body]
[PATCH 6.6 0905/1674] HID: rate-limit hid_warn to prevent log flooding	[Body]
[PATCH 6.6 0906/1674] HID: core: Mitigate potential OOB by removing bogus memset()	[Body]
[PATCH 6.6 0907/1674] HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure	[Body]
[PATCH 6.6 0908/1674] Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers	[Body]
[PATCH 6.6 0909/1674] x86-64: rename misleadingly named __copy_user_nocache() function	[Body]
[PATCH 6.6 0910/1674] net: ioam6: fix OOB and missing lock	[Body]
[PATCH 6.6 0911/1674] ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()	[Body]
[PATCH 6.6 0912/1674] xfrm: account XFRMA_IF_ID in aevent size calculation	[Body]
[PATCH 6.6 0913/1674] srcu: Use irq_work to start GP in tiny SRCU	[Body]
[PATCH 6.6 0914/1674] btrfs: convert to new timestamp accessors	[Body]
[PATCH 6.6 0915/1674] btrfs: tree-log: dont use token set/get accessors in fill_inode_item()	[Body]
[PATCH 6.6 0916/1674] btrfs: fix zero size inode with non-zero size after log replay	[Body]
[PATCH 6.6 0917/1674] fs/ntfs3: Accumulated refactoring changes	[Body]
[PATCH 6.6 0918/1674] ntfs3: fix circular locking dependency in run_unpack_ex	[Body]
[PATCH 6.6 0919/1674] xfs: remove xfs_attr_leaf_hasname	[Body]
[PATCH 6.6 0920/1674] wifi: iwlwifi: fix 22000 series SMEM parsing	[Body]
[PATCH 6.6 0921/1674] ksmbd: fix signededness bug in smb_direct_prepare_negotiation()	[Body]
[PATCH 6.6 0922/1674] netconsole: avoid OOB reads, msg is not nul-terminated	[Body]
[PATCH 6.6 0923/1674] net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query	[Body]
[PATCH 6.6 0924/1674] wifi: rtw89: pci: validate sequence number of TX release report	[Body]
[PATCH 6.6 0925/1674] team: avoid NETDEV_CHANGEMTU event when unregistering slave	[Body]
[PATCH 6.6 0926/1674] kcm: fix zero-frag skb in frag_list on partial sendmsg error	[Body]
[PATCH 6.6 0927/1674] vhost: move vdpa group bound check to vhost_vdpa	[Body]
[PATCH 6.6 0928/1674] 9p/xen: protect xen_9pfs_front_free against concurrent calls	[Body]
[PATCH 6.6 0929/1674] usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()	[Body]
[PATCH 6.6 0930/1674] arch: turn off -Werror for architectures with known warnings	[Body]
[PATCH 6.6 0931/1674] alpha: fix user-space corruption during memory compaction	[Body]
[PATCH 6.6 0932/1674] drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels	[Body]
[PATCH 6.6 0933/1674] drm/amdgpu: Skip vcn poison irq release on VF	[Body]
[PATCH 6.6 0934/1674] btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()	[Body]
[PATCH 6.6 0935/1674] btrfs: dont BUG() on unexpected delayed ref type in run_one_delayed_ref()	[Body]
[PATCH 6.6 0936/1674] btrfs: reserve enough transaction items for qgroup ioctls	[Body]
[PATCH 6.6 0937/1674] i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue	[Body]
[PATCH 6.6 0938/1674] i3c: mipi-i3c-hci: Fix race in DMA ring dequeue	[Body]
[PATCH 6.6 0939/1674] scsi: qla2xxx: Completely fix fcport double free	[Body]
[PATCH 6.6 0940/1674] ASoC: amd: acp-mach-common: Add missing error check for clock acquisition	[Body]
[PATCH 6.6 0941/1674] net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ	[Body]
[PATCH 6.6 0942/1674] net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ	[Body]
[PATCH 6.6 0943/1674] mm: list_lru: Update kernel documentation to follow the requirements	[Body]
[PATCH 6.6 0944/1674] list_lru: allow explicit memcg and NUMA node selection	[Body]
[PATCH 6.6 0945/1674] gfs2: Fix slab-use-after-free in qd_put	[Body]
[PATCH 6.6 0946/1674] HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend	[Body]
[PATCH 6.6 0947/1674] HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients	[Body]
[PATCH 6.6 0948/1674] iommu/vt-d: Clear Present bit before tearing down PASID entry	[Body]
[PATCH 6.6 0949/1674] netfilter: nf_tables: revert commit_mutex usage in reset path	[Body]
[PATCH 6.6 0950/1674] ipvs: do not keep dest_dst if dev is going down	[Body]
[PATCH 6.6 0951/1674] bpf: Fix tcx/netkit detach permissions when prog fd isnt given	[Body]
[PATCH 6.6 0952/1674] btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation	[Body]
[PATCH 6.6 0953/1674] net: stmmac: fix oops when split header is enabled	[Body]
[PATCH 6.6 0954/1674] erofs: fix inline data read failure for ztailpacking pclusters	[Body]
[PATCH 6.6 0955/1674] iommu/vt-d: Clear Present bit before tearing down context entry	[Body]
[PATCH 6.6 0956/1674] gfs2: fix memory leaks in gfs2_fill_super error path	[Body]
[PATCH 6.6 0957/1674] RDMA/mlx5: Fix UMR hang in LAG error state unload	[Body]
[PATCH 6.6 0958/1674] KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT	[Body]
[PATCH 6.6 0959/1674] KVM: nSVM: Always use NextRIP as vmcb02s NextRIP after first L2 VMRUN	[Body]
[PATCH 6.6 0960/1674] KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12	[Body]
[PATCH 6.6 0961/1674] KVM: nSVM: Raise #UD if unhandled VMMCALL isnt intercepted by L1	[Body]
[PATCH 6.6 0962/1674] dm-verity-fec: fix reading parity bytes split across blocks (take 3)	[Body]
[PATCH 6.6 0963/1674] spi: microchip-core-qspi: control built-in cs manually	[Body]
[PATCH 6.6 0964/1674] riscv: kvm: fix vector context allocation leak	[Body]
[PATCH 6.6 0965/1674] f2fs: fix fsck inconsistency caused by FGGC of node block	[Body]
[PATCH 6.6 0966/1674] RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()	[Body]
[PATCH 6.6 0967/1674] spi: mpc52xx: switch to use modern name	[Body]
[PATCH 6.6 0968/1674] spi: mpc52xx: fix controller deregistration	[Body]
[PATCH 6.6 0969/1674] spi: mpc52xx: fix use-after-free on registration failure	[Body]
[PATCH 6.6 0970/1674] drm/amd/display: Fix dc_link NULL handling in HPD init	[Body]
[PATCH 6.6 0971/1674] coresight: tmc-etr: Fix race condition between sysfs and perf mode	[Body]
[PATCH 6.6 0972/1674] device property: Add fwnode_property_match_property_string()	[Body]
[PATCH 6.6 0973/1674] iio: frequency: admv1013: Use devm_regulator_get_enable_read_voltage()	[Body]
[PATCH 6.6 0974/1674] iio: frequency: admv1013: add dev variable	[Body]
[PATCH 6.6 0975/1674] iio: frequency: admv1013: fix NULL pointer dereference on str	[Body]
[PATCH 6.6 0976/1674] selinux: allow multiple opens of /sys/fs/selinux/policy	[Body]
[PATCH 6.6 0977/1674] netfilter: nf_tables: use list_del_rcu for netlink hooks	[Body]
[PATCH 6.6 0978/1674] RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE	[Body]
[PATCH 6.6 0979/1674] Revert "net/smc: Introduce TCP ULP support"	[Body]
[PATCH 6.6 0980/1674] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR	[Body]
[PATCH 6.6 0981/1674] libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()	[Body]
[PATCH 6.6 0982/1674] fsnotify: fix inode reference leak in fsnotify_recalc_mask()	[Body]
[PATCH 6.6 0983/1674] sched/psi: fix race between file release and pressure write	[Body]
[PATCH 6.6 0984/1674] netfilter: nat: use kfree_rcu to release ops	[Body]
[PATCH 6.6 0985/1674] ice: fix double-free of tx_buf skb	[Body]
[PATCH 6.6 0986/1674] f2fs: fix data loss caused by incorrect use of nat_entry flag	[Body]
[PATCH 6.6 0987/1674] f2fs: avoid reading already updated pages during GC	[Body]
[PATCH 6.6 0988/1674] greybus: raw: fix use-after-free on cdev close	[Body]
[PATCH 6.6 0989/1674] iommu/amd: Fix clone_alias() to use the original devices devid	[Body]
[PATCH 6.6 0990/1674] sctp: disable BH before calling udp_tunnel_xmit_skb()	[Body]
[PATCH 6.6 0991/1674] net: pull headers in qdisc_pkt_len_segs_init()	[Body]
[PATCH 6.6 0992/1674] wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()	[Body]
[PATCH 6.6 0993/1674] wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()	[Body]
[PATCH 6.6 0994/1674] powerpc/64s: Fix unmap race with PMD migration entries	[Body]
[PATCH 6.6 0995/1674] powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy	[Body]
[PATCH 6.6 0996/1674] wifi: ath11k: fix memory leaks in beacon template setup	[Body]
[PATCH 6.6 0997/1674] bus: fsl-mc: use generic driver_override infrastructure	[Body]
[PATCH 6.6 0998/1674] vdpa: use generic driver_override infrastructure	[Body]
[PATCH 6.6 0999/1674] PCI: use generic driver_override infrastructure	[Body]
[PATCH 6.6 1000/1674] btrfs: fix deadlock between reflink and transaction commit when using flushoncommit	[Body]
[PATCH 6.6 1001/1674] mm: move some shrinker-related function declarations to mm/internal.h	[Body]
