Syzbot CI

Subject	6.18.51-rc1 review
Author	gregkh@linuxfoundation.org
Date	2026-09-09 13:34:46 +0000 UTC
Version
Cc	achill@achill.org akpm@linux-foundation.org broonie@kernel.org conor@kernel.org f.fainelli@gmail.com gregkh@linuxfoundation.org hargar@microsoft.com jonathanh@nvidia.com linux-kernel@vger.kernel.org linux@roeck-us.net lkft-triage@lists.linaro.org patches@kernelci.org patches@lists.linux.dev pavel@nabladev.com rwarsow@gmx.de shuah@kernel.org sr@sladewatkins.com stable@vger.kernel.org sudipm.mukherjee@gmail.com torvalds@linux-foundation.org

Name	Content [All]
[PATCH 6.18 001/583] net: skbuff: dont skb_tx_error() the source skb in skb_zerocopy()	[Body]
[PATCH 6.18 002/583] openvswitch: Fix CT limit teardown use-after-free	[Body]
[PATCH 6.18 003/583] mm/page_vma_mapped: use huge_ptep_get() for hugetlb	[Body]
[PATCH 6.18 004/583] entry: Fix seccomp bypass after ptrace with TSYNC	[Body]
[PATCH 6.18 005/583] fsnotify: Fix stale object mask after concurrent mark updates	[Body]
[PATCH 6.18 006/583] objtool/rust: add one more `noreturn` Rust function	[Body]
[PATCH 6.18 007/583] mfd: qnap-mcu: keep the reply buffer alive past a command timeout	[Body]
[PATCH 6.18 008/583] drm/amd: Drop calls to restore power limit and clock from smu_resume()	[Body]
[PATCH 6.18 009/583] fsnotify: inotify: pass mark connector to fsnotify_recalc_mask()	[Body]
[PATCH 6.18 010/583] drm/xe: Dont hand out the flat CCS storage as usable VRAM	[Body]
[PATCH 6.18 011/583] bpf: fix the return value of push_stack	[Body]
[PATCH 6.18 012/583] drm/amd/display: fix division by zero in get_estimated_bw()	[Body]
[PATCH 6.18 013/583] usb: image: mdc800: change kmalloc() to kzalloc()	[Body]
[PATCH 6.18 014/583] ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()	[Body]
[PATCH 6.18 015/583] clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset	[Body]
[PATCH 6.18 016/583] media: usbtv: keep device alive while ALSA card exists	[Body]
[PATCH 6.18 017/583] usb-storage: ene_ub6250: fix race between scan work and probe	[Body]
[PATCH 6.18 018/583] usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()	[Body]
[PATCH 6.18 019/583] usb: dwc3: clear forceRM when issuing EndTransfer	[Body]
[PATCH 6.18 020/583] usb: storage: realtek_cr: fix use-after-free on disconnect	[Body]
[PATCH 6.18 021/583] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop	[Body]
[PATCH 6.18 022/583] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails	[Body]
[PATCH 6.18 023/583] usb: typec: qcom-pmic: cancel reset_work on stop	[Body]
[PATCH 6.18 024/583] usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling	[Body]
[PATCH 6.18 025/583] usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x	[Body]
[PATCH 6.18 026/583] usb: typec: ucsi: displayport: Fix OOB altmode array index	[Body]
[PATCH 6.18 027/583] usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs	[Body]
[PATCH 6.18 028/583] usb: gadget: f_midi2: fix use-after-free in string attribute show path	[Body]
[PATCH 6.18 029/583] usb: gadget: f_midi: initialize work in f_midi_alloc()	[Body]
[PATCH 6.18 030/583] USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()	[Body]
[PATCH 6.18 031/583] usb: gadget: fix null pointer dereference in usb_put_function_instance()	[Body]
[PATCH 6.18 032/583] staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()	[Body]
[PATCH 6.18 033/583] staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()	[Body]
[PATCH 6.18 034/583] xhci: fix lost bounce buffers on TDs spanning several ring segments	[Body]
[PATCH 6.18 035/583] thermal/drivers/imx: Disable clock on runtime resume failure	[Body]
[PATCH 6.18 036/583] thermal/drivers/qoriq: Disable clock on resume failure	[Body]
[PATCH 6.18 037/583] userfaultfd: reset err to be 0 when move_pages_ptes succeeded	[Body]
[PATCH 6.18 038/583] ublk: clear VM_MAYWRITE on read-only ublk char device mmap	[Body]
[PATCH 6.18 039/583] soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size	[Body]
[PATCH 6.18 040/583] spi: bcm63xx-hsspi: disable clocks on resume failure	[Body]
[PATCH 6.18 041/583] spi: bcm63xx: disable clock on resume failure	[Body]
[PATCH 6.18 042/583] spi: bcmbca-hsspi: disable clocks on resume failure	[Body]
[PATCH 6.18 043/583] spi: Fix DMA mapping ownership on partial map failure	[Body]
[PATCH 6.18 044/583] scsi: target: iscsi: Reserve a terminator byte for the login payload	[Body]
[PATCH 6.18 045/583] scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame	[Body]
[PATCH 6.18 046/583] scsi: pm8001: Use rollback index when freeing MSI-X vectors	[Body]
[PATCH 6.18 047/583] mm/damon/vaddr-kunit: check region count in three_regions test	[Body]
[PATCH 6.18 048/583] samples/damon/mtier: handle damon_start() failure	[Body]
[PATCH 6.18 049/583] samples/damon/mtier: handle damon_stop() failure	[Body]
[PATCH 6.18 050/583] samples/damon/prcl: handle damon_start() failure	[Body]
[PATCH 6.18 051/583] samples/damon/prcl: stop and free damon ctx when damon_call() fails	[Body]
[PATCH 6.18 052/583] samples/damon/wsse: handle damon_start() failure	[Body]
[PATCH 6.18 053/583] samples/damon/wsse: stop and free damon ctx when damon_call() fails	[Body]
[PATCH 6.18 054/583] mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs	[Body]
[PATCH 6.18 055/583] mm/damon/sysfs-schemes: kobject_del() scheme dirs	[Body]
[PATCH 6.18 056/583] mm/damon/sysfs-schemes: kobject_del() scheme filter dirs	[Body]
[PATCH 6.18 057/583] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs	[Body]
[PATCH 6.18 058/583] mm/damon/sysfs-schemes: kobject_del() scheme region dirs	[Body]
[PATCH 6.18 059/583] mm/damon/sysfs: kobject_del() region and target (error) dirs	[Body]
[PATCH 6.18 060/583] mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs	[Body]
[PATCH 6.18 061/583] mm/damon/core-kunit: check region count before testing in split_at()	[Body]
[PATCH 6.18 062/583] futex: Prevent rcuwait use-after-free during requeue PI	[Body]
[PATCH 6.18 063/583] ftrace: Synchronize the initialization of ftrace_ops	[Body]
[PATCH 6.18 064/583] HID: bpf: serialize device reference release in struct_ops destroy path	[Body]
[PATCH 6.18 065/583] HID: rmi: fix OOB access with undersized RMI reports	[Body]
[PATCH 6.18 066/583] HID: wacom: validate report length in wacom_intuos_pro2_bt_irq	[Body]
[PATCH 6.18 067/583] dm: fix race when loading and unloading a table	[Body]
