# changelog

author: Funda Wang <fundawang@yeah.net> - 5.3.1-10
changelog:
  - Type:CVE
  - CVE:CVE-2025-2751 CVE-2025-3158 CVE-2025-3196
  - SUG:NA
  - DESC:fix CVE-2025-2751 CVE-2025-3158 CVE-2025-3196


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-17
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         h3: fix query of concurrent streams
         noproxy: fix the IPV6 network mask pattern match
         krb5_gssapi: fix memory leak on error path
         openldap: fix memory-leak in error path
         conn: fix hostname move on connection reuse 
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes
         openssl: fix a potential memory leak of params.cert


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-25
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:urlapi: avoid null deref if setting blank host to url
         urlapi: skip appending NULL pointer query


author: zhouyihang <zhouyihang3@h-partners.com> - 8.4.0-26
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-14819 CVE-2025-15079 CVE-2025-15224


author: Funda Wang <fundawang@yeah.net> - 9.56.1-14
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.56.1-15
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: Qingqing Li <liqingqing3@huawei.com> - 2.38-84
changelog:
  - memalign: reinstate alignment overflow check (CVE-2026-0861)
  - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)


author: Mingzheng Xing <xingmingzheng@iscas.ac.cn> - 6.6.0-115.0.0.120
changelog:
  - RISC-V kernel upgrade to 6.6.0-115.0.0
  - Remove CI-related file changes
  - riscv: Backport steal-time support for RISC-V
  - riscv: RISC-V SBI debug console extension support
  - riscv: Add support for kernel mode vector


author: Li Nan <linan122@huawei.com> - 6.6.0-117.0.0.121
changelog:
  - !17926 spufs: fix a leak on spufs_new_file() failure
  - !18393 platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
  - !18389 regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
  - !18381 f2fs: zone: fix to avoid inconsistence in between SIT and SSA
  - !18370 dmaengine: ti: Add NULL check in udma_probe()
  - !18674 jfs: fix array-index-out-of-bounds read in add_missing_indices
  - !18438 jfs: Fix null-ptr-deref in jfs_ioc_trim
  - !18435 ksmbd: fix null pointer dereference in destroy_previous_session
  - !18434 tty: serial: uartlite: register uart driver in init
  - !18404 mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter-&gt;memcg_path on write
  - !18799 [OLK-6.6] Fix CVE-2025-38336
  - !18798 [OLK-6.6] Fix CVE-2025-38335
  - !18793 [OLK-6.6] Fix CVE-2025-38275
  - !18789 [OLK-6.6] Fix CVE-2025-38274
  - !18786 [OLK-6.6] Fix CVE-2025-38300
  - !18781 [OLK-6.6] Fix CVE-2025-38295
  - !18778 [OLK-6.6] Fix CVE-2025-38293
  - !18777 [OLK-6.6] Fix CVE-2025-38292
  - !18849 urma: introduce ubcore main module.
  - !18842 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.85-6.6.86 LTS Patches
  - !18484 btf: Avoid weak external references
  - !18921  blk-ioinf: introduce inflight-based IO QoS controller
  - blk-rq-qos: fix kabi broken in struct rq_qos
  - blk-mq: fix kabi broken in struct request
  - openeuler_defconfig: Enable CONFIG_BLK_CGROUP_IOINFLIGHT
  - blk-io-hierarchy: support new bio based stage ioinf
  - blk-ioinf: support percentile latency QoS for oneline workloads
  - blk-ioinf: dynamically adjust inflight limit to balance workloads
  - blk-ioinf: add rqos/inflight/stat debufs interface
  - blk-ioinf: introduce inflight-based IO QoS controller
  - !18863 drivers/perf: hisi: Add support for HiSilicon MN PMU driver
  - !18885 ub: ubase: Fix some compile warnings&fix pages free problem
  - !18910  um: virtio_uml: Fix use-after-free after put_device in probe
  - !18902  i2c: cros-ec-tunnel: defer probe if parent EC is not present
  - urma: introduce ubcore main module.
  - um: virtio_uml: Fix use-after-free after put_device in probe
  - ub: ubase: Fix some compile warnings
  - !18894  some bugfixes for NUMA.remote
  - i2c: cros-ec-tunnel: defer probe if parent EC is not present
  - !18723 GMEM: General Memory Management
  - !18852 vfio:ubus: Support Virtual Function I/O  of UBUS
  - !18788 ub: Support new features for UBUS
  - !18701 ubios_uvb: support uvb driver
  - mm/numa_remote: check if memory block is preonlined when undoing fake-online
  - mm/numa_remote: fix restoring to preonline when failing to offline from preonline
  - mm/numa_remote: fix memory leak of struct memory_block
  - !18840 v2  Backport some memory policy feature and bugfix from mainline
  - ub: ubase: Fix the problem that free pages when ubase driver destroy TA context
  - ubios_uvb: support CIS framework receive function
  - ubios_uvb: support CIS framework send function
  - ubios_uvb: support parse ubios information by dtb
  - ubios_uvb: support UBIOS object description specification parse
  - vfio:ubus: support obtaining and configuring function entity information in user mode
  - vfio:ubus: Support configuration for function entity interrupt
  - vfio:ubus: Support access to function entity resource space
  - vfio:ubus: Init vfio ub config space 1 perm and port perm bits during module init
  - vfio:ubus: Init vfio ub config space 0 perm bits during module init
  - vfio:ubus: Init vfio ub configuration space
  - vfio:ubus: Support ub vfio config read and write
  - vfio:ubus: Support for vfio ubus driver framework
  - ub:ubus: Support UBUS driver host probe and remove
  - ub:ubus: Add configuration and resource sysfs interfaces
  - ub:ubus: Add basic System Filesystem attributes
  - ub:ubus: Support processing protocol link messages
  - ub:ubus: Support hotplug processing main workflow
  - ub:ubus: Support for device enumeration during the hotplug phase
  - ub:ubus: Support for slot register configuration
  - ub:ubus: Support hotplug service driver
  - ub:ubus: Add generic ub component driver
  - ub:ubus: Add ub service driver framework
  - ub:ubus: Add new UBUS pool device interfaces
  - ub:ubus: Support UBUS pool devices register
  - ub:ubfi: register ubc usi domain
  - ub:ubus: Support for ub device resource space registration
  - ub:ubus: Add UBUS receive message framework
  - ub:ubus: Support device binding and unbinding bus instance
  - ub:ubus: Support for static cluster bus instance
  - ub:ubus: Support for dynamic bus instance
  - ub:ubus: Support for bus instance framework
  - ub:ubus: Support handle device link up and link down
  - ub:ubus: Support enumerate port and route set/clear for port
  - ub:ubus: Support route modify/delete function
  - !18750 iommu/ummu: Add ummu driver basic capabilities.
  - iommu/ummu: Add UMMU cache flush interfaces
  - iommu/ummu: Support UMMU event handling
  - iommu/ummu: Support UMMU global error handling
  - iommu/ummu: Support UMMU command queue
  - iommu/ummu: Support UMMU device
  - !18748 ub: ubfi: Support ummu node in ubfi
  - !18804 drivers/perf: hisi: Support UMMU pmu
  - !18855  mm: do not install PMD mappings when handling a COW fault
  - !18848 net:nebula-matrix:fix compile err
  - drivers/perf: hisi: Add support for HiSilicon MN PMU driver
  - drivers/perf: hisi: Add support for HiSilicon NoC PMU
  - Revert "drivers/perf: hisi: Add support for HiSilicon NoC PMU"
  - Revert "drivers/perf: hisi: Add support for HiSilicon MN PMU driver"
  - ub: ubfi: Parsing ummu node in the ubrt table
  - net:nebula-matrix:fix compile err
  - mm: do not install PMD mappings when handling a COW fault
  - urma: implement workqueue management for ubcore module.