[PATCH 6.6 1002/1674] mm: vmscan: move shrinker-related code into a separate file	[Body]
[PATCH 6.6 1003/1674] mm: shrinker: add infrastructure for dynamically allocating shrinker	[Body]
[PATCH 6.6 1004/1674] mbcache: dynamically allocate the mbcache shrinker	[Body]
[PATCH 6.6 1005/1674] fs/mbcache: cancel shrink work before destroying the cache	[Body]
[PATCH 6.6 1006/1674] vsock/virtio/vhost: read data from non-linear skb	[Body]
[PATCH 6.6 1007/1674] vsock/virtio: fix `rx_bytes` accounting for stream sockets	[Body]
[PATCH 6.6 1008/1674] vsock/virtio: fix potential unbounded skb queue	[Body]
[PATCH 6.6 1009/1674] of: device: Export of_device_make_bus_id()	[Body]
[PATCH 6.6 1010/1674] nvmem: Move of_nvmem_layout_get_container() in another header	[Body]
[PATCH 6.6 1011/1674] nvmem: core: Rework layouts to become regular devices	[Body]
[PATCH 6.6 1012/1674] nvmem: core: fix use-after-free bugs in error paths	[Body]
[PATCH 6.6 1013/1674] staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction	[Body]
[PATCH 6.6 1014/1674] Staging: rtl8723bs: Remove dead code from _rtw_free_network()	[Body]
[PATCH 6.6 1015/1674] Staging: rtl8723bs: Delete dead code from update_current_network()	[Body]
[PATCH 6.6 1016/1674] staging: rtl8723bs: clean up redundant & parentheses	[Body]
[PATCH 6.6 1017/1674] staging: rtl8723bs: fix buffer over-read in rtw_update_protection	[Body]
[PATCH 6.6 1018/1674] sctp: validate embedded INIT chunk and address list lengths in cookie	[Body]
[PATCH 6.6 1019/1674] bpf: make it easier to add new metadata kfunc	[Body]
[PATCH 6.6 1020/1674] tools: ynl: extend netdev sample to dump xdp-rx-metadata-features	[Body]
[PATCH 6.6 1021/1674] net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure	[Body]
[PATCH 6.6 1022/1674] wifi: fix leak if split 6 GHz scanning fails	[Body]
[PATCH 6.6 1023/1674] l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()	[Body]
[PATCH 6.6 1024/1674] btrfs: only release the dirty pages io tree after successful writes	[Body]
[PATCH 6.6 1025/1674] net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind	[Body]
[PATCH 6.6 1026/1674] net: mana: Guard mana_remove against double invocation	[Body]
[PATCH 6.6 1027/1674] drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths	[Body]
[PATCH 6.6 1028/1674] wifi: mt76: mt7921: Place upper limit on station AID	[Body]
[PATCH 6.6 1029/1674] drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()	[Body]
[PATCH 6.6 1030/1674] drm/msm: always recover the gpu	[Body]
[PATCH 6.6 1031/1674] fbdev: omap2: fix inconsistent lock returns in omapfb_mmap	[Body]
[PATCH 6.6 1032/1674] fbdev: omap2: fix use-after-free in omapfb_mmap	[Body]
[PATCH 6.6 1033/1674] f2fs: read COW data with the original inode during atomic write	[Body]
[PATCH 6.6 1034/1674] gcov: use atomic counter updates to fix concurrent access crashes	[Body]
[PATCH 6.6 1035/1674] drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring	[Body]
[PATCH 6.6 1036/1674] drm/amdgpu: fix amdgpu_hmm_range_get_pages	[Body]
[PATCH 6.6 1037/1674] KVM: SEV: Ignore Port I/O requests of length 0	[Body]
[PATCH 6.6 1038/1674] usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()	[Body]
[PATCH 6.6 1039/1674] usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers	[Body]
[PATCH 6.6 1040/1674] Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close	[Body]
[PATCH 6.6 1041/1674] net/handshake: Drain pending requests at net namespace exit	[Body]
[PATCH 6.6 1042/1674] ethtool: rss: fix indir_table and hkey leak on get_rxfh failure	[Body]
[PATCH 6.6 1043/1674] cgroup/rstat: validate cpu before css_rstat_cpu() access	[Body]
[PATCH 6.6 1044/1674] hwmon: (lm90) Stop work before releasing hwmon device	[Body]
[PATCH 6.6 1045/1674] netfilter: bridge: eb_tables: close module init race	[Body]
[PATCH 6.6 1046/1674] netfilter: ebtables: move to two-stage removal scheme	[Body]
[PATCH 6.6 1047/1674] mm/util: Introduce kmemdup_array()	[Body]
[PATCH 6.6 1048/1674] netfilter: Use kmemdup_array instead of kmemdup for multiple allocation	[Body]
[PATCH 6.6 1049/1674] netfilter: x_tables: allow initial table replace without emitting audit log message	[Body]
[PATCH 6.6 1050/1674] netfilter: x_tables: allocate hook ops while under mutex	[Body]
[PATCH 6.6 1051/1674] wifi: mac80211: fix missing RX bitrate update for mesh forwarding path	[Body]
[PATCH 6.6 1052/1674] wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb	[Body]
[PATCH 6.6 1053/1674] ksmbd: validate SID in parent security descriptor during ACL inheritance	[Body]
[PATCH 6.6 1054/1674] erofs: fix metabuf leak in inode xattr initialization	[Body]
[PATCH 6.6 1055/1674] drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()	[Body]
[PATCH 6.6 1056/1674] hwmon: (lm90) Add lock protection to lm90_alert	[Body]
[PATCH 6.6 1057/1674] crypto: qat - protect service table iterations with service_lock	[Body]
[PATCH 6.6 1058/1674] nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page	[Body]
[PATCH 6.6 1059/1674] USB: iowarrior: fix use-after-free on disconnect race	[Body]
[PATCH 6.6 1060/1674] cpufreq: pcc: Remove empty exit() callback	[Body]
[PATCH 6.6 1061/1674] cpufreq: Make cpufreq_driver->exit() return void	[Body]
[PATCH 6.6 1062/1674] cpufreq: qcom-cpufreq-hw: Fix possible double free	[Body]
[PATCH 6.6 1063/1674] smb/client: fix chown/chgrp with SMB3 POSIX Extensions	[Body]
[PATCH 6.6 1064/1674] ksmbd: validate NTLMv2 response before updating session key	[Body]
[PATCH 6.6 1065/1674] ksmbd: use opener credentials for ADS I/O	[Body]
[PATCH 6.6 1066/1674] ksmbd: prevent path traversal bypass by restricting caseless retry	[Body]
[PATCH 6.6 1067/1674] ALSA: hda/cs35l41: Fix firmware load work teardown	[Body]
[PATCH 6.6 1068/1674] net/handshake: Take a long-lived file reference at submit	[Body]
[PATCH 6.6 1069/1674] Bluetooth: eir: Fix stack OOB write when prepending the Flags AD	[Body]
[PATCH 6.6 1070/1674] KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state	[Body]
[PATCH 6.6 1071/1674] ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name	[Body]
[PATCH 6.6 1072/1674] vfs: make LAST_XXX private to fs/namei.c	[Body]
[PATCH 6.6 1073/1674] ksmbd: fix path resolution in ksmbd_vfs_kern_path_create	[Body]
[PATCH 6.6 1074/1674] LoongArch: Move jump_label_init() before parse_early_param()	[Body]
[PATCH 6.6 1075/1674] media: vivid: fix cleanup bugs in vivid_init()	[Body]
[PATCH 6.6 1076/1674] drm/vc4: Shut down BO cache timer before teardown	[Body]
[PATCH 6.6 1077/1674] drm/amdgpu: Use dbg level for VBIOS check messages	[Body]
[PATCH 6.6 1078/1674] drm/amdgpu: Add wrapper for freeing vbios memory	[Body]
[PATCH 6.6 1079/1674] drm/amdgpu: Release VFCT ACPI table reference	[Body]
[PATCH 6.6 1080/1674] drm/i915/mst: limit DP MST ESI service loop	[Body]
[PATCH 6.6 1081/1674] drm/i915/gt: Fix NULL deref on sched_engine alloc failure	[Body]
[PATCH 6.6 1082/1674] drm/i915/bios: range check LFP Data Block panel_type2	[Body]
[PATCH 6.6 1083/1674] drm/amdkfd: Check bounds on CRIU restore queue type and mqd size	[Body]
[PATCH 6.6 1084/1674] drm/amdgpu: Fix context pstate override handling	[Body]
[PATCH 6.6 1085/1674] net/mlx5: Fix MCIA register buffer overflow on 32 dword reads	[Body]
[PATCH 6.6 1086/1674] drm/vc4: hvs/v3d: Fix null dereference in unbind	[Body]
[PATCH 6.6 1087/1674] cifs: prevent readdir from changing file size due to stale directory metadata	[Body]
[PATCH 6.6 1088/1674] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths	[Body]
[PATCH 6.6 1089/1674] pds_core: Dont assign interrupt index/bound_intr to notifyq	[Body]
[PATCH 6.6 1090/1674] pds_core: Clean up init/uninit flows to be more readable	[Body]
[PATCH 6.6 1091/1674] pds_core: fix use-after-free on workqueue during remove	[Body]
[PATCH 6.6 1092/1674] tipc: serialize udp bearer replicast list updates	[Body]
[PATCH 6.6 1093/1674] scsi: core: wake eh reliably when using scsi_schedule_eh	[Body]
[PATCH 6.6 1094/1674] bpf: Disable migration when destroying sock storage	[Body]
[PATCH 6.6 1095/1674] bpf: Disable migration when cloning sock storage	[Body]
[PATCH 6.6 1096/1674] rcu: add rcu_read_lock_dont_migrate()	[Body]
[PATCH 6.6 1097/1674] bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c	[Body]
[PATCH 6.6 1098/1674] bpf: Fix UAF in sock clone early bailouts	[Body]