[PATCH 6.18 068/583] dm: fix resume-vs-remove race	[Body]
[PATCH 6.18 069/583] dma-direct: return struct page from dma_direct_alloc_from_pool()	[Body]
[PATCH 6.18 070/583] dmaengine: fsl-edma: tracing: no ptr dereference during log output	[Body]
[PATCH 6.18 071/583] dmaengine: dw-edma: Fix HDMA channel status register access	[Body]
[PATCH 6.18 072/583] dmaengine: dw-edma: Complete descriptors before pausing	[Body]
[PATCH 6.18 073/583] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs	[Body]
[PATCH 6.18 074/583] cpuidle: dt_idle_genpd: kfree() the original name allocation	[Body]
[PATCH 6.18 075/583] cpuidle: psci: Fix support for probe deferral by dropping the faux device	[Body]
[PATCH 6.18 076/583] block: flag zoned disks with GENHD_FL_NO_PART	[Body]
[PATCH 6.18 077/583] bpf: Fix infinite loop in pcpu_freelist push with one possible CPU	[Body]
[PATCH 6.18 078/583] ceph: lock mutex in ceph_mds_check_access()	[Body]
[PATCH 6.18 079/583] ata: ahci: work around lost interrupts on Marvell 88SE61xx	[Body]
[PATCH 6.18 080/583] ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()	[Body]
[PATCH 6.18 081/583] irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout	[Body]
[PATCH 6.18 082/583] kprobes: Protect kprobe_blacklist with RCU	[Body]
[PATCH 6.18 083/583] mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()	[Body]
[PATCH 6.18 084/583] fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list	[Body]
[PATCH 6.18 085/583] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()	[Body]
[PATCH 6.18 086/583] Input: aiptek - validate raw macro indices before updating state	[Body]
[PATCH 6.18 087/583] memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done	[Body]
[PATCH 6.18 088/583] memcg: make the v1 soft limit knob inert	[Body]
[PATCH 6.18 089/583] rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt	[Body]
[PATCH 6.18 090/583] rtc: rzn1: Fix weekday underflow when alarm crosses month boundary	[Body]
[PATCH 6.18 091/583] rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm	[Body]
[PATCH 6.18 092/583] rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers	[Body]
[PATCH 6.18 093/583] perf/x86/intel: Fix kernel address leakages in LBR stack	[Body]
[PATCH 6.18 094/583] perf trace: Factor out BPF loop body	[Body]
[PATCH 6.18 095/583] perf trace: Refactor augmented_raw_syscalls using bpf_for	[Body]
[PATCH 6.18 096/583] perf hisi-ptt: Fix PTT trace TLP header parsing	[Body]
[PATCH 6.18 097/583] i2c: designware: Enable interrupt mask workaround for HJMC3001	[Body]
[PATCH 6.18 098/583] i2c: qcom-geni: update frequency table to fix timing parameters	[Body]
[PATCH 6.18 099/583] i2c: core: fix debugfs UAF on adapter removal	[Body]
[PATCH 6.18 100/583] i2c: mux: Fix channel node leak on adapter add failure	[Body]
[PATCH 6.18 101/583] arm64: mm: Fix the lockless page-table walk in show_pte()	[Body]
[PATCH 6.18 102/583] arm64: errata: pass REVIDR when matching target implementation CPUs	[Body]
[PATCH 6.18 103/583] ALSA: rawmidi: Return the error from snd_rawmidi_input_params()	[Body]
[PATCH 6.18 104/583] ALSA: harmony: initialize locks before requesting IRQ	[Body]
[PATCH 6.18 105/583] ALSA: pcm: Fix race between non-atomic ops and trigger-start	[Body]
[PATCH 6.18 106/583] nvme-fabrics: fix DHCHAP secret leak on parse failure	[Body]
[PATCH 6.18 107/583] nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails	[Body]
[PATCH 6.18 108/583] nvme-tcp: check the data direction of a C2HData PDU	[Body]
[PATCH 6.18 109/583] nvme: add missing SRCU grace period in error path	[Body]
[PATCH 6.18 110/583] nvmet-auth: Synchronize timeout work during SQ teardown	[Body]
[PATCH 6.18 111/583] nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU	[Body]
[PATCH 6.18 112/583] nvmet-tcp: reject unsolicited H2CData PDUs	[Body]
[PATCH 6.18 113/583] pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig	[Body]
[PATCH 6.18 114/583] Revert "irqchip/mbigen: Fix mbigen node address layout"	[Body]
[PATCH 6.18 115/583] mm/hugetlb: fix missing migratable flag on same-node hugetlb migration	[Body]
[PATCH 6.18 116/583] mm/hugetlb: keep max_huge_pages when dissolving surplus folios	[Body]
[PATCH 6.18 117/583] mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()	[Body]
[PATCH 6.18 118/583] nvdimm/btt: reject an arena whose nfree is below the lane count	[Body]
[PATCH 6.18 119/583] parisc: eisa: Fix infinite loop when parsing invalid IRQ value	[Body]
[PATCH 6.18 120/583] parisc: Fix alignment of asm statements in head.S	[Body]
[PATCH 6.18 121/583] powerpc/kexec_file: Fix null-ptr-def in extra size calculation	[Body]
[PATCH 6.18 122/583] powerpc/kexec_file: Prevent kexec range truncation	[Body]
[PATCH 6.18 123/583] powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population	[Body]
[PATCH 6.18 124/583] powerpc/pseries: Handle and log pseries-wdt registration failures	[Body]
[PATCH 6.18 125/583] powerpc/pseries: Move H_WATCHDOG definitions to a common header	[Body]
[PATCH 6.18 126/583] powerpc/crash: stop watchdogs before booting kdump kernel	[Body]
[PATCH 6.18 127/583] s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()	[Body]
[PATCH 6.18 128/583] s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove	[Body]
[PATCH 6.18 129/583] s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove	[Body]
[PATCH 6.18 130/583] s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL	[Body]
[PATCH 6.18 131/583] s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed	[Body]
[PATCH 6.18 132/583] s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects	[Body]
[PATCH 6.18 133/583] s390/vfio-ap: Fix NULL deref in status_show() during queue probe	[Body]
[PATCH 6.18 134/583] s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap	[Body]
[PATCH 6.18 135/583] s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object	[Body]
[PATCH 6.18 136/583] mtd: afs: validate v2 image info bounds	[Body]
[PATCH 6.18 137/583] mtd: mtdoops: free page bitmap when the backing MTD is removed	[Body]
[PATCH 6.18 138/583] mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()	[Body]
[PATCH 6.18 139/583] mtd: rawnand: validate ONFI extended parameter page sections	[Body]
[PATCH 6.18 140/583] batman-adv: fix stale receive device on merged fragments	[Body]
[PATCH 6.18 141/583] batman-adv: mcast: ensure unshared skb for multicast packets	[Body]
