From:

        Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To:

         <>

Subject:

    Accepted linux 6.12.113-1 (source) into stable-security

Date:

    Fri, 16 Oct 2026 13:17:37 +0000

Signed by: Salvatore Bonaccorso carnil@debian.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Format: 1.8 Date: Thu, 15 Oct 2026 17:02:11 +0200 Source: linux Architecture: source Version: 6.12.113-1 Distribution: trixie-security Urgency: high Maintainer: Debian Kernel Team debian-kernel@lists.debian.org Changed-By: Salvatore Bonaccorso carnil@debian.org Closes: 1149499 1149564 1150891 Changes: linux (6.12.113-1) trixie-security; urgency=high .

• New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.112
  • Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"
  • Revert "hwmon: (emc1403) Rely on subsystem locking"
  • landlock: Fix TCP Fast Open connection bypass
  • [s390x] boot: Add sized_strscpy() to enable strscpy() usage
  • [s390x] boot: Avoid IPL parameter append past command line
  • sunvdc: fix -EIO issue due to lack of retries
  • net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
  • net: cpsw: Execute ndo_set_rx_mode callback in a work queue
  • ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
  • ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.
  • ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.
  • ipv6: mcast: Don't hold RTNL for MCAST_ socket options.
  • ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (CVE-2026-98101)
  • media: video-i2c: fix buffer queue ordering
  • ipv6: Select best matching nexthop object in fib6_table_lookup()
  • ipv6: Honor oif when choosing nexthop for locally generated traffic
  • pidfd: hold exec_update_lock around namespace ioctl (CVE-2026-89766)
  • xfrm: avoid RCU warnings around the per-netns netlink socket
  • xfrm: fix compat ALLOCSPI request use-after-free
  • xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
  • esp: downgrade zerocopy managed frags before mutating skb frags
  • RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
  • RDMA/rxe: validate access flags before swapping the MR's PD
  • RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
  • [arm64] firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
  • clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
  • RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
  • RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
  • IB/iser: reject a remote invalidation of an unregistered direction
  • IB/isert: wait for deferred control PDU completions before releasing the connection
  • RDMA/mad: Fix receive buffer leak when PKey enforcement fails
  • RDMA/irdma: Enforce local fence for IB_WR_REG_MR
  • RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
  • dmaengine: sprd: Fix runtime PM reference leak in probe
  • wifi: virt_wifi: free skb when disconnected
  • wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
  • wifi: libipw: reject too-short beacon and probe responses
  • wifi: libipw: reject too-short association responses
  • IB/IPoIB: Avoid restoring OPER_UP after multicast flush
  • wifi: cfg80211: don't get the radio mask for netdev-less wdevs
  • wifi: cfg80211: check IP header size in cfg80211_classify8021d()
  • soundwire: cadence_master: wait and cancel cdns->work before clock stop
  • dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
  • dma-coherent: report a failed reserved memory assignment
  • dmaengine: Fix device kref underflow in dma_chan_put()
  • dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
  • dmaengine: wait for RCU readers before releasing dma_device
  • wifi: cfg80211: only group hidden BSSes with beacon entries
  • wifi: cfg80211: don't filter by BSS type when removing stale entries
  • wifi: mac80211: don't start a ROC while scanning
  • wifi: cfg80211: add option for vif allowed radios
  • wifi: mac80211: use vif radio mask to limit ibss scan frequencies
  • wifi: mac80211: don't warn when an IBSS has no channel to scan
  • wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
  • wifi: mac80211: suppress chanctx warning for debugfs reset
  • wifi: mac80211: abort chanswitch when leaving a mesh
  • wifi: mac80211: reset state when starting AP fails
  • wifi: mac80211: unlist vifs when their netdev is unregistered
  • wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
  • wifi: cfg80211: skip regulatory for punctured subchannels
  • wifi: cfg80211: expose cfg80211_chandef_get_width()
  • wifi: mac80211: don't allow injecting frames wider than the chanctx
  • wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
  • wifi: mac80211: require a peer station for TDLS setup confirm
  • wifi: mac80211: don't allow link changes when iface is down
  • wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
  • wifi: mac80211: don't access the TSF of a down interface
  • wifi: mac80211: add HE 6 GHz capability in the scan elems len
  • wifi: mac80211: mesh: reset the CSA state when leaving
  • wifi: mac80211: mesh: release the channel if start fails
  • wifi: mac80211: set up the TX info early to fix failure paths
  • mm: memblock: show all region flags in debugfs
  • scsi: qla2xxx: Fix the ql2xfc2target parameter description
  • dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
  • dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
  • RDMA/efa: Keep admin queues alive while IRQ is registered
  • RDMA/efa: Keep EQ resources alive while IRQ is registered
  • RDMA/siw: Bound fragmented header copies by the remaining length
  • netfilter: nft_nat: fully initialise new_addr in netmap setup
  • netfilter: flowtable: hold reference on ct until flow is released
  • perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
  • [arm64] hibernate: clone only the linear map that exists at runtime
  • drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
  • keys: fix lost wakeup when reaping a dead key type
  • ALSA: bcd2000: Fix race between rawmidi and disconnect
  • [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
  • [arm64] phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
  • ALSA: pcm: set timer->private_data before registering the PCM timer
  • ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask
  • ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map
  • ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params
  • Input: trackpoint - fix the inertia attribute name in the ABI document
  • gpio: virtuser: skip free_irq when no IRQ is installed
  • ALSA: 6fire: Clean ups with guard()
  • ALSA: usb: 6fire: Avoid embedded URBs
  • ALSA: 6fire: fix OOB write from device-reported iso length
  • wifi: virt_wifi: don't transfer operstate before register
  • drm/vc4: Use managed KMS polling to fix UAF on unbind
  • ALSA: hda: trace PCM open only after assigning a stream
  • wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
  • btrfs: tree-checker: print dev extent offset in error message
  • [arm64] drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
  • seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
  • ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
  • net: fddi: skfp: fix NULL deref when setting the MAC address while down
  • wifi: brcmfmac: fix lost 802.1x TX completion wakeup
  • net: bridge: mst: move switchdev call outside rcu
  • tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
  • tcp: do not let tcp_rmem be set below 4096
  • ksmbd: return buffer overflow for partial filesystem info
  • ksmbd: fix partial file information responses
  • ksmbd: keep compound responses on query info errors
  • dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
  • Bluetooth: hci_core: Print number of packets in conn->data_q
  • Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
  • Bluetooth: coredump: Quiesce dump work on unregister
  • Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
  • Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync
  • Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
  • Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
  • Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
  • Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
  • pppoatm: ensure a writable skb header and linear data
  • drop_monitor: synchronize tracepoint unregistration on error path
  • drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
  • net: stmmac: do not overwrite phc_index when no PTP clock is registered
  • [powerpc*] KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
  • [powerpc*] KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
  • [powerpc*] iommu: Fix the overflow validation in iommu_tce_check_ioba
  • ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
  • ASoC: hdmi-codec: Report a change when the channel status moves
  • net: netsec: fix device_node reference leak on phy_np
  • net: lock the socket in sock_gettstamp()
  • net: ethernet: cortina: Ack RX overrun interrupt correctly
  • net: stmmac: propagate FPE preemption-class mapping errors
  • net: macb: fix ordering around PTP timestamp read
  • net: mvpp2: prevent buffer overflow in page_pool allocation
  • net: skbuff: do not leave stale header offsets after pskb_carve()
  • drm/amdgpu: check ras and obj before dereference
  • btrfs: abort transaction on failure to update inode for hole punching and reflinking
  • [amd64] x86/fred: Reconstruct the #GP context for rejected INT instructions
  • mm/huge_memory: use folio's memcg inside __folio_split()
  • wifi: rtw88: TX QOS Null data the same way as Null data
  • wifi: rtw88: Fix the random "error beacon valid" messages for USB
  • Input: xpad - add support for Victrix Pro BFG Controller
  • Input: xpad - add support for Azeron devices
  • Input: xpad - fix PDP Marvel Xbox 360 controller
  • ALSA: core: Fix potential UAF after asynchronous card release
  • ALSA: virtio: reset device before deleting virtqueues
  • ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
  • ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
  • ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources()
  • cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
  • exec: Cleanup POSIX timers right after de_thread()
  • rds: ib: use rds_conn_drop() on protocol version mismatch
  • [amd64] x86/microcode/intel: Reject problematic loading on Granite Rapids systems
  • tcp: exclude old ACKs from tcp fast path
  • RDMA/ucma: Serialize join and leave on copy_to_user failure
  • RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
  • openvswitch: avoid reallocating confirmed conntrack labels
  • net: xfrm: reject unrepresentable espintcp transport headers
  • HID: logitech-hidpp: fix race condition when accessing stale stack pointer
  • [arm64] hibernate: pass HVC_SET_VECTORS args to the resume hvc
  • [arm64] dts: renesas: r8a779f0: Set UFS lane count
  • [arm64] percpu: Fix this_cpu_write() casting
  • [arm64] percpu: Fix this_cpu_and() mask generation
  • Bluetooth: btusb: fix NXP IW610 composite device handling
  • Bluetooth: eir: validate service data length before reading UUID
  • Bluetooth: hci_codec: validate vendor codec count length
  • Bluetooth: hci_sync: Serialize local codec list cleanup
  • dmaengine: sun6i: fix non-atomic read of DMA position registers
  • dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
  • dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
  • ipv6: xfrm: use full sockets in local error paths
  • net: lan743x: fix RX checksum use-after-free
  • net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
  • net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
  • net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
  • net/sched: act_api: release tail references on DELACTION failure
  • net/sched: hhf: cap hh_flows_limit at change time
  • net/packet: clear RX owner on VNET header error
  • net/packet: avoid truncating TPACKET_V3 private size
  • scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
  • xfrm: serialize state GC with device state flush
  • xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
  • memstick: ms_block: destroy io_queue workqueue on removal
  • mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
  • KEYS: encrypted: fix integer overflow of datablob_len
  • keys: translate request_key_auth pid for the reading procfs instance
  • KEYS: trusted: Fix tpm2_load_cmd() boundary check
  • i2c: at91: release DMA channels on remove and probe error
  • i2c: atr: fix dangling adapter pointer on add failure
  • i2c: imx: release DMA channels on probe error
  • i2c: imx: disable autosuspend on remove
  • IB/mlx4: Fix use-after-free on pkey sysfs registration failure
  • IB/hfi1: Resolve the credit-return buffer through the send context's node
  • IB/hfi1: Fix the PIO_CRED credit-return mmap
  • selinux: preserve user SID across nested backing files
  • selinux: recheck intermediate backing files on mprotect()
  • selinux: always fill AVC decision in avc_has_perm_noaudit()
  • power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed
  • power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
  • power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
  • mmc: core: Cancel SDIO IRQ work before freeing host
  • mmc: core: Fix OF node reference leak on card add failure
  • mmc: hsq: Fix use-after-free in retry work
  • mmc: mmci: Fix use-after-free in busy-timeout work
  • mmc: mxcmmc: cancel data work and watchdog on remove
  • mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
  • mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
  • mmc: sdio_uart: fix xmit_fifo leak when the port table is full
  • mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
  • mmc: spi: reset bytes_xfered before retrying CRC failures
  • mmc: sdhci_am654: Move tuning_loop to local variable
  • mmc: sdhci_am654: Reset command and data lines on failed tuning
  • mmc: sdhci_am654: Clear ITAPDLY on tuning failure
  • mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure
  • Input: adp5588-keys - cache GPIO state before registering the gpiochip
  • Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
  • Input: cyttsp5 - clamp the HID report size before memcpy
  • Input: evdev - zero absinfo before partial copy in EVIOCSABS
  • Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
  • Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
  • Input: soc_button_array - fix MS Surface Pro 11 probe failure
  • Input: soc_button_array - check btns_desc->package.count
  • Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
  • Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
  • Input: zero ff_effect before compat copy in input_ff_effect_from_user
  • hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
  • hwmon: (pmbus/core) increase number of phases and add new mask
  • hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
  • hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
  • hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
  • hwmon: (w83793) release probe data through kref
  • watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
  • watchdog: digicolor: Avoid division by zero
  • watchdog: msc313e: Fix premature reset during timeout update
  • watchdog: msc313e: Propagate error code in resume()
  • watchdog: rtd119x: Avoid division by zero
  • watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
  • watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
  • wifi: brcmsmac: fix UAF in brcms_free_timer()
  • wifi: iwlegacy: fix broadcast stations deallocation
  • wifi: libertas_tf: fix UAF in lbtf_free_adapter()
  • wifi: rsi: fix heap OOB write on key removal
  • wifi: wlcore: release runtime PM ref on regdomain config failure
  • wifi: wilc1000: fix out-of-bounds read in P2P public action frames
  • wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
  • wifi: p54: validate curve data length in the calibration curve converters
  • wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
  • wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
  • wifi: mwifiex: validate scan response extents
  • wifi: mwifiex: prevent authentication frame length truncation
  • wifi: mwifiex: validate action frame fixed fields
  • wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
  • drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
  • [arm64] drm/msm/adreno: fix autosuspend cleanup during teardown
  • [arm64] drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
  • smb: client: cancel reconnect work in clean_demultiplex_info()
  • smb: client: fix rlist race and missing initialization
  • smb: client: reject short Next offsets in parse_server_interfaces()
  • smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
  • smb: client: fix unaligned access in WSL reparse point parser
  • smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
  • smb: client: fix potential OOB read in smb3_enum_snapshots()
  • smb: client: fix server->total_read for compound encrypted PDUs
  • smb: client: fix missing lower-bound check on DFS referral string offsets
  • smb: client: fix missing iov bounds check in parse_posix_sids()
  • HID: asus: fortify keyboard handshake (Closes: #1149499)
  • ksmbd: fix partial normalized name responses
  • spi: spi-zynqmp-gqspi: stop the controller on shutdown
  • smb: client: fix busy dentry warning on unmount after DIO (CVE-2026-72315)
  • xfs: don't stash removename operations with unknown ftype
  • erofs: fix large folio race in erofs_fscache_req_complete
  • ALSA: hda/realtek: Limit Star Labs internal mic boost
  • ALSA: hda/realtek: Add StarFighter HDA SSID
  • netfilter: nf_tables: Tolerate chains with no remaining hooks
  • netfilter: nf_tables: Simplify chain netdev notifier
  • xfrm: Refactor xfrm_input lock to reduce contention with RSS
  • xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463) (Closes: #1150891)
  • xfrm: save input state data before secpath resets
  • remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
  • [s390x] KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
  • bpf: Fix bpf_skb_change_tail wrt csum partial skbs
  • bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
  • bpf: Fix divide-by-zero in btf_struct_walk()
  • bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
  • tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
  • HID: elecom: fix bus type for M-XGL20DLBK
  • [amd64] KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
  • bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
  • bpf: Fix out-of-bounds read of rtt_min in sock_ops
  • bpf: Remove migrate_{disable|enable} in ->map_for_each_callback
  • bpf: Bail out early in __htab_map_lookup_and_delete_elem()
  • bpf: Factor out htab_elem_value helper()
  • bpf: Register dtor for freeing special fields
  • bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
  • bpf, sockmap: Fix self-redirect copied_seq double-counting
  • [arm64] bpf, arm64: set up the frame pointer for the exception callback
  • pinctrl: meson: Fix typo in s4 group name
  • [amd64] HID: amd_sfh: Validate PCI BAR size before mapping
  • HID: bpf: fix __hid_bpf_hw_check_params report length
  • [riscv64] KVM: Preserve firmware counter value across stop/start
  • [riscv64] KVM: Report snapshot write failure to the guest
  • [riscv64] KVM: Fix perf-backed counter accounting across stop and read
  • [arm64] KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
  • [arm64] KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes
  • [arm64] KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
  • [arm64] KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
  • [arm64] KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds
  • scsi: sd_zbc: Reject disks with too many zones
  • Bluetooth: SMP: reject Security Request over BR/EDR
  • Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
  • cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c
  • scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
  • docs: s390/pci: Improve and update PCI documentation
  • [s390x] pci/docs: Fix sriov_numvfs attribute name
  • [s390x] cio: Fix cio_update_schib() to not cache invalid schib
  • [s390x] cio: Check pmcw.dnv before pmcw.ena in I/O entry points
  • [s390x] cio: Guard PMCW field accesses with dnv check
  • xsk: Use a 32-bit compare in xsk_map_gen_lookup
  • bpf: Skip unsettled links in link iterator
  • net/sched: cls_u32: fix manual hash table handle IDR aliasing
  • net/mlx5: devcom, Base component size on linked devices
  • bpf: Restrict CO-RE poisoning to relocatable instructions
  • libbpf: Reject truncated ldimm64 CO-RE relocations
  • netfilter: flowtable: publish HW_DEAD after worker is done
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
  • netfilter: nft_synproxy: use the family-aware checksum helper
  • ipvs: revalidate ihl before icmp_send
  • netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
  • [arm64] io: Reject non-user protection in ioremap_prot()
  • ocfs2: make ocfs2_calc_xattr_init() return void
  • drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
  • drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
  • drm/nouveau/disp: don't reject HDMI config on cards without SCDC
  • net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
  • net: gue: reject invalid REMCSUM offsets
  • net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
  • ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
  • eth: fbnic: Handle maximum standalone channels
  • eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
  • sctp: avoid livelock while updating retransmit path
  • bpf: Bound ownership depth through local kptrs and graph roots
  • net: usb: catc: bound the RX packet length in catc_rx_done()
  • bpf: Check params size before reading reserved fields
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
  • drm/virtio: fix object leak when drm_gem_handle_create() fails
  • drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
  • drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
  • drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
  • drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
  • Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
  • Bluetooth: btintel_pcie: validate device-supplied DMA indices
  • Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
  • octeontx2-af: Fix memory scaling limitation in SR-IOV mode
  • dpll: use exact lookup for reference sync pin id
  • net: usb: sr9700: include receive overhead in the length check
  • ipv6: Fix dst leak for uncached routes.