[PATCH 6.6 1099/1674] firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()	[Body]
[PATCH 6.6 1100/1674] wifi: cfg80211: use wiphy work for socket owner autodisconnect	[Body]
[PATCH 6.6 1101/1674] wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock	[Body]
[PATCH 6.6 1102/1674] wifi: mac80211: refactor populating mesh related fields in sinfo	[Body]
[PATCH 6.6 1103/1674] wifi: cfg80211: add link_station_info structure to support MLO statistics	[Body]
[PATCH 6.6 1104/1674] wifi: mac80211: defer link RX stats percpu free to RCU	[Body]
[PATCH 6.6 1105/1674] RDMA/irdma: Prevent user-triggered null deref on QP create	[Body]
[PATCH 6.6 1106/1674] xfrm: fix stale skb->prev after async crypto steals a GSO segment	[Body]
[PATCH 6.6 1107/1674] loongarch, kexec: change dependency of object files	[Body]
[PATCH 6.6 1108/1674] LoongArch: Fix address space mismatch in kexec command line lookup	[Body]
[PATCH 6.6 1109/1674] net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains	[Body]
[PATCH 6.6 1110/1674] ovl: check access to copy_file_range source with src mounter creds	[Body]
[PATCH 6.6 1111/1674] s390/zcrypt: Fix buffer over-read in cca_cipher2protkey	[Body]
[PATCH 6.6 1112/1674] wifi: ieee80211: validate MLE common info length	[Body]
[PATCH 6.6 1113/1674] mmc: vub300: fix use-after-free on probe failure	[Body]
[PATCH 6.6 1114/1674] dm-verity: fix buffer overflow in FEC calculation	[Body]
[PATCH 6.6 1115/1674] nvmet: Introduce nvmet_req_transfer_len()	[Body]
[PATCH 6.6 1116/1674] nvmet-auth: reject short AUTH_RECEIVE buffers	[Body]
[PATCH 6.6 1117/1674] ocfs2: correct l_next_free_rec in online check	[Body]
[PATCH 6.6 1118/1674] ocfs2: add suballoc slot check in ocfs2_validate_inode_block()	[Body]
[PATCH 6.6 1119/1674] ocfs2: validate i_refcount_loc when refcount flag is set	[Body]
[PATCH 6.6 1120/1674] ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec	[Body]
[PATCH 6.6 1121/1674] mtd: maps: vmu-flash: fix fault in unaligned fixup	[Body]
[PATCH 6.6 1122/1674] fs: Remove NTFS classic	[Body]
[PATCH 6.6 1123/1674] mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch	[Body]
[PATCH 6.6 1124/1674] KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling	[Body]
[PATCH 6.6 1125/1674] netfilter: nft_lookup: fix catchall element handling with inverted lookups	[Body]
[PATCH 6.6 1126/1674] ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()	[Body]
[PATCH 6.6 1127/1674] gpio: mvebu: free generic chips on unbind	[Body]
[PATCH 6.6 1128/1674] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path	[Body]
[PATCH 6.6 1129/1674] net/liquidio: drop cached VF pci_dev LUT	[Body]
[PATCH 6.6 1130/1674] Bluetooth: 6lowpan: avoid untracked enable work	[Body]
[PATCH 6.6 1131/1674] net/mlx5e: Fix publication race for priv->channel_stats[]	[Body]
[PATCH 6.6 1132/1674] HID: bpf: Fix hid_bpf_get_data() range check	[Body]
[PATCH 6.6 1133/1674] afs: Fix reinitialisation of the inode, in particular ->lock_work	[Body]
[PATCH 6.6 1134/1674] xen/pvcalls: bound backend response req_id before indexing rsp[]	[Body]
[PATCH 6.6 1135/1674] sctp: fix addr_wq_timer race in sctp_free_addr_wq()	[Body]
[PATCH 6.6 1136/1674] hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()	[Body]
[PATCH 6.6 1137/1674] sctp: add INIT verification after cookie unpacking	[Body]
[PATCH 6.6 1138/1674] tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()	[Body]
[PATCH 6.6 1139/1674] net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync	[Body]
[PATCH 6.6 1140/1674] md/raid5: avoid R5_Overlap races while breaking stripe batches	[Body]
[PATCH 6.6 1141/1674] bpf: net: netfilter: drop dead NULL checks	[Body]
[PATCH 6.6 1142/1674] bpf: Guard conntrack opts error writes	[Body]
[PATCH 6.6 1143/1674] md/raid10: fix writes_pending and barrier reference leaks on discard failures	[Body]
[PATCH 6.6 1144/1674] md/raid10: Handle bio_split() errors	[Body]
[PATCH 6.6 1145/1674] md/raid10: fix writes_pending leak on write request failures	[Body]
[PATCH 6.6 1146/1674] md/raid1: fix writes_pending and barrier reference leaks on write failures	[Body]
[PATCH 6.6 1147/1674] xprtrdma: Fix ep kref imbalance on ADDR_CHANGE	[Body]
[PATCH 6.6 1148/1674] soundwire: fix bug in sdw_add_element_group_count found by syzkaller	[Body]
[PATCH 6.6 1149/1674] RDMA/irdma: Replace waitqueue and flag with completion	[Body]
[PATCH 6.6 1150/1674] RDMA/bnxt_re: Avoid repeated requests to allocate WC pages	[Body]
[PATCH 6.6 1151/1674] RDMA/bnxt_re: Initialize dpi variable to zero	[Body]
[PATCH 6.6 1152/1674] sockmap: Fix use-after-free in udp_bpf_recvmsg()	[Body]
[PATCH 6.6 1153/1674] ALSA: seq: fifo: Use guard() for locking	[Body]
[PATCH 6.6 1154/1674] ALSA: seq: Clean up fifo locking with guard	[Body]
[PATCH 6.6 1155/1674] ALSA: seq: avoid stale FIFO cells during resize	[Body]
[PATCH 6.6 1156/1674] net: watchdog: fix refcount tracking races	[Body]
[PATCH 6.6 1157/1674] bnxt: fix head underflow on XDP head-grow	[Body]
[PATCH 6.6 1158/1674] cxl/region: Block region delete during region creation	[Body]
[PATCH 6.6 1159/1674] ALSA: seq: Drop superfluous filter argument of get_event_dest_client()	[Body]
[PATCH 6.6 1160/1674] ALSA: seq: Fix kernel heap address leak in bounce_error_event()	[Body]
[PATCH 6.6 1161/1674] ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT	[Body]
[PATCH 6.6 1162/1674] ixgbe: do not configure xps for XDP queues	[Body]
[PATCH 6.6 1163/1674] bpf: Reject sleepable BPF_LSM_CGROUP programs at load time	[Body]
[PATCH 6.6 1164/1674] bpf: Clear rb node linkage when freeing bpf_rb_root	[Body]
[PATCH 6.6 1165/1674] RDMA/siw: Introduce siw_destroy_cep_sock	[Body]
[PATCH 6.6 1166/1674] RDMA/siw: Fix endpoint/socket association handling	[Body]
[PATCH 6.6 1167/1674] netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount	[Body]
[PATCH 6.6 1168/1674] ocfs2: add extra consistency checks for chain allocator dinodes	[Body]
[PATCH 6.6 1169/1674] ocfs2: validate fast symlink target during inode read	[Body]
[PATCH 6.6 1170/1674] vhost: correct misleading printing information	[Body]
[PATCH 6.6 1171/1674] vhost: move smp_rmb() into vhost_get_avail_idx()	[Body]
[PATCH 6.6 1172/1674] vhost: fix vhost_get_avail_idx for a non empty ring	[Body]
[PATCH 6.6 1173/1674] wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()	[Body]
[PATCH 6.6 1174/1674] md/raid1,raid10: fix deadlock in read error recovery path	[Body]
[PATCH 6.6 1175/1674] nvmet-tcp: make nvmet_tcp_alloc_queue() a void function	[Body]
[PATCH 6.6 1176/1674] nvmet-tcp: allocate socket file	[Body]
[PATCH 6.6 1177/1674] net: introduce page_frag_cache_drain()	[Body]
[PATCH 6.6 1178/1674] nvmet-tcp: fix page fragment cache leak in error path	[Body]
[PATCH 6.6 1179/1674] ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data	[Body]
[PATCH 6.6 1180/1674] RDMA/hns: Fix log flood after cmd_mbox failure	[Body]
[PATCH 6.6 1181/1674] OPP: Fix race between OPP addition and lookup	[Body]
[PATCH 6.6 1182/1674] wifi: ath11k: cancel SSR work items during PCI shutdown	[Body]
[PATCH 6.6 1183/1674] s390/zcrypt: Close speculative mem read possibility	[Body]
[PATCH 6.6 1184/1674] octeontx2-af: Block VFs from clobbering special CGX PKIND state	[Body]
[PATCH 6.6 1185/1674] Bluetooth: ISO: hold sk properly in iso_conn_ready	[Body]
[PATCH 6.6 1186/1674] net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()	[Body]
[PATCH 6.6 1187/1674] net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds	[Body]
[PATCH 6.6 1188/1674] xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx	[Body]
[PATCH 6.6 1189/1674] netfilter: nf_tables: make nft_object rhltable per table	[Body]
[PATCH 6.6 1190/1674] btrfs: skip global block reserve accounting for rescue mounts	[Body]
[PATCH 6.6 1191/1674] mm/page_table_check: skip special zero mappings	[Body]
[PATCH 6.6 1192/1674] eventfs: Use children field for rcu head and add memory barriers	[Body]
[PATCH 6.6 1193/1674] selftests: tls: add test with a partially invalid iov	[Body]
[PATCH 6.6 1194/1674] selftests: tls: add rekey tests	[Body]
[PATCH 6.6 1195/1674] tls: rx: restore msg_iter before TLS 1.3 optimistic retry	[Body]
[PATCH 6.6 1196/1674] serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx	[Body]
[PATCH 6.6 1197/1674] net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()	[Body]