[PATCH 6.18 142/583] batman-adv: mcast: linearize skbuff for packet generation	[Body]
[PATCH 6.18 143/583] batman-adv: dat: avoid unaligned fault in IP extraction	[Body]
[PATCH 6.18 144/583] batman-adv: bla: fix freeing of claims on meshif deletion	[Body]
[PATCH 6.18 145/583] batman-adv: bla: prevent CRC corruptions after claim flush	[Body]
[PATCH 6.18 146/583] clk: clocking-wizard: fix integer overflow in rate calculation	[Body]
[PATCH 6.18 147/583] clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen	[Body]
[PATCH 6.18 148/583] clk: meson: align gxbb_32k_clk_sel number of parents with actual count	[Body]
[PATCH 6.18 149/583] clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk	[Body]
[PATCH 6.18 150/583] clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk	[Body]
[PATCH 6.18 151/583] clk: rockchip: rk3588: Dont change PLL rates when setting dclk_vop2_src	[Body]
[PATCH 6.18 152/583] clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src	[Body]
[PATCH 6.18 153/583] clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src	[Body]
[PATCH 6.18 154/583] clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk	[Body]
[PATCH 6.18 155/583] clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk	[Body]
[PATCH 6.18 156/583] clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks	[Body]
[PATCH 6.18 157/583] i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure	[Body]
[PATCH 6.18 158/583] ASoC: adau1761: sort the register default table	[Body]
[PATCH 6.18 159/583] ASoC: cs35l33: drain threaded IRQ before runtime suspend	[Body]
[PATCH 6.18 160/583] ASoC: cs35l34: drain threaded IRQ before runtime suspend	[Body]
[PATCH 6.18 161/583] ASoC: cx2072x: sort the register default table	[Body]
[PATCH 6.18 162/583] ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure	[Body]
[PATCH 6.18 163/583] ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division	[Body]
[PATCH 6.18 164/583] ASoC: fsl_easrc: sort the register default table	[Body]
[PATCH 6.18 165/583] ASoC: hdac_hda: Fix hlink refcount leak on component registration failure	[Body]
[PATCH 6.18 166/583] AsoC: intel: sst: fix PCI device reference leak on probe failure	[Body]
[PATCH 6.18 167/583] ASoC: loongson: Fix error handling in ACPI property parsing	[Body]
[PATCH 6.18 168/583] ASoC: max9860: sort the register default table	[Body]
[PATCH 6.18 169/583] ASoC: ml26124: sort the register default table	[Body]
[PATCH 6.18 170/583] ASoC: pcm512x: sort the register default table	[Body]
[PATCH 6.18 171/583] ASoC: pm4125-sdw: sort the register default table	[Body]
[PATCH 6.18 172/583] ASoC: rt1017-sdca-sdw: sort the register default table	[Body]
[PATCH 6.18 173/583] ASoC: rt1316-sdw: sort the register default table	[Body]
[PATCH 6.18 174/583] ASoC: rt1318-sdw: sort the register default table	[Body]
[PATCH 6.18 175/583] ASoC: rt1318: sort the register default table	[Body]
[PATCH 6.18 176/583] ASoC: rt274: sort the register default table	[Body]
[PATCH 6.18 177/583] ASoC: rt286: sort the register default table	[Body]
[PATCH 6.18 178/583] ASoC: rt298: sort the register default table	[Body]
[PATCH 6.18 179/583] ASoC: rt700: drop duplicate reg_default entry	[Body]
[PATCH 6.18 180/583] ASoC: rt700: sort the register default table	[Body]
[PATCH 6.18 181/583] ASoC: rt711-sdca: sort the register default tables	[Body]
[PATCH 6.18 182/583] ASoC: rt711: sort the register default table	[Body]
[PATCH 6.18 183/583] ASoC: rt712-sdca-dmic: sort the register default table	[Body]
[PATCH 6.18 184/583] ASoC: rt712-sdca-sdw: sort the register default table	[Body]
[PATCH 6.18 185/583] ASoC: rt715-sdca: drop duplicate reg_default entries	[Body]
[PATCH 6.18 186/583] ASoC: rt715-sdca: sort the register default tables	[Body]
[PATCH 6.18 187/583] ASoC: rt715: sort the register default table	[Body]
[PATCH 6.18 188/583] ASoC: rt721-sdca-sdw: sort the register default table	[Body]
[PATCH 6.18 189/583] ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get	[Body]
[PATCH 6.18 190/583] ASoC: sgtl5000: sort the register default table	[Body]
[PATCH 6.18 191/583] ASoC: sti-sas: sort the register default table	[Body]
[PATCH 6.18 192/583] ASoC: tas2552: sort the register default table	[Body]
[PATCH 6.18 193/583] ASoC: tas2764: sort the register default table	[Body]
[PATCH 6.18 194/583] ASoC: tas2780: sort the register default table	[Body]
[PATCH 6.18 195/583] ASoC: tas2783-sdw: drop duplicate reg_default entry	[Body]
[PATCH 6.18 196/583] ASoC: tas2783-sdw: sort the register default table	[Body]
[PATCH 6.18 197/583] ASoC: tegra210_mixer: sort the register default table	[Body]
[PATCH 6.18 198/583] ASoC: tegra: Sort MBDRC register defaults	[Body]
[PATCH 6.18 199/583] ASoC: tegra: Sort ADMAIF register defaults	[Body]
[PATCH 6.18 200/583] ASoC: tegra: Fix the MIXER enable default value	[Body]
[PATCH 6.18 201/583] ASoC: tegra210_i2s: sort the Tegra264 register default table	[Body]
[PATCH 6.18 202/583] ASoC: tegra210_i2s: sort the register default table	[Body]
[PATCH 6.18 203/583] iio: adc: adi-axi-adc: add data size support for AD408X backend	[Body]
[PATCH 6.18 204/583] iio: adc: max34408: add missing select REGMAP_I2C to Kconfig	[Body]
[PATCH 6.18 205/583] iio: adc: pac1921: fix wrong channel used in trigger handler read	[Body]
[PATCH 6.18 206/583] iio: buffer: Fix potential use-after-free in anonymous buffer release	[Body]
[PATCH 6.18 207/583] iio: buffer: Make IIO DMA fence release RCU-safe	[Body]
[PATCH 6.18 208/583] iio: buffer: Tie IIO dma fence lock lifetime to the fence	[Body]
[PATCH 6.18 209/583] iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable	[Body]
[PATCH 6.18 210/583] iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF	[Body]
[PATCH 6.18 211/583] iio: chemical: sgp30: Handle IAQ thread creation failure	[Body]
[PATCH 6.18 212/583] iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show	[Body]
[PATCH 6.18 213/583] iio: dac: m62332: Fix regulator reference count imbalance	[Body]
[PATCH 6.18 214/583] iio: gyro: mpu3050: fix sign of raw angular velocity readings	[Body]
[PATCH 6.18 215/583] iio: light: cm32181: return zero after writing calibscale	[Body]
[PATCH 6.18 216/583] iio: light: gp2ap002: Disable regulators on resume failure	[Body]
[PATCH 6.18 217/583] iio: light: ltrf216a: fix runtime PM reference leak in error path	[Body]
