* Update to upstream stable Linux 5.10.269 (from 5.10.262). * Bump kernel ABI to 48: ship the ELS kernel as 5.10.0-48-*, distinct from the prior 5.10.0-47. * CVE-2024-40973 - media: mtk-vcodec: potential null pointer deference in SCP {CVE-2024-40973} * CVE-2024-46754 - bpf: Remove tst_run from lwt_seg6local_prog_ops. {CVE-2024-46754} * CVE-2024-50125 - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125} * CVE-2024-58094 - jfs: add check read-only before truncation in jfs_truncate_nolock() {CVE-2024-58094} * CVE-2024-58095 - jfs: add check read-only before txBeginAnon() call {CVE-2024-58095} * CVE-2024-58240 - tls: separate no-async decryption request handling from async {CVE-2024-58240} * CVE-2025-23160 - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization {CVE-2025-23160} * CVE-2025-38524 - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524} * CVE-2025-40054 - f2fs: fix UAF issue in f2fs_merge_page_bio() {CVE-2025-40054} * CVE-2025-40102 - KVM: arm64: Prevent access to vCPU events before init {CVE-2025-40102} * CVE-2025-68794 - iomap: adjust read range correctly for non-block-aligned positions {CVE-2025-68794} * CVE-2026-31408 - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} * CVE-2026-31650 - mmc: vub300: fix use-after-free on disconnect {CVE-2026-31650} * CVE-2026-43491 - net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491} * CVE-2026-45839 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() {CVE-2026-45839} * CVE-2026-46003 - net: qrtr: ns: Raise node count limit to 512 {CVE-2026-46003} * CVE-2026-46026 - net: qrtr: ns: Raise lookup limit to 128 {CVE-2026-46026} * CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} * CVE-2026-53090 - bpf: Fix ld_{abs,ind} failure path analysis in subprogs {CVE-2026-53090} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-64048 - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot {CVE-2026-64048} * CVE-2026-64192 - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized {CVE-2026-64192} * CVE-2026-64269 - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg {CVE-2026-64269} * CVE-2026-64270 - Input: mms114 - reject an oversized device packet size {CVE-2026-64270} * CVE-2026-64280 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280} * CVE-2026-64336 - USB: serial: keyspan_pda: fix information leak {CVE-2026-64336} * CVE-2026-64371 - proc: Fix broken error paths for namespace links {CVE-2026-64371} * CVE-2026-64427 - HID: logitech-dj: Fix maxfield check in DJ short report validation {CVE-2026-64427} * CVE-2026-64434 - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref {CVE-2026-64434} - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev {CVE-2026-64434} * CVE-2026-64535 - nvmet-tcp: Fix potential UAF when ddgst mismatch {CVE-2026-64535} * CVE-2026-64543 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} * CVE-2026-64562 - KVM: nVMX: Hide shadow VMCS right after VMCLEAR {CVE-2026-64562} * CVE-2026-64563 - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} * CVE-2026-64565 - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() {CVE-2026-64565} - Input: ims-pcu - fix logic error in packet reset {CVE-2026-64565} * CVE-2026-64567 - btrfs: reject free space cache with more entries than pages {CVE-2026-64567} * CVE-2026-64569 - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n {CVE-2026-64569} * CVE-2026-64571 - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() {CVE-2026-64571} * CVE-2026-64572 - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} * CVE-2026-64579 - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} * CVE-2026-64581 - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() {CVE-2026-64581} * CVE-2026-64582 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} * CVE-2026-64583 - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583} * CVE-2026-64584 - usb: gadget: f_midi: cancel pending IN work before freeing the midi object {CVE-2026-64584} * CVE-2026-64586 - wifi: brcmfmac: drain bus_reset work on device removal {CVE-2026-64586} * CVE-2026-64590 - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning {CVE-2026-64590} - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() {CVE-2026-64590} * CVE-2026-68082 - libceph: fix two unsafe bare decodes in decode_lockers() {CVE-2026-68082} * CVE-2026-68096 - audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096} * CVE-2026-68104 - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd {CVE-2026-68104} * CVE-2026-68106 - drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106} * CVE-2026-68111 - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111} * CVE-2026-68115 - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115} * CVE-2026-68117 - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() {CVE-2026-68117} * CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} * CVE-2026-68123 - openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123} * CVE-2026-68125 - mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125} * CVE-2026-68127 - ila: reload IPv6 header after pskb_may_pull in checksum adjust {CVE-2026-68127} * CVE-2026-68131 - rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131} * CVE-2026-68132 - super: fix emergency thaw deadlock on frozen block devices {CVE-2026-68132} * CVE-2026-68135 - net: hip04: fix RX buffer leak on build_skb failure {CVE-2026-68135} * CVE-2026-68136 - net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136} * CVE-2026-68137 - net/x25: fix use-after-free in x25_kill_by_neigh() {CVE-2026-68137} * CVE-2026-68138 - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138} * CVE-2026-68140 - net/iucv: fix use-after-free of a severed iucv_path {CVE-2026-68140} * CVE-2026-68141 - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() {CVE-2026-68141} * CVE-2026-68142 - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} * CVE-2026-68143 - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} * CVE-2026-68144 - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} * CVE-2026-68146 - ftrace: Add global mutex to serialize trace_parser access {CVE-2026-68146} * CVE-2026-68151 - binfmt_elf_fdpic: only honour the first PT_INTERP {CVE-2026-68151} * CVE-2026-68153 - libceph: remove debugfs files before client teardown {CVE-2026-68153} * CVE-2026-68154 - libceph: reject zero bucket types in crush_decode {CVE-2026-68154} * CVE-2026-68156 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} * CVE-2026-68157 - libceph: guard missing CRUSH type name lookup {CVE-2026-68157} * CVE-2026-68158 - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} * CVE-2026-68159 - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159} * CVE-2026-68160 - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} * CVE-2026-68162 - sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162} * CVE-2026-68175 - tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175} * CVE-2026-68176 - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} * CVE-2026-68180 - intel_th: fix MSC output device reference leak {CVE-2026-68180} * CVE-2026-68182 - comedi: comedi_parport: deal with premature interrupt {CVE-2026-68182} * CVE-2026-68183 - firmware: stratix10-svc: fix memory leaks and list corruption bugs {CVE-2026-68183} * CVE-2026-68184 - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184} * CVE-2026-68186 - binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186} * CVE-2026-68187 - exec: fix unsigned loop counter wrap in transfer_args_to_stack() {CVE-2026-68187} * CVE-2026-68188 - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} * CVE-2026-68192 - wifi: brcmfmac: make release_scratchbuffers idempotent {CVE-2026-68192} * CVE-2026-68195 - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses {CVE-2026-68195} * CVE-2026-68196 - wifi: wilc1000: validate assoc response length before subtracting header {CVE-2026-68196} * CVE-2026-68197 - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197} * CVE-2026-68198 - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198} * CVE-2026-68199 - wifi: ath6kl: fix OOB access from firmware ADDBA window size {CVE-2026-68199} * CVE-2026-68202 - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} * CVE-2026-68204 - media: vivid: check for vb2_is_busy() when toggling caps {CVE-2026-68204} * CVE-2026-68205 - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() {CVE-2026-68205} * CVE-2026-68209 - media: sun4i-csi: Return queued buffers on start_streaming() failure {CVE-2026-68209} * CVE-2026-68212 - media: saa7134: Fix a possible memory leak in saa7134_video_init1 {CVE-2026-68212} * CVE-2026-68213 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure {CVE-2026-68213} * CVE-2026-68214 - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} * CVE-2026-68215 - media: radio-si476x: Unregister v4l2_device on probe failure {CVE-2026-68215} * CVE-2026-68216 - media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216} * CVE-2026-68217 - media: pwc: Drain fill_buf on start_streaming() failure {CVE-2026-68217} * CVE-2026-68218 - media: pci: dm1105: Free allocated workqueue {CVE-2026-68218} * CVE-2026-68222 - media: msi2500: Return queued buffers on start_streaming() failure {CVE-2026-68222} * CVE-2026-68223 - media: meson: vdec: Fix memory leak in error path of vdec_open {CVE-2026-68223} * CVE-2026-68226 - media: cx23885: add ioremap return check and cleanup {CVE-2026-68226} * CVE-2026-68227 - media: cx231xx: fix devres lifetime {CVE-2026-68227} * CVE-2026-68229 - media: cedrus: skip invalid H.264 reference list entries {CVE-2026-68229} * CVE-2026-68231 - media: airspy: Return queued buffers on start_streaming() failure {CVE-2026-68231} * CVE-2026-68234 - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234} * CVE-2026-68249 - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() {CVE-2026-68249} * CVE-2026-68250 - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() {CVE-2026-68250} * CVE-2026-68255 - drm/virtio: bound EDID block reads to the response buffer {CVE-2026-68255} * CVE-2026-68277 - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers {CVE-2026-68277} * CVE-2026-68278 - drm/dp/mst: fix buffer overflows in sideband chunk accumulation {CVE-2026-68278} * CVE-2026-68279 - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers {CVE-2026-68279} * CVE-2026-68284 - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() {CVE-2026-68284} * CVE-2026-68294 - net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294} * CVE-2026-68297 - tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297} * CVE-2026-68299 - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299} * CVE-2026-68300 - sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300} * CVE-2026-68304 - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304} * CVE-2026-68313 - tipc: fix infinite loop in __tipc_nl_compat_dumpit {CVE-2026-68313} * CVE-2026-68315 - sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315} * CVE-2026-68320 - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} * CVE-2026-68322 - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled {CVE-2026-68322} * CVE-2026-68325 - iommu/amd: Bound the early ACPI HID map {CVE-2026-68325} * CVE-2026-68326 - wifi: mwifiex: bound uAP association event IEs to the event buffer {CVE-2026-68326} * CVE-2026-68327 - wan: wanxl: Only reset hardware after BAR mapping {CVE-2026-68327} * CVE-2026-68328 - nfp: Check resource mutex allocation {CVE-2026-68328} * CVE-2026-68335 - rds: drop incoming messages that cross network namespace boundaries {CVE-2026-68335} * CVE-2026-68338 - net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338} * CVE-2026-68344 - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect {CVE-2026-68344} * CVE-2026-68349 - wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349} * CVE-2026-68350 - wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350} * CVE-2026-68351 - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351} * CVE-2026-68352 - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event {CVE-2026-68352} * CVE-2026-68353 - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler {CVE-2026-68353} * CVE-2026-68354 - firewire: net: Fix fragmented datagram reassembly {CVE-2026-68354} * CVE-2026-68355 - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() {CVE-2026-68355} * CVE-2026-68357 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() {CVE-2026-68357} * CVE-2026-68360 - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop {CVE-2026-68360} * CVE-2026-68363 - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} * CVE-2026-68365 - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} * CVE-2026-68366 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer {CVE-2026-68366} * CVE-2026-68367 - usb: gadget: f_tcm: synchronize delayed set_alt with teardown {CVE-2026-68367} * CVE-2026-68368 - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() {CVE-2026-68368} * CVE-2026-68369 - usb: gadget: printer: fix infinite loop in printer_read() {CVE-2026-68369} * CVE-2026-68370 - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback {CVE-2026-68370} * CVE-2026-68373 - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} * CVE-2026-68376 - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} * CVE-2026-68377 - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} * CVE-2026-68388 - smb/client: handle overlapping allocated ranges in fallocate {CVE-2026-68388} * CVE-2026-68395 - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered {CVE-2026-68395} * CVE-2026-68397 - net/iucv: take a reference on the socket found in afiucv_hs_rcv() {CVE-2026-68397} * CVE-2026-68402 - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} * CVE-2026-68403 - wifi: brcmfmac: initialize SDIO data work before cleanup {CVE-2026-68403} * CVE-2026-68405 - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock {CVE-2026-68405} * CVE-2026-68406 - wifi: cfg80211: validate PMSR FTM preamble range {CVE-2026-68406} * CVE-2026-68410 - wifi: libertas: fix memory leak in helper_firmware_cb() {CVE-2026-68410} * CVE-2026-68411 - wifi: mac80211_hwsim: clamp virtio RX length before skb_put {CVE-2026-68411} * CVE-2026-68413 - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413} * CVE-2026-68425 - IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425} * CVE-2026-68428 - KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428} * CVE-2026-68430 - drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430} * CVE-2026-68432 - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} * CVE-2026-68433 - libceph: bound get_version reply decode to front len {CVE-2026-68433} * CVE-2026-68434 - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms {CVE-2026-68434} * CVE-2026-68446 - drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446} * CVE-2026-68449 - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning {CVE-2026-68449} * CVE-2026-68451 - s390/zcrypt: Validate length for CCA ECC private key requests {CVE-2026-68451} * CVE-2026-68452 - s390/zcrypt: Validate length for CCA AES cipher key requests {CVE-2026-68452} * CVE-2026-68476 - ipvs: reload ip header after head reallocation {CVE-2026-68476} * CVE-2026-68480 - x86/bugs: Make Safe-RET robust against interrupt injection {CVE-2026-68480} * CVE-2026-72015 - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list {CVE-2026-72015} * CVE-2026-72019 - macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019} * CVE-2026-72023 - octeontx2-pf: fix SQB pointer leak on init failure {CVE-2026-72023} * CVE-2026-72035 - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72035} * CVE-2026-72041 - espintcp: use sk_msg_free_partial to fix partial send {CVE-2026-72041} * CVE-2026-72051 - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051} * CVE-2026-72053 - net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053} * CVE-2026-72063 - gpio: tegra: do not call pinctrl for GPIO direction {CVE-2026-72063} * CVE-2026-72066 - cpu: hotplug: Bound hotplug states sysfs output {CVE-2026-72066} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-72073 - mmc: vub300: fix use-after-free on probe failure {CVE-2026-72073} * CVE-2026-72075 - Input: ims-pcu - fix race condition in reset_device sysfs callback {CVE-2026-72075} * CVE-2026-72077 - Input: ims-pcu - fix firmware leak in async update {CVE-2026-72077} * CVE-2026-72084 - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} * CVE-2026-72087 - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() {CVE-2026-72087} * CVE-2026-72096 - dm-verity: make error counter atomic {CVE-2026-72096} * CVE-2026-72099 - dm-integrity: don't increment hash_offset twice {CVE-2026-72099} * CVE-2026-72113 - can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113} * CVE-2026-72114 - can: bcm: validate frame length in bcm_rx_setup() for RTR replies {CVE-2026-72114} * CVE-2026-72115 - can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115} * CVE-2026-72116 - can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116} * CVE-2026-72117 - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117} * CVE-2026-72118 - can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118} * CVE-2026-72119 - can: bcm: extend bcm_tx_lock usage for data and timer updates {CVE-2026-72119} * CVE-2026-72121 - can: bcm: add locking when updating filter and timer values {CVE-2026-72121} * CVE-2026-72123 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF {CVE-2026-72123} * CVE-2026-72124 - can: isotp: serialize TX state transitions under so->rx_lock {CVE-2026-72124} - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering {CVE-2026-72124} * CVE-2026-72125 - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125} * CVE-2026-72142 - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) {CVE-2026-72142} * CVE-2026-72148 - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK {CVE-2026-72148} * CVE-2026-72152 - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() {CVE-2026-72152} * CVE-2026-72155 - mtd: spi-nor: swp: Improve locking user experience {CVE-2026-72155} * CVE-2026-72157 - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} * CVE-2026-72166 - net/9p: fix infinite loop in p9_client_rpc on fatal signal {CVE-2026-72166} * CVE-2026-72168 - mtd: maps: vmu-flash: fix fault in unaligned fixup {CVE-2026-72168} * CVE-2026-72170 - 9p: skip nlink update in cacheless mode to fix WARN_ON {CVE-2026-72170} * CVE-2026-72181 - mips: sched: Fix CPUMASK_OFFSTACK memory corruption {CVE-2026-72181} * CVE-2026-72225 - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() {CVE-2026-72225} * CVE-2026-72242 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() {CVE-2026-72242} * CVE-2026-72253 - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it {CVE-2026-72253} * CVE-2026-72299 - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} * CVE-2026-72308 - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308} * CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} * CVE-2026-72392 - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump {CVE-2026-72392} * CVE-2026-74436 - rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436} * CVE-2026-74443 - drm/vmwgfx: bound DMA command body size against suffix pointer {CVE-2026-74443} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2026-74453 - drm/vc4: Zero the tile state data array before each BIN job {CVE-2026-74453} * CVE-2026-74455 - can: peak_usb: validate uCAN receive record lengths {CVE-2026-74455} * CVE-2026-74456 - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456} * CVE-2026-74457 - can: peak_usb: add bounds check for USB channel index {CVE-2026-74457} * CVE-2026-74458 - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents {CVE-2026-74458} * CVE-2026-74463 - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock {CVE-2026-74463} * CVE-2026-74464 - net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464} * CVE-2026-74465 - net: openvswitch: fix potential UAF on meter attach failure {CVE-2026-74465} * CVE-2026-74468 - gpio: pch: use raw_spinlock_t for the register lock {CVE-2026-74468} * CVE-2026-74469 - sctp: prevent peer transport count overflow {CVE-2026-74469} * CVE-2026-74470 - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470} * CVE-2026-74471 - tracing: Check return value of __register_event() in trace_module_add_events() {CVE-2026-74471} * CVE-2026-74473 - vxlan: use pskb_network_may_pull() in route_shortcircuit() {CVE-2026-74473} * CVE-2026-74475 - vxlan: use neigh_ha_snapshot() in route_shortcircuit() {CVE-2026-74475} * CVE-2026-74478 - um: vector: fix use-after-free in vector_mmsg_rx() {CVE-2026-74478} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-74480 - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} * CVE-2026-74481 - mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481} * CVE-2026-74482 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios {CVE-2026-74482} * CVE-2026-74485 - binfmt_misc: reject a flag character as the field delimiter {CVE-2026-74485} * CVE-2026-74486 - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone {CVE-2026-74486} * CVE-2026-74487 - binfmt_misc: restore write access when removing an entry {CVE-2026-74487} * CVE-2026-74488 - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames {CVE-2026-74488} * CVE-2026-74490 - tipc: avoid use-after-free in poll trace queue dumps {CVE-2026-74490} * CVE-2026-74492 - netfilter: ipset: do not update comments from kernel-side hash adds {CVE-2026-74492} * CVE-2026-74493 - net/smc: fix socket use-after-free during link group termination {CVE-2026-74493} * CVE-2026-74495 - igbvf: Fix leak in TX DMA error cleanup {CVE-2026-74495} * CVE-2026-74497 - ALSA: usb-audio: Clamp frame size in implicit-feedback mode {CVE-2026-74497} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-74507 - Bluetooth: HIDP: validate numbered report payloads {CVE-2026-74507} * CVE-2026-74508 - Bluetooth: HIDP: reject frames without a transaction header {CVE-2026-74508} * CVE-2026-74512 - audit: fix potential use-after-free in audit_del_rule() {CVE-2026-74512} * CVE-2026-74518 - mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518} * CVE-2026-74519 - pinctrl: devicetree: don't free uninitialized dev_name on error path {CVE-2026-74519} * CVE-2026-74523 - qede: sync udp_tunnel ports outside qede_lock in the recovery path {CVE-2026-74523} * CVE-2026-74525 - net: sxgbe: free TX rings on RX allocation failure {CVE-2026-74525} * CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} * CVE-2026-74547 - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread {CVE-2026-74547} * CVE-2026-74548 - forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548} * CVE-2026-74549 - hwmon: (nct6775-core) Prevent access to unsupported weight registers {CVE-2026-74549} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-74557 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer {CVE-2026-74557} * CVE-2026-74563 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() {CVE-2026-74563} * CVE-2026-74564 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH {CVE-2026-74564} * CVE-2026-74566 - keys: make keyring key-chunk byte order agree with keyring_diff_objects() {CVE-2026-74566} * CVE-2026-74567 - keys: fix out-of-bounds read in keyring_get_key_chunk() {CVE-2026-74567} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-74575 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} * CVE-2026-74577 - net: mpls: initialize rtm_tos in mpls_getroute() {CVE-2026-74577} * CVE-2026-74579 - netfilter: nft_payload: fix mask build for partial field offload {CVE-2026-74579} * CVE-2026-74580 - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} * CVE-2026-74581 - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} * CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} * CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} * CVE-2026-74585 - thunderbolt: Bound the DROM dual link port number before indexing sw->ports {CVE-2026-74585} * CVE-2026-74586 - sctp: clear new_transport when removing a peer {CVE-2026-74586} * CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} * CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} * CVE-2026-74589 - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} * CVE-2026-74594 - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() {CVE-2026-74594} * CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} * CVE-2026-74598 - ipv6: fix Route Information option length validation {CVE-2026-74598} * CVE-2026-74599 - mm/ptdump: always stabilise against page table freeing using init_mm {CVE-2026-74599} * CVE-2026-74601 - ring-buffer: Use current_context for safe per-CPU buffer swap {CVE-2026-74601} * CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} * CVE-2026-74613 - vsock/virtio: avoid refilling the RX queue after teardown {CVE-2026-74613} * CVE-2026-74615 - vxlan: do not arm the ageing timer on a device that is down {CVE-2026-74615} * CVE-2026-74620 - net/sched: act_gact, act_police: range check the fallback control action {CVE-2026-74620} * CVE-2026-74622 - net: atlantic: free RX pages of consumed but not refilled buffers {CVE-2026-74622} * CVE-2026-74623 - net: atlantic: free stranded TX buffers on ring deinit {CVE-2026-74623} * CVE-2026-74625 - netfilter: bridge: release template ct on non-IP path {CVE-2026-74625} * CVE-2026-74626 - NTB: ntb_netdev: Preserve RX queue depth on allocation failure {CVE-2026-74626} * CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628} * CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} * CVE-2026-74631 - net: smc: fix splice entry lifetime imbalance in smc_rx_splice {CVE-2026-74631} * CVE-2026-74632 - mm/huge_memory: fix huge_zero_pfn race {CVE-2026-74632} * CVE-2026-74635 - fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635} * CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} * CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} * CVE-2026-74647 - misc: fastrpc: Remove buffer from list prior to unmap operation {CVE-2026-74647} * CVE-2026-74648 - staging: rtl8723bs: validate monitor transmit frame lengths {CVE-2026-74648} * CVE-2026-74650 - staging: rtl8723bs: fix OOB read in WMM_param_handler() {CVE-2026-74650} * CVE-2026-74651 - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651} * CVE-2026-74654 - serial: 8250_dma: Clear stale RX state on shutdown {CVE-2026-74654} * CVE-2026-74656 - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} * CVE-2026-74657 - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops {CVE-2026-74657} * CVE-2026-74658 - futex: Prevent robust futex exit race some more {CVE-2026-74658} * CVE-2026-74660 - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} * CVE-2026-74662 - inet: frags: publish queues before arming timer {CVE-2026-74662} * CVE-2026-74663 - net/sched: reject overly deep qdisc hierarchies {CVE-2026-74663} * CVE-2026-74664 - net: openvswitch: reallocate update replies for mismatched IDs {CVE-2026-74664} * CVE-2026-74666 - packet: synchronize pressure clearing with ring reconfiguration {CVE-2026-74666} * CVE-2026-74667 - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} * CVE-2026-74668 - packet: use consistent hard_header_len in TX_RING send path {CVE-2026-74668} * CVE-2026-74669 - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} * CVE-2026-74671 - ima: fix out-of-bounds read in xattr_verify() {CVE-2026-74671} * CVE-2026-74673 - Input: evdev - fix information leak in evdev_pass_values() {CVE-2026-74673} * CVE-2026-74675 - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get {CVE-2026-74675} * CVE-2026-74676 - vt: add permission check for KDSKBMETA ioctl {CVE-2026-74676} * CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679} * CVE-2026-74680 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() {CVE-2026-74680} * CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} * CVE-2026-74683 - Input: evdev - sanitize event type index when fetching event masks {CVE-2026-74683} * CVE-2026-74688 - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} * CVE-2026-74693 - net: prestera: validate firmware header length {CVE-2026-74693} * CVE-2026-74694 - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length {CVE-2026-74694} * CVE-2026-74697 - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption {CVE-2026-74697} * CVE-2026-74701 - net/openvswitch: check Ethernet header length in key_extract() {CVE-2026-74701} * CVE-2026-74704 - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704} * CVE-2026-74705 - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} * CVE-2026-74717 - net/mlx5: fw_tracer, return NULL on create error {CVE-2026-74717} * CVE-2026-74719 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() {CVE-2026-74719} * CVE-2026-74720 - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} * CVE-2026-74726 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor {CVE-2026-74726} * CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} * CVE-2026-74737 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG {CVE-2026-74737} * CVE-2026-74746 - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} * CVE-2026-74748 - netfilter: ipset: fix refcount race between list:set GC and swap {CVE-2026-74748} * CVE-2026-80527 - ceph: fix hanging __ceph_get_caps() with stale mds_wanted {CVE-2026-80527} * CVE-2026-80528 - ceph: avoid fs reclaim while using current->journal_info {CVE-2026-80528} * CVE-2026-80534 - xfs: fix ilock leak on error in xfs_dq_get_next_id {CVE-2026-80534} * CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} * CVE-2026-80540 - drm/amdgpu: Fix UVD decode image min size calculation {CVE-2026-80540} * CVE-2026-80541 - drm/amdgpu: validate GEM_CREATE domain combinations {CVE-2026-80541} * CVE-2026-80550 - s390/vfio_ccw: Fix out of bounds check on CCW array {CVE-2026-80550} * CVE-2026-80553 - s390/vfio_ccw: Cancel existing workqueues {CVE-2026-80553} * CVE-2026-80555 - s390/vfio_ccw: Free all memory if cp_init() fails {CVE-2026-80555} * CVE-2026-80557 - libceph: fix OOB read in decode_watchers() via missing bounds check {CVE-2026-80557} * CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} * CVE-2026-80559 - Input: sur40 - fix input device registration ordering {CVE-2026-80559} * CVE-2026-80560 - openrisc: signal: do not restore privileged SR bits on sigreturn {CVE-2026-80560} * CVE-2026-80561 - libceph: fix multiple unsafe decodes in decode_locker() {CVE-2026-80561} * CVE-2026-80562 - gpio: ml-ioh: use raw_spinlock_t for the register lock {CVE-2026-80562} * CVE-2026-80565 - crypto: qce - fix error path in devm_qce_register_algs {CVE-2026-80565} * CVE-2026-80567 - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue {CVE-2026-80567} * CVE-2026-80568 - Input: synaptics-rmi4 - block s_input when F54 queue is busy {CVE-2026-80568} * CVE-2026-80569 - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer {CVE-2026-80569} * CVE-2026-80570 - Input: synaptics-rmi4 - zero report size on F54 work error {CVE-2026-80570} * CVE-2026-80573 - Input: iforce - validate input packet lengths {CVE-2026-80573} * CVE-2026-80574 - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet {CVE-2026-80574} * CVE-2026-80584 - s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584} * CVE-2026-80586 - mptcp: options: reset DSS fields in case of unexpected size {CVE-2026-80586} * CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} * CVE-2026-80679 - s390/dasd: Fix potential NULL pointer dereference {CVE-2026-80679} * CVE-2026-80680 - i2c: amd-mp2: Unregister callback on adapter add failure {CVE-2026-80680} * CVE-2026-80681 - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} * CVE-2026-80706 - can: softing: fw_parse(): validate firmware record spans {CVE-2026-80706} * CVE-2026-80707 - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer {CVE-2026-80707} * CVE-2026-80708 - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() {CVE-2026-80708} * CVE-2026-80714 - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} * CVE-2026-80716 - ALSA: pcm: wake linked drain waiters on unlink {CVE-2026-80716} * CVE-2026-80717 - sctp: validate Adaptation Indication parameter length {CVE-2026-80717} * CVE-2026-80718 - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() {CVE-2026-80718} * CVE-2026-80731 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731} * CVE-2026-80732 - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732} * CVE-2026-80733 - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733} * CVE-2026-80737 - serial: amba-pl011: synchronize DMA teardown {CVE-2026-80737} * CVE-2026-80742 - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} * CVE-2026-80743 - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers {CVE-2026-80743} * CVE-2026-80744 - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path {CVE-2026-80744} * CVE-2026-80752 - Input: psxpad-spi - set driver data before use {CVE-2026-80752} * CVE-2026-80754 - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo {CVE-2026-80754} * CVE-2026-80756 - selinux: do not cancel a policy conversion that never started {CVE-2026-80756} * CVE-2026-80757 - selinux: reject a class permission count below its inherited common {CVE-2026-80757} * Miscellaneous upstream changes - debian: build a version-unique source package (source format 1.0) - Linux 5.10.263 - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - Linux 5.10.264 - KVM: VMX: Make vmread_error_trampoline() uncallable from C code - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - btrfs: remove crc_check logic from free space - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - mac80211_hwsim: add 6GHz channels - wifi: cfg80211: validate PMSR measurement type data - wifi: cfg80211: reject unsupported PMSR FTM location requests - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: remove variable num_processed - drm/i915/gt: use correct selftest config symbol - can: j1939: fix lockless local-destination check - drm/i915/selftests: Fix GT PM sort comparators - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: gadget: snps-udc: fix device name leak on probe failure - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: option: add TDTECH MT5710-CN - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - wifi: mac80211: recalculate TIM when a station enters power save - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - net: bridge: vlan: add support for global options - net: bridge: vlan: add support for dumping global vlan options - net: bridge: vlan: fix vlan range dumps starting with pvid - net: stmmac: reset residual action in L3L4 filters on delete - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - hinic: remove unused ethtool RSS user configuration buffers - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - raw: use more conventional iterators - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/radeon: fix r100_copy_blit for large BOs - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - iommu/vt-d: Disallow SVA if page walk is not coherent - raw: remove unused variables from raw6_icmp_error() - raw: fix a typo in raw_icmp_error() - net: bridge: vlan: fix global vlan option range dumping - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets - media: uvcvideo: Fix sequence number when no EOF - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - assoc_array: trim the final shortcut word using the current chunk end - smb: client: fix buffer leaks in SMB1 read and write - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Create functions for updating readings and limits - hwmon: (adt7470) Fix some style issues - hwmon: (adt7470) Convert to use regmap - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - powerpc/boot: Fix simpleboot CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix treeboot-akebono CPU node lookup check - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - net: phylink: put link_gpio if phylink_create fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - net: sxgbe: check descriptor ring allocation failures - can: isotp: check register_netdevice_notifier() error in module init - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - pinctrl: bm1880: add missing select GENERIC_PINCONF - audit: fix potential integer overflow in audit_log_n_string() - bpf: lwt: Fix dst reference leak on reroute failure - ALSA: lx6464es: fix period byte count for 16-bit streams - ASoC: tas2562: fix DVC coefficient write order - ASoC: tas2562: fix broken entries in the volume lookup table - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - e1000: fix memory leak in e1000_probe() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - tracing/filters: Fix false positive match in regex_match_full() - selftests/clone3: fix wild pointer access of getline due to missing init - sctp: reject stale cookies with mismatched verification tags - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - drm/amdgpu: cap GTT size to physical RAM on APUs - net: openvswitch: fix skb leak on flow key update failure during recirculation - mount: honour SB_NOUSER in the new mount API - nfs4: take a reference on the nfs_client when running FREE_STATEID - ARM: npcm: Fix OF node refcount leaks in SMP setup - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/mlx5: Remove second FW tracer check - counter: microchip-tcb-capture: Fix DT channel validation - net: openvswitch: Fix kerneldoc warnings - net: openvswitch: fix kernel-doc warnings in flow.c - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - net: marvell: prestera: try to load previous fw version - sctp: remove the unessessary hold for idev in sctp_v6_err - sctp: extract sctp_v6_err_handle function from sctp_v6_err - sctp: extract sctp_v4_err_handle function from sctp_v4_err - tls: don't abort the connection on signal-interrupted sends - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - ALSA: usb-audio: Evaluate packsize caps at the right place - ipvs: add totalconns for dest - ipvs: properly update the overload flag on dest edit - fscrypt: Replace mk_users keyring with simple list - misc: fastrpc: fix channel ctx ref leak when session alloc fails - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - scsi: scsi_debug: Negate wrapped memcmp() result - prestera: fix fallback to previous version on same major version - hwmon: (adt7470) Add missing dependency on REGMAP_I2C - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - Linux 5.10.265 - ipvs: separate destination availability state - selinux: require every boolean value to be defined - ASoC: cs4265: sort the register default table - powerpc/pseries: pci - logic bug - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - powerpc/pseries: lparcfg - fix kbuf[] underflow - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - Input: sur40 - fix V4L error path cleanup - ceph: fix MDS random selection readiness predicate - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - mmc: sdhci: make tuning_err a signed int - drm/radeon: fix autosuspend cleanup during teardown - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Implement insert_end for VCE 3 - xfs: check v5 superblock features early - udmabuf: Do not create malformed scatterlists - i2c: davinci: Unregister cpufreq notifier on probe failure - device property: Add fwnode_irq_get_byname - i2c: smbus: Use device_*() functions instead of of_*() - VFS/audit: introduce kern_path_parent() for audit - audit: widen ino fields to u64 - audit: use 'unsigned int' instead of 'unsigned' - ALSA: hda: Fix cached processing coefficient verbs - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: max310x: implement gpio_chip::get_direction() - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - mlxsw: spectrum: Apply RIF configuration when joining a LAG - mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - ASoC: mediatek: mt8183: Check runtime resume during probe - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - netfilter: nf_conntrack_sip: remove net variable shadowing - jbd2: add a helper to find out number of fast commit blocks - lsm: use default hook return value in call_int_hook() - lsm: infrastructure management of the sock security - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - mtd: spi-nor: sst: remove global protection flag - mtd: spi-nor: intel: remove global protection flag - mtd: spi-nor: Move Software Write Protection logic out of the core - mtd: spi-nor: Fix spi_nor_try_unlock_all() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - PCI: Add pci_find_vsec_capability() to find a specific VSEC - dmaengine: dw-edma: Improve the linked list and data blocks definition - dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip - i2c: imx: separate atomic, dma and non-dma use case - thunderbolt: Keep XDomain reference during the lifetime of a service - thunderbolt: Remove XDomain from the bus without holding tb->lock - ovl: use linked upper dentry in copy-up tmpfile - scsi: target: core: pr: Initialize arrays at declaration time - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - mmc: vub300: rename probe error labels - firmware_loader: introduce __free() cleanup hanler - net: Add helper function to parse netlink msg of ip_tunnel_encap - net/sched: taprio: avoid calling child->ops->dequeue(child) twice - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - net: ipa: fix SMEM state handle leaks in SMP2P init - usb: gadget: bdc: fix checkpatch.pl spacing error - USB: serial: keyspan_pda: refactor write-room handling - USB: serial: keyspan_pda: fix write implementation - USB: serial: keyspan_pda: add write-fifo support - USB: serial: keyspan_pda: clean up comments and whitespace - USB: serial: keyspan_pda: fix data loss on receive throttling - KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update() - KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield - KVM: x86: Move "apicv_active" into "struct kvm_lapic" - KVM: Introduce vcpu->wants_to_run - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - dma-buf/drivers: make reserving a shared slot mandatory v4 - drm/virtio: use uninterruptible resv lock for plane updates - drm/displayid: fix Tiled Display Topology ID size - drm/tegra: fbdev: Remove offset into framebuffer memory - drm/virtio: Return proper error codes instead of -1 - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - drm/i915/hdcp: require monotonically increasing seq_num_v - media: marvell-cam: fix missing pci_disable_device() on remove - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Correct the minimum vblanking value - media: i2c: imx219: Rename VTS to FRM_LENGTH - media: imx219: Fix maximum frame length in lines - media: v4l: async: Set owner for async sub-devices - serial: 8250_mid: Remove unneeded test for ->setup() presence - mptcp: only set DATA_FIN when a mapping is present - sc16is7xx: Properly resume TX after stop - serial: sc16is7xx: Fill in rs485_supported - serial: sc16is7xx: remove obsolete out_thread label - serial: sc16is7xx: fix regression with GPIO configuration - serial: sc16is7xx: implement gpio get_direction() callback - mptcp: fix subflow accounting on close - mptcp: decrement subflows counter on failed passive join - libceph: Amend checking to fix `make W=1` build breakage - libceph: add doutc and *_client debug macros support - ceph: rename _to_client() to _to_fs_client() - skbuff: introduce skb_pull_data - mm/vmstat: fold stranded per-cpu node stats when a node comes online - net: pktgen: fix code style (WARNING: Block comments) - scsi: sd: sd_zbc: Improve source code documentation - scsi: sd: sd_zbc: Use logical blocks as unit when querying zones - scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() - scsi: scsi_debug: Rename zone type constants - ice: fix VF interrupts cleanup - ice: fix memory leak in ice_lbtest_prepare_rings() - i2c: bcm-iproc: remove printout on handled timeouts - i2c: iproc: reset bus after timeout if START_BUSY is stuck - fsnotify: opt-in for permission events at file open time - fs: don't block write during exec on pre-content watched files - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - drm/amd/pm: fix torn gpu metrics reads - ALSA: usx2y: Fix potential leaks of uninitialized memory - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - netfilter: ipset: fix list type element drift bug - net: packet: fix wrong transport_header when sending VLAN-tagged frame - net: ethernet: ti: am65-cpsw: move ale selection in pdata - net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata - net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode - net/smc: rdma write inline if qp has sufficient inline space - i2c: smbus: Check for parent device before dereference - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - Linux 5.10.266 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - rndis_host: add overflow check in rndis_rx_fixup() - ocfs2: fix missing metadata reservation for large xattrs - ext4: stop retrying saturated xattr cache entries - ext4: clear error before retrying inode xattr space fallback - xfs: validate attr entry pointer before field access - misc: fastrpc: separate fastrpc device from channel context - misc: fastrpc: Rework fastrpc_req_munmap - net: ipv4: Publish fib_nlmsg_size() - perf: Fix cgroup state vs ERROR - perf: Fix dangling cgroup pointer in cpuctx - KVM: arm64: Retry fault if vma_lookup() results become invalid - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: free destination parameters when closing a connection - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" - can: use skb hash instead of private variable in headroom - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: hyperv: validate initial device info bounds - Revert "ALSA: aoa: Use guard() for mutex locks" - Linux 5.10.267 - Linux 5.10.268 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() - ext4: don't enable DAX on new encrypted files - io_uring/io-wq: fix worker accounting when canceling creation callbacks - Revert "PM: sleep: Use complete() in device_pm_sleep_init()" - selinux: switch two allocations to use kzalloc_objs() - Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" - Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: propagate errors from fast commit range replay - nilfs2: reject invalid block index in GC ioctl - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - HID: magicmouse: do not keep a stale msc->input if no input is claimed - nfc: nci: add data_len bound checks to activation parameter extractors - nvmet-tcp: bound SGL data length before allocating command buffers - HID: input: read battery capacity from its actual report offset - fpga: dfl: fme: add error handling - accessibility: speakup: unregister tty ldisc on later init failures - usb: usbtest: disable dynamic ID support - usb: gadget: f_tcm: keep port count until LUN teardown completes - xfrm: espintcp: fix UAF during close - xfrm: drop ESP-in-TCP packets with no ingress device - xfrm: ah6: validate routing header segments_left - xfrm: fix xfrm_state_construct() auth-trunc leak - ipv6: seg6: clear IPv4 control block on IPIP decapsulation - mm/swap: reject swapon() on filesystem-level encrypted files - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: mxs-dcp - fix source scatterlist length access - KVM: s390: vsie: zero stale crypto bits - usb: core: Add lock to usb_wakeup_notification() - usb: core: Strengthen error handling in hub_hub_status() - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() - USB: serial: option: fix slab OOB read in interrupt URB callback - USB: serial: spcp8x5: drop broken carrier detect support - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() - usb: usbfs: fix use-after-free of usb_device in usbdev_release() - Linux 5.10.269