[PATCH 6.6 1198/1674] watchdog: at91sam9_wdt: prevent timer rearm during teardown	[Body]
[PATCH 6.6 1199/1674] s390/ism: Fix UAF of sba and ieq during ism_dev_exit()	[Body]
[PATCH 6.6 1200/1674] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()	[Body]
[PATCH 6.6 1201/1674] hwmon: (pmbus) Fix type confusion in notification logic	[Body]
[PATCH 6.6 1202/1674] vhost_iotlb: bound map allocation in add_range	[Body]
[PATCH 6.6 1203/1674] bpf: Fix netns reference imbalance in conntrack kfuncs	[Body]
[PATCH 6.6 1204/1674] btrfs: lzo: reject inline extents without valid headers	[Body]
[PATCH 6.6 1205/1674] soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read	[Body]
[PATCH 6.6 1206/1674] gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock	[Body]
[PATCH 6.6 1207/1674] firewire: ohci: fix NULL pointer dereference in ar_context_release	[Body]
[PATCH 6.6 1208/1674] l2tp: fix tunnel and session refcount leak on seq_file release	[Body]
[PATCH 6.6 1209/1674] ipvs: revalidate ihl to prevent out-of-bounds access	[Body]
[PATCH 6.6 1210/1674] sctp: validate cookie AUTH state before use	[Body]
[PATCH 6.6 1211/1674] scsi: core: pair EH runtime PM get and put	[Body]
[PATCH 6.6 1212/1674] mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition	[Body]
[PATCH 6.6 1213/1674] drm/amdgpu: reject oversized IBs with per-ring packet limits	[Body]
[PATCH 6.6 1214/1674] tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg	[Body]
[PATCH 6.6 1215/1674] ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()	[Body]
[PATCH 6.6 1216/1674] coresight: ete: Always save state on power down	[Body]
[PATCH 6.6 1217/1674] ALSA: seq: oss: Serialize readq reset state with q->lock	[Body]
[PATCH 6.6 1218/1674] octeontx2-af: npc: Fix size of entry2cntr_map	[Body]
[PATCH 6.6 1219/1674] btrfs: lzo: reject compressed segment that overflows the compressed input	[Body]
[PATCH 6.6 1220/1674] netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag	[Body]
[PATCH 6.6 1221/1674] netfilter: make nftables drops visible in net dropmonitor	[Body]
[PATCH 6.6 1222/1674] netfilter: synproxy: drop packets if timestamp adjustment fails	[Body]
[PATCH 6.6 1223/1674] netfilter: synproxy: adjust duplicate timestamp options	[Body]
[PATCH 6.6 1224/1674] netfilter: synproxy: fix unaligned memory access in timestamp adjustment	[Body]
[PATCH 6.6 1225/1674] EDAC/igen6: Fix call trace due to missing release()	[Body]
[PATCH 6.6 1226/1674] media: atomisp: gc2235: fix UAF and memory leak	[Body]
[PATCH 6.6 1227/1674] scsi: hisi_sas: Add slave_destroy interface for v3 hw	[Body]
[PATCH 6.6 1228/1674] soc/xilinx: zynqmp_power: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 1229/1674] soc: xilinx: Shutdown and free rx mailbox channel	[Body]
[PATCH 6.6 1230/1674] cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size	[Body]
[PATCH 6.6 1231/1674] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations	[Body]
[PATCH 6.6 1232/1674] perf tools: Use perf_env__get_cpu_topology() in machine__resolve()	[Body]
[PATCH 6.6 1233/1674] Drivers: hv: vmbus: use generic driver_override infrastructure	[Body]
[PATCH 6.6 1234/1674] Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks	[Body]
[PATCH 6.6 1235/1674] net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller	[Body]
[PATCH 6.6 1236/1674] hwmon: (sht3x) Fix unaligned accesses	[Body]
[PATCH 6.6 1237/1674] dmaengine: idxd: fix double free of wq, engine, and group structs	[Body]
[PATCH 6.6 1238/1674] drm/amd/display: use proper context for logging	[Body]
[PATCH 6.6 1239/1674] bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie	[Body]
[PATCH 6.6 1240/1674] drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length	[Body]
[PATCH 6.6 1241/1674] drm/amdkfd: Add bounds check for CRAT subtype length	[Body]
[PATCH 6.6 1242/1674] selinux: reject a permission value exceeding the class permission count	[Body]
[PATCH 6.6 1243/1674] Bluetooth: ISO: zero the sockaddr before returning it in getname	[Body]
[PATCH 6.6 1244/1674] fbdev: Wrap user-invoked calls to fb_set_var() in helper	[Body]
[PATCH 6.6 1245/1674] tcp: clamp route advmss to TCP_MIN_MSS	[Body]
[PATCH 6.6 1246/1674] RDMA/rxe: Remove redundant scheduling of rxe_completer	[Body]
[PATCH 6.6 1247/1674] RDMA/rxe: Merge request and complete tasks	[Body]
[PATCH 6.6 1248/1674] RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp	[Body]
[PATCH 6.6 1249/1674] tipc: avoid busy looping in tipc_exit_net()	[Body]
[PATCH 6.6 1250/1674] NTB: core: Add .get_dma_dev() callback to ntb_dev_ops	[Body]
[PATCH 6.6 1251/1674] NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers	[Body]
[PATCH 6.6 1252/1674] ntb: Store original DMA address for future release	[Body]
[PATCH 6.6 1253/1674] tap: Keep hdr_len in tap_get_user()	[Body]
[PATCH 6.6 1254/1674] net: tap: fix wrong transport_header when sending VLAN-tagged frame	[Body]
[PATCH 6.6 1255/1674] io_uring: defer eventfd signaling when queued from a wakeup handler	[Body]
[PATCH 6.6 1256/1674] wifi: mt76: mt7915: set correct background radar capability	[Body]
[PATCH 6.6 1257/1674] wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy	[Body]
[PATCH 6.6 1258/1674] wifi: iwlwifi: dvm: pair transport op-mode enter/leave	[Body]
[PATCH 6.6 1259/1674] wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()	[Body]
[PATCH 6.6 1260/1674] mfd: sm501: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 1261/1674] mfd: sm501: Fix potential memory leaks during remove	[Body]
[PATCH 6.6 1262/1674] net/smc: Address spelling errors	[Body]
[PATCH 6.6 1263/1674] net/smc: stop killed, freed and out_of_sync sharing a byte	[Body]
[PATCH 6.6 1264/1674] net: ravb: serialize PTP clock teardown	[Body]
[PATCH 6.6 1265/1674] net: l2tp: do not propagate multicast notification errors	[Body]
[PATCH 6.6 1266/1674] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address	[Body]
[PATCH 6.6 1267/1674] platform/x86: intel_sar: Check ACPI_HANDLE() against NULL	[Body]
[PATCH 6.6 1268/1674] platform/x86: int1092: Fix potential memory leak in sar_probe()	[Body]
[PATCH 6.6 1269/1674] platform/x86: ISST: Add a NULL check for sst_inst[]	[Body]
[PATCH 6.6 1270/1674] iommu/msm: Unwind probe state on registration failure	[Body]
[PATCH 6.6 1271/1674] power: supply: max17040: propagate register read errors	[Body]
[PATCH 6.6 1272/1674] power: supply: lp8788-charger: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 1273/1674] power: supply: lp8788: Use devm_power_supply_register() helper	[Body]
[PATCH 6.6 1274/1674] power: supply: lp8788-charger: fix use-after-free on remove	[Body]
[PATCH 6.6 1275/1674] power: supply: charger-manager: Convert to platform remove callback returning void	[Body]
[PATCH 6.6 1276/1674] power: supply: charger-manager: register regulators before exposing sysfs	[Body]
[PATCH 6.6 1277/1674] filelock: split common fields into struct file_lock_core	[Body]
[PATCH 6.6 1278/1674] lockd: adapt to breakup of struct file_lock	[Body]
[PATCH 6.6 1279/1674] lockd: fix NULL dereference on lockowner allocation failure	[Body]
[PATCH 6.6 1280/1674] sched/core: Make core-sched flips wait for in-flight selections	[Body]
[PATCH 6.6 1281/1674] svcrdma: Refactor the creation of listener CMA ID	[Body]
[PATCH 6.6 1282/1674] sunrpc: xprtrdma: Use ERR_CAST() to return	[Body]
[PATCH 6.6 1283/1674] svcrdma: Use svc_xprt_put to free listener on create failure	[Body]
[PATCH 6.6 1284/1674] svcrdma: Reject Read lists that exceed the page budget	[Body]
[PATCH 6.6 1285/1674] svcrdma: Reject inline replies that overflow the pull-up buffer	[Body]
[PATCH 6.6 1286/1674] svcrdma: Handle ADDR_CHANGE CM event properly	[Body]
[PATCH 6.6 1287/1674] svcrdma: Reject connection when transport allocation fails	[Body]
[PATCH 6.6 1288/1674] SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2	[Body]
[PATCH 6.6 1289/1674] sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir	[Body]
[PATCH 6.6 1290/1674] SUNRPC: move all of xprt handling into svc_xprt_handle()	[Body]
[PATCH 6.6 1291/1674] SUNRPC: Add a server-side API for retrieving an RPCs pseudoflavor	[Body]
[PATCH 6.6 1292/1674] sunrpc: refactor pool_mode setting code	[Body]
[PATCH 6.6 1293/1674] SUNRPC: make various functions static, or not exported.	[Body]