[PATCH 6.18 218/583] iio: pressure: dps310: fix NULL pointer dereference on ACPI probe	[Body]
[PATCH 6.18 219/583] iio: pressure: mpl115: Fix runtime PM cleanup	[Body]
[PATCH 6.18 220/583] iio: srf04: fix pm_runtime handling on probe error path	[Body]
[PATCH 6.18 221/583] iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()	[Body]
[PATCH 6.18 222/583] iio: ti-ads7138: Disable STATS_EN bit while reading conversion results	[Body]
[PATCH 6.18 223/583] iio: light: opt4060: Reject integration times with a non-zero seconds part	[Body]
[PATCH 6.18 224/583] iio: light: opt4060: Fix incorrect register name in threshold read error message	[Body]
[PATCH 6.18 225/583] iio: light: opt4001: Fix power down clearing bits of the wrong register	[Body]
[PATCH 6.18 226/583] iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()	[Body]
[PATCH 6.18 227/583] iio: light: opt4001: Reject integration times with a non-zero seconds part	[Body]
[PATCH 6.18 228/583] iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask	[Body]
[PATCH 6.18 229/583] KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode	[Body]
[PATCH 6.18 230/583] KVM: nVMX: Always flush vpid02 on first use	[Body]
[PATCH 6.18 231/583] KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02	[Body]
[PATCH 6.18 232/583] KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit	[Body]
[PATCH 6.18 233/583] KVM: nVMX: Service local TLB flushes on failed nested VM-Enter	[Body]
[PATCH 6.18 234/583] KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU	[Body]
[PATCH 6.18 235/583] KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot()	[Body]
[PATCH 6.18 236/583] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves	[Body]
[PATCH 6.18 237/583] KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU	[Body]
[PATCH 6.18 238/583] KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot	[Body]
[PATCH 6.18 239/583] KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk	[Body]
[PATCH 6.18 240/583] KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock	[Body]
[PATCH 6.18 241/583] KVM: x86: Serialize writes to disabled_quirks using kvm->lock	[Body]
[PATCH 6.18 242/583] KVM: x86: Ensure runtime reads of disabled_quirks are resolved once	[Body]
[PATCH 6.18 243/583] KVM: s390: Fix length check __import_wp_info()	[Body]
[PATCH 6.18 244/583] KVM: s390: Fix memory leak in guest debug handling	[Body]
[PATCH 6.18 245/583] KVM: s390: Fix old_data leak in guest debug error path	[Body]
[PATCH 6.18 246/583] KVM: s390: Free guest debug data on vcpu destroy	[Body]
[PATCH 6.18 247/583] KVM: s390: Take srcu when importing watchpoint data	[Body]
[PATCH 6.18 248/583] KVM: s390: Zero initialize irq in reinject_machine_check	[Body]
[PATCH 6.18 249/583] KVM: s390: Fix memory corruption by not reinjecting CK machine checks	[Body]
[PATCH 6.18 250/583] KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP	[Body]
[PATCH 6.18 251/583] KVM: s390: Restore sigset on error path	[Body]
[PATCH 6.18 252/583] KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page	[Body]
[PATCH 6.18 253/583] KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation	[Body]
[PATCH 6.18 254/583] KVM: arm64: Correctly handle end of VA space TLBI invalidation	[Body]
[PATCH 6.18 255/583] KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry	[Body]
[PATCH 6.18 256/583] KVM: arm64: Sign-extend VA for range-based TLBI invalidation	[Body]
[PATCH 6.18 257/583] KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables	[Body]
[PATCH 6.18 258/583] KVM: arm64: vgic: Fix detection of MI on no pending LR	[Body]
[PATCH 6.18 259/583] KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure	[Body]
[PATCH 6.18 260/583] KVM: arm64: vgic-its: Dont dereference a NULL collection on ITT save	[Body]
[PATCH 6.18 261/583] KVM: arm64: Correctly cap TLBI Range to the architural limit	[Body]
[PATCH 6.18 262/583] LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path	[Body]
[PATCH 6.18 263/583] LoongArch: KVM: Fix TOCTOU race on pv_features	[Body]
[PATCH 6.18 264/583] LoongArch: KVM: Free init resources if kvm_init() fails	[Body]
[PATCH 6.18 265/583] LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY	[Body]
[PATCH 6.18 266/583] LoongArch: Add DIRECT_MAP_PHYSMEM_END definition	[Body]
[PATCH 6.18 267/583] LoongArch: BPF: Optimize redundant TCC loads in epilogue	[Body]
[PATCH 6.18 268/583] LoongArch: BPF: Refactor jump offset calculation in tail call	[Body]
[PATCH 6.18 269/583] LoongArch: Fix acpi_package_ids[] array overflow	[Body]
[PATCH 6.18 270/583] LoongArch: Do not select HAVE_RUST when KASAN is enabled	[Body]
[PATCH 6.18 271/583] LoongArch: Do not save/restore percpu base register in rethook trampoline	[Body]
[PATCH 6.18 272/583] LoongArch: Avoid preempt count underflow without probe	[Body]
[PATCH 6.18 273/583] rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments	[Body]
[PATCH 6.18 274/583] media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref	[Body]
[PATCH 6.18 275/583] media: amphion: Remove obsolete frame_count check in venc_start_session	[Body]
[PATCH 6.18 276/583] media: cec: core: Fix kmemleak due to missed rc_free_device() call	[Body]
[PATCH 6.18 277/583] media: cec: disable delayed work before freeing an interrupted transmit	[Body]
[PATCH 6.18 278/583] media: cec: extron-da-hd-4k-plus: add sanity check	[Body]
[PATCH 6.18 279/583] media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash	[Body]
[PATCH 6.18 280/583] media: cec: Serialize exclusive follower delivery	[Body]
[PATCH 6.18 281/583] media: cedrus: fix memory leak in cedrus_init_ctrls()	[Body]
[PATCH 6.18 282/583] media: cobalt: Avoid freeing ALSA private data twice	[Body]
[PATCH 6.18 283/583] media: cx231xx: reject geometry changes while the VBI queue is busy	[Body]
[PATCH 6.18 284/583] media: cx23885: cancel NetUP CI work before teardown	[Body]
[PATCH 6.18 285/583] media: em28xx: defer audio-only extension registration	[Body]
[PATCH 6.18 286/583] media: em28xx: fix use-after-free of dev_next->devlist on disconnect	[Body]
[PATCH 6.18 287/583] media: go7007: defer the ALSA v4l2 put until card release	[Body]
[PATCH 6.18 288/583] media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure	[Body]
[PATCH 6.18 289/583] media: i2c: imx415: Release runtime PM reference on VBLANK error	[Body]
[PATCH 6.18 290/583] media: i2c: imx415: Return test pattern write errors	[Body]