  • tg3: clean up PHYLIB resources on probe failure
  • [amd64] drm/i915/psr: Add new SU area calculation helper to apply workarounds
  • [amd64] drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable
  • [s390x] debug: Do not register views for failed static debug areas
  • [s390x] debug: Fix NULL pointer dereference in debug_info_copy()
  • net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
  • genetlink: report the real command id for dump-only ops in policy dumps
  • net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
  • thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
  • bpf: Fix bounds check for skb-backed dynptrs
  • bpf: Fix bpf_sock context code generation
  • bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
  • net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
  • net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
  • sctp: hold asoc or transport before mod_timer() in timer handlers
  • net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
  • bpf: Reject dev-bound-only programs on other devices
  • nfc: nfcmrvl: validate helper command length before pull
  • nfc: st21nfca: validate received frame size
  • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
  • nfc: llcp: Fix race condition in accept_queue lifecycle
  • nfc: virtual_ncidev: Add missing ioctl compat handler
  • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
  • nfc: st21nfca: validate ISO15693 inventory length
  • nfc: llcp: fix -ENOMEM on connect with zero-length service name
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names
  • nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
  • net/sched: act_gate: budget the per-entry list in get_fill_size
  • veth: manage XDP program pointers during channel resize
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
  • vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
  • bpf: Fix immediate JMP JEQ/JNE on MIPS32
  • bpf: Fix BSWAP 32 and 16 on MIPS64
  • driver core: Add device probe log helper dev_warn_probe()
  • tg3: use random MAC address when tg3_get_device_address fails
  • net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
  • net: bcmgenet: initialize u64 stats seq counter for all queues
  • net: bcmgenet: move bcmgenet_power_up into resume_noirq
  • net: bcmgenet: allow return of power up status
  • net: bcmgenet: do not skip WoL power up on GENET V1
  • net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
  • net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
  • ip_gre: Reject enabling collect metadata through changelink
  • vxlan: use one headroom snapshot for neighbour replies
  • net: xps: reject an out of range traffic class
  • drm/imagination: clamp freelist reconstruction requests
  • bonding: crypto offload enabled, non-offload slave failover, rekey failed
  • net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
  • tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
  • nfp: hold IPsec RX state under the XArray lock
  • net/smc: fix UAF on lgr list traversal in smcr_port_err()
  • tipc: Fix a data race on mon->peer_cnt in mon_timeout()
  • net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
  • bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
  • net/sched: sch_teql: fix shadowed err in __teql_resolve()
  • vlan: ensure sufficient headroom in vlan_dev_hard_header()
  • autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
  • [amd64] perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
  • [amd64] perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
  • [amd64] perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
  • [amd64] perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
  • mptcp: return sk_wait_data() errors from recvmsg()
  • rculist: add list_splice_rcu() for private lists
  • netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (CVE-2026-52988)
  • [amd64] x86/mce: Fix hardware debug register corruption on task migration
  • [amd64] x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
  • virtio_net: copy zerocopy frags in start_xmit without NAPI
  • tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
  • tcp: prevent collapsing skbs across boundary in rtx queue
  • sctp: discard the rest of the packet on a stale-cookie error
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
  • ata: libata-scsi: bound the ATA passthru sense descriptor writes
  • cgroup/pids: Restore pids.events notifications in local mode
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
  • fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
  • writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
  • workqueue: Fix NULL current_pwq deref in flush dependency check
  • writeback: report a Tasks-RCU quiescent state per cgwb drain pass
  • fsl/fman: Fix clk reference leak in read_dts_node()
  • ipe: protect the dm-verity root hash with RCU
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end
  • ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
  • gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
  • gpio: zynq: fix runtime PM leak on request error path
  • llc: reserve device headroom for allocated frames
  • mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
  • rds: ib: Clear the sg list when mapping an MR fails
  • [amd64] drm/i915: fix incorrect RCU teardown order
  • drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
  • drm/amd/display: Bump frame warning limit for clang builds of dml
  • drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
  • drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
  • drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
  • drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
  • drm/nouveau: fix autosuspend cleanup during teardown
  • drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
  • drm/nouveau: fix double-free in nvif_vmm_dtor
  • drm/nouveau: Fix gem reference leak in validate_init()
  • drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
  • drm/nouveau: RCU-free the scheduler-containing nouveau_sched
  • drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
  • drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
  • drm/virtio: fix memory leak of fence event on execbuffer failure
  • drm/virtio: fix NULL pointer dereference on fence allocation failure
  • gpio: tps65219: Fix GPIO input value reads
  • mm/hugetlb: preserve mremap address delta when skipping page tables
  • PCI: of_property: Omit bus properties without a subordinate bus
  • HID: alps: fix use-after-free on input2 registration failure
  • HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
  • HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
  • net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
  • net/mlx5e: advertise MACsec offload only when supported
  • net/sched: reject IDR error pointers when deleting actions
  • net: arp: terminate device name before lookup
  • net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
  • net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
  • net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
  • net: openvswitch: conntrack: remove 'add_helper' dead code
  • net: openvswitch: conntrack: fix helper UAF due to extensions realloc
  • net: atl1c: fix soft lockup on out-of-range tpd_cons read
  • net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
  • net: bridge: mdb: restart port group walk after deletion
  • net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
  • net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
  • netfilter: ip6t_rpfilter: reject routes without inet6_dev
  • netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
  • netfilter: nf_tables: skip expired catchall elements on insert and delete
  • nfc: fix use-after-free in nfc_get_local_general_bytes
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
  • nfc: port100: reject frames whose declared length exceeds the received data
  • scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
  • perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
  • perf/core: Run sched_task() for PMUs with only CPU-wide events
  • pinctrl: single: free the IRQ on domain creation failure
  • pinctrl: sunxi: keep a shadow copy of the data register output latches
  • [s390x] cio: Fix NULL pointer dereference in ccw_device_get_util_str()
  • [s390x] cmf: Fix virtual vs physical address confusion
  • [s390x] vfio-ap: fix KVM GISC and page leak when queue removed from host config
  • KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg
  • KVM: Don't treat reserved xarray entries as having memory attributes
  • [arm64] KVM: arm64: Fix spurious warning for benign stage 2 teardown race
  • [riscv64] KVM: Synchronize hrtimer callback during teardown
  • [riscv64] KVM: Fix HSM hart status error propagation
  • Bluetooth: hci_conn: fix CIS hold ownership on reuse
  • Bluetooth: hci_sock: validate event length before filtering
  • Bluetooth: hci_sock: reject out-of-range OCF values
  • Bluetooth: ISO: balance the parent hold in hci_bind_bis()
  • Bluetooth: L2CAP: validate frame length before control and FCS access
  • Bluetooth: mgmt: fix race in read_unconf_index_list()
  • Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
  • smb: client: fix create context out-of-bounds reads
  • smb: client: clean up failed cached directory opens
  • smb: client: validate POSIX create context length
  • xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
  • xfs: fix attr fork block count checks in xrep_inode_blockcounts
  • xfs: release orphanage dir inode if chown fails
  • xfs: use correct jiffies comparison function in xchk_maybe_relax
  • xfs: check padding field in xfs_ioc_commit_range
  • xfs: don't call xfs_exchange_range_finish for a dry run
  • xfs: check di_forkoff correctly in scrub
  • xfs: fix blockgc group quota scanning when usrquota isn't enforced
  • net: tls: fix silent data drop under pipe back-pressure
  • ring-buffer: Add helper functions for allocations
  • ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (CVE-2026-89503)
  • sched: Rework prev_balance() to avoid stale prev references
  • sched/core: Make core-sched flips wait for in-flight selections (CVE-2026-89520)
  • ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)
  • dmaengine: Add devm_dma_request_chan()
  • i2c: mxs: fix DMA channel leak on probe error
  • lockd: fix swapped arguments in nlmsvc_match_ip() (CVE-2026-93231)
  • [arm64] firmware: qcom_scm: Rename peripheral as pas_id
  • remoteproc: pas: Replace metadata context with PAS context structure
  • remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check
  • power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe()
  • power: supply: ab8500_fg: fix use-after-free on remove (CVE-2026-89797)
  • [riscv64] PCI: starfive: Use regulator APIs to control the 3v3 power supply of PCIe slots
  • [riscv64] PCI: starfive: Fix resource leaks on error paths in host_init()
  • iommu/msm: Use helper function devm_clk_get_prepared()
  • iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
  • iommufd: Pass @pasid through the device attach/replace path
  • iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445)
  • [amd64] platform/x86: ISST: Check for admin capability for write commands
  • [amd64] platform/x86: ISST: Validate max level for set feature
  • mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
  • PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
  • PCI: Allow per function PCI slots to fix slot reset on s390 (CVE-2026-89795)
  • [amd64] platform/x86: think-lmi: Fix current password length check
  • [amd64] platform/x86: think-lmi: improve check if BIOS account security enabled
  • [amd64] platform/x86: think-lmi: Fix certificate thumbprint sysfs output
  • [amd64] platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
  • [amd64] platform/x86: int1092: Fix potential memory leak in sar_probe() (CVE-2026-89437)
  • [amd64] platform/x86/amd/pmc: Move STB block into amd_pmc_s2d_init()
  • [amd64] platform/x86/amd/pmc: Move STB functionality to a new file for better code organization
  • [amd64] platform/x86/amd/pmc: Define enum for S2D/PMC msg_port and add helper function
  • [amd64] platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths
  • [amd64] platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (CVE-2026-81016)
  • io_uring/waitid: have io_waitid_complete() remove wait queue entry
  • io_uring/waitid: avoid siginfo copy during ring teardown
  • power: supply: qcom_battmgr: fix use-after-free (CVE-2026-89467)
  • net/smc: Address spelling errors
  • net/smc: stop killed, freed and out_of_sync sharing a byte (CVE-2026-80980)
  • net/mlx5e: SHAMPO, Always calculate page size
  • net/mlx5e: do not HW-GRO coalesce small frames
  • ALSA: hda/ext: preserve PPLCCTL bits when clearing reset
  • hwrng: drivers - Switch back to struct platform_driver::remove()
  • hwrng: stm32 - Fix runtime PM cleanup on registration failure
  • i3c: master: Do not treat master device as a duplicate target (CVE-2026-93199)
  • wifi: mt76: mt7915: set correct background radar capability
  • wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (CVE-2026-80937)
  • i3c: master: Fix use-after-free of master->this (CVE-2026-93200)
  • udf: Move udf_map_block() up
  • udf: Fix data loss when converting inline inodes to out of line
  • usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior
  • usb: dwc3: clear forceRM when issuing EndTransfer (CVE-2026-90030)
  • wifi: rtw89: cleanup unused rtwdev::roc_work
  • wifi: rtw89: Hide some errors when the device is unplugged
  • wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (CVE-2026-80939)
  • usb: typec: tcpm: fix debug accessory mode detection for sink ports
  • usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
  • wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (CVE-2026-80935)
  • xhci: Cleanup Candence controller PCI device and vendor ID usage
  • usb: cdns3: rename hibernated argument of role->resume() to lost_power
  • usb: cdnsp: fix wakeup from S3 after controller context loss
  • usb: storage: realtek_cr: fix use-after-free on disconnect (CVE-2026-90029)
  • usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() (CVE-2026-90023)
  • staging: rtl8723bs: fix spacing around operators
  • staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() (CVE-2026-90016)
  • staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
  • tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
  • Documentation: tracing: Add documentation about eprobes
  • tracing/probes: Fix BTF kflag check for anonymous struct member access
  • tracing: Clean up use of trace_create_maxlat_file()
  • tracing: Take trace_array reference when opening options file (CVE-2026-90013)
  • ftrace: Take trace_array reference before accessing its ftrace_ops (CVE-2026-90002)
  • dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (CVE-2026-89996)
  • compiler_types: Move lock checking attributes to compiler-context-analysis.h
  • futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
  • rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
  • perf/aux: Allocate non-contiguous AUX pages by default
  • [amd64] perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
  • ring-buffer: Show persistent buffer dropped events in trace_pipe file
  • ring-buffer: Allow splice reads on static buffers
  • nvme: add missing SRCU grace period in error path (CVE-2026-89972)
  • nvme: all namespaces in a subsystem must adhere to a common atomic write size
  • nvme: refactor the atomic write unit detection
  • nvme: fix atomic write size validation
  • nvme: skip the zoned limits update if the zone info query failed (CVE-2026-89971)
  • [s390x] vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956)
  • mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs
  • nvdimm: preserve flush callback -ENOMEM
  • nvdimm: pmem: keep PREFLUSH before data writes (CVE-2026-98161)
  • nvdimm: virtio_pmem: stop allocating child flush bio
  • nvdimm: virtio_pmem: always wake -ENOSPC waiters
  • nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags
  • nvdimm: virtio_pmem: refcount requests for token lifetime (CVE-2026-93196)
  • mtd: rawnand: pl353: Add message about ECC mode
  • mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses
  • clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
  • mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
  • [amd64] KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list
  • [amd64] KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves
  • [amd64] KVM: x86: Extract REGS and SREGS runtime sync code to helpers
  • [amd64] KVM: x86: Rename _{g,s}et_sregs2() => kvm_vcpu_ioctl_x86{g,s}et_sregs2()
  • [amd64] KVM: x86: Move the bulk of register specific code from x86.c to regs.c
  • [amd64] KVM: x86: Check EFER validity on KVM_SET_SREGS*
  • media: i2c: imx355: Replace client->dev usage
  • media: imx355: Avoid calling imx355_power_off twice in error path
  • media: rkvdec: Propagate platform_get_irq() errors
  • [s390x] KVM: s390: Zero initialize data structures for inject_pfault_token (CVE-2026-89921)
  • [amd64] KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (CVE-2026-89859)
  • scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (CVE-2026-97537)
  • scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (CVE-2026-97536)
  • scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path (CVE-2026-97532)
  • scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (CVE-2026-97535)
  • media: chips-media: wave5: Add timeout while stop_streaming (CVE-2026-89868)
  • scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
  • scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
  • scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
  • scsi: qla2xxx: Skip vport under deletion in report ID acquisition (CVE-2026-97531)
  • scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (CVE-2026-97530)
  • scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity
  • scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (CVE-2026-97528)
  • scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (CVE-2026-97527)
  • scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] (CVE-2026-97529)
  • f2fs: validate MOVE_RANGE destination size (CVE-2026-89840)
  • f2fs: convert F2FS_I_SB to sbi in f2fs_setattr()
  • f2fs: don't allow unaligned truncation to smaller/equal size on pinned file
  • f2fs: fix to avoid potential section-unaligned pinfile
  • f2fs: dirty directory inodes on mtime/ctime update
  • f2fs: limit recovery filename logging to stored length (CVE-2026-89838)
  • f2fs: fix dentry folio leak in find_in_level (CVE-2026-89837)
  • f2fs: embed f2fs_gc_kthread in f2fs_sb_info (CVE-2026-93285)
  • f2fs: Convert clear_node_page_dirty() to clear_node_folio_dirty()
  • f2fs: fix to clear dirty flag on folio in error path (CVE-2026-89832)
  • f2fs: accurately adjust free_sections during free_segment_range (CVE-2026-97534)
  • drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path
  • drm/amdgpu: add a helper to calculate ring distance
  • drm/amdgpu: plumb timedout fence through to force completion
  • drm/amdgpu: avoid force-completing uninitialized UVD rings (CVE-2026-89827)
  • drm/nouveau/disp/r535: Add scanline position support + head state support
  • drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
  • drm/sysfb: simpledrm: Improve panel-size validation
  • drm/sysfb: simpledrm: Improve stride validation (CVE-2026-93244)
  • firmware: sysfb: Move bpp-depth calculation into screen_info helper
  • drm/sysfb: simpledrm: Improve framebuffer-size validation
  • drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation (CVE-2026-89806)
  • drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
  • configfs:get_target() - release path as soon as we grab configfs_item reference
  • configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (CVE-2026-97950)
  • tracing: Fix memory corruption from a "STACKTRACE" histogram key (CVE-2026-97934)
  • ipmr: account multicast table and route memory (CVE-2026-97939)
  • sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
  • reboot: fix cad_pid use-after-free race (CVE-2026-97938)
  • configfs: unhash the dentry before dropping the item in rmdir (CVE-2026-97949)
  • tracing: Constify struct event_trigger_ops
  • tracing: Remove get_trigger_ops() and add count_func() from trigger ops
  • tracing: Merge struct event_trigger_ops into struct event_command
  • tracing: Set the trace clock before registering the histogram trigger (CVE-2026-97935)
  • virtio-mmio: Remove virtqueue list from mmio device
  • virtio_mmio: disable IRQ wake before free_irq
  • tools/bootconfig: Cleanup bootconfig footer size calculations
  • tools/bootconfig: Fix integer overflow and truncation in size checks
  • tracing: Take trace_array reference when opening a tracer options file (CVE-2026-97933)
  • tracing: Take the reference before publishing the named histogram trigger (CVE-2026-97919)
  • tracing: Undo the registration when enabling the histogram trigger fails (CVE-2026-97918)
  • EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout
  • EDAC/altera: Use parent device for devres in altr_portb_setup()
  • genetlink: pin family module during policy dump (CVE-2026-97901)
  • drm/bridge: tc358768: Enforce input bus flags via atomic_check
  • io_uring/rw: end write accounting from ->ki_complete (CVE-2026-97619)
  • io_uring/net: don't overconsume buffers when using MSG_TRUNC (CVE-2026-97618)
  • bootconfig: Fix integer overflow in initrd size check (CVE-2026-97906)
  • net: bridge: use option bits for CFM/MRP frame handlers (CVE-2026-97615)
  • drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches (CVE-2026-97620)
  • netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVE-2026-74347)
  • netfilter: cttimeout: prevent UAF during module unload (CVE-2026-97609)
  • net: macb: Replace open-coded implementation with napi_schedule()
  • net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI
  • net: macb: unify device pointer naming convention
  • net: macb: initialize PTP state before registering clock
  • erofs: add sysfs feature entry for xattr prefixes
  • [amd64,arm64] idpf: Fix kernel-doc descriptions to avoid warnings
  • [amd64,arm64] idpf: introduce idpf_q_vec_rsrc struct and move vector resources to it
  • [amd64,arm64] idpf: disable DIM work before freeing q_vectors (CVE-2026-97603)
  • ipv6: make ipv6_pinfo.saddr_cache a boolean
  • ipv6: reorganise struct ipv6_pinfo
  • ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock.
  • ipv6: flowlabel: cap duplicate leases per socket (CVE-2026-97597)
  • landlock: Clarify documentation for the IOCTL access right
  • landlock: Fix use-after-free of the source's parent directory (CVE-2026-97594)
  • netmem: add a couple of page helper wrappers
  • net: page_pool: rename page_pool_alloc_netmem to *_netmems
  • page_pool: disable sync for cpu for dmabuf memory provider
  • bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (CVE-2026-97571)
  • mptcp: pm: drop match in userspace_pm_append_new_local_addr
  • sock: add sock_kmemdup helper
  • mptcp: use sock_kmemdup for address entry
  • mptcp: pm: userspace: fix address ID overflow
  • bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
  • eth: bnxt: store rx buffer size per queue
  • bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
  • bnxt_en: Don't free the live ring's TPA state on queue restart failure (CVE-2026-97574)
  • mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
  • mptcp: pm: use for_each_subflow helper
  • mptcp: pm: rename add_entry structure to add_addr
  • mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 (CVE-2026-97566)
  • tcp: introduce icsk->icsk_keepalive_timer
  • mptcp: do not reschedule the RTX timer for fallback sockets
  • smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl()
  • smb/client: fix security flag calculation when setting security descriptors
  • smb: client: fail DACL rewrite when the new DACL exceeds 64K (CVE-2026-97559)
  • xfs: report healthy filesystem events in scrub stats
  • xfs: fix short ifork reaping computation in xreap_bmapi_binval
  • xfs: strengthen the "is cow staging" helpers in scrub
  • xfs: remove the i_ino field in struct xfs_inode
  • xfs: fix under-reservation of blocks when repairing sf directories (CVE-2026-97549)
  • xfs: fix backwards mergeability logic in refcount scrubber
  • cifs: Fix specification of function pointers
  • 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
  • [arm64] phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context
  • ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
  • ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
  • swiotlb: use the adjusted address for the highmem page lookup
  • net: phy: mediatek: do not report link and per-speed LED rules together
  • btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
  • [arm64] Use load LSE atomics for the non-return per-CPU atomic operations
  • [arm64] percpu: Fix LSE operations on {8,16}-bit types
  • [arm64] i2c: qcom-cci: Stop complaining about DT set clock rate
  • [arm64] i2c: qcom-cci: Remove the unused variable cci_clk_rate
  • [arm64] i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove()
  • scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU
  • Input: hp_sdc - shut down kicker timer on module exit
  • wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
  • hwmon: (pwm-fan) Stop RPM timer before freeing tach data
  • drm/msm/dpu: clear pending peripheral flush state
  • wifi: libipw: reject TKIP frames without a full MIC
  • wifi: mac80211: track MU-MIMO configuration on disabled interfaces
  • wifi: mac80211: refuse to make a monitor active when it has no queue
  • smb: mark the new channel addition log as informational log with cifs_info
  • smb: client: fix use-after-free of iface in cifs_try_adding_channels()
  • drm/amdgpu: Failed to check various return code
  • drm/amdgpu/umsch: remove vpe test from umsch
  • drm/amdgpu: use GFP_NOWAIT for memory allocations
  • drm/amdgpu: fix rmmio iounmap skipped on device removal
  • smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
  • drm: add drm_memory_stats_is_zero
  • drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments
  • smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
  • smb/client: send lease break ACKs thru correct session for multiuser mounts
  • [arm64] boot: Disable trapping of PMZR_EL0 writes to EL2
  • vlan: require the MAC header to be present in __vlan_insert_inner_tag()
  • gpio: cdev: fix kernel stack leak to user-space in error path
  • ipe: fix use-after-free when auditing a newly loaded policy
  • bna: prevent IOC timer rearm during teardown
  • i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
  • drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
  • drm/client: Pass force parameter to client restore
  • drm/client: fix restore of partially initialized client
  • [amd64] drm/i915/mst: add mst sub-struct to struct intel_dp
  • [amd64] drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
  • mm/rmap: allocate anon_vma_chain objects unlocked when possible
  • mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
  • drm/xe/vm: nuke PTs only after unlinking contested VMAs
  • mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
  • mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  • mm/hugetlb: create hstate_is_gigantic_no_runtime helper
  • mm/hugetlb: do not dissolve gigantic pages without runtime support
  • super: make iterate_supers_type() deletion-safe
  • PCI: Fix Resizable BAR restore order
  • PCI: Fix BAR resize for devices on a root bus
  • packet: use ubuf_info completion for TX_RING packets
  • HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
  • HID: alps: unregister DualPoint Stick input device on remove
  • net/sched: act_ct: fix helper UAF due to extensions realloc
  • net/sched: act_ct: avoid modifying shared unconfirmed ct entry
  • net: ipconfig: Remove outdated comment and indent code block
  • net: ipconfig: bound DHCP option construction
  • net: ena: Remove autopolling mode
  • net: ena: fix MMIO read buffer leak on probe failure
  • [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
  • [amd64] perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
  • [amd64] perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
  • [amd64] perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
  • [riscv64] KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
  • [riscv64] KVM: Serialize IMSIC attributes with vCPU migration
  • rose: fix dev_put() leak in rose_loopback_timer()
  • rose: hold loopback neighbour reference across timer callback
  • rose: fix race between loopback timer and module removal
  • rose: clear neighbour pointer after rose_neigh_put() in state machines
  • rose: guard rose_neigh_put() against NULL in timer expiry
  • rose: fix netdev double-hold in rose_rx_call_request()
  • rose: fix notifier unregistered too early in rose_exit()
  • rose: fix netdev double-hold in rose_make_new()
  • rose: drop CALL_REQUEST in loopback timer when device is not running
  • rose: cancel neighbour timers in rose_neigh_put() before freeing
  • nvme: revert the cross-controller atomic write size validation
  • bootconfig: Fix negative seeks on 32-bit with LFS enabled
  • tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
  • mtd: rawnand: pl353: Fix debug prints
  • [amd64] platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails
  • usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
  • bpf: Reject key-less BTF for hash maps
  • mm/hugetlb: keep max_huge_pages when dissolving surplus folios https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.113
  • smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
  • smb: client: fix cifsFileInfo reference leak in deferred close (CVE-2026-97558)
  • [arm64] KVM: arm64: nv: Fix life cycle of the nested_mmus array
  • [arm64] KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
  • smb: client: use finish_no_open() for non-regular inodes
  • xfs: don't let memory failures leak blocks and kill repairs
  • [riscv64] KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()
  • bpf, xdp: move offload check into dev_xdp_install() (CVE-2026-90146)
  • ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
  • Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
  • ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of sof_ipc4_fw_data
  • ASoC: SOF: ipc4/Intel: Add support for library restore firmware functionality
  • smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
  • smb/client: pass cifs_open_info_data to SMB2_open()
  • smb: client: close handle after create-context parsing failure
  • Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
  • Bluetooth: ISO: release unused CIS holds after channel attach
  • smb: client: close completed creates on compound wait errors
  • xfs: fix cursor and pointer handling when recovering iunlink buckets
  • neighbour: Skip default parms when resumed in neightbl_dump_info().
  • ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
  • audit: fix exe mark UAF in kill_rules()
  • HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
  • kprobes: Skip disarmed probes when checking optkprobe overlap
  • of/irq: Fix remaining refcount leaks in of_irq_init()
  • of/overlay: put property on deadprops only after changeset add succeeds
  • of/overlay: only treat a positive changeset id as registered
  • net: fix checksum offsets in skb_splice_from_iter()
  • netfilter: nft_flow_offload: drop flowtable reference on init error path
  • net/packet: prevent TX_RING byte count overflow
  • rtc: ac100: Assign .num before accessing .hws
  • rtc: spear: initialize IRQ state before requesting alarm IRQ
  • sctp: check RCV_SHUTDOWN after the sendmsg connect wait
  • tpm: Disable TPM on null key name mismatch
  • virt: vmgenid: set driver_data before registering notification handlers
  • smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
  • rds_tcp: close NULL deref window in rds_tcp_set_callbacks
  • vt: skip screen update for DEC alignment test on backgroup consoles
  • wifi: wlcore: Fix runtime PM leak in wlcore_remove()
  • ALSA: caiaq: unregister the input device when probe fails
  • ALSA: line6: reject oversized playback packets
  • mm/secretmem: properly account locked pages (CVE-2026-93243)
  • perf/core: Fix WARN in perf_sigtrap()
  • random: vDSO: avoid call to memset() when zeroing reserved parameter
  • mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
  • iio: accel: kionix-kx022a: Fix array boundary check
  • mtd: core: call _get_device() with the master MTD
  • nvmet: preserve device path on allocation failure
  • random: fix vgetrandom_opaque_params kernel-doc
  • of/overlay: don't leak fragment references when changeset init fails
  • of/overlay: don't create "//" paths for fragments targeting the root
  • ASoC: wm8903: Move the DRC QR threshold to the register that holds it
  • wifi: wfx: validate MIB read length before copying to caller
  • ASoC: tegra: Fix ASRC Stream6 input threshold control
  • wifi: ath11k: reset ar->num_stations on hardware start
  • wifi: ath9k: reject short WMI command responses
  • wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
  • rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
  • rtc: Switch back to struct platform_driver::remove()
  • rtc: ac100: Fix clock provider use-after-free on probe failure
  • rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
  • wifi: cfg80211: preserve hidden-group beacon IE ownership
  • wifi: mac80211: Add multicast to unicast support for 802.3 path
  • wifi: mac80211: Add 802.3 multicast encapsulation offload support
  • wifi: mac80211: prevent AP VLAN tx from other interfaces
  • ASoC: codecs: rt286: Revert delay value for jack setup
  • ASoC: codecs: rt274: Fix format setting for 44100 rate
  • Bluetooth: hci_core: free the HCI ID if naming fails
  • Bluetooth: btintel: validate DDC record lengths
  • net/mctp: publish the mctp_dev only after it is initialised
  • net/sched: cls_api: reclaim an empty proto on the error path
  • ipv6: fix prefix route expiry in modify_prefix_route()
  • netfilter: ipset: do not update comments from kernel-side adds
  • Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
  • net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
  • net: systemport: Fix RUNT MIB counter register offset calculation
  • net/mlx5: LAG, Refactor lag logic
  • net/mlx5: Fix slab-out-of-bounds when handling team device events
  • octeontx2-af: mcs: Fix SC resource cleanup loop
  • tipc: prevent GCM nonce reuse on peer key changes
  • memcg: convert memcg->socket_pressure to u64
  • mptcp: Fix up subflow's memcg when CONFIG_SOCK_CGROUP_DATA=n.
  • net: Clean up __sk_mem_raise_allocated().
  • net-memcg: Introduce mem_cgroup_from_sk().
  • net-memcg: Introduce mem_cgroup_sk_enabled().
  • net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
  • net/sched: fq_codel: match the no-drop threshold to the packet size
  • net/sched: sch_codel: match the no-drop threshold to the packet size
  • virtio_blk: set the zone write granularity
  • net: bcmgenet: fix NULL dereference in set_coalesce before first open
  • net: cap skb->queue_mapping when the tx queue is picked
  • net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
  • tcp: refresh TS.Recent for accepted old ACKs
  • ipvs: fix missing counter decrement in lblc
  • ipvs: do not create invisible templates
  • ipvs: filter some flags received in the backup server
  • netfilter: bpf: reject invalid NAT manipulation types
  • netfilter: conntrack: remove skb argument from nf_ct_refresh
  • netfilter: conntrack: rework offload nf_conn timeout extension logic
  • netfilter: flowtable: generalize pending status bit
  • net: microchip: vcap: stop scanning after deleting key field
  • net: sparx5: make ports inherit the switch base mac address type
  • net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
  • ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
  • xdp, xsk: constify read-only arguments of some static inline helpers
  • net: mvneta: clear XDP pfmemalloc flag between frames
  • i2c: at91: release DMA channels when probe defers
  • perf: Fix race between perf_event_exit_task() and perf_pending_task()
  • ALSA: core: Define auto-cleanup for snd_card_free()
  • ALSA: ice1712: Fix the error handling via auto-cleanup at probe
  • PCI: Accept AtomicOps already enabled by the hypervisor
  • drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
  • drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
  • drm/amd/pm/si: Fix updating clock limits on AC/DC
  • drm/amdgpu/gfx6: fix firmware leak on teardown
  • drm/radeon: Read the VRAM VBIOS signature with readb()
  • drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
  • drm/mediatek: Fix ovl adaptor platform device leak
  • drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
  • drm/amdgpu: fix IP instance memory leak on kobject add failure
  • drm/amdgpu: fix ACP MFD device leak on init failure
  • binder: fix is_failure flag for superseded transaction cleanup
  • binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
  • kgdboc: Fix tty driver reference leak in configure_kgdboc()
  • Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
  • Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
  • Input: s6sy761 - fix resume ordering and restore sensing
  • Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
  • Input: synaptics - limit T440p InterTouch quirk to LEN0036
  • nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
  • [arm64] soc: qcom: geni-se: Correct QUP Core ICC vote constants
  • USB: cdc-acm: fix racy TIOCMIWAIT implementation
  • USB: cdc-acm: skip URB restart in port_shutdown if disconnected
  • USB: serial: fix port tear down use-after-free
  • usb: storage: sierra_ms: reject short SWoC info transfers
  • usb: hub: use shorter 120ms post resume hold for SS root hubs
  • usb: octeon-hcd: fix the FIFO-flush timeout computation
  • usb: ohci-da8xx: disable controller wakeup on cleanup
  • usb: ohci-s3c2410: disable controller wakeup on removal
  • usb: ohci-st: disable controller wakeup on removal
  • usb: gadget: midi2: Fix the jack descriptor array sizes
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
  • usb: typec: anx7411 - stop the IRQ before destroying the workqueue
  • usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
  • usb: gadget: aspeed-vhub: cancel wake work on device removal
  • USB: gadget: dummy-hcd: Fix wait for outstanding request completions
  • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
  • usb: chipidea: tegra: disable runtime PM on resume failure
  • usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
  • usb: typec: tcpm: recover after failure to start the frs ams
  • usb: typec: tipd: don't send GAID when probe fails in APP mode
  • usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
  • usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
  • usb: typec: ucsi: Get the connector fwnode based on reg value
  • usb: typec: ucsi: displayport: Current CAM OOB index fixup
  • usb: cdns3: fix use-after-free in cdns3_gadget_exit()
  • usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
  • tty: vt: fix memory leak in vc_allocate()
  • tty: amiserial: fix broken TIOCMIWAIT
  • tty: vcc: zero-initialize control packet in vcc_send_ctl()
  • tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
  • tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
  • tty: abort break signalling on hangup
  • tty: serial: max3100: shut down timer before freeing port
  • serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
  • serial: fix TIOCMIWAIT race
  • serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
  • serial: tegra: don't clear the Tx FIFO on an Rx-only reset
  • serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
  • serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
  • serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
  • ASoC: codecs: max98363: fix uninitialized stream_config->type
  • ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
  • ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
  • ALSA: seq: Serialize compat port-info ioctls
  • ALSA: ua101: reject mismatched capture/playback packet sizes
  • EDAC/altera: Fix memory leak on dci allocation failure
  • i2c: xiic: don't clobber msg->len to signal block-read completion
  • Bluetooth: RFCOMM: Fix initial port reference race
  • Bluetooth: hci_sync: Fix inquiry cache use-after-free
  • Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
  • Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
  • Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
  • Bluetooth: hci_core: Serialize fragmented ISO packet queueing
  • Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
  • Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
  • Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
  • io_uring: fix task_work add use-after-free with SQPOLL
  • ipvs: bound LBLCR and LBLC cache growth
  • HID: multitouch: stop the release timer from being rearmed on remove
  • net: ext2end IPv6 exthdr detection of tunneled packets
  • tpm: fix off-by-four bounds check in tpm2_get_random()
  • nvme-multipath: fix underflow in ANA log bounds checks
  • nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
  • nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
  • mtd: block2mtd: Fix divide error when erase_size is zero
  • mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
  • mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
  • mtd: spinand: fix zero oobavail when no ECC engine is used
  • [amd64] KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
  • [amd64] KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
  • wifi: cw1200: fix TX padding OOB read leaking heap data to device
  • wifi: iwlegacy: 3945: free EEPROM data on remove
  • wifi: mac80211: keep paired old chanctx alive
  • wifi: mac80211: drain PS delivery work during station teardown
  • wifi: mac80211: account proxy paths against the mesh path limit
  • wifi: mac80211: keep fallback association elements alive
  • wifi: mac80211: minstrel_ht: validate fixed rate index
  • wifi: mac80211: reject invalid 320 MHz CSA bandwidth
  • wifi: mac80211: release mesh path quota on failed additions
  • wifi: mac80211: fix mesh fast xmit path deletion UAF
  • wifi: mac80211: handle empty FILS association request payload
  • USB: serial: cp210x: add Corsair AX1500i Power Supply
  • USB: serial: quatech2: fix baud rate overflow
  • USB: serial: ssu100: fix baud rate overflow
  • USB: serial: fix dynamic id driver deregistration race
  • USB: serial: fix driver deregistration order
  • USB: serial: fix ioctl hangup race
  • USB: serial: option: add support for SIMCom SIM8260C
  • USB: serial: option: add Quectel EG060W
  • USB: serial: option: add Compal EXM-G1x support
  • USB: serial: option: add Quectel RG660QB
  • USB: serial: option: add Compal EXC-T1 support
  • [amd64] thunderbolt: Fix KASAN reported use-after-free when request is canceled
  • [amd64] thunderbolt: Disable CL states for the Anker Prime TB5 dock
  • [amd64] thunderbolt: Reject oversized XDomain properties responses
  • smb: client: discard post-EOF pagecache when extending a file via zero range
  • smb: client: discard post-EOF pagecache when extending a file via copy range
  • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
  • iio: accel: kxcjk-1013: reject duplicate event disable
  • iio: accel: sca3000: fix frequency divider condition check
  • iio: adc: pac1934: check ACPI label duplication
  • iio: adc: stm32-adc: fix check on internal channel availability
  • iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
  • iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
  • iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
  • iio: admv1013: initialize callback mutex before registering notifier
  • iio: buffer: serialize buffer teardown with mode claims
  • iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
  • iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
  • iio: gyro: adis16136: fix unprotected debugfs reads
  • iio: health: max30102: fix NULL dereference in interrupt handler
  • iio: imu: adis16400: fix unprotected debugfs reads
  • iio: imu: adis16480: fix unprotected debugfs reads
  • iio: light: gp2ap020a00f: drain irq_work after free_irq
  • iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
  • iio: proximity: aw96103: validate firmware data length
  • iio: proximity: isl29501: Fix return type of isl29501_register_write
  • iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
  • iio: proximity: sx9324: Correct proximity channel resolution
  • iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
  • iio: trigger: cancel reenable_work before freeing trigger
  • ipv6: use RCU in ip6_output() (CVE-2025-40158)
  • jfs: fix array-index-out-of-bounds read in add_missing_indices (CVE-2025-38204)
  • [arm64] KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVE-2026-89912)
  • svcrdma: Use svc_xprt_put to free listener on create failure (CVE-2026-89527)
  • drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (CVE-2026-93179)
  • console: introduce console_lock guard()s
  • tty/vt: use guard()s
  • vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
  • mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
  • mptcp: prevent race between disconnect() and rtx (CVE-2026-97567)
  • pfcp: fix socket lifetime on netdevice registration failure
  • netfs: clear post-EOF pagecache when extending a file via write
  • mm: shmem: remove __shmem_huge_global_enabled()
  • mm: factor out the order calculation into a new helper
  • mm: shmem: change shmem_huge_global_enabled() to return huge order bitmap
  • mm: shmem: ignore sysfs configs for shmem forced collapse
  • [arm64] KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
  • cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB1
  • net: usb: qmi_wwan: add Quectel EG120K-EA
  • xen/netfront: drop RX packets with a short Ethernet header (CVE-2026-98375)
  • fs,fsverity: reject size changes on fsverity files in setattr_prepare
  • fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
  • drm/amd/display: Fix fast updates on DCE 8.1
  • usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
  • tty: fix saved termios reset race
  • perf: Remove unnecessary parameter of security check
  • perf/core: Check kernel access when kernel callchains are requested
  • perf: Require kernel access for text poke events
  • [arm64] fpsimd: signal: Clear PSTATE.SM when restoring FPSIMD frame only
  • [arm64] fpsimd: signal: Mandate SVE payload for streaming-mode state
  • [arm64] fpsimd: signal: Consistently read FPSIMD context
  • [arm64] fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
  • Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
  • Bluetooth: Serialize SMP remote OOB data access
  • [arm64] errata: Factor out broken AMU const counter cap
  • [arm64] errata: Add Cortex-A725 erratum 3821522 workaround
  • [arm64] KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
  • fsverity: add dependency on 64K or smaller pages
  • drm/amdgpu: reset VI ASIC on MacBookPro15,1
  • drm/amdgpu: reset VI ASIC on MacBookPro14,3
  • usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
  • usb: ohci-spear: disable controller wakeup on removal
  • USB: dwc2: shut down wakeup timer before freeing HCD state
  • drm/amd/display: Preserve eDP mode on initial ASSR failure
  • usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
  • tty: introduce tty_port_tty guard()
  • tty: tty_port: use guard()s
  • tty: tty_port: restore TTY_IO_ERROR on activation failure
  • tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
  • perf: Replace perf_event_header__init_id with full header init
  • ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
  • i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode
  • i2c: xiic: preserve PEC byte length in SMBus block read setup
  • drm/amd/display: Mark DCE 6.4 as not APU
  • mtd: spinand: fix NULL pointer dereference with no ECC engine
  • wifi: mac80211: shut down RX BA session timer on teardown
  • mtd: spinand: Enable QE on all dies
  • nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
  • [arm64] KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
  • ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
  • bnxt_en: fix DMA mapping length for padded small packets (Closes: #1149564)
  • tty: port: fix tty_port_tty_vhangup() race
  • wifi: mac80211: count only matching reservations in reserved switch
  • fs: Free any excess xarray nodes in clear_inode()
  • net/mlx5e: Prevent stale XSK buffer release on refill retry
  • net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
  • net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
  • net: mana: Skip WQ object destruction for uninitialized RXQ
  • net: mana: remove double CQ cleanup in mana_create_rxq error path
  • [amd64] KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
  • wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
  • wifi: mac80211: set info->band for 802.3 encap offload frames
  • iio: accel: kx022a: Use cleanup.h helpers
  • iio: accel: kionix-kx022a: Prevent memory leak and fix state
  • iio: adc: ad_sigma_delta: fix use-after-free on unbind
  • iio: adc: aspeed: Simplify with dev_err_probe
  • iio: adc: aspeed: propagate reset deassert errors
  • iio: adc: max1363: sign-extend bipolar differential channel reads
  • iio: adc: axp288: Add TS bias override for Haier HV103H
  • iio: adc: stm32-adc: fix possible division by zero in processed channel
  • smb: client: only require read lease for size-extending preallocate
  • iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
  • iio: cdc: ad7150: fix OF matching and publish module aliases
  • iio: bu27034: simplify using guard(mutex)
  • iio: light: rohm-bu27034: Fix infinite delay on error
  • iio: light: rohm-bu27034: Fix error return
  • tools: ynl-gen: use names of constants in generated limits
  • tools: ynl-gen: support limits using definitions
  • tools: ynl: add scope qualifier for definitions
  • doc/netlink: netlink-raw: Add max check
  • f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
  • f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
  • f2fs: fix to reset all pinned status during fggc
  • mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
  • mm/damon/core: fix unconditionally skip last region
  • Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
  • wifi: ath12k: fix reusing m3 memory
  • crypto: drbg - Fix ineffective sanity check
  • ipv4: validate checksum_start before completing checksum (CVE-2026-99999)
  • ipv4: stop PMTU walk when nexthop group shrinks
  • ipv4: stop exception dump when nexthop group shrinks
  • ipv4: stop route notification sizing when nexthop group shrinks
  • ipv4: do not warn on route notification size race
  • ipv6: do not warn on route notification size race
  • Input: ati_remote2 - fix type confusion in device attribute handlers
  • Input: xpad - add support for Corsair Novablade Pro
  • arm64: irq: exclude the softirq stack switch from KCOV
  • [amd64] ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
  • btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
  • cipso: adjust cached option offsets when removing CIPSO
  • dm ioctl: don't let data_start run past the buffer
  • usb: f81604: fix struct f81604_int_data size mismatch
  • vsock/virtio: account only unread bytes in read_skb()
  • wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
  • wireguard: queueing: preserve tstamp_type when encapsulating packet
  • wireguard: noise: reject response consumption after intermediate initiation
  • workqueue: Fix NULL current_pwq deref in chained work check
  • xen/netfront: don't leak the skb when xennet_fill_frags() fails
  • tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
  • strparser: make sure __strp_recv isn't running before tearing down the parser
  • swiotlb: fix default_swiotlb_limit() for non-growable default pool
  • tcp: reject net_iov in zerocopy receive mapping hints
  • tipc: destroy topsrv workqueues before closing connections
  • tipc: hold a reference to nodes found by link name
  • Revert "wifi: libertas: reject short monitor TX frames"
  • selinux: fix data race on AVC latest_notif
  • selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
  • sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
  • [amd64] EDAC/amd64: Mask UMC chip select to the four implemented selects
  • gpio: xilinx: fix runtime PM leak on request error path
  • ibmveth: h_free logical LAN on open-fail after register
  • ibmveth: fix TX LTB and filter unwind on open-fail
  • ice: fix metadata_dst refcount handling on representor teardown
  • keys: finalize persistent keyring timeout after link attempt
  • KEYS: Fix add_key() race with keyring restriction
  • memstick: core: wait for request completion before freeing card
  • memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
  • dm-crypt: reject the lmk IV mode with AEAD ciphers
  • dm-snap: reject the transient exception store for snapshot-merge
  • dm: fix reading free memory in do_resume
  • mmc: cavium-octeon: destroy slot platform devices on remove
  • mmc: cavium-thunderx: destroy slot platform devices on remove
  • mmc: mtk-sd: Cancel request timeout work on remove
  • mmc: sdhci-sprd: disable runtime PM on remove
  • net/packet: guard the ll header push in packet_rcv_spkt()
  • net/smc: protect clcsock lifetime in smc_getname
  • net: bridge: avoid recursive multicast port cleanup
  • net: dsa: microchip: fix KSZ8765 fiber detection
  • net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
  • net: sparx5: free the matchall entry on destroy
  • net: usb: ax88179_178a: fix rx frame length for non-last packets
  • nvme: fix swapped ZRASF zone state values for full and read only
  • openvswitch: fix soft lockup in the netlink flow dump
  • optee: register TEE devices only once fully initialized
  • regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
  • regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
  • pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
  • pmdomain: rockchip: don't ignore clock lookup errors on attach
  • pmdomain: rockchip: fix clock leak on domain probe failure
  • pmdomain: rockchip: propagate subdomain add errors
  • scsi: qedi: Initialize callback state before registration
  • [riscv64] entry: gate shadow call stack reload on sstatus.SPP, not tp
  • [riscv64] fix load_unaligned_zeropad() fixup for RV32
  • Bluetooth: btintel_pcie: use managed IRQ teardown
  • Bluetooth: hci_sock: Serialize dead-device detachment
  • Bluetooth: ISO: Reject concurrent BIS listener setup
  • Bluetooth: ISO: Serialize concurrent connect calls
  • Bluetooth: MGMT: Fix status of pending commands flushed on power off
  • Bluetooth: RFCOMM: free the skb when the DLC has no owner
  • Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
  • drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
  • drm/gud: don't keep a connector without a CRTC as connector_state
  • [amd64] drm/i915/gem: Prevent overstepping exec array boundary
  • [amd64] drm/i915/gt: Unmask interrupts only when ACTIVE is true
  • drm/imagination: Size page table preallocation by device address
  • drm/vc4: drain the hangcheck timer and works on V3D unbind
  • drm/amdkfd: align SDMA doorbell base for shader doorbell writes
  • drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
  • drm/amdgpu: serialize vblank counter reads against GPU reset
  • drm/amdgpu: make Mac FB workaround generic
  • drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
  • drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
  • namespace: don't copy an unmounted mount tree
  • fs: refuse fspick() on internal superblocks
  • namespace: check a submount for references right before unmounting it
  • dcache: don't put a mountpoint on a dentry that's being removed
  • namespace: don't let a pseudo dentry become the root of a mount
  • namei: don't reveal overmounted entries in refwalk
  • namespace: refuse an automount below a mount that is in no namespace
  • [arm64] dts: lx2160a: fix incorrect pinmux
  • [arm64] dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
  • [arm64] dts: lx2160a: fix the iic5 spi3 pinmux offset and value
  • Bluetooth: btintel_pcie: fix TX descriptor bounds check
  • Bluetooth: btintel_pcie: Add recovery mechanism
  • Bluetooth: btintel_pcie: Add shared HW reset for clean start
  • drm/dp: don't mark the AUX backlight enabled when enabling failed
  • gpio: exar: initialize the ID before registering its cleanup
  • drm/aspeed: Balance the display clock enable on teardown
  • drm/vc4: Free the BO cache size list on teardown
  • net/sched: em_text: reject unterminated algo before autoload
  • amt: send the relay's General Query directly from the receive path
  • cxgb4/ch_ktls: disable softirqs around tid_list erases
  • optee: sync secure world ABI headers
  • [arm64] tee: optee: ffa: support shared memory offsets on large-page kernels
  • nvmet: use the local P2P device on metadata allocation failure
  • [arm64] boot: Don't set PMUv3p9 FGT2 bits without PMUv3
  • btrfs: fix xattr replace when multiple xattrs are packed in the same item
  • wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
  • wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
  • wifi: mt76: mt7915: disable rx napi when removing device
  • wifi: mt76: mt7925: don't put the band auto marker in TGID
  • wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
  • wifi: mt76: mt792x: pick the SAR table layout from the table itself
  • ASoC: adau1372: allow sleepy powerdown GPIOs
  • ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
  • ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
  • cpuset: separate tmpmasks and cpuset allocation logic
  • cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
  • flow_dissector: avoid u16 truncation of skb->len when computing thoff
  • devlink: fix devlink_rel reference leak when notify work is pending
  • net/sched: cls_route: reject change with no routing attribute
  • pfcp: make sure the SEID is linear before reading it
  • bnxt_en: Add bnxt_clear_bars() helper
  • bnxt_en: Fix driver init in kdump kernel
  • flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
  • drm/imagination: Fix reference and vm_bo handling in remap()
  • veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
  • net/mlx5e: Order ICOSQ cc update after CQ doorbell
  • mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
  • ptp: ocp: fix PCIe delay estimation calculation
  • net: openvswitch: validate transport header presence in set_ipv6_addr
  • vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
  • drm/vc4: Make v3d paths unavailable on any generation newer than vc4
  • drm/vc4: Fix binner slot allocation failing on an idle GPU
  • drm/panthor: validate userspace queue count against initialized firmware slot count
  • io_uring/waitid: use io_waitid_remove_wq() consistently
  • io_uring/waitid: fix KCSAN warning on io_waitid->head
  • netfilter: conntrack: fix erronous removal of offload bit
  • netfilter: flowtable: fix offloaded ct timeout never being extended
  • wifi: mt76: mt7603: initialize global station WCID
  • can: fix unique skb identifier regression under RPS
  • drm/amd/display: Don't replace a sink mode that shares the native totals
  • sched_ext: Generate qseq from a per-task counter
  • HID: steam: Fully unregister controller when hidraw is opened
  • HID: steam: Rearrange teardown sequence
  • HID: steam: Refactor registration
  • HID: steam: Clean up locking Checksums-Sha1: d679ca71370b2510c3f120ca452503d8d51a9967 290418 linux_6.12.113-1.dsc 906275a30c7581f5f23681ae935dfa88fb1aa0a1 151589656 linux_6.12.113.orig.tar.xz 5b62a04c2fd924f77eef7c497d8b4b4f7e4c9d73 1954984 linux_6.12.113-1.debian.tar.xz f387a6456c403e8ee95d2ffd983edba06865c59a 5884 linux_6.12.113-1_source.buildinfo Checksums-Sha256: 7785e2db803dc74912f2dd4861eb454404cf3b9a2c2120f0cc3efda1f2337fa6 290418 linux_6.12.113-1.dsc 2efc477744741f5d580a199ee79c251abb01f899759c621d1af0c3d361380821 151589656 linux_6.12.113.orig.tar.xz e2d62aaf6d3771dce7116feea9c419b47d6bbf8cb957153896fbbc276f2a54f9 1954984 linux_6.12.113-1.debian.tar.xz 1e8ac52ec78b76cbe8a732934e81ffaf23f19f32effe82471dbdaa984b99424c 5884 linux_6.12.113-1_source.buildinfo Files: 45df6d3b14bf56238e10cf8f4a980cc2 290418 kernel optional linux_6.12.113-1.dsc 6455c13db94c8767c0d4f17ec98c8c9d 151589656 kernel optional linux_6.12.113.orig.tar.xz 718d6afd37f0fbef1c50a451aa7717ba 1954984 kernel optional linux_6.12.113-1.debian.tar.xz 4c1403f1ea9a45951b51a1b5f35ab69e 5884 kernel optional linux_6.12.113-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrQ68tfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E+vkP/RaBZxxLc7W/4gGaIX9V++T5huA2z6Fu gpguVBeXuG/vudO9z95yEyG/xHpvIWRaQ5CLKvgFDFrb+dwaSZFdO2rFoL8263Z0 1mqk5NrY57E1vctun/Rldf6b/JmSvK73uZNxKveL+KBywz8eRlPqtn0wm2qEI/qf /4OMYfbmKYlGBxbDrvP5qWOOTXbQ5ddktQH9f7wFAijfTi7OjNo01+NwAdRppGPt R1HHeny5u9J533/i+vWbyyjfmkbBJW3YOLwb9gNo31JF1VC/panIb8hN5NOkonf0 Uie7fSHzY+bPcG0cRRNbE+InucIPhwOsD/W07C+tJCQs6pj6z3qQN1zViY60jTlN 0wH80pJAugq+/oidKSFrq8sWdedKlIG3iK45emAnEMFe+XJHAkiU87Uvcr1D4t+d UdAtiUudUpToucVUEBVxoaBbE0LltKUD16xrmp93DC4VSmcQ8xfbLsVBVOLmnjms 8C5fIMVlFsd594xmCgvs53DBFeNr2hziW9AKAvKo/KDezRu7LbVdE+h7ea50BeHa GIiIpGdP5OupkddGWQzY63SqEibBwQMkaFJ7ZNzXYU7EoG+XvFJo0f210Gl0Tm36 3ejysjdbxXcqp1OzxXZtbTBwhzDDigISG0IIDdZZ/cgUQPD/Lgw321n1MH4IDxNB Y56jJh25bz2F =WU5T -----END PGP SIGNATURE-----