[PATCH 6.6 1294/1674] SUNRPC: Introduce xdr_set_scratch_folio()	[Body]
[PATCH 6.6 1295/1674] SUNRPC: Update svcxdr_init_decode() to call xdr_set_scratch_folio()	[Body]
[PATCH 6.6 1296/1674] sunrpc: defer rq_argp and rq_resp free until after RCU grace period	[Body]
[PATCH 6.6 1297/1674] ipv6: annotate data-races around devconf->rpl_seg_enabled	[Body]
[PATCH 6.6 1298/1674] ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()	[Body]
[PATCH 6.6 1299/1674] ip: orphan prefetched skbs before multicast forwarding	[Body]
[PATCH 6.6 1300/1674] jbd2: use shrink_type type instead of bool type for __jbd2_journal_clean_checkpoint_list()	[Body]
[PATCH 6.6 1301/1674] dm array: validate array block headers on read	[Body]
[PATCH 6.6 1302/1674] bpf: Disable preemption in __bpf_get_stack	[Body]
[PATCH 6.6 1303/1674] ext2: Fix lost inode updates for IS_SYNC inodes	[Body]
[PATCH 6.6 1304/1674] HID: mcp2221: fix OOB write in mcp2221_raw_event()	[Body]
[PATCH 6.6 1305/1674] HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes	[Body]
[PATCH 6.6 1306/1674] smb: client: reject a tree connect response whose byte count is too small	[Body]
[PATCH 6.6 1307/1674] smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()	[Body]
[PATCH 6.6 1308/1674] cifs: call pagecache_isize_extended() in cifs_setsize() when extending	[Body]
[PATCH 6.6 1309/1674] btrfs: fix extent map leak in NOCOW direct I/O write	[Body]
[PATCH 6.6 1310/1674] btrfs: rename ret to err in btrfs_recover_relocation()	[Body]
[PATCH 6.6 1311/1674] btrfs: rename ret to ret2 in btrfs_recover_relocation()	[Body]
[PATCH 6.6 1312/1674] btrfs: rename err to ret in btrfs_recover_relocation()	[Body]
[PATCH 6.6 1313/1674] btrfs: drop recovered reloc root refs on recovery failure	[Body]
[PATCH 6.6 1314/1674] ceph: do not repeat ceph_trim_dentries() if no progress possible	[Body]
[PATCH 6.6 1315/1674] ceph: cap delegated inode count in ceph_parse_deleg_inos()	[Body]
[PATCH 6.6 1316/1674] ceph: fix UAF in check_new_map() on session freed during unlock	[Body]
[PATCH 6.6 1317/1674] NFSD: Prevent client use-after-free during delegation revoke	[Body]
[PATCH 6.6 1318/1674] nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops	[Body]
[PATCH 6.6 1319/1674] nfsd: fix stale s2s_cp_stateids IDR entry for async COPY	[Body]
[PATCH 6.6 1320/1674] NFSD: Add simple u32, u64, and bool encoders	[Body]
[PATCH 6.6 1321/1674] NFSD: Clean up nfsd4_encode_stateid()	[Body]
[PATCH 6.6 1322/1674] NFSD: Clean up nfsd4_encode_layoutreturn()	[Body]
[PATCH 6.6 1323/1674] nfsd: split sc_status out of sc_type	[Body]
[PATCH 6.6 1324/1674] nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke	[Body]
[PATCH 6.6 1325/1674] lockd, nfsd: RCU-protect nlmsvc_ops dispatch	[Body]
[PATCH 6.6 1326/1674] nfsd: Pass cred instead of rqstp to some functions.	[Body]
[PATCH 6.6 1327/1674] NFSD: check truncate permission under inode lock	[Body]
[PATCH 6.6 1328/1674] zram: set default primary compressor in zram_destroy_comps()	[Body]
[PATCH 6.6 1329/1674] zram: fix out-of-bounds access in writeback_store()	[Body]
[PATCH 6.6 1330/1674] mm/migrate_device: clear stale mapping after freeing swapcache	[Body]
[PATCH 6.6 1331/1674] mm/mglru: fix and remove redundant unevictable folio handling	[Body]
[PATCH 6.6 1332/1674] mm/kmemleak: avoid soft lockup when scanning task stacks	[Body]
[PATCH 6.6 1333/1674] ksmbd: fix tree connection use-after-free in smb2_tree_connect()	[Body]
[PATCH 6.6 1334/1674] ksmbd: zero pipe read compound padding	[Body]
[PATCH 6.6 1335/1674] PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value	[Body]
[PATCH 6.6 1336/1674] PCI: Allow per function PCI slots to fix slot reset on s390	[Body]
[PATCH 6.6 1337/1674] bpf: Disable preemption in bpf_get_stackid	[Body]
[PATCH 6.6 1338/1674] drm/gpuvm: rename struct drm_gpuva_manager to struct drm_gpuvm	[Body]
[PATCH 6.6 1339/1674] drm/nouveau: remove nouveau_chan.device	[Body]
[PATCH 6.6 1340/1674] drm/nouveau: remove chan->drm	[Body]
[PATCH 6.6 1341/1674] drm/nouveau: unsubscribe the channel-kill event before the fence context	[Body]
[PATCH 6.6 1342/1674] drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram	[Body]
[PATCH 6.6 1343/1674] drm/amdkfd: Fix error path at svm_migrate_copy_to_ram	[Body]
[PATCH 6.6 1344/1674] drm/amdkfd: Add TLB flush after MES queue eviction/suspension	[Body]
[PATCH 6.6 1345/1674] drm/amdgpu: force complete the KIQ ring fences on reset	[Body]
[PATCH 6.6 1346/1674] drm/amdgpu: avoid force-completing uninitialized UVD rings	[Body]
[PATCH 6.6 1347/1674] f2fs: fix to clear dirty flag on folio in error path	[Body]
[PATCH 6.6 1348/1674] f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()	[Body]
[PATCH 6.6 1349/1674] f2fs: fix to migrate all curseg types during free_segment_range	[Body]
[PATCH 6.6 1350/1674] f2fs: use new ioprio Macro to get ckpt thread ioprio level	[Body]
[PATCH 6.6 1351/1674] f2fs: avoid NULL checkpoint thread access in sysfs	[Body]
[PATCH 6.6 1352/1674] LoongArch: BPF: Refactor jump offset calculation in tail call	[Body]
[PATCH 6.6 1353/1674] KVM: s390: Fix memory corruption by not reinjecting CK machine checks	[Body]
[PATCH 6.6 1354/1674] KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU	[Body]
[PATCH 6.6 1355/1674] iio: light: ltrf216a: Return floating point values	[Body]
[PATCH 6.6 1356/1674] iio: light: ltrf216a: fix runtime PM reference leak in error path	[Body]
[PATCH 6.6 1357/1674] s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects	[Body]
[PATCH 6.6 1358/1674] powerpc/kexec_file: Prevent kexec range truncation	[Body]
[PATCH 6.6 1359/1674] mm/huge_memory: transfer the pmd dirty bit to the folio on zap	[Body]
[PATCH 6.6 1360/1674] dma-buf: dma-heap: dont publish fd before copy_to_user() succeeds	[Body]
[PATCH 6.6 1361/1674] tracing: Take trace_array reference when opening options file	[Body]
[PATCH 6.6 1362/1674] usb: gadget: f_midi: Annotate struct f_midi with __counted_by	[Body]
[PATCH 6.6 1363/1674] usb: gadget: f_midi: initialize work in f_midi_alloc()	[Body]
[PATCH 6.6 1364/1674] usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior	[Body]
[PATCH 6.6 1365/1674] usb: dwc3: clear forceRM when issuing EndTransfer	[Body]
[PATCH 6.6 1366/1674] NFSD: Prevent client use-after-free during blocked-lock reaping	[Body]
[PATCH 6.6 1367/1674] NFSD: Prevent client use-after-free during close_lru reaping	[Body]
[PATCH 6.6 1368/1674] HID: sony: clean up device list on probe failure	[Body]
[PATCH 6.6 1369/1674] netfilter: nf_tables: skip double clone set expressions on element insert	[Body]
[PATCH 6.6 1370/1674] net_sched: sch_fq: struct sched_data reorg	[Body]
[PATCH 6.6 1371/1674] net_sched: sch_fq: change how @inactive is tracked	[Body]
[PATCH 6.6 1372/1674] net_sched: export pfifo_fast prio2band[]	[Body]
[PATCH 6.6 1373/1674] net/sched: fq: add overflow bounds to quantum and initial quantum	[Body]
[PATCH 6.6 1374/1674] net/sched: act_ife: Only operate on Ethernet frames	[Body]
[PATCH 6.6 1375/1674] octeontx2-vf: fix workqueue and netdev race in probe/remove	[Body]
[PATCH 6.6 1376/1674] Bluetooth: do not leak an hci_conn when a second LE connect is rejected	[Body]
[PATCH 6.6 1377/1674] Bluetooth: L2CAP: access chan->conn safely in get/setsockopt	[Body]
[PATCH 6.6 1378/1674] Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition	[Body]
[PATCH 6.6 1379/1674] net/sched: account classifier filter allocations to memcg	[Body]
[PATCH 6.6 1380/1674] NFSv4.1: zero referring call lists before decoding	[Body]
[PATCH 6.6 1381/1674] vxlan: fix reading neigh ha	[Body]
[PATCH 6.6 1382/1674] net: bridge: arp/nd proxy: fix reading neigh ha	[Body]
[PATCH 6.6 1383/1674] net_sched: sch_fifo: implement lockless __fifo_dump()	[Body]
[PATCH 6.6 1384/1674] net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue	[Body]
[PATCH 6.6 1385/1674] ip6mr: do not clone dst in ip6mr_cache_report()	[Body]
[PATCH 6.6 1386/1674] net: qlcnic: validate unified ROM sections before loading	[Body]
[PATCH 6.6 1387/1674] ALSA: mtpav: shut down output timer before card teardown	[Body]
[PATCH 6.6 1388/1674] net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()	[Body]
[PATCH 6.6 1389/1674] vsock: dont check the listeners sk_err in vsock_accept()	[Body]
[PATCH 6.6 1390/1674] filelock: add some new helper functions	[Body]