[PATCH 6.18 291/583] media: i2c: ov02a10: fix endpoint parsing use-after-free	[Body]
[PATCH 6.18 292/583] media: i2c: ov7740: fix use-after-destroy in remove	[Body]
[PATCH 6.18 293/583] media: imx355: Avoid calling imx355_power_off twice in error path	[Body]
[PATCH 6.18 294/583] media: intel/ipu6: fix async notifier cleanup leak on parse error	[Body]
[PATCH 6.18 295/583] media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder	[Body]
[PATCH 6.18 296/583] media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common	[Body]
[PATCH 6.18 297/583] media: platform: mtk-mdp3: Fix SCP device refcounting	[Body]
[PATCH 6.18 298/583] media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup	[Body]
[PATCH 6.18 299/583] media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing	[Body]
[PATCH 6.18 300/583] media: nxp: imx8-isi: Correct color map between V4L2 and ISI	[Body]
[PATCH 6.18 301/583] media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks	[Body]
[PATCH 6.18 302/583] media: rc: sunxi-cir: Unregister rc device on probe failure	[Body]
[PATCH 6.18 303/583] media: rkvdec: Propagate platform_get_irq() errors	[Body]
[PATCH 6.18 304/583] media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak	[Body]
[PATCH 6.18 305/583] media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure	[Body]
[PATCH 6.18 306/583] media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement	[Body]
[PATCH 6.18 307/583] media: s2255: bound JPEG frame size before copying into the buffer	[Body]
[PATCH 6.18 308/583] media: s2255: check firmware size before reading trailing marker	[Body]
[PATCH 6.18 309/583] media: saa7164: fix cleanup on resource allocation failure	[Body]
[PATCH 6.18 310/583] media: tda18250: fix possible integer overflow	[Body]
[PATCH 6.18 311/583] media: v4l2-async: avoid deleting unlinked ASC entry on link error	[Body]
[PATCH 6.18 312/583] media: v4l2-ctrls: Allow unknown HDR10 white point and luminance	[Body]
[PATCH 6.18 313/583] media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link	[Body]
[PATCH 6.18 314/583] media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()	[Body]
[PATCH 6.18 315/583] media: venus: fix payload size calculation in parse_raw_formats()	[Body]
[PATCH 6.18 316/583] media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure	[Body]
[PATCH 6.18 317/583] media: vimc: fix pixel format lookup in enum_framesizes	[Body]
[PATCH 6.18 318/583] media: zoran: Avoid freeing a registered video_device twice	[Body]
[PATCH 6.18 319/583] media: qcom: iris: fix state-change debug log printing stale value	[Body]
[PATCH 6.18 320/583] media: qcom: iris: use disable_irq() during power-off	[Body]
[PATCH 6.18 321/583] media: chips-media: wave5: Guard bit depth check with initial_info_obtained	[Body]
[PATCH 6.18 322/583] media: chips-media: wave5: Set inst->std during default format initialization	[Body]
[PATCH 6.18 323/583] scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers	[Body]
[PATCH 6.18 324/583] scsi: qla2xxx: Bound i2c->length in I2C bsg handlers	[Body]
[PATCH 6.18 325/583] scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check	[Body]
[PATCH 6.18 326/583] scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters	[Body]
[PATCH 6.18 327/583] scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()	[Body]
[PATCH 6.18 328/583] scsi: qla2xxx: Initialize NVMe abort_work once at submission	[Body]
[PATCH 6.18 329/583] scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()	[Body]
[PATCH 6.18 330/583] scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()	[Body]
[PATCH 6.18 331/583] scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject	[Body]
[PATCH 6.18 332/583] scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation	[Body]
[PATCH 6.18 333/583] scsi: qla2xxx: Serialize flash version read in reset handler	[Body]
[PATCH 6.18 334/583] scsi: qla2xxx: Fix cs84xx use-after-free on host teardown	[Body]
[PATCH 6.18 335/583] scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump	[Body]
[PATCH 6.18 336/583] scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()	[Body]
[PATCH 6.18 337/583] scsi: qla2xxx: Fix FCE trace enable parsing in debugfs	[Body]
[PATCH 6.18 338/583] scsi: qla2xxx: Dont query firmware state while chip is down	[Body]
[PATCH 6.18 339/583] scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path	[Body]
[PATCH 6.18 340/583] scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()	[Body]
[PATCH 6.18 341/583] scsi: qla2xxx: Quiesce response IRQ before freeing request queue	[Body]
[PATCH 6.18 342/583] scsi: qla2xxx: Avoid double completion in async IOCB timeout	[Body]
[PATCH 6.18 343/583] scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read	[Body]
[PATCH 6.18 344/583] scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()	[Body]
[PATCH 6.18 345/583] scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort	[Body]
[PATCH 6.18 346/583] scsi: qla2xxx: Drop vport reference under lock in report ID acquisition	[Body]
[PATCH 6.18 347/583] scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition	[Body]
[PATCH 6.18 348/583] scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics	[Body]
[PATCH 6.18 349/583] scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak	[Body]
[PATCH 6.18 350/583] scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started	[Body]
[PATCH 6.18 351/583] f2fs: return symlink writeback errors	[Body]
[PATCH 6.18 352/583] f2fs: reject overlapping move range after len expansion	[Body]
[PATCH 6.18 353/583] f2fs: only redirty pinned folios in redirty_blocks	[Body]
[PATCH 6.18 354/583] f2fs: fix to avoid move_range and defragment on device_alias file	[Body]
[PATCH 6.18 355/583] f2fs: dirty directory inodes on mtime/ctime update	[Body]
[PATCH 6.18 356/583] f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()	[Body]
[PATCH 6.18 357/583] f2fs: return writeback error from collapse range	[Body]
[PATCH 6.18 358/583] f2fs: fix to avoid potential section-unaligned pinfile	[Body]
[PATCH 6.18 359/583] f2fs: fix dentry folio leak in find_in_level	[Body]
[PATCH 6.18 360/583] f2fs: avoid NULL checkpoint thread access in sysfs	[Body]
[PATCH 6.18 361/583] f2fs: fix to migrate all curseg types during free_segment_range	[Body]
[PATCH 6.18 362/583] f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()	[Body]