  - urma: implement topology information management for ubcore module.
  - urma: implement hash table utilities for ubcore module.
  - !18810 ub: ubase: support for advanced functions
  - urma: implement log module for ubcore subsystem.
  - gmem: open CONFIG_GMEM for arm64 and x86
  - mm: implement hmemcpy API
  - mm: implement hmadvise API
  - mm: support mmap/unmap peer-shared memory area
  - gmem: add gmem stat
  - gmem: support pin/unpin device memory
  - gmem: support swapping heterogeneous memory
  - gmem: implement page faulting for peer-shared vma
  - gmem: implement allocating/deallocating peer-shared vma.
  - gmem: introduce hnode for free peer-shared free page management
  - gmem: introduce vm_object for managing hetergoneous memory mapping
  - gmem: prepare config, boot parameter, vma flag and basic GMEM related structs
  - !18758  nbd: restrict sockets to TCP and UDP
  - !18407 net:Add a new protocol family definition AF_UB to support UB Memory based Socket(UMS)
  - !18839  rseq: Protect event mask against membarrier IPI
  - wifi: ath12k: fix invalid access to memory
  - serial: 8250_dma: terminate correct DMA in tx_dma_flush()
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
  - net: usb: usbnet: restore usb%d name exception for local mac addresses
  - net: usb: qmi_wwan: add Telit Cinterion FE990B composition
  - net: usb: qmi_wwan: add Telit Cinterion FN990B composition
  - tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers
  - tty: serial: 8250: Add Brainboxes XC devices
  - tty: serial: 8250: Add some more device IDs
  - counter: microchip-tcb-capture: Fix undefined counter channel state on probe
  - counter: stm32-lptimer-cnt: fix error handling when enabling
  - ALSA: hda/realtek: Support mute LED on HP Laptop 15s-du3xxx
  - mm/page_alloc: fix memory accept before watermarks gets initialized
  - drm/amd/display: Don't write DP_MSTM_CTRL after LT
  - drm/dp_mst: Add a helper to queue a topology probe
  - drm/dp_mst: Factor out function to queue a topology probe work
  - ARM: Remove address checking for MMUless devices
  - ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
  - ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
  - HID: hid-plantronics: Add mic mute mapping and generalize quirks
  - ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
  - mm/mempolicy: count MPOL_WEIGHTED_INTERLEAVE to "interleave_hit"
  - mm/mempolicy: fix memory leaks in weighted interleave sysfs
  - mempolicy: clean up minor dead code in queue_pages_test_walk()
  - mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq
  - mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving
  - mm/mempolicy: refactor a read-once mechanism into a function for re-use
  - mm/mempolicy: implement the sysfs-based weighted_interleave interface
  - mempolicy: migration attempt to match interleave nodes
  - mempolicy: mmap_lock is not needed while migrating folios
  - mempolicy: alloc_pages_mpol() for NUMA policy without vma
  - kernfs: drop shared NUMA mempolicy hooks
  - mempolicy: remove confusing MPOL_MF_LAZY dead code
  - mempolicy: mpol_shared_policy_init() without pseudo-vma
  - mempolicy trivia: use pgoff_t in shared mempolicy tree
  - mempolicy trivia: slightly more consistent naming
  - mempolicy trivia: delete those ancient pr_debug()s
  - mempolicy: fix migrate_pages(2) syscall return nr_failed
  - Revert "mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str"
  - ub: ubase: support for activate/deactivate dev interface
  - ub: ubase: pf supports debugfs query port/vl current.
  - ub: ubase: adds the function to get ub port stats for unic and other aux driver
  - ub: ubase: support pre-alloc 2M pages.
  - ub: ubase: support ras function
  - ub: ubase: Support to port reset
  - ub: ubase: Added QoS and traffic management debugging features
  - ub: ubase: Support reset count information statistics.
  - ub: ubase: Support for ELR and entity reset.
  - ub: ubase: Provide an entity_list query interface.
  - ub: ubase: support create and delete UM TP/TPG
  - ub: ubase: Support to config and query the sl scheduling mode and weight in ETS and TM modes.
  - ub: ubase: support querying sl information in initialization phase
  - ub: ubase: Supports for ctrl queue management.
  - rseq: Protect event mask against membarrier IPI
  - !18820 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - !18817 [OLK-6.6] backport important bugfix for mpt3sas driver from upstream linux-6.6.y
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path
  - !18800 net: hibmcge: support pagepool for rx
  - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  - !18745  *** Mainline PATCH backport ***
  - !18807  smb: client: fix wrong index reference in smb2_compound_op()
  - !18711  Bluetooth: hci_conn: Use disable_delayed_work_sync
  - !17268  LoongArch: fix nvme/megaraid/stmmac/uprobe/rtc/kdump problems
  - !18500 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.82-6.6.83 LTS Conflicts Patches
  - ub: ubase: adds the function that query oor caps
  - ub: ubase: Support for virtual register and unregister.
  - ub: ubase: Add trace events to aeqe and ceqe.
  - ub: ubase: Add the cmdq trace event print at the ubase layer.
  - ub: ubase: Support for timer/ext_dtb buffer management.
  - !18784  padata: Reset next CPU when reorder sequence wraps around
  - !18806 perf: fix ddrc redundant value set
  - !18802  KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
  - !18739  fs: udf: fix OOB read in lengthAllocDescs handling
  - !18710 ub: ubase: Add support of base driver for ub network
  - smb: client: fix wrong index reference in smb2_compound_op()
  - ub: ubase: Support for public Context memory allocation and release.
  - ub: ubase: support for cdma auxiliary device
  - ub: ubase: support for complete event process
  - ub: ubase: support for async event process
  - ub: ubase: add interrupt management framework and misc handler
  - ub: ubase: add function to query device resource
  - ub: ubase: add the function that query ueid
  - ub: ubase: support debugfs public interface.
  - ub: ubase: support for command process
  - ub: ubase: add support of ubase driver for ub network
  - perf: fix ddrc redundant value set
  - drivers/perf: hisi: Add the sysfs interface to configure pmu mpam
  - drivers/perf: hisi: Implement ummu-pmu driver.
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
  - net: hibmcge: support pagepool for rx
  - net: hibmcge: reduce packet drop under stress testing
  - ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
  - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
  - phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
  - fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
  - padata: Reset next CPU when reorder sequence wraps around
  - crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()
  - perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create()
  - wifi: ath11k: fix node corruption in ar->arvifs list
  - nbd: restrict sockets to TCP and UDP
  - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
  - x86/umip: Check that the instruction opcode is at least two bytes
  - PM: sleep: core: Clear power.must_resume in noirq suspend error path
  - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
  - ACPI: processor: idle: Fix memory leak when register cpuidle device failed
  - fs: udf: fix OOB read in lengthAllocDescs handling
  - net: Add a new protocol family AF_UB
  - Bluetooth: hci_conn: Use disable_delayed_work_sync
  - jfs: fix array-index-out-of-bounds read in add_missing_indices
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store()
  - regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
  - regulator: max20086: fix invalid memory access
  - dmaengine: ti: Add NULL check in udma_probe()
  - selftests: net: test for lwtunnel dst ref loops
  - arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou
  - arm64: dts: rockchip: Move uart5 pin configuration to px30 ringneck SoM
  - net: ipv6: fix dst ref loop in ila lwtunnel
  - net: ipv6: fix missing dst ref drop in ila lwtunnel
  - arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou
  - arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes
  - NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
  - btf: Avoid weak external references
  - vmlinux: Avoid weak reference to notes section
  - kallsyms: Avoid weak references for kallsyms symbols
  - jfs: Fix null-ptr-deref in jfs_ioc_trim
  - ksmbd: fix null pointer dereference in destroy_previous_session
  - tty: serial: uartlite: register uart driver in init
  - mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
  - f2fs: zone: fix to avoid inconsistence in between SIT and SSA
  - spufs: fix a leak on spufs_new_file() failure
  - net: stmmac: dwmac-loongson: Set correct {tx,rx}_fifo_size
  - LoongArch: Support mem=<size> kernel parameter
  - LoongArch: Reserve the EFI memory map region
  - LoongArch: Add debugfs entries to switch SFB/TSO state
  - LoongArch: uprobes: Remove redundant code about resume_era
  - LoongArch: uprobes: Remove user_{en,dis}able_single_step()
  - LoongArch: fix access mode of 7A2000 acpi gpio.
  - LoongArch: configs: enable zstd compressed firmware support
  - Loongarch: configs: Make EFI RTC built-in for correct vmcore timestamps
  - megaraid: Add udelay to avoid data error caused by dma sequence
  - nvme: Add udelay to avoid data error caused by dma sequence


author: Li Nan <linan122@huawei.com> - 6.6.0-119.0.0.122
changelog:
  - !19043  EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
  - !18348 Intel: Backport PMU support for Intel Clearwater Forest platform
  - !18703 ub: udma: Support loading and unloading driver.
  - !19031 v6  fuse:io_uring: support fuse over io_uring
  - !19033 ub:ubus: Add ummu_map attribute in sysfs
  - !18980  misc: uacce - fix a null pointer access issue when poweroff
  - !18519 media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
  - !18518 iio: imu: bno055: fix OOB access of hw_xlate array
  - !18515 s390/ism: fix concurrency management in ism_cmd()
  - !18493 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
  - !18506 Fix CVE-2025-39781
  - !18505 Fix CVE-2025-38696
  - !18504 Fix CVE-2025-38640
  - !18503 Fix CVE-2025-39716
  - !18502 Fix CVE-2025-39767
  - !18501 Fix CVE-2025-39693
  - !18494 Fix CVE-2025-39909
  - !18497 Fix CVE-2025-39952
  - !18492 Fix CVE-2025-39916
  - !18957 [OLK-6.6] Fix CVE-2025-39846
  - !18956 [OLK-6.6] Fix CVE-2025-39842
  - !18955 [OLK-6.6] Fix CVE-2025-39861
  - !18954 [OLK-6.6] Fix CVE-2025-39794
  - !18953 [OLK-6.6] Fix CVE-2025-39863
  - !18633 [OLK-6.6] Fix CVE-2025-38715
  - !18631 [OLK-6.6]Fix CVE-2025-38698
  - !18215 [OLK-6.6] Fix CVE-2025-38576
  - !18398 btrfs: avoid NULL pointer dereference if no valid csum tree
  - !18876 Fix CVE-2025-38011
  - !18388 fs/ntfs3: handle hdr_first_de() return value
  - !18369 usb: renesas_usbhs: Reorder clock handling and power management in probe
  - !18367 clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
  - !18321 wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
  - !18310 net: usb: aqc111: debug info before sanitation
  - !18309 coresight: fix indentation error in cscfg_remove_owned_csdev_configs()
  - !18949 [OLK-6.6] Fix CVE-2025-38107
  - !18947 [OLK-6.6] Fix CVE-2025-38126
  - !18946 [OLK-6.6] Fix CVE-2025-38218
  - !18945 [OLK-6.6] Fix CVE-2025-38217
  - !18944 [OLK-6.6] Fix CVE-2025-38230
  - !18814 [OLK-6.6] Fix CVE-2025-38225
  - !18813 [OLK-6.6] Fix CVE-2025-38185
  - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
  - !18812 [OLK-6.6] Fix CVE-2025-38206
  - !18675 wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
  - !18432 [OLK-6.6] Fix CVE-2025-38259
  - !18244 eventpoll: don't decrement ep refcount while still holding the ep mutex
  - !18245 wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
  - !18243 f2fs: fix to do sanity check on ino and xnid
  - !18242 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
  - !18246 aoe: clean device rq_list in aoedev_downdev()
  - ub: udma: Support init and uninit dfx function.
  - ub: udma: Support register and unregister segment function.
  - ub: udma: Support set eid function.
  - ub: udma: Support register and unregister ctrlq event.
  - ub: udma: Support register and unregister ce and crq event.
  - ub: udma: Support register and unregister ae event.
  - ub: udma: Register and unregister debugfs.
  - ub: udma: Create and destroy u-context.
  - ub:ubus: Add ummu_map attribute in sysfs
  - openeuler_defconfig: enable CONFIG_FUSE_IO_URING by default
  - fuse: remove unneeded atomic set in uring creation
  - fuse: removed unused function fuse_uring_create() from header
  - fuse: {io-uring} Fix a possible req cancellation race
  - fuse: fix possible deadlock if rings are never initialized
  - fuse: fix uring race condition for null dereference of fc
  - fuse: prevent disabling io-uring on active connections
  - fuse: enable fuse-over-io-uring
  - fuse: block request allocation until io-uring init is complete
  - fuse: {io-uring} Prevent mount point hang on fuse-server termination
  - fuse: Allow to queue bg requests through io-uring
  - fuse: Allow to queue fg requests through io-uring
  - fuse: {io-uring} Make fuse_dev_queue_{interrupt,forget} non-static
  - fuse: {io-uring} Handle teardown of ring entries
  - fuse: Add io-uring sqe commit and fetch support
  - fuse: {io-uring} Make hash-list req unique finding functions non-static
  - fuse: Add fuse-io-uring handling into fuse_copy
  - fuse: Make fuse_copy non static
  - fuse: {io-uring} Handle SQEs - register commands
  - fuse: make args->in_args[0] to be always the header
  - fuse: Add fuse-io-uring design documentation
  - fuse: Move request bits
  - fuse: Move fuse_get_dev to header file
  - fuse: rename to fuse_dev_end_requests and make non-static
  - io_uring: fix kabi broken for header file changed
  - io_uring: fix kabi broken in struct io_submit_state
  - io_uring: fix kabi broken in struct io_ring_ctx
  - io_uring: fix kabi broken in struct io_tw_state
  - io_uring: kill dead code in io_req_complete_post
  - io_uring: remove dead struct io_submit_state member
  - io_uring/cmd: let cmds to know about dying task
  - io_uring: clean up io_lockdep_assert_cq_locked
  - io_uring: refactor io_req_complete_post()
  - io_uring: remove current check from complete_post
  - io_uring: get rid of intermediate aux cqe caches
  - io_uring: refactor io_fill_cqe_req_aux
  - io_uring: remove struct io_tw_state::locked
  - io_uring: force tw ctx locking
  - io_uring/cmd: document some uring_cmd related helpers
  - io_uring/cmd: fix tw <-> issue_flags conversion
  - io_uring/cmd: kill one issue_flags to tw conversion
  - io_uring/cmd: move io_uring_try_cancel_uring_cmd()
  - io_uring/cmd: give inline space in request to cmds
  - io_uring/cmd: expose iowq to cmds
  - io_uring/cmd: inline io_uring_cmd_do_in_task_lazy
  - io_uring: split out cmd api into a separate header
  - io_uring: cancelable uring_cmd
  - io_uring: retain top 8bits of uring_cmd flags for kernel internal use
  - !19006 ub:ubus: Bugfix of ubus and ubfi
  - !18969  arm64/mpam: Add quirk to shrink MATA PMG range
  - ub:ubus: Bugfix of ubus and ubfi
  - ub: udma: Support loading and unloading driver.