[PATCH 6.6 1391/1674] NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()	[Body]
[PATCH 6.6 1392/1674] NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers	[Body]
[PATCH 6.6 1393/1674] pnfs/blocklayout: Fix device leaks on parse failure	[Body]
[PATCH 6.6 1394/1674] smb/server: fix session leak in ksmbd_session_register()	[Body]
[PATCH 6.6 1395/1674] ksmbd: scope session state changes to bound connections	[Body]
[PATCH 6.6 1396/1674] ksmbd: detach blocked lock requests before freeing	[Body]
[PATCH 6.6 1397/1674] ksmbd: safely discard unregistered deferred locks	[Body]
[PATCH 6.6 1398/1674] erofs: fix interlaced ztailpacking pclusters	[Body]
[PATCH 6.6 1399/1674] ksmbd: defer publishing granted locks to prevent UAF/double-free race	[Body]
[PATCH 6.6 1400/1674] smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()	[Body]
[PATCH 6.6 1401/1674] ksmbd: serialize oplock close with pending break ownership	[Body]
[PATCH 6.6 1402/1674] ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()	[Body]
[PATCH 6.6 1403/1674] apparmor: fix deadlock in complain-mode change_hat	[Body]
[PATCH 6.6 1404/1674] blk-cgroup: delay freeing policy data after rcu grace period	[Body]
[PATCH 6.6 1405/1674] blk-iocost: clear delay state when freeing policy data	[Body]
[PATCH 6.6 1406/1674] blk-iolatency: clear delay state when freeing policy data	[Body]
[PATCH 6.6 1407/1674] null_blk: free zones array on device power-off	[Body]
[PATCH 6.6 1408/1674] ocfs2: validate DIO orphan slot during inode read	[Body]
[PATCH 6.6 1409/1674] ocfs2: validate orphan slot during inode read	[Body]
[PATCH 6.6 1410/1674] nvmet: fix max_qid race between configfs and controller allocation	[Body]
[PATCH 6.6 1411/1674] clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type	[Body]
[PATCH 6.6 1412/1674] amt: Dont support cross-netns setup.	[Body]
[PATCH 6.6 1413/1674] NFS: Return a delegation the client fails to record	[Body]
[PATCH 6.6 1414/1674] bpf: Fix mmap_lock leak in irq_work path	[Body]
[PATCH 6.6 1415/1674] bpf, cgroup: Fix storage null-ptr-deref after replacing prog	[Body]
[PATCH 6.6 1416/1674] Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero	[Body]
[PATCH 6.6 1417/1674] Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind	[Body]
[PATCH 6.6 1418/1674] btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()	[Body]
[PATCH 6.6 1419/1674] btrfs: check if root is readonly when setting posix acl	[Body]
[PATCH 6.6 1420/1674] btrfs: always wait for ordered extents to avoid OE races	[Body]
[PATCH 6.6 1421/1674] btrfs: defrag: fix deadlock between defrag and delalloc space reservation	[Body]
[PATCH 6.6 1422/1674] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails	[Body]
[PATCH 6.6 1423/1674] coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable	[Body]
[PATCH 6.6 1424/1674] drm/amd/display: Resize MST HDCP per-connector arrays to 32	[Body]
[PATCH 6.6 1425/1674] module/dups: Fix use-after-free in kmod_dup_req lifetime handling	[Body]
[PATCH 6.6 1426/1674] bpf: Clear buf on error in __bpf_get_task_stack	[Body]
[PATCH 6.6 1427/1674] ocfs2/heartbeat: fix slot mapping rollback leaks on error paths	[Body]
[PATCH 6.6 1428/1674] ocfs2/cluster: keep heartbeat local node stable	[Body]
[PATCH 6.6 1429/1674] ocfs2: o2hb: quiesce negotiate handlers and timeout work	[Body]
[PATCH 6.6 1430/1674] RDMA/erdma: Hold QP references for AE and CM processing	[Body]
[PATCH 6.6 1431/1674] thermal: hwmon: Remove hwmon class device along with its parent	[Body]
[PATCH 6.6 1432/1674] ocfs2: validate inline xattrs during inode block validation	[Body]
[PATCH 6.6 1433/1674] ublk: check import_ubuf() return value	[Body]
[PATCH 6.6 1434/1674] blk-cgroup: fix race between policy activation and blkg destruction	[Body]
[PATCH 6.6 1435/1674] HID: steam: Reject short reads	[Body]
[PATCH 6.6 1436/1674] HID: logitech-hidpp: Fix FF device cleanup on init failure	[Body]
[PATCH 6.6 1437/1674] tty: skip cdev_del() when no cdev is registered	[Body]
[PATCH 6.6 1438/1674] serial: core: clear freed pointers on uart_register_driver() failure	[Body]
[PATCH 6.6 1439/1674] serial: core: do fallible allocations before the console can be registered	[Body]
[PATCH 6.6 1440/1674] wifi: cfg80211: stop PMSR before P2P and NAN teardown	[Body]
[PATCH 6.6 1441/1674] wifi: brcmfmac: fix P2P action frame handling without device vif	[Body]
[PATCH 6.6 1442/1674] wifi: nl80211: check link is beaconing for color change	[Body]
[PATCH 6.6 1443/1674] wifi: nl80211: clean up color-change beacon data on errors	[Body]
[PATCH 6.6 1444/1674] arm64: ptrace: Keep orig_x0 in-sync with x0 on syscall entry	[Body]
[PATCH 6.6 1445/1674] bpf, x86: Fix trampoline stack size for 128-bit arguments	[Body]
[PATCH 6.6 1446/1674] wifi: mt76: cancel reset and rc work on device unregister	[Body]
[PATCH 6.6 1447/1674] wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER	[Body]
[PATCH 6.6 1448/1674] wifi: mt76: mt7915: allocate vif wcid in the same range as stations	[Body]
[PATCH 6.6 1449/1674] wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()	[Body]
[PATCH 6.6 1450/1674] wifi: mt76: mt7915: unwind state on add_interface failure	[Body]
[PATCH 6.6 1451/1674] wifi: mt76: fix non-AQL packet accounting for MLO stations	[Body]
[PATCH 6.6 1452/1674] mm/treewide: replace pmd_large() with pmd_leaf()	[Body]
[PATCH 6.6 1453/1674] misc: sgi-gru: remove interrupt-context page-table walks	[Body]
[PATCH 6.6 1454/1674] md/raid1: create serial pool adding rdev to array with serialize_policy=1	[Body]
[PATCH 6.6 1455/1674] firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published	[Body]
[PATCH 6.6 1456/1674] wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()	[Body]
[PATCH 6.6 1457/1674] wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()	[Body]
[PATCH 6.6 1458/1674] wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()	[Body]
[PATCH 6.6 1459/1674] RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()	[Body]
[PATCH 6.6 1460/1674] PCI: Initialize temporary device in new_id_store()	[Body]
[PATCH 6.6 1461/1674] PCI: Make pci_match_one_device() match on ID instead of device	[Body]
[PATCH 6.6 1462/1674] PCI: Fix dyn_id add TOCTOU	[Body]
[PATCH 6.6 1463/1674] PCI: Fix UAF when probe runs concurrent to dyn ID removal	[Body]
[PATCH 6.6 1464/1674] clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path	[Body]
[PATCH 6.6 1465/1674] spi: oc-tiny: switch to managed controller allocation	[Body]
[PATCH 6.6 1466/1674] scsi: ufs: core: Convert string descriptor format macros to enum	[Body]
[PATCH 6.6 1467/1674] scsi: ufs: core: Validate string descriptors	[Body]
[PATCH 6.6 1468/1674] pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip	[Body]
[PATCH 6.6 1469/1674] bpf: Fix WARNING in bpf_tracing_link_release	[Body]
[PATCH 6.6 1470/1674] RDMA/erdma: complete object teardown when the destroy command fails	[Body]
[PATCH 6.6 1471/1674] ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()	[Body]
[PATCH 6.6 1472/1674] powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data	[Body]
[PATCH 6.6 1473/1674] bpf: remove unused parameter in bpf_jit_binary_pack_finalize	[Body]
[PATCH 6.6 1474/1674] riscv, bpf: Fix memory leak in bpf_jit_free	[Body]
[PATCH 6.6 1475/1674] bpf: Zero queue and stack outputs on lock failure	[Body]
[PATCH 6.6 1476/1674] drm/sched: Use struct for drm_sched_init() params	[Body]
[PATCH 6.6 1477/1674] drm/msm: Only fini scheduler after successful init	[Body]
[PATCH 6.6 1478/1674] firmware: arm_scmi: Fix SCMI device destroy lifetimes	[Body]
[PATCH 6.6 1479/1674] firmware: arm_scmi: Clean up channels on setup failure	[Body]
[PATCH 6.6 1480/1674] RDMA/rvt: Return NULL after port allocation failure	[Body]
[PATCH 6.6 1481/1674] esp: do not unref managed frag pages in esp_ssg_unref()	[Body]
[PATCH 6.6 1482/1674] platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend	[Body]
[PATCH 6.6 1483/1674] platform/x86: asus-wmi: fix resource leaks on probe failure	[Body]
[PATCH 6.6 1484/1674] usb: gadget: uac: validate rate list length before storing	[Body]
[PATCH 6.6 1485/1674] bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max	[Body]
[PATCH 6.6 1486/1674] platform/x86: lg-laptop: Fix LED resource handling	[Body]
[PATCH 6.6 1487/1674] platform/x86: dell-wmi-base: Fix handling of ultra performance key	[Body]
[PATCH 6.6 1488/1674] bpf: Reject writes through untrusted BTF pointers	[Body]
[PATCH 6.6 1489/1674] time/namespace: Validate nanosecond field in proc_timens_set_offset()	[Body]
[PATCH 6.6 1490/1674] bpf: Reject MEM_ALLOC BTF accesses past object bounds	[Body]
[PATCH 6.6 1491/1674] cgroup/cpuset: introduce cpuset-v1.c	[Body]
[PATCH 6.6 1492/1674] cgroup/cpuset: move common code to cpuset-internal.h	[Body]
[PATCH 6.6 1493/1674] cgroup/cpuset: Make nr_deadline_tasks an atomic_t	[Body]
[PATCH 6.6 1494/1674] hwrng: core - fix rng list on registration error	[Body]
[PATCH 6.6 1495/1674] dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout	[Body]
[PATCH 6.6 1496/1674] mm: change type of state in struct memory_block	[Body]
[PATCH 6.6 1497/1674] mm: name the anonymous MMOP enum as enum mmop	[Body]
[PATCH 6.6 1498/1674] mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug	[Body]
[PATCH 6.6 1499/1674] drm/amd/display: Fix dangling pointer in CRTC reset function	[Body]
[PATCH 6.6 1500/1674] drm/amd/display: Fix dangling pointer in plane reset function	[Body]
[PATCH 6.6 1501/1674] ASoC: fsl_audmix: rework runtime PM handling in probe	[Body]
[PATCH 6.6 1502/1674] cxl/mbox: Clamp mailbox output allocation to the payload size	[Body]
[PATCH 6.6 1503/1674] drm/v3d: Clear queue->active_job when v3d_fence_create() fails	[Body]
[PATCH 6.6 1504/1674] nvdimm: virtio_pmem: refcount requests for token lifetime	[Body]
[PATCH 6.6 1505/1674] i3c: master: Fix recursive locking during device registration	[Body]
[PATCH 6.6 1506/1674] iommu/arm-smmu-v3: Manage teardown with devm	[Body]
[PATCH 6.6 1507/1674] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()	[Body]
[PATCH 6.6 1508/1674] nfsd: convert nfsd_net boolean flags to unsigned long flags word	[Body]
[PATCH 6.6 1509/1674] svcrdma: Reject Write/Reply chunks with segcount 0	[Body]
[PATCH 6.6 1510/1674] memcg: make the v1 soft limit knob inert	[Body]
[PATCH 6.6 1511/1674] ACPI: bus: Introduce acpi_bus_get_primary_device()	[Body]
[PATCH 6.6 1512/1674] powerpc/xive: add error return value to xive_smp_probe()	[Body]
[PATCH 6.6 1513/1674] powerpc/xive: propagate IPI init errors to prevent use-after-free	[Body]
[PATCH 6.6 1514/1674] remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3	[Body]
[PATCH 6.6 1515/1674] perf/x86/intel/pt: Fix stop/start with no update	[Body]
[PATCH 6.6 1516/1674] ksmbd: remove redundant DACL check in smb_check_perm_dacl	[Body]
[PATCH 6.6 1517/1674] ksmbd: fix maximum allowed access checks	[Body]
[PATCH 6.6 1518/1674] wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp*	[Body]
[PATCH 6.6 1519/1674] wifi: iwlwifi: mvm: validate TX_CMD response layout	[Body]
[PATCH 6.6 1520/1674] wifi: iwlwifi: pcie: null RX pointers after free	[Body]
[PATCH 6.6 1521/1674] smb/client: zero-initialize stack-allocated cifs_open_info_data	[Body]
[PATCH 6.6 1522/1674] wifi: mac80211: ibss: wait for in-flight TX on disconnect	[Body]
[PATCH 6.6 1523/1674] perf: Fix addr_filter_ranges lifetime	[Body]
[PATCH 6.6 1524/1674] exfat: resolve memory leak from exfat_create_upcase_table()	[Body]
[PATCH 6.6 1525/1674] exfat: fix handling of damaged volume in exfat_create_upcase_table()	[Body]
[PATCH 6.6 1526/1674] pds_core: quiesce DMA before freeing resources	[Body]
[PATCH 6.6 1527/1674] drm/amdkfd: fix SMI event cross-process information leak	[Body]
[PATCH 6.6 1528/1674] drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq	[Body]
[PATCH 6.6 1529/1674] drm/amdgpu: Refactor FRU product information	[Body]
[PATCH 6.6 1530/1674] drm/amdgpu: harden FRU PIA parsing with bounded helpers	[Body]
[PATCH 6.6 1531/1674] wifi: iwlwifi: mvm: fix P2P-Device binding handling	[Body]
[PATCH 6.6 1532/1674] RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()	[Body]
[PATCH 6.6 1533/1674] virt: acrn: Fix irqfd use-after-free during eventfd shutdown	[Body]
[PATCH 6.6 1534/1674] driver core: Avoid warning when removing a device while its supplier is unbinding	[Body]
[PATCH 6.6 1535/1674] serial: 8250: invert serial8250_register_8250_port() CIR condition	[Body]
[PATCH 6.6 1536/1674] tty: serial: 8250: protect against NULL uart->port.dev in register	[Body]
[PATCH 6.6 1537/1674] wifi: mac80211: dont call ieee80211_handle_reconfig_failure when not needed	[Body]
[PATCH 6.6 1538/1674] drm/amdgpu: Remove unused amdgpu_i2c functions	[Body]
[PATCH 6.6 1539/1674] drm/amdgpu/atombios: drop empty function	[Body]
[PATCH 6.6 1540/1674] drm/amdgpu: rework i2c init and fini	[Body]
[PATCH 6.6 1541/1674] drm/amdgpu: Bound GPIO I2C table entry count from VBIOS	[Body]
[PATCH 6.6 1542/1674] drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw	[Body]
[PATCH 6.6 1543/1674] pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction	[Body]
[PATCH 6.6 1544/1674] genirq/proc: Size interrupt directory names for 10-digit interrupt numbers	[Body]
[PATCH 6.6 1545/1674] PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions	[Body]
[PATCH 6.6 1546/1674] PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()	[Body]
[PATCH 6.6 1547/1674] bpf: Mark raw_tp arguments with PTR_MAYBE_NULL	[Body]
[PATCH 6.6 1548/1674] scsi: ufs: exynos: Disable iocc if dma-coherent property isnt set	[Body]
[PATCH 6.6 1549/1674] net: dsa: b53: do not enable EEE on bcm63xx	[Body]
[PATCH 6.6 1550/1674] HID: nintendo: avoid bluetooth suspend/resume stalls	[Body]
[PATCH 6.6 1551/1674] xen: fix UAF in dmabuf_exp_from_pages()	[Body]
[PATCH 6.6 1552/1674] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work	[Body]
[PATCH 6.6 1553/1674] ACPI: platform: Use acpi_bus_get_primary_device()	[Body]
[PATCH 6.6 1554/1674] drm/msm: Recover HW before retire hung submit	[Body]
[PATCH 6.6 1555/1674] ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS	[Body]
[PATCH 6.6 1556/1674] RDMA/efa: Fix use of completion ctx after free	[Body]
[PATCH 6.6 1557/1674] ASoC: qcom: q6asm: handle the responses after closing	[Body]
[PATCH 6.6 1558/1674] ASoC: qcom: q6asm: drop DSP responses for closed data streams	[Body]
[PATCH 6.6 1559/1674] media: hantro: Disable multicore support	[Body]
[PATCH 6.6 1560/1674] media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure	[Body]
[PATCH 6.6 1561/1674] media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC	[Body]
[PATCH 6.6 1562/1674] netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation	[Body]
[PATCH 6.6 1563/1674] hwrng: core - use RCU and work_struct to fix race condition	[Body]
[PATCH 6.6 1564/1674] KVM: SVM: Add missing save/restore handling of LBR MSRs	[Body]
[PATCH 6.6 1565/1674] ceph: fix num_ops off-by-one when crypto allocation fails	[Body]
[PATCH 6.6 1566/1674] greybus: raw: fix use-after-free if write is called after disconnect	[Body]
[PATCH 6.6 1567/1674] netfilter: revalidate bridge ports	[Body]
[PATCH 6.6 1568/1674] erofs: fix use-after-free on sbi->sync_decompress	[Body]
[PATCH 6.6 1569/1674] net/handshake: hand off the pinned file reference to accept_doit	[Body]
[PATCH 6.6 1570/1674] cxl/region: Resolve region deletion races	[Body]
[PATCH 6.6 1571/1674] Bluetooth: hci_core: Fix UAF in hci_unregister_dev()	[Body]
[PATCH 6.6 1572/1674] btrfs: fix deadlock cloning inline extent when using flushoncommit	[Body]
[PATCH 6.6 1573/1674] md/raid1,raid10: fix bio accounting for split md cloned bios	[Body]
[PATCH 6.6 1574/1674] md/raid1,raid10: fix error-path detection with md_cloned_bio()	[Body]
[PATCH 6.6 1575/1674] iommu: Pass domain to remove_dev_pasid() op	[Body]
[PATCH 6.6 1576/1674] iommu/sva: Set handle->dev before the SVA handle is visible	[Body]
[PATCH 6.6 1577/1674] svcrdma: Validate Read chunk positions before reconstruction	[Body]
[PATCH 6.6 1578/1674] nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net	[Body]
[PATCH 6.6 1579/1674] firewire: core: fix memory leak in error path of build_tree()	[Body]
[PATCH 6.6 1580/1674] ocfs2: validate external xattr entries when reading metadata	[Body]
[PATCH 6.6 1581/1674] wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]	[Body]
[PATCH 6.6 1582/1674] fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()	[Body]
[PATCH 6.6 1583/1674] wifi: cfg80211: reject duplicate wiphy cipher suite entries	[Body]
[PATCH 6.6 1584/1674] scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error	[Body]
[PATCH 6.6 1585/1674] scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock	[Body]
[PATCH 6.6 1586/1674] scsi: qla2xxx: Skip vport under deletion in report ID acquisition	[Body]
[PATCH 6.6 1587/1674] f2fs: accurately adjust free_sections during free_segment_range	[Body]
[PATCH 6.6 1588/1674] scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size	[Body]
[PATCH 6.6 1589/1674] smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()	[Body]
[PATCH 6.6 1590/1674] smb: client: fail DACL rewrite when the new DACL exceeds 64K	[Body]
[PATCH 6.6 1591/1674] smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid	[Body]
[PATCH 6.6 1592/1674] mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0	[Body]
[PATCH 6.6 1593/1674] perf: RISC-V: store available counter mask as bitmap	[Body]
[PATCH 6.6 1594/1674] ipv6: flowlabel: cap duplicate leases per socket	[Body]
[PATCH 6.6 1595/1674] netfilter: cttimeout: prevent UAF during module unload	[Body]
[PATCH 6.6 1596/1674] bootconfig: Fix integer overflow in initrd size check	[Body]
[PATCH 6.6 1597/1674] accel/ivpu: Limit firmware log name prints to field size	[Body]
[PATCH 6.6 1598/1674] accel/ivpu: Validate firmware log buffer metadata	[Body]
[PATCH 6.6 1599/1674] accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr	[Body]
[PATCH 6.6 1600/1674] tracing: Undo the registration when enabling the histogram trigger fails	[Body]
[PATCH 6.6 1601/1674] tracing: Take the reference before publishing the named histogram trigger	[Body]
[PATCH 6.6 1602/1674] ALSA: usx2y: Use standard print API	[Body]
[PATCH 6.6 1603/1674] ALSA: usbusx2y: validate URB actual_length in interrupt callback	[Body]
[PATCH 6.6 1604/1674] tracing: Take trace_array reference when opening a tracer options file	[Body]
[PATCH 6.6 1605/1674] reboot: fix cad_pid use-after-free race	[Body]
[PATCH 6.6 1606/1674] configfs: unhash the dentry before dropping the item in rmdir	[Body]
[PATCH 6.6 1607/1674] path: add cleanup helper	[Body]
[PATCH 6.6 1608/1674] configfs:get_target() - release path as soon as we grab configfs_item reference	[Body]
[PATCH 6.6 1609/1674] configfs: pin the symlink targets dirent instead of chasing ->ci_dentry	[Body]
[PATCH 6.6 1610/1674] net: stmmac: fix TX descriptor availability check for TSO traffic	[Body]
[PATCH 6.6 1611/1674] perf/x86/intel: Prevent drain_pebs() reentry	[Body]
[PATCH 6.6 1612/1674] net/mlx5e: Move representor vnic reporter to eswitch devlink port	[Body]
[PATCH 6.6 1613/1674] vxlan: initialize _md in vxlan_xmit_one()	[Body]
[PATCH 6.6 1614/1674] Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()	[Body]
[PATCH 6.6 1615/1674] eth: ice: dont dereference pointers from TP_printk()	[Body]
[PATCH 6.6 1616/1674] af_unix: Update last skb marker in manage_oob().	[Body]
[PATCH 6.6 1617/1674] vhost: invalidate vring access on IOTLB transitions	[Body]
[PATCH 6.6 1618/1674] vduse: validate virtqueue alignment	[Body]
[PATCH 6.6 1619/1674] eventfd: simplify eventfd_signal()	[Body]
[PATCH 6.6 1620/1674] vhost-vdpa: protect config_ctx from being freed under the config callback	[Body]
[PATCH 6.6 1621/1674] virtio_ring: fix stale descriptor flags after a failed packed add	[Body]
[PATCH 6.6 1622/1674] iommu/amd: Do not reallocate GA log buffers on resume	[Body]
[PATCH 6.6 1623/1674] bpf: mark a NULL call argument precise	[Body]
[PATCH 6.6 1624/1674] net: reject oversized tx_queue_len at netlink parse time	[Body]
[PATCH 6.6 1625/1674] bpf: Preserve inner map identity in callback frames	[Body]
[PATCH 6.6 1626/1674] bpf: Mark NULL kptr stores precise	[Body]
[PATCH 6.6 1627/1674] bpf: Improve JEQ/JNE branch taken logic	[Body]
[PATCH 6.6 1628/1674] bpf: rename is_branch_taken reg arguments to prepare for the second one	[Body]
[PATCH 6.6 1629/1674] bpf: generalize is_branch_taken() to work with two registers	[Body]
[PATCH 6.6 1630/1674] bpf: move is_branch_taken() down	[Body]
[PATCH 6.6 1631/1674] bpf: generalize is_branch_taken to handle all conditional jumps in one place	[Body]
[PATCH 6.6 1632/1674] bpf: unify 32-bit and 64-bit is_branch_taken logic	[Body]
[PATCH 6.6 1633/1674] bpf: generalize is_scalar_branch_taken() logic	[Body]
[PATCH 6.6 1634/1674] bpf: Dont predict JMP32 pointer vs zero comparisons	[Body]
[PATCH 6.6 1635/1674] bpf: Dont infer non-NULL from a pointer with an unbounded offset	[Body]
[PATCH 6.6 1636/1674] nvme_core: scan namespaces asynchronously	[Body]
[PATCH 6.6 1637/1674] nvme: remove stale namespaces by NSID range during scan	[Body]
[PATCH 6.6 1638/1674] bpf: Mark syscall helpers as sleepable	[Body]
[PATCH 6.6 1639/1674] erofs: disable LZ4 rolling decompression for now	[Body]
[PATCH 6.6 1640/1674] net: plumb extack in __dev_change_net_namespace()	[Body]
[PATCH 6.6 1641/1674] net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().	[Body]
[PATCH 6.6 1642/1674] btrfs: zstd: fix lost wakeup when waiting for a workspace	[Body]
[PATCH 6.6 1643/1674] btrfs: zoned: finish active block group cleanup if call_zone_finish() fails	[Body]
[PATCH 6.6 1644/1674] bpf: backtracking shouldnt clear outer frame R1-R5 for callbacks	[Body]
[PATCH 6.6 1645/1674] bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge	[Body]
[PATCH 6.6 1646/1674] tipc: Dont send random pad bytes in RESET/ACTIVATE messages	[Body]
[PATCH 6.6 1647/1674] ipv6: mcast: use rcu_assign_pointer() for __rcu list updates	[Body]
[PATCH 6.6 1648/1674] igmp: convert struct ip_sf_list to RCU	[Body]
[PATCH 6.6 1649/1674] Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect	[Body]
[PATCH 6.6 1650/1674] ksmbd: propagate DACL parsing errors	[Body]
[PATCH 6.6 1651/1674] smb/client: invalidate fscache for fallocate range operations	[Body]
[PATCH 6.6 1652/1674] smb/client: fix stale page cache in insert/collapse range	[Body]
[PATCH 6.6 1653/1674] smb/client: validate new EOF for zero range	[Body]
[PATCH 6.6 1654/1674] smb/client: validate new EOF for insert range	[Body]
[PATCH 6.6 1655/1674] bpf: check_cond_jmp_op(): properly infer if register is null	[Body]
[PATCH 6.6 1656/1674] drm/gud: validate GUD_ROTATION_0 is present in supported rotations	[Body]
[PATCH 6.6 1657/1674] drm/virtio: use the DMA API for resource backing on Xen	[Body]
[PATCH 6.6 1658/1674] nvdimm: pmem: keep PREFLUSH before data writes	[Body]
[PATCH 6.6 1659/1674] smb/server: fix tree connection leak in smb2_tree_connect()	[Body]
[PATCH 6.6 1660/1674] r8169: remove original workaround for RTL8125 broken rx issue	[Body]
[PATCH 6.6 1661/1674] netfilter: nft_byteorder: remove multi-register support	[Body]
[PATCH 6.6 1662/1674] ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14	[Body]
[PATCH 6.6 1663/1674] Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()"	[Body]
[PATCH 6.6 1664/1674] Revert "mm/filemap: avoid buffered read/write race to read inconsistent data"	[Body]
[PATCH 6.6 1665/1674] Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained	[Body]
[PATCH 6.6 1666/1674] bpf: abort verification if env->cur_state->loop_entry != NULL	[Body]
[PATCH 6.6 1667/1674] xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock	[Body]
[PATCH 6.6 1668/1674] xfs: catch stale AGF/AGF metadata	[Body]
[PATCH 6.6 1669/1674] xfs: rearrange code in xfs_buf_item.c	[Body]
[PATCH 6.6 1670/1674] xfs: factor out stale buffer item completion	[Body]
[PATCH 6.6 1671/1674] xfs: fix unmount hang with unflushable inodes stuck in the AIL	[Body]
[PATCH 6.6 1672/1674] types: move struct rcuwait into types.h	[Body]
[PATCH 6.6 1673/1674] irqwork: Move data struct to a types header	[Body]
[PATCH 6.6 1674/1674] bpf, sockmap: Account for receive queue in FIONREAD without a verdict program	[Body]

ID (for dev)	5162dd4d-2a95-4226-adb2-9a8fc9f6d977
Status	finished
Triaged	OK [Log]
Execution Log	[Link]

Test	Base	Patched	Verdict
[KASAN] Build Base	cecd39af8a1ab81373fd9fa765b2f7ab73becaad [Config]		passed [Log]
[KASAN] Boot test: Base	cecd39af8a1ab81373fd9fa765b2f7ab73becaad [Config]		passed [Log]
[KASAN] Build Patched		cecd39af8a1ab81373fd9fa765b2f7ab73becaad [Config] [patched]	passed [Log]
[KASAN] Boot test: Patched		cecd39af8a1ab81373fd9fa765b2f7ab73becaad [Config] [patched]	passed [Log]
[KASAN] Fuzz	cecd39af8a1ab81373fd9fa765b2f7ab73becaad [Config]	cecd39af8a1ab81373fd9fa765b2f7ab73becaad [Config] [patched]	passed [Log] [Artifacts]

Patches (1674)

Series Summary

Sessions

Session 2026-10-20