[PATCH 6.18 363/583] f2fs: fix i_size when pinned fallocate partially fails	[Body]
[PATCH 6.18 364/583] f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()	[Body]
[PATCH 6.18 365/583] f2fs: fix to clear dirty flag on folio in error path	[Body]
[PATCH 6.18 366/583] f2fs: fix valid block count leak on data block allocation failure	[Body]
[PATCH 6.18 367/583] f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()	[Body]
[PATCH 6.18 368/583] f2fs: fix to zero post-EOF data when extending file size	[Body]
[PATCH 6.18 369/583] drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()	[Body]
[PATCH 6.18 370/583] drm/xe/vram: report FLAT_CCS base misalignment	[Body]
[PATCH 6.18 371/583] drm/panthor: harden firmware build-info bounds checks	[Body]
[PATCH 6.18 372/583] drm/panthor: fix firmware control interface bounds checks	[Body]
[PATCH 6.18 373/583] drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure	[Body]
[PATCH 6.18 374/583] drm/panel-edp: fix i2c adapter leak on probe failure	[Body]
[PATCH 6.18 375/583] drm: fix race between partial drm_dev_register() failure and ioctl	[Body]
[PATCH 6.18 376/583] drm/i915: Guard against NULL driver_data in i915_pci_probe()	[Body]
[PATCH 6.18 377/583] drm/ssd130x: fix column and row end address in partial updates for ssd132x	[Body]
[PATCH 6.18 378/583] drm/sun4i: fix refcount leak in sun4i_backend_init_sat()	[Body]
[PATCH 6.18 379/583] drm/ssd130x: fix column and row end address in partial updates in ssd133x	[Body]
[PATCH 6.18 380/583] drm/nouveau/disp/r535: Add scanline position support + head state support	[Body]
[PATCH 6.18 381/583] drm/hibmc: Fix list of formats on the primary plane	[Body]
[PATCH 6.18 382/583] drm/hibmc: Use drm_atomic_helper_check_plane_state()	[Body]
[PATCH 6.18 383/583] drm/amd/display: avoid divide-by-zero in __is_lut_linear()	[Body]
[PATCH 6.18 384/583] drm/amd/display: fix dc_lock leak on GPU reset error paths	[Body]
[PATCH 6.18 385/583] drm/amd/display: validate plane degamma LUT size for private color prop	[Body]
[PATCH 6.18 386/583] drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check	[Body]
[PATCH 6.18 387/583] drm/gud: NUL-terminate TV mode names read from the device	[Body]
[PATCH 6.18 388/583] drm/gud: validate TV mode names before creating enum property	[Body]
[PATCH 6.18 389/583] drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value	[Body]
[PATCH 6.18 390/583] drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used	[Body]
[PATCH 6.18 391/583] drm/amdgpu: check thunderbolt before switcheroo registration	[Body]
[PATCH 6.18 392/583] drm/amdgpu: clamp the isolation index for rings outside a partition	[Body]
[PATCH 6.18 393/583] drm/amdgpu: Disable runtime PM for externally attached dGPUs	[Body]
[PATCH 6.18 394/583] drm/amdgpu: fix autosuspend cleanup during removal	[Body]
[PATCH 6.18 395/583] drm/amdgpu: Skip accessing psp rum time db for APUs	[Body]
[PATCH 6.18 396/583] drm/amdgpu: update the fw version for gfx11 userqueues	[Body]
[PATCH 6.18 397/583] drm/amdgpu: update the fw version for gfx12 userqueues	[Body]
[PATCH 6.18 398/583] drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT	[Body]
[PATCH 6.18 399/583] drm/amdkfd: Add TLB flush after MES queue eviction/suspension	[Body]
[PATCH 6.18 400/583] drm/amdkfd: Fix error path at svm_migrate_copy_to_ram	[Body]
[PATCH 6.18 401/583] drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram	[Body]
[PATCH 6.18 402/583] drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore	[Body]
[PATCH 6.18 403/583] drm/amdkfd: Reject zero-sized AQL queue allocations after size halving	[Body]
[PATCH 6.18 404/583] drm/sysfb: simpledrm: Improve framebuffer-size validation	[Body]
[PATCH 6.18 405/583] drm/sysfb: simpledrm: Improve panel-size validation	[Body]
[PATCH 6.18 406/583] drm/sysfb: simpledrm: Improve stride validation	[Body]
[PATCH 6.18 407/583] drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation	[Body]
[PATCH 6.18 408/583] drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug	[Body]
[PATCH 6.18 409/583] drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware	[Body]
[PATCH 6.18 410/583] drm/nouveau: unsubscribe the channel-kill event before the fence context	[Body]
[PATCH 6.18 411/583] drm/nouveau: Use write-combined maps for coherent	[Body]
[PATCH 6.18 412/583] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op	[Body]
[PATCH 6.18 413/583] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE	[Body]
[PATCH 6.18 414/583] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE	[Body]
[PATCH 6.18 415/583] drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c	[Body]
[PATCH 6.18 416/583] drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp	[Body]
[PATCH 6.18 417/583] drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks	[Body]
[PATCH 6.18 418/583] drm/nouveau/disp: fix HDMI vendor infoframes on GB20x	[Body]
[PATCH 6.18 419/583] drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x	[Body]
[PATCH 6.18 420/583] drm/nouveau/disp: fix head state readback on GB20x	[Body]
[PATCH 6.18 421/583] drm/nouveau/gsp: fix vblank interrupts on GB20x	[Body]
[PATCH 6.18 422/583] ksmbd: fix use-after-free in oplock break notification	[Body]
[PATCH 6.18 423/583] afs: Fix leak of ungot volume	[Body]
[PATCH 6.18 424/583] usb: xhci: add tracing for PORTSC register writes	[Body]
[PATCH 6.18 425/583] usb: xhci: add helper to read PORTSC register	[Body]
[PATCH 6.18 426/583] usb: xhci: add USB Port Register Set struct	[Body]
[PATCH 6.18 427/583] usb: xhci: implement USB Port Register Set struct	[Body]
[PATCH 6.18 428/583] usb: xhci: use cached HCSPARAMS1 value	[Body]
[PATCH 6.18 429/583] usb: xhci: simplify handling of Structural Parameters 1 values	[Body]
[PATCH 6.18 430/583] usb: xhci: bail out of setup if the controller is inaccessible	[Body]
[PATCH 6.18 431/583] fuse: publish io-uring queues with release semantics	[Body]
[PATCH 6.18 432/583] fuse: split off fuse_args and related definitions into a separate header	[Body]
[PATCH 6.18 433/583] fuse: remove fm arg of args->end callback	[Body]
[PATCH 6.18 434/583] fuse: fix race between interrupt and resend	[Body]
[PATCH 6.18 435/583] net/packet: defer vmalloc TX_RING free until skbs finish	[Body]
[PATCH 6.18 436/583] vlan: fix skb_under_panic and races when toggling HW VLAN offload	[Body]
[PATCH 6.18 437/583] crypto: iaa - fall back to software for multi-entry scatterlists	[Body]
[PATCH 6.18 438/583] crypto: iaa - unmap dst before software fallback on decompress	[Body]
[PATCH 6.18 439/583] crypto: atmel-ecc - replace min_t with min	[Body]
[PATCH 6.18 440/583] crypto: atmel-ecc - clean up and improve ECDH comments	[Body]
[PATCH 6.18 441/583] crypto: atmel-ecc - avoid stale fallback key after set_secret failure	[Body]
[PATCH 6.18 442/583] ovl: fix double end_creating() on the casefold-mismatch path	[Body]
[PATCH 6.18 443/583] pidfs: simplify PIDFD_GET_<type>_NAMESPACE ioctls	[Body]
[PATCH 6.18 444/583] pidfd: hold exec_update_lock around namespace ioctl	[Body]
[PATCH 6.18 445/583] rust: devres: fix race condition due to nesting	[Body]
[PATCH 6.18 446/583] rust: devres: fix race between concurrent revokers	[Body]
[PATCH 6.18 447/583] rust: bug: prevent dead_code warning from warn_on!s flags constant	[Body]
[PATCH 6.18 448/583] mm/hugetlb: defer vmemmap population for bootmem hugepages	[Body]
[PATCH 6.18 449/583] mm/hugetlb: refactor code around vmemmap_walk	[Body]
[PATCH 6.18 450/583] mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier	[Body]
[PATCH 6.18 451/583] mm/mglru: use the common routine for dirty/writeback reactivation	[Body]
[PATCH 6.18 452/583] mm/mglru: fix and remove redundant unevictable folio handling	[Body]
[PATCH 6.18 453/583] mm/rmap: use huge_ptep_get() in try_to_migrate_one()	[Body]
[PATCH 6.18 454/583] mm/slab: move and refactor __kmem_cache_alias()	[Body]
[PATCH 6.18 455/583] mm/slub: fix missing debugfs entries for caches created before sysfs init	[Body]
[PATCH 6.18 456/583] xen/balloon: improve accuracy of initial balloon target for dom0	[Body]
[PATCH 6.18 457/583] x86/xen: fix init of balloon stats again	[Body]
[PATCH 6.18 458/583] mm/page_alloc: dont spin_trylock() in NMI on UP	[Body]
[PATCH 6.18 459/583] USB: gadget: ffs: fix mm lifetime handling	[Body]
[PATCH 6.18 460/583] usb: gadget: f_fs: Fix Use-After-Free in AIO error path	[Body]
[PATCH 6.18 461/583] cxl/pci: Move CXL drivers RCH error handling into core/ras_rch.c	[Body]
[PATCH 6.18 462/583] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read	[Body]
[PATCH 6.18 463/583] ceph: cap delegated inode count in ceph_parse_deleg_inos()	[Body]
[PATCH 6.18 464/583] ceph: force a cap message when a deferred revoke cant be acked immediately	[Body]
[PATCH 6.18 465/583] NFSD: Guard admin state-revocation walks with NFSD_NET_UP	[Body]
[PATCH 6.18 466/583] ceph: properly decrypt filenames in vmalloc() buffers	[Body]
[PATCH 6.18 467/583] smb: move some definitions from common/smb2pdu.h into common/fscc.h	[Body]
[PATCH 6.18 468/583] smb/client: reduce fallocate zero buffer allocation	[Body]
[PATCH 6.18 469/583] smb/client: emulate small EOF-extending mode 0 fallocate ranges	[Body]
[PATCH 6.18 470/583] cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem	[Body]
[PATCH 6.18 471/583] HID: sony: use guard() and scoped_guard()	[Body]
[PATCH 6.18 472/583] HID: sony: clean up device list on probe failure	[Body]
[PATCH 6.18 473/583] HID: mcp2221: fix OOB write in mcp2221_raw_event()	[Body]
[PATCH 6.18 474/583] HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes	[Body]
[PATCH 6.18 475/583] erofs: skip sufficiently large global buffers when resizing	[Body]
[PATCH 6.18 476/583] ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+	[Body]
[PATCH 6.18 477/583] ACPI: x86: cmos_rtc: Create a CMOS RTC platform device	[Body]
[PATCH 6.18 478/583] ACPI: x86/rtc-cmos: Use platform device for driver binding	[Body]
[PATCH 6.18 479/583] ACPI: TAD: Rearrange RT data validation checking	[Body]
[PATCH 6.18 480/583] ACPI: TAD: Add locking around AML evaluations	[Body]
[PATCH 6.18 481/583] cpufreq: apple-soc: Fix OPP table cleanup	[Body]
[PATCH 6.18 482/583] bpf: Factor stackid_init function from __bpf_get_stackid	[Body]
[PATCH 6.18 483/583] bpf: Factor stackid_fastpath function from __bpf_get_stackid	[Body]
[PATCH 6.18 484/583] bpf: Factor stackid_new_bucket from __bpf_get_stackid	[Body]
[PATCH 6.18 485/583] bpf: Use stack id functions instead of __bpf_get_stackid	[Body]
[PATCH 6.18 486/583] bpf: Disable preemption in bpf_get_stackid	[Body]
[PATCH 6.18 487/583] cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register	[Body]
[PATCH 6.18 488/583] dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding	[Body]
[PATCH 6.18 489/583] cxl/region: Add helper to check Soft Reserved containment by CXL regions	[Body]
[PATCH 6.18 490/583] cxl/mce: Make the MCE notifier per-region	[Body]
[PATCH 6.18 491/583] SUNRPC: fix gssx_dec_option_array error path bugs	[Body]
[PATCH 6.18 492/583] svcrdma: Release transport resources synchronously	[Body]
[PATCH 6.18 493/583] svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id	[Body]
[PATCH 6.18 494/583] rpcrdma: arm rn_done before publishing the notification	[Body]
[PATCH 6.18 495/583] svcrdma: Reject oversized Read segments at decode time	[Body]
[PATCH 6.18 496/583] svcrdma: Reject Read lists that exceed the page budget	[Body]
[PATCH 6.18 497/583] sched_ext: Fix exit_task leak on fork failure during enable	[Body]
[PATCH 6.18 498/583] RDMA/ionic: Embed counter driver data in rdma_counter allocation	[Body]
[PATCH 6.18 499/583] scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock	[Body]
[PATCH 6.18 500/583] sched_ext: Fix inverted ops.core_sched_before() invocation	[Body]
[PATCH 6.18 501/583] sched: Add assert_balance_callbacks_empty helper	[Body]
[PATCH 6.18 502/583] sched: Rework prev_balance() to avoid stale prev references	[Body]
[PATCH 6.18 503/583] sched/core: Make core-sched flips wait for in-flight selections	[Body]
[PATCH 6.18 504/583] firmware: qcom_scm: Rename peripheral as pas_id	[Body]
[PATCH 6.18 505/583] remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check	[Body]
[PATCH 6.18 506/583] ASoC: codecs: aw88261: reduce log spam	[Body]
[PATCH 6.18 507/583] ASoC: codecs: aw88261: only check PLL and clock state at power-up	[Body]
[PATCH 6.18 508/583] ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page	[Body]
[PATCH 6.18 509/583] ocfs2: validate dx_root extent list fields during block read	[Body]
[PATCH 6.18 510/583] ocfs2: validate directory-index entry counts when reading metadata	[Body]
[PATCH 6.18 511/583] lockd: fix swapped arguments in nlmsvc_match_ip()	[Body]
[PATCH 6.18 512/583] PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots	[Body]
[PATCH 6.18 513/583] PCI: starfive: Fix resource leaks on error paths in host_init()	[Body]
[PATCH 6.18 514/583] fuse: fix missing barrier when checking io-uring readiness	[Body]
[PATCH 6.18 515/583] fuse-uring: refactor io-uring header copying to ring	[Body]
[PATCH 6.18 516/583] fuse-uring: refactor io-uring header copying from ring	[Body]
[PATCH 6.18 517/583] fuse-uring: use enum types for header copying	[Body]
[PATCH 6.18 518/583] fuse-uring: refactor setting up copy state for payload copying	[Body]
[PATCH 6.18 519/583] fuse-uring: use named constants for io-uring iovec indices	[Body]
[PATCH 6.18 520/583] fuse: copy request headers via a stack buffer for io-uring	[Body]
[PATCH 6.18 521/583] ipv6: pass proto by value to ipv6_push_nfrag_opts() and ipv6_push_frag_opts()	[Body]
[PATCH 6.18 522/583] ipv6: add some unlikely()/likely() clauses in ip6_output.c	[Body]
[PATCH 6.18 523/583] inet: add dst4_mtu() and dst6_mtu() helpers	[Body]
[PATCH 6.18 524/583] ipv6: use dst6_mtu() instead of dst_mtu()	[Body]
[PATCH 6.18 525/583] ipv4: use dst4_mtu() instead of dst_mtu()	[Body]
[PATCH 6.18 526/583] tcp: clamp route advmss to TCP_MIN_MSS	[Body]
[PATCH 6.18 527/583] net: advertise TCP MSS from the configured MTU, not the learned PMTU	[Body]
[PATCH 6.18 528/583] nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()	[Body]
[PATCH 6.18 529/583] nfsd: move struct nfsd_genl_rqstp to nfsctl.c	[Body]
[PATCH 6.18 530/583] nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage	[Body]
[PATCH 6.18 531/583] nfsd: fix clock domain mismatch in clients_still_reclaiming()	[Body]
[PATCH 6.18 532/583] nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net	[Body]
[PATCH 6.18 533/583] nfsd: fix UAF in async copy cancel and shutdown	[Body]
[PATCH 6.18 534/583] nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache	[Body]
[PATCH 6.18 535/583] nfsd: convert global state_lock to per-net deleg_lock	[Body]
[PATCH 6.18 536/583] NFSD: Prevent client use-after-free during delegation revoke	[Body]
[PATCH 6.18 537/583] NFSD: Prevent client use-after-free during admin state revocation	[Body]
[PATCH 6.18 538/583] cifs: Scripted clean up fs/smb/client/cifs_unicode.h	[Body]
[PATCH 6.18 539/583] cifs: Scripted clean up fs/smb/client/fscache.h	[Body]
[PATCH 6.18 540/583] cifs: Scripted clean up fs/smb/client/fs_context.h	[Body]
[PATCH 6.18 541/583] cifs: Scripted clean up fs/smb/client/smb2proto.h	[Body]
[PATCH 6.18 542/583] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions	[Body]
[PATCH 6.18 543/583] cifs: Remove dead function prototypes	[Body]
[PATCH 6.18 544/583] cifs: SMB1 split: Create smb1proto.h for SMB1 declarations	[Body]
[PATCH 6.18 545/583] cifs: SMB1 split: Separate out SMB1 decls into smb1proto.h	[Body]
[PATCH 6.18 546/583] smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2	[Body]
[PATCH 6.18 547/583] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()	[Body]
[PATCH 6.18 548/583] cifs: Do some preparation prior to organising the function declarations	[Body]
[PATCH 6.18 549/583] smb: client: reject a tree connect response whose byte count is too small	[Body]
[PATCH 6.18 550/583] NFSD: Consolidate the revocation-path client unpin	[Body]
[PATCH 6.18 551/583] NFSD: Prevent client use-after-free during blocked-lock reaping	[Body]
[PATCH 6.18 552/583] NFSD: Prevent client use-after-free during close_lru reaping	[Body]
[PATCH 6.18 553/583] zram: fixup read_block_state()	[Body]
[PATCH 6.18 554/583] zram: fix out-of-bounds access in read_block_state()	[Body]
[PATCH 6.18 555/583] zram: take write lock in wb limit store handlers	[Body]
[PATCH 6.18 556/583] zram: drop wb_limit_lock	[Body]
[PATCH 6.18 557/583] zram: read slot block idx under slot lock	[Body]
[PATCH 6.18 558/583] zram: fix the issue that the write - back limits might overflow	[Body]
[PATCH 6.18 559/583] zram: set default primary compressor in zram_destroy_comps()	[Body]
[PATCH 6.18 560/583] mm: rework compound_head() for power-of-2 sizeof(struct page)	[Body]
[PATCH 6.18 561/583] hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU	[Body]
[PATCH 6.18 562/583] mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios()	[Body]
[PATCH 6.18 563/583] Docs/ABI/damon: fix typo in intervals_goal sysfs path	[Body]
[PATCH 6.18 564/583] power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()	[Body]
[PATCH 6.18 565/583] power: supply: ab8500_fg: fix use-after-free on remove	[Body]
[PATCH 6.18 566/583] iommu/arm-smmu-v3: Add HAFT support for SVA	[Body]
[PATCH 6.18 567/583] mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()	[Body]
[PATCH 6.18 568/583] mm/damon/vaddr: drop last same folio access check optimization	[Body]
[PATCH 6.18 569/583] mm/damon/paddr: drop last same folio access check reuse optimization	[Body]
[PATCH 6.18 570/583] mm/damon/ops-common: use nr_accesses moving sum for quota score	[Body]
[PATCH 6.18 571/583] mm/damon/core: skip aging from repeated aggressive merging	[Body]
[PATCH 6.18 572/583] mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs()	[Body]
[PATCH 6.18 573/583] mm/damon/core-kunit: handle region split failure in filter_out()	[Body]
[PATCH 6.18 574/583] mm/damon/core: initialize damos->last_applied	[Body]
[PATCH 6.18 575/583] mm: thp: introduce folio_split_queue_lock and its variants	[Body]
[PATCH 6.18 576/583] mm: thp: use folio_batch to handle THP splitting in deferred_split_scan()	[Body]
[PATCH 6.18 577/583] mm/huge_memory: change folio_split_supported() to folio_check_splittable()	[Body]
[PATCH 6.18 578/583] mm/huge_memory: replace can_split_folio() with direct refcount calculation	[Body]
[PATCH 6.18 579/583] migrate: replace RMP_ flags with TTU_ flags	[Body]
[PATCH 6.18 580/583] mm/huge_memory: use folios memcg inside __folio_split()	[Body]
[PATCH 6.18 581/583] pidfs: protect PIDFD_GET_* ioctls() via ifdef	[Body]
[PATCH 6.18 582/583] mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback	[Body]
[PATCH 6.18 583/583] cifs: add fscache_resize_cookie() to cifs_setsize()	[Body]

ID (for dev)	c9db6540-557d-42b0-890d-c2d70a1fd03c
Status	skipped
Triaged	Skipped: failed to find a base commit: series does not apply [Log]
Execution Log	[Link]

Patches (583)

Series Summary

Sessions

Session 2026-09-15