  - !18859 KVM: arm64: Deactivate the spurious vtimer interrupt
  - !19009 v2  mm: Fix shmem build and numa fault counting errors
  - !19019  media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
  - KVM: arm64: Deactivate the spurious vtimer interrupt
  - !19026  accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
  - !19024  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
  - !19027 v11  Add xcall 2.0 support
  - xcall2.0: Introduce xcall epollwait prefetch feature
  - openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default
  - xcall2.0: Add a basic testcase
  - xcall: Add debug mode to force fast syscall for all threads
  - xcall: Rework the early exception vector of XCALL and SYNC
  - xcall2.0: Support xcall1.0 for hardware xcall
  - xcall2.0: Hajack syscall with dynamic instruciton replace
  - xcall2.0: Add xcall_area
  - xcall2.0: Add xcall module register interface
  - xcall2.0: Add userspace proc interface
  - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
  - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
  - !18988  zcopy: A zero-copy data transfer mechanism
  - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
  - mm: fix nr_pages counting for folio in task_numa_fault
  - mm: fix shmem build errors with CONFIG_SWAP disable
  - !18970 net: unic: Support advanced functions of unic driver
  - !18964 ub: add cdma driver code
  - !18874  mm: introduce memalloc_flags_{save,restore}
  - !18428 Add ccp-mdev feature into hygon ccp driver
  - !18440 [OLK-6.6] pinctrl: Zhaoxin: Add KH-50000 support
  - !18992  blk-ioinf: fix division by zero caused by inflight overflow in ioinf_qos_write()
  - !18482 [OLK-6.6] ACPI: processor: idle: Set timer broadcast state on C3 for KH-50000
  - !18478 [OLK-6.6] hwmon: zhaoxin-cputemp: Update for KH-50000
  - !18477 [OLK-6.6] perf/zhaoxin/core: Tailor FMS for KH-50000
  - !18467 [OLK-6.6] Enhance SM3 SM4 drivers with optimizations and compatibility fixes
  - !18450 [OLK-6.6] i2c: zhaoxin: Enhancements and Modifications to SMBus Driver
  - !18449 [OLK-6.6] Optimize Zhaoxin CPU Temp Monitoring During Suspend/Resume
  - !18447 RDMA/bnxt_re: Fix error recovery sequence
  - !18448 bnxt_en: Fix ethtool -d byte order for 32-bit values
  - !18452 bnxt_en: Fix DCB ETS validation
  - !18961  mm: add huge pfnmap support for remap_pfn_range()
  - blk-ioinf: fix division by zero caused by inflight overflow in ioinf_qos_write()
  - !18950 urma: implement netlink and memory management features.
  - !18930 ubcore: implement device registration and jetty management
  - zcopy: enable ZCOPY module
  - zcopy: Add ZCOPY documentation
  - zcopy: Add debug inerface dump_pagetable
  - zcopy: Add tracepoint for PageAttach
  - zcopy: Extend PMD trans hugepage mapping ability
  - zcopy: Introduce the pageattach interface
  - zcopy: Initialize zcopy module
  - ubcore: add genl, netlink and vtp support to ubcore module.
  - !18960  KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
  - misc: uacce - fix a null pointer access issue when poweroff
  - !18966  wakeup kswapd during node_reclaim
  - !18857 Backport PLR (Power Limit Reasons) TPMI driver for 6.6
  - !17988 [OLK-6.6] Fix CVE-2025-38734
  - !18005 [OLK-6.6] Fix CVE-2025-38718
  - !18977 mm: migrate: Fix the compilation error caused by redundant semicolons
  - mm: migrate: Fix the compilation error caused by redundant semicolons
  - !18943 smb: client: validate change notify buffer before copy
  - !18942 rtc: rx8025: fix incorrect register reference
  - !18051 [OLK-6.6] [Bugfix] Bug fix for min_free_kbytes warning storms
  - !18040 [OLK-6.6] Fix CVE-2025-39808
  - ub: cdma: support for cdma kernelspace north-south compatibility requirements
  - ub: cdma: support reset function
  - ub: cdma: support RX stop flow function
  - ub: cdma: support debugfs interface
  - ub: cdma: support dma faa semantic
  - ub: cdma: support dma cas semantic
  - ub: cdma: support dma read semantic
  - ub: cdma: support dma write with notify semantic
  - ub: cdma: support dma write semantic delivery
  - ub: cdma: support dma write semantic configuration
  - ub: cdma: support kernel resource reclamation
  - !18892 CCA: Fix soft lockup bug while destroy realm
  - ubcore: implement support for UVS commands
  - ubcore: implement device registration and jetty management
  - !18968 kvm: supports hugepages POD when migrate vm
  - ubcore: add device management for character device and class operations
  - kvm: supports hugepages POD when migrate vm
  - net: unic: Debugfs supports querying IP specifications and IP entries.
  - net: unic: support subscribes to the RX stream stop and recovery interface.
  - net: unic: support config/query traffic class parameters
  - net: unic: support config/query ets parameters
  - net: unic: Add debugfs support for QoS configuration and query.
  - net: unic: support config/query the mapping between dscp and tc
  - net: unic: Support RAS
  - net: unic: Drive supports ub entity reset.
  - net: unic: Support to query and clear historical NIC link status information
  - net: unic: support querying and configuring coalesce parameters.
  - net: unic: Add debugfs for JFS/JFR/JFC context.
  - net: unic: Support driver dump register.
  - arm64/mpam: Merge redundant local static variables 'cpus'
  - arm64/mpam: Add quirk to shrink MATA PMG range
  - !18963 kvm: supports hugepages reclaime notify
  - mm: node_reclaim: add wakeup kswapd mode
  - mm: vmscan: wakeup kswapd during node_reclaim
  - arch_numa: Make node reclaim distance adjustment always available
  - kvm: supports hugepages reclaime notify
  - !18940 [OLK-6.6][linux-6.6.y sync] Backport 6.6.86-6.6.87 LTS Patches
  - arm64/x86: configs: Enable huge pfnmap support in openeuler defconfig
  - mm: introduce remap_pfn_range_try_pmd() for PMD-level hugepage mapping
  - pgtable: add pte_clrhuge() implementation for arm64
  - arm64: mm: Drop dead code for pud special bit handling
  - mm/huge_memory: check pmd_special() only after pmd_present()
  - mm/arm64: support large pfn mappings
  - mm/x86: support large pfn mappings
  - mm: always define pxx_pgprot()
  - mm/fork: accept huge pfnmap entries
  - mm/pagewalk: check pfnmap for folio_walk_start()
  - mm/gup: detect huge pfnmap entries in gup-fast
  - mm: allow THP orders for PFNMAPs
  - mm: mark special bits for huge pfn mappings when inject
  - mm: drop is_huge_zero_pud()
  - mm: introduce ARCH_SUPPORTS_HUGE_PFNMAP and special bits to pmd/pud
  - !18841 mm: add auxillary functions for folios and hugetlb
  - !18896 kvm: add struct kvm if only CONFIG_KVM enabled
  - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
  - mm: hugetlb: add putback_hugetlb_folio()
  - mm: hugetlb: add get_hugetlb_folio_nodemask() mm: hugetlb: add filter function to dequeue hugetlb functions
  - mm: migrate: add isolate_and_migrate_folios()
  - kvm: add struct kvm if only CONFIG_KVM enabled
  - !18908 [Backport] mm/hugetlb: declare hugetlbfs_pagecache_present() non-static
  - !18376 net: wangxun: ngbe: add support for wangxun 1G
  - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
  - ocfs2: prevent release journal inode after journal shutdown
  - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
  - ARM: tegra: Use I/O memcpy to write to IRAM
  - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
  - !18887 urma: implement ubcore sysfs interface and device management
  - !18685 ub: add cdma driver code
  - !18684 ub: ub_fwctl:Add the ub_fwctl driver
  - net_sched: ets: fix a race in ets_qdisc_change()
  - [Backport] mm/hugetlb: declare hugetlbfs_pagecache_present() non-static
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
  - !18928 gmem: fix some warnings
  - !18938 dma-mapping: benchmark: add support for UB devices
  - f2fs: fix to do sanity check on sit_bitmap_size
  - hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
  - jfs: validate AG parameters in dbMount() to prevent crashes
  - fs/jfs: consolidate sanity checking in dbMount
  - jfs: add sanity check for agwidth in dbMount
  - perf: Fix dangling cgroup pointer in cpuctx
  - nfsd: decrease sc_count directly if fail to queue dl_recall
  - tracing: Do not add length to print format in synthetic events
  - ksmbd: fix memory leak in parse_lease_state()
  - ipv6: Align behavior across nexthops during path selection
  - gre: Fix IPv6 multicast route creation.
  - gre: Fix again IPv6 link-local address generation.
  - Revert "drm/amd: Keep display off while going into S4"
  - Revert "rndis_host: Flag RNDIS modems as WWAN devices"
  - Revert "PCI: Avoid reset when disabled via sysfs"
  - PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
  - tracing: Do not use PERF enums when perf is not defined
  - NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
  - nfsd: put dl_stid if fail to queue dl_recall
  - exec: fix the racy usage of fs_struct->in_exec
  - jfs: add index corruption check to DT_GETPAGE()
  - ext4: fix OOB read when checking dotdot dir
  - ext4: don't over-report free space or inodes in statvfs
  - arm64: Don't call NULL in do_compat_alignment_fixup()
  - tracing: Fix synth event printk format for str fields
  - tracing: Ensure module defining synth event cannot be unloaded while tracing
  - ksmbd: add bounds check for create lease context
  - ksmbd: add bounds check for durable handle context
  - mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
  - mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
  - mmc: omap: Fix memory leak in mmc_omap_new_slot
  - ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
  - x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
  - kunit/overflow: Fix UB in overflow_allocation_test
  - ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
  - platform/x86: ISST: Correct command storage data length
  - ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers
  - x86/hyperv: Fix check of return value from snp_set_vmsa()
  - LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
  - media: imx-jpeg: Cleanup after an allocation error
  - media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
  - smb: client: validate change notify buffer before copy
  - ub: cdma: support register segment
  - ub: cdma: support unregister segment
  - ub: cdma: support reporting completed events
  - ub: cdma: support reporting asynchronous events
  - ub: cdma: support the creation of jfs
  - ub: cdma: support the deletion of jfs
  - ub: cdma: support the creation of ctp
  - ub: cdma: support the deletion of ctp
  - ub: cdma: support the creation of jfc
  - ub: cdma: support the deletion of jfc
  - ub: cdma: support for releasing queue
  - ub: cdma: support for allocating queue
  - ub: cdma: support for getting device by eid
  - ub: cdma: support for getting device list
  - ub: cdma: support querying sl information and updating eu
  - ub: cdma: support the probe and remove processes
  - !18906 v2  Add MFS Support
  - rtc: rx8025: fix incorrect register reference
  - !18920 perf: Fix tt_core mismatch over PG CPU
  - !18934  mm/thp: Add a new sysfs knob for zero COW
  - !18845  fs/resctrl: Fix the L3 CMAX conversion mechanism
  - !18858 ub: ubase: Support debugs functions
  - !18853 net: unic: add support of unic driver for ub network
  - !18901 ub:hisi-ubus: Support HISI-UBUS driver framework
  - !18927  mm: add nr_free_highatomic in show_free_areas
  - !18929 v2:mm/swap: get the swap device offset directly
  - perf/core: Fix child_total_time_enabled accounting bug at task exit
  - drm/amdgpu/gfx11: fix num_mec
  - ipv6: Do not consider link down nexthops in path selection
  - ipv6: Start path selection from the first nexthop
  - net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
  - ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
  - vsock: avoid timeout during connect() if the socket is closing
  - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
  - e1000e: change k1 configuration on MTP and later platforms
  - riscv: Fix hugetlb retrieval of number of ptes in case of !present pte
  - ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe()
  - x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs
  - RISC-V: errata: Use medany for relocatable builds
  - ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
  - ntb: intel: Fix using link status DB's
  - riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
  - spufs: fix a leak in spufs_create_context()
  - hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
  - memory: omap-gpmc: drop no compatible check
  - can: statistics: use atomic access in hot path
  - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
  - drm/amd: Keep display off while going into S4
  - nvme-pci: fix stuck reset on concurrent DPC and HP
  - x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
  - x86/hyperv: Fix output argument to hypercall that changes page visibility
  - locking/semaphore: Use wake_q to wake up processes outside lock critical section
  - wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state
  - x86/hyperv/vtl: Stop kernel from probing VTL0 low memory
  - sched/deadline: Use online cpus for validating runtime
  - ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
  - HID: i2c-hid: improve i2c_hid_get_report error message
  - platform/x86/intel/vsec: Add Diamond Rapids support
  - platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
  - cifs: fix incorrect validation for num_aces field of smb_acl
  - perf/core: Fix perf_pmu_register() vs. perf_init_event()
  - ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
  - ALSA: hda/realtek: Fix Asus Z13 2025 audio
  - affs: don't write overlarge OFS data block size fields
  - affs: generate OFS sequence numbers starting at 1
  - wifi: brcmfmac: keep power during suspend if board requires it
  - nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
  - nvme-pci: clean up CMBMSC when registering CMB fails
  - wifi: iwlwifi: mvm: use the right version of the rate API
  - wifi: iwlwifi: fw: allocate chained SG tables for dump
  - rcu-tasks: Always inline rcu_irq_work_resched()
  - context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
  - sched/smt: Always inline sched_smt_active()
  - objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
  - octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
  - octeontx2-af: Fix mbox INTR handler when num VFs > 64
  - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
  - LoongArch: Rework the arch_kgdb_breakpoint() implementation
  - LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
  - objtool: Fix segfault in ignore_unreachable_insn()
  - ring-buffer: Fix bytes_dropped calculation issue
  - net/mlx5e: SHAMPO, Make reserved size independent of page size
  - ksmbd: fix multichannel connection failure
  - ksmbd: use aead_request_free to match aead_request_alloc
  - rndis_host: Flag RNDIS modems as WWAN devices
  - exfat: fix the infinite loop in exfat_find_last_cluster()
  - NFS: Shut down the nfs_client only after all the superblocks
  - perf tools: annotate asm_pure_loop.S
  - fs/procfs: fix the comment above proc_pid_wchan()
  - tty: n_tty: use uint for space returned by tty_write_room()
  - staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
  - perf python: Check if there is space to copy all the event
  - perf python: Don't keep a raw_data pointer to consumed ring buffer space
  - perf python: Decrement the refcount of just created event on failure
  - perf python: Fixup description of sample.id event member
  - i3c: master: svc: Fix missing the IBI rules
  - um: hostfs: avoid issues on inode number reuse by host
  - um: remove copy_from_kernel_nofault_allowed
  - selftests/mm/cow: fix the incorrect error handling
  - fuse: fix dax truncate/punch_hole fault path
  - NFSv4: Don't trigger uneccessary scans for return-on-close delegations
  - arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
  - kexec: initialize ELF lowest address to ULONG_MAX
  - kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
  - perf units: Fix insufficient array space
  - perf evlist: Add success path to evlist__create_syswide_maps
  - iio: adc: ad7124: Fix comparison of channel configs
  - iio: adc: ad4130: Fix comparison of channel setups
  - dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
  - fs/ntfs3: Prevent integer overflow in hdr_first_de()
  - usb: xhci: correct debug message page size calculation
  - perf bench: Fix perf bench syscall loop count
  - perf arm-spe: Fix load-store operation checking
  - iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
  - iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
  - ucsi_ccg: Don't show failed to get FW build information error
  - perf pmu: Don't double count common sysfs and json events
  - coresight-etm4x: add isb() before reading the TRCSTATR
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
  - coresight: catu: Fix number of pages while using 64k pages
  - soundwire: slave: fix an OF node reference leak in soundwire slave device
  - isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
  - perf stat: Fix find_stat for mixed legacy/non-legacy events
  - clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
  - leds: Fix LED_OFF brightness race
  - mfd: sm501: Switch to BIT() to mitigate integer overflows
  - pinctrl: renesas: rzv2m: Fix missing of_node_put() call
  - crypto: nx - Fix uninitialised hv_nxc on error
  - power: supply: max77693: Fix wrong conversion of charge input threshold value
  - x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
  - clk: amlogic: g12a: fix mmc A peripheral clock
  - clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
  - selftests/bpf: Select NUMA_NO_NODE to create map
  - clk: amlogic: gxbb: drop non existing 32k clock parent
  - clk: amlogic: g12b: fix cluster A parent data
  - pinctrl: tegra: Set SFIO mode to Mux Register
  - IB/mad: Check available slots before posting receive WRs
  - remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
  - RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
  - RDMA/mlx5: Fix calculation of total invalidated pages
  - clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
  - pinctrl: renesas: rzg2l: Fix missing of_node_put() call
  - pinctrl: renesas: rza2: Fix missing of_node_put() call
  - lib: 842: Improve error handling in sw842_compress()
  - remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
  - RDMA/mana_ib: Ensure variable err is initialized
  - clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
  - clk: samsung: Fix UBSAN panic in samsung_clk_init()
  - selftests/bpf: Fix string read in strncmp benchmark
  - libbpf: Fix hypothetical STT_SECTION extern NULL deref case
  - remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
  - remoteproc: core: Clear table_sz when rproc_shutdown
  - clk: amlogic: gxbb: drop incorrect flag on 32k clock
  - fbdev: sm501fb: Add some geometry checks.
  - mdacon: rework dependency list
  - fbdev: au1100fb: Move a variable assignment behind a null pointer check
  - PCI: pciehp: Don't enable HPIE when resuming in poll mode
  - PCI: histb: Fix an error handling path in histb_pcie_probe()
  - drm/amd/display: avoid NPD when ASIC does not support DMUB
  - drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
  - PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
  - PCI: Remove stray put_device() in pci_register_host_bridge()
  - drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
  - PCI: Avoid reset when disabled via sysfs
  - PCI/portdrv: Only disable pciehp interrupts early when needed
  - PCI: brcmstb: Fix potential premature regulator disabling
  - PCI: brcmstb: Use internal register to change link capability
  - PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
  - drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables'
  - drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
  - drm/msm/dsi: Use existing per-interface slice count in DSC timing
  - drm/msm/dpu: don't use active in atomic_check()
  - drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
  - drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
  - PCI: Use downstream bridges for distributing resources
  - drm: xlnx: zynqmp: Fix max dma segment size
  - drm/bridge: it6505: fix HDCP V match check is not performed correctly
  - drm/dp_mst: Fix drm RAD print
  - drm/bridge: ti-sn65dsi86: Fix multiple instances
  - ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
  - ALSA: hda/realtek: Always honor no_shutup_pins
  - dt-bindings: vendor-prefixes: add GOcontroll
  - HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
  - ASoC: cs35l41: check the return value from spi_setup()
  - platform/x86: dell-ddv: Fix temperature calculation
  - media: platform: allgro-dvt: unregister v4l2_device on the error path
  - media: verisilicon: HEVC: Initialize start_bit field
  - x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
  - x86/traps: Make exc_double_fault() consistently noreturn
  - perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
  - lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
  - PM: sleep: Fix handling devices with direct_complete set on errors
  - EDAC/ie31200: Fix the error path order of ie31200_init()
  - EDAC/ie31200: Fix the DIMM size mask for several SoCs
  - EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
  - selinux: Chain up tool resolving errors in install_policy.sh
  - RISC-V: KVM: Disable the kernel perf counter during configure
  - PM: sleep: Adjust check before setting power.must_resume
  - lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
  - x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
  - x86/platform: Only allow CONFIG_EISA for 32-bit
  - x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
  - x86/fpu: Fix guest FPU state buffer allocation size
  - smack: dont compile ipv6 code unless ipv6 is configured
  - cpufreq: scpi: compare kHz instead of Hz
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
  - watch_queue: fix pipe accounting mismatch
  - ub: ub_fwctl: support ummu data processing
  - ub: ub_fwctl: query the MSG queue information and entry details within UB.
  - ub: ub_fwctl: support querying SCC and io_die related information.
  - ub: ub_fwctl: support querying UB link trace information.
  - ub: ub_fwctl: Support Dump register.
  - ub: ub_fwctl: supports querying and configuring some scattered registers.
  - ub: ub_fwctl: supports querying TP, BA related register information
  - dma-mapping: benchmark: add support for UB devices
  - ub: ub_fwctl: supports querying NL, TA, DL related register information
  - ub: ub_fwctl: Add some simple common framework functions
  - ub: ub_fwctl: Add the ub_fwctl driver and its basic features.
  - mm/thp: Add a new sysfs knob for zero COW
  - !18803  arm64/mpam: Add quirk to retrigger L3 CSU monitor
  - net: unic: support querying and configuring queue parameters.
  - net: unic: support querying and configuring the number of queues.
  - net: unic: support querying and configuring simple RSS.
  - net: unic: support querying and configuring promisc.
  - net: unic: support querying and configuring MTU.
  - net: unic: support querying and configuring FEC parameters.
  - net: unic: add fec statistic support
  - net: unic: add rack ip for unic
  - net: unic: add io basic Rx/Tx functionality for unic
  - net: unic: add support of unic driver for ub network
  - !18914  misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
  - !18915  scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
  - !18916  software node: Correct a OOB check in software_node_get_reference_args()
  - !18917  KVM: x86: use array_index_nospec with indices that come from guest
  - !18877 iommu/ummu: Implement IOMMU ops and advanced capabilities.
  - mm/swap: get the swap device offset directly
  - mm: add nr_free_highatomic in show_free_areas
  - ub:ubus: reserve space for ub subsystem related structure
  - ub:hisi-ubus: Support UBUS configure EID-UPI table
  - ub:hisi-ubus: Support UBUS vdm entity enable message
  - ub:hisi-ubus: Support for MSGQ's debugging functionality
  - urma: implement ubcore sysfs interface and device management
  - mm: migrate: add isolate_folio_to_list()
  - urma: implement ubcore basic connection and bonding support
  - urma: add network framework facilities for ubcore.
  - urma: add tp table support and related cmd header for ubcore.
  - CCA: unmap state2 range can block to fix soft lockup while destroy realm
  - config: enable config for PLR
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID
  - perf: Fix tt_core mismatch over PG CPU
  - iommu/ummu: Add UMMU trace log
  - iommu/ummu: Support UMMU identity mapping
  - iommu/ummu: Add UB Memory support
  - iommu/ummu: Support UMMU iopf capability
  - iommu/ummu: Support UMMU nested mode
  - iommu/ummu: Add SVA API support to UMMU driver
  - iommu/ummu: Implement iommu_ops and iommu_domain_ops for UMMU driver
  - iommu/ummu: Implement domain and core ops in logic UMMU framework
  - iommu/ummu: Implement MPAM for QoS
  - iommu/ummu: Support UMMU attribute show and store operations
  - iommu/ummu: Implement IOMMU ops forwarding in logic UMMU framework
  - iommu/ummu: Support UMMU page table management
  - iommu/ummu: Introduce logic UMMU framework
  - iommu/ummu: Add UMMU permission queue
  - iommu/ummu: Add grant and ungrant operations for permission table
  - iommu/ummu: Add UMMU permission table memory management
  - iommu/ummu: Add UMMU private implementation
  - iommu/ummu: Add manager for UMMU permission table
  - iommu/ummu: Add tct/tect ops for configuration table
  - iommu/ummu: Support UMMU configuration table management
  - ub: ubase: Support querying dev caps.
  - ub: ubase: Supports the query of UBCL config.
  - ub: ubase: add function that query aeq/ceq/tp/tpg context
  - KVM: x86: use array_index_nospec with indices that come from guest
  - software node: Correct a OOB check in software_node_get_reference_args()
  - scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
  - misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
  - mfs: tool: Add mfs user space tool demo
  - mfs: Optimize mfs syncer process and metadata ops
  - mfs: enable MFS
  - MAINTAINERS: Add maintainer for mfs
  - mfs: Add MFS documentation
  - mfs: Add tracepoint for MFS
  - mfs: Add user command for handling events
  - mfs: Add communication devie and event acquisition operations
  - mfs: Add basic events framework
  - mfs: Add basic cache framework: check method and control structure
  - mfs: Add basic data operation for MFS
  - mfs: Add basic metadata operation for MFS
  - mfs: implement the mount procedure
  - mfs: Initialize mfs module
  - platform/x86/intel: power-domains: Add Clearwater Forest support
  - platform/x86/intel/tpmi/plr: Fix output in plr_print_bits()
  - platform/x86/intel/tpmi/plr: Add support for the plr mailbox
  - platform/x86/intel/tpmi: Add new auxiliary driver for performance limits
  - platform/x86/intel: TPMI domain id and CPU mapping
  - platform/x86/intel/tpmi: Add API to get debugfs root
  - platform/x86/intel/tpmi: Add support for performance limit reasons
  - batman-adv: Switch to linux/array_size.h
  - ub:hisi-ubus: Support MSGQ queue exception handling
  - ub:hisi-ubus: Support for processing CQ request messages
  - ub:hisi-ubus: Provide callback functions for message devices
  - ub:hisi-ubus: Support for MSGQ channel processing in SQ and CQ
  - ub:hisi-ubus: Support for hisi MSGQ framework
  - ub:hisi-ubus: Support UBUS local RAS interfaces
  - ub:hisi-ubus: Support UBUS vdm pue/ue register and release
  - ub:hisi-ubus: Support UBUS vendor defined message framework
  - ub:hisi-ubus: Add HiSilicon ubus driver framework
  - drm/amdgpu: csa unmap use uninterruptible lock
  - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
  - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
  - ASoC: codecs: wcd9335: Fix missing free of regulator supplies
  - ASoC: codec: wcd9335: Convert to GPIO descriptors
  - ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe()
  - parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
  - mm: introduce memalloc_flags_{save,restore}
  - ub: ubase: Added debug information query function for FST/FVT/RQMT entries
  - ub: ubase: support debugfs for active dev stats.
  - MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
  - bpf: Disable migration in nf_hook_run_bpf().
  - gmem: fix some warnings
  - parisc: Revise __get_user() to probe user read access
  - LoongArch: Optimize module load time by optimizing PLT/GOT counting
  - drm/amd/display: Avoid a NULL pointer dereference
  - wifi: wilc1000: avoid buffer overflow in WID string configuration
  - eventpoll: don't decrement ep refcount while still holding the ep mutex
  - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
  - f2fs: fix to do sanity check on ino and xnid
  - jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
  - aoe: clean device rq_list in aoedev_downdev()
  - arm64/mpam: Add quirk for L3 CPBM validity check
  - fs/resctrl: Fix the L3 CMAX conversion mechanism
  - kernel.h: Move ARRAY_SIZE() to a separate header
  - atm: atmtcp: Free invalid length skb in atmtcp_c_send().
  - exfat: fix double free in delayed_free
  - arm64/mpam: Add quirk to retrigger L3 CSU monitor
  - configs: Add Zhaoxin GPIO pinctrl for kh-50000 in openeuler_config
  - pinctrl: Zhaoxin: Add KH-50000 support
  - wifi: ath12k: Fix memory leak due to multiple rx_stats allocation
  - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
  - iio: imu: bno055: fix OOB access of hw_xlate array
  - s390/ism: fix concurrency management in ism_cmd()
  - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
  - btrfs: avoid NULL pointer dereference if no valid csum tree
  - fs/ntfs3: handle hdr_first_de() return value
  - clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
  - wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
  - net: usb: aqc111: debug info before sanitation
  - net: usb: aqc111: fix error handling of usbnet read calls
  - coresight: fix indentation error in cscfg_remove_owned_csdev_configs()
  - coresight: holding cscfg_csdev_lock while removing cscfg from csdev
  - coresight: change coresight_device lock type to raw_spinlock_t
  - hfs: fix slab-out-of-bounds in hfs_bnode_read()
  - jfs: Regular file corruption check
  - net: wangxun: ngbe: add support for wangxun 1G
  - RDMA/bnxt_re: Fix error recovery sequence
  - bnxt_en: Fix ethtool -d byte order for 32-bit values
  - bnxt_en: Fix DCB ETS validation
  - Fix kabi for CWF PMU support
  - crypto: sm4 - Refactor mode handling and optimize performance
  - i2c: zhaoxin: Enhancements and Modifications to SMBus Driver
  - ACPI: processor: idle: Set timer broadcast state on C3 for KH-50000
  - hwmon: zhaoxin-cputemp: Update for KH-50000
  - perf/zhaoxin/core: Tailor FMS for KH-50000
  - crypto: sm3 - Refactor code and harden security
  - perf mem: Fix printing PERF_MEM_LVLNUM_{L2_MHB|MSC}
  - perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap()
  - perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK
  - KVM: x86/pmu: Manipulate FIXED_CTR_CTRL MSR with macros
  - KVM: x86/pmu: Change ambiguous _mask suffix to _rsvd in kvm_pmu
  - KVM: x86/pmu: Add common define to capture fixed counters offset
  - perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error
  - tools arch x86: Sync the msr-index.h copy with the kernel sources
  - tools/include: Sync x86 headers with the kernel sources
  - perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr()
  - perf/x86/intel: Fix bitmask of OCR and FRONTEND events for LNC
  - perf/x86/intel: Fix event constraints for LNC
  - perf/x86/intel/ds: Fix counter backwards of non-precise events counters-snapshotting
  - perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
  - perf vendor events: Add Clearwaterforest events
  - perf/x86/intel/uncore: Support customized MMIO map size
  - perf/x86/intel/uncore: Support MSR portal for discovery tables
  - perf/x86/intel/uncore: Add Clearwater Forest support
  - perf/uapi: Clean up <uapi/linux/perf_event.h> a bit
  - tools headers: Update the uapi/linux/perf_event.h copy with the kernel sources
  - tools/include: Sync uapi/linux/perf.h with the kernel sources
  - perf/x86: Optimize the is_x86_event
  - perf/x86/intel: Check the X86 leader for ACR group
  - perf/x86/intel: Check the X86 leader for pebs_counter_event_group
  - perf/x86/intel: Parse CPUID archPerfmonExt leaves for non-hybrid CPUs
  - perf/x86/intel: Add PMU support for Clearwater Forest
  - perf/x86/intel: Don't clear perf metrics overflow bit unconditionally
  - perf/x86/intel: Support auto counter reload
  - perf/x86/intel: Add CPUID enumeration for the auto counter reload
  - perf: Extend the bit width of the arch-specific flag
  - perf/x86/intel: Track the num of events needs late setup
  - perf/x86: Add dynamic constraint
  - perf: Extend per event callchain limit to branch stack
  - perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF
  - perf/x86/intel: Support PEBS counters snapshotting
  - Optimize Zhaoxin CPU Temp Monitoring During Suspend/Resume
  - Optimize VIA CPU Temp Monitoring During Suspend/Resume
  - perf/x86/intel: Support RDPMC metrics clear mode
  - perf/x86/intel/ds: Add PEBS format 6
  - perf/x86/intel/ds: Simplify the PEBS records processing for adaptive PEBS
  - perf/x86/intel/ds: Factor out functions for PEBS records processing
  - perf/x86/intel/ds: Clarify adaptive PEBS processing
  - perf/x86/intel: Support Perfmon MSRs aliasing
  - perf/x86/intel: Support PERFEVTSEL extension
  - perf/x86: Add config_mask to represent EVENTSEL bitmask
  - perf/x86/intel: Support new data source for Lunar Lake
  - perf/x86/intel: Rename model-specific pebs_latency_data functions
  - perf/x86: Add Lunar Lake and Arrow Lake support
  - perf/x86: Support counter mask
  - crypto: ccp: add ccp-mdev functionality to the ccp module.
  - usb: renesas_usbhs: Reorder clock handling and power management in probe
  - perf/x86/intel: Support the PEBS event mask
  - tools headers UAPI: Sync include/uapi/linux/perf_event.h header with the kernel
  - perf/x86/intel/uncore: Support more units on Granite Rapids
  - perf/x86/intel/uncore: Clean up func_id
  - powerpc/eeh: Make EEH driver device hotplug safe
  - mm: Use pr_warn_once() for min_free_kbytes warning
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
  - sctp: linearize cloned gso packets in sctp_rcv
  - net/smc: fix UAF on smcsk after smc_listen_out()


author: Li Nan <linan122@huawei.com> - 6.6.0-121.0.0.123
changelog:
  - !19291  usbnet: Fix using smp_processor_id() in preemptible code warnings
  - !19191  Fix CVE-2025-40200
  - !19303  pid: Add a judgment for ns null in pid_nr_ns
  - !19282  fix cves
  - !19211  ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
  - !19175 [OLK-6.6] Fix CVE-2025-38666
  - !18496 [OLK-6.6] Fix CVE-2025-22107
  - !18029 [OLK-6.6] Fix CVE-2025-37892
  - !19151 [OLK-6.6] Fix CVE-2025-40055
  - !19131 [OLK-6.6] Fix CVE-2025-40012
  - !19125 [OLK-6.6] Fix CVE-2025-39692
  - !19124 [OLK-6.6] Fix CVE-2025-39694
  - !19133 [OLK-6.6] Fix CVE-2025-40082
  - !19118 [OLK-6.6] Fix CVE-2025-39703
  - !19113 [OLK-6.6] Fix CVE-2025-39938
  - !19111 [OLK-6.6] Fix CVE-2025-40043
  - !19100 obmm: Ownership Based Memory Management framework
  - pid: Add a judgment for ns null in pid_nr_ns
  - !19285  xsched: XCU Partition
  - !19293  sched/rt: Fix race in push_rt_task
  - !19294  dm-stripe: fix a possible integer overflow
  - !19278 ub: ubase: Improve performance and fix some bug
  - dm-stripe: fix a possible integer overflow
  - sched/rt: Fix race in push_rt_task
  - usbnet: Fix using smp_processor_id() in preemptible code warnings
  - xsched: move stream_lock into xsched_vsm_add_tail() to avoid sleeping in atomic context
  - xsched: rename vstream->id to vstream->sq_id
  - xsched: add null check for sched in xsched_xse_set_class
  - xsched: modify the logic for inc and dec the count value
  - xsched: replace hard-coded numeric values
  - xsched: unify root detection logic for cgroups
  - xsched: remove parent->lock and rely on cgroup_mutex for shares update
  - xsched: avoid sleeping while holding spinlock in xcu_move_task()
  - xsched: add missing spin_unlock() in xcu_move_task() error path
  - xsched: enforce valid xsched scheduler config dependencies
  - xsched: unify log prefix format and remove duplicated prefix macros
  - mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
  - mm: zswap: move allocations during CPU init outside the lock
  - mm: zswap: properly synchronize freeing resources during CPU hotunplug
  - mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx
  - mm/hugetlb: unshare page tables during VMA split, not before
  - !19194  ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
  - !19195  iommu/vt-d: debugfs: Fix legacy mode page table dump logic
  - !19273  net/ip6_tunnel: Prevent perpetual tunnel growth
  - !19272  tls: wait for pending async decryptions if tls_strp_msg_hold fails
  - !19274  netfilter: nft_objref: validate objref and objrefmap expressions
  - !19052  arm64/mpam: Add build dependencies for CONFIG_RESCTRL_IOMMU
  - !19182  ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
  - !19179  x86/iopl: Cure TIF_IO_BITMAP inconsistencies
  - !19178  fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  - !19177  ACPICA: fix acpi parse and parseext cache leaks
  - !19176  crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - ub: ubase: change cmdq/mbx timeout val & fix spell error
  - ub: ubase: adapt to response message structure change for ctrlq sl query
  - net: unic: Fix UE deactivate message cleaning
  - net: unic: Use copy instead of ummu map in tx
  - netfilter: nft_objref: validate objref and objrefmap expressions
  - net/ip6_tunnel: Prevent perpetual tunnel growth
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails
  - !19257  init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
  - obmm: Add resource management support for imported memory
  - obmm: Add sysfs interface for configuration and monitoring
  - obmm: Add low memory management support
  - obmm: Add ownership management and transfer mechanisms
  - obmm: Add mmap support for shared memory regions
  - obmm: Add shared memory device interface
  - obmm: Add pre-import support for performance optimization
  - obmm: Add memory region import functionality
  - obmm: Add address validation and checking
  - obmm: Add user address export support
  - obmm: Add memory region export functionality
  - obmm: Implement memory pool allocator
  - obmm: Add continuous memory allocator for OBMM framework
  - obmm: Add cache maintenance helpers for inter-node consistency
  - obmm: Add region definitions and core data structures
  - obmm: Add Ownership Based Memory Management framework
  - ub:hisi-ubus: Support for ub memory decoder ras handle
  - ub:hisi-ubus: Support for UB Memory Decoder Initialization
  - ub:ubus: Support for UB Memory Decoder general layer implementation
  - !19227  bpf: Avