# changelog

author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.5.0.0344
changelog:
  - !8566 [openEuler-1.0-LTS] Update a series of xhci-related Zhaoxin patches
  - !18002  gfs2: Validate i_depth for exhash directories
  - !17998  fix CVE-2025-38449
  - gfs2: Validate i_depth for exhash directories
  - drm: fix kabi for struct drm_framebuffer
  - drm/gem: Acquire references on GEM handles for framebuffers
  - drm/print: introduce new struct drm_device based WARN* macros
  - xhci: Add ZHAOXIN xHCI host U1/U2 feature support
  - Revert "xhci: Add Zhaoxin xHCI LPM U1/U2 feature support"
  - xhci: Show ZHAOXIN xHCI root hub speed correctly
  - Revert "xhci: Show Zhaoxin XHCI root hub speed correctly"
  - Revert "xhci: Fix a logic issue when display Zhaoxin XHCI root hub speed"
  - xhci: Fix TRB prefetch issue of ZHAOXIN hosts
  - Revert "xhci: fix issue of cross page boundary in TRB prefetch"
  - xhci: Fix resume issue of some ZHAOXIN hosts
  - Revert "xhci: fix issue with resume from system Sx state"


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2509.6.0.0345
changelog:
  - !18098  drivers: serial: jsm: fix some leaks in probe
  - !18074  tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
  - !18085  Fix CVE-2022-50343
  - !18022  ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  - drivers: serial: jsm: fix some leaks in probe
  - rapidio: fix possible name leaks when rio_add_device() fails
  - tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.1.0.0346
changelog:
  - !17921  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  - !18255  scsi: qla2xxx: Pointer may be dereferenced
  - !18257  udf: Do not update file length for failed writes to inline files
  - !18261  drm/radeon: Fix integer overflow in radeon_cs_parser_init
  - !18174  fix CVE-2022-50384 and CVE-2022-50249
  - !18252  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init
  - udf: Do not update file length for failed writes to inline files
  - scsi: qla2xxx: Pointer may be dereferenced
  - !18163  x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  - !18185  crypto: cavium - prevent integer overflow loading firmware
  - !18113  wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - !18198  drm/radeon: Add the missed acpi_put_table() to fix memory leak
  - !18187  media: uvcvideo: Handle cameras with invalid descriptors
  - !18134  wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - !18181  udf: Fix uninitialized array access for some pathnames
  - !18139  ALSA: hda: Fix Oops by 9.1 surround channel names
  - !18141  sched/core: Fix potential deadlock on rq lock
  - !18121  nfsd: call op_release, even when op_func returns an error
  - !18148  rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - !18158  firewire: net: fix use after free in fwnet_finish_incoming_packet()
  - !18109  recordmcount: Fix memory leaks in the uwrite function
  - drm/radeon: Add the missed acpi_put_table() to fix memory leak
  - media: uvcvideo: Handle cameras with invalid descriptors
  - crypto: cavium - prevent integer overflow loading firmware
  - !18136  sched/fair: Don't balance task to its current running CPU
  - !18137  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - udf: Fix uninitialized array access for some pathnames
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add
  - memory: of: Fix refcount leak bug in of_get_ddr_timings()
  - !18142  Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors
  - firewire: net: fix use after free in fwnet_finish_incoming_packet()
  - !18135  wifi: ath9k: verify the expected usb_endpoints are present
  - !18108  tee: fix NULL pointer dereference in tee_shm_put
  - !18069  fs: writeback: fix use-after-free in __mark_inode_dirty()
  - !18065  btrfs: fix BUG_ON condition in btrfs_cancel_balance
  - !18132  Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
  - sched/core: Fix potential deadlock on rq lock
  - ALSA: hda: Fix Oops by 9.1 surround channel names
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  - sched/fair: Don't balance task to its current running CPU
  - wifi: ath9k: verify the expected usb_endpoints are present
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
  - !18125  mm: vmscan: fix page cache limit work condition
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
  - !18042  scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - !18039  ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
  - mm: vmscan: fix page cache limit work condition
  - nfsd: call op_release, even when op_func returns an error
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
  - recordmcount: Fix memory leaks in the uwrite function
  - tee: fix NULL pointer dereference in tee_shm_put
  - fs: writeback: fix use-after-free in __mark_inode_dirty()
  - btrfs: fix BUG_ON condition in btrfs_cancel_balance
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.2.0.0347
changelog:
  - !18323  platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx
  - !18329  umount performance fix
  - !18347  Add Huawei Intelligent Network Card Driver: hinic3
  - !18349  vme: Fix error not catched in fake_init()
  - vme: Fix error not catched in fake_init()
  - Add Huawei Intelligent Network Card Driver: hinic3
  - !18066  NFSD: Protect against send buffer overflow in NFSv2 READ
  - !18337  drm/i915/gvt: fix vgpu debugfs clean in remove
  - !18332  kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - drm/i915/gvt: fix vgpu debugfs clean in remove
  - kobject: Add sanity check for kset->kobj.ktype in kset_register()
  - do_make_slave(): choose new master sanely
  - change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED()
  - change_mnt_propagation() cleanups, step 1
  - !18115  media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - !18318  CVE-2023-53254
  - !18317  scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
  - !18302  mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
  - drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
  - scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
  - !18176  fix race between memory offline and UCE handling
  - !18175  watchdog: Fix kmemleak in watchdog_cdev_register
  - !18111  mmc: vub300: fix return value check of mmc_add_host()
  - !18145  PNP: fix name memory leak in pnp_alloc_dev()
  - !18285  Bluetooth: L2CAP: Fix user-after-free
  - Bluetooth: L2CAP: Fix user-after-free
  - !18193 v3  fix CVE-2025-38709
  - !18008  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  - !18274  wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - !18238  wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - !18239  wifi: mac80211: fix memory leak in ieee80211_if_add()
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  - wifi: mwifiex: Fix missed return in oob checks failed path
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets
  - wifi: mac80211: fix memory leak in ieee80211_if_add()
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  - loop: Avoid updating block size under exclusive owner
  - block: use bd_prepare_to_claim directly in the loop driver
  - mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range()
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
  - watchdog: Fix kmemleak in watchdog_cdev_register
  - PNP: fix name memory leak in pnp_alloc_dev()
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
  - mmc: vub300: fix return value check of mmc_add_host()
  - NFSD: Protect against send buffer overflow in NFSv2 READ
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.3.0.0348
changelog:
  - !18072  CVE-2023-53431
  - !18469  e1000e: fix heap overflow in e1000_set_eeprom
  - !18396  scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - !18380  iommu/amd: Fix pci device refcount leak in ppr_notifier()
  - !18379  Fix CVE-2022-50494
  - !18468 scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - e1000e: fix heap overflow in e1000_set_eeprom
  - scsi/hifc: Fix rport dev loss tmo flag and function parameter check err
  - !18315  fs: quota: create dedicated workqueue for quota_release_work
  - !18399  scsi: qla4xxx: Add length check when parsing nlattrs
  - !18359  CVE-2022-50341
  - !18210  drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
  - !18209  md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - !18208  fix CVE-2023-53357
  - !18207  md/raid10: fix wrong setting of max_corr_read_errors
  - !18206  nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - !18205  md/raid10: prevent soft lockup while flush writes
  - !18204  md/raid10: fix leak of 'r10bio->remaining' for recovery
  - !18203  md: Replace snprintf with scnprintf
  - !18408  udf: Do not bother merging very long extents
  - !18373  mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
  - !18377  clk: samsung: Fix memory leak in _samsung_clk_register_pll()
  - !18333  scsi: qla2xxx: Wait for io return on terminate rport
  - !17992  NFS: Fix a race when updating an existing write
  - !18394  ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
  - udf: Do not bother merging very long extents
  - !18375  Enable Huawei Intelligent Network Card Driver: hinic3
  - scsi: qla4xxx: Add length check when parsing nlattrs
  - scsi: target: target_core_configfs: Add length check to avoid buffer overflow
  - ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
  - iommu/amd: Fix pci device refcount leak in ppr_notifier()
  - thermal: intel_powerclamp: Use first online CPU as control_cpu
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
  - clk: samsung: Fix memory leak in _samsung_clk_register_pll()
  - Enable Huawei Intelligent Network Card Driver: hinic3
  - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
  - !18340  binfmt_misc: fix shift-out-of-bounds in check_special_flags
  - !18355  fix CVE-2023-53560
  - cifs: Remove duplicated include in cifsglob.h
  - cifs: fix oops during encryption
  - tracing/histograms: Return an error if we fail to add histogram to hist_vars list
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags
  - scsi: qla2xxx: Wait for io return on terminate rport
  - fs: quota: create dedicated workqueue for quota_release_work
  - drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
  - md: fix resync softlockup when bitmap size is less than array size
  - md/bitmap: md_bitmap_get_counter returns wrong blocks
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
  - md/raid10: fix wrong setting of max_corr_read_errors
  - nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  - md/raid10: prevent soft lockup while flush writes
  - md/raid10: fix leak of 'r10bio->remaining' for recovery
  - md: Replace snprintf with scnprintf
  - scsi: ses: Handle enclosure with just a primary component gracefully
  - scsi: ses: Don't attach if enclosure has no components
  - NFS: Fix a race when updating an existing write


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2510.4.0.0349
changelog:
  - !18619  notifiers: Add oops check in blocking_notifier_call_chain()
  - !18595  Fix CVE-2023-53719
  - !18618  CVE-2023-53648
  - !18590  mtd: Fix device name leak when register device failed in add_mtd_device()
  - !18601  xhci: Remove device endpoints from bandwidth list when freeing the device
  - !18582  media: v4l2-mem2mem: add lock to protect parameter num_rdy
  - notifiers: Add oops check in blocking_notifier_call_chain()
  - ALSA: ac97: Fix possible error value of *rac97
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
  - !18607  wifi: mwifiex: avoid possible NULL skb pointer dereference
  - !18603  Bluetooth: L2CAP: Fix use-after-free
  - wifi: mwifiex: avoid possible NULL skb pointer dereference
  - !18575  CVE-2023-53153
  - !18581  net/tunnel: wait until all sk_user_data reader finish before releasing the sock
  - !18580  sctp: fix a potential overflow in sctp_ifwdtsn_skip
  - !18578  sctp: check send stream number after wait_for_sndbuf
  - !18577  CVE-2023-53148
  - !18576  wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
  - !18574  sctp: handle the error returned from sctp_auth_asoc_init_active_key
  - !18573  igb: Do not free q_vector unless new one was allocated
  - Bluetooth: L2CAP: Fix use-after-free
  - !18600  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - !18599  scsi: qla4xxx: Prevent a potential error pointer dereference
  - xhci: Remove device endpoints from bandwidth list when freeing the device
  - !18551  posix-timers: Ensure timer ID search-loop limit is valid
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  - scsi: qla4xxx: Prevent a potential error pointer dereference
  - drivers: fix a typo in the kernel doc for devm_platform_ioremap_resource()
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
  - drivers: provide devm_platform_ioremap_resource()
  - mtd: Fix device name leak when register device failed in add_mtd_device()
  - !18543  CVE-2023-53567
  - !18529  drm/radeon: free iio for atombios when driver shutdown
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy
  - net/tunnel: wait until all sk_user_data reader finish before releasing the sock
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip
  - sctp: check send stream number after wait_for_sndbuf
  - igb: Do not bring the device up after non-fatal error
  - igb: Fix igb_down hung on surprise removal
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
  - wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
  - wifi: cfg80211: Fix use after free for wext
  - sctp: handle the error returned from sctp_auth_asoc_init_active_key
  - igb: Do not free q_vector unless new one was allocated
  - !18499  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - !18454  usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
  - !18366  squashfs: add more sanity checks
  - !18240  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  - !18491  CVE-2023-53515
  - posix-timers: Ensure timer ID search-loop limit is valid
  - spi: qup: Don't skip cleanup in remove's error path
  - spi: qup: fix PM reference leak in spi_qup_remove()
  - drm/radeon: free iio for atombios when driver shutdown
  - !18429  bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
  - !18426  dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
  - !18416  ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
  - !18418  CVE-2023-53271
  - !18420  CVE-2023-53265
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - virtio-mmio: fix memory leak of vm_dev
  - virtio-mmio: don't break lifecycle of vm_dev
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
  - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
  - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  - ubi: ensure that VID header offset + VID header size <= alloc, size
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
  - ubi: Fix use-after-free when volume resizing failed
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
  - Squashfs: fix handling and sanity checking of xattr_ids count
  - squashfs: fix xattr id and id lookup sanity checks
  - squashfs: fix inode lookup sanity checks
  - squashfs: add more sanity checks in inode lookup
  - squashfs: add more sanity checks in xattr id lookup
  - squashfs: add more sanity checks in id lookup
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.1.0.0350
changelog:
  - !18795  *** fix CVE-2023-53454 ***
  - HID: multitouch: Add NULL check in mt_input_configured
  - HID: multitouch: Correct devm device reference for hidinput input_dev name
  - !18787  misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
  - !18776  tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
  - tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
  - !18759  wifi: ath9k: hif_usb: fix memory leak of remain_skbs
  - !18757  fix CVE-2023-53675
  - !18754  scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
  - !18727  fbdev: Fix out-of-bounds issue in sys_fillrect()
  - !18734  drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
  - wifi: ath9k: hif_usb: fix memory leak of remain_skbs
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
  - Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process"
  - !18749  wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
  - !18740  *** CVE-2023-53199 ***
  - wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
  - !18731  *** CVE-2023-53446 ***
  - !18730  wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
  - !18724  *** CVE-2023-53185 ***
  - !18460  blk-mq: use quiesced elevator switch when reinitializing queues
  - !18726 v2  ext4: avoid crash when inline data creation follows DIO write
  - !18417  cifs: Fix warning and UAF when destroy the MR list
  - wifi: ath9k: use proper statements in conditionals
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
  - ath9k: htc: clean up statistics macros
  - ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
  - ath9k: hif_usb: simplify if-if to if-else
  - !18725  ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
  - !18698  i40e: add validation for ring_len param
  - !18697  wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
  - !18693  wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
  - PCI/ASPM: Fix link state exit during switch upstream function removal
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
  - fbdev: Fix out-of-bounds issue in sys_fillrect()
  - ext4: avoid crash when inline data creation follows DIO write
  - ipvs: Defer ip_vs_ftp unregister during netns cleanup
  - ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
  - ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
  - !18717  drm/mipi-dsi: Detach devices when removing the host
  - !18716  scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
  - !18715  net: hns: fix possible memory leak in hnae_ae_register()
  - !18714  net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
  - !18707 v2  xfrm: fix slab-use-after-free in decode_session6
  - !18712  can: peak_usb: fix shift-out-of-bounds issue
  - drm/mipi-dsi: Detach devices when removing the host
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
  - net: hns: fix possible memory leak in hnae_ae_register()
  - net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
  - can: peak_usb: fix shift-out-of-bounds issue
  - xfrm: fix slab-use-after-free in decode_session6
  - i40e: add validation for ring_len param
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
  - wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
  - !18688  PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
  - PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
  - !18657  ALSA: usb-audio: Fix potential memory leaks
  - !18658  iommu/vt-d: Clean up si_domain in the init_dmars() error path
  - !18269  can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path
  - ALSA: usb-audio: Fix potential memory leaks
  - !18643  wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
  - !18642  tipc: fix a null-ptr-deref in tipc_topsrv_accept
  - !18641  tipc: fix an information leak in tipc_topsrv_kern_subscr
  - !18623  *** SUBJECT HERE ***
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
  - tipc: fix a null-ptr-deref in tipc_topsrv_accept
  - tipc: fix an information leak in tipc_topsrv_kern_subscr
  - udf: Detect system inodes linked into directory hierarchy
  - udf: Preserve link count of system files
  - blk-mq: use quiesced elevator switch when reinitializing queues
  - cifs: Fix warning and UAF when destroy the MR list
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.2.0.0351
changelog:
  - !18884  Revert "fbdev: Fix out-of-bounds issue in sys_fillrect()"
  - Revert "fbdev: Fix out-of-bounds issue in sys_fillrect()"
  - !18811  net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
  - !18736  fs: udf: fix OOB read in lengthAllocDescs handling
  - fs: udf: fix OOB read in lengthAllocDescs handling


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.3.0.0352
changelog:
  - !19025  scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  - !18973  Fix CVE-2025-39964
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg


author: huwentao <huwentao19@h-partners.com> - 4.19.90-2511.4.0.0353
changelog:
  - !19055  scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses


author: xinghe <xinghe2@h-partners.com> - 2:1.6.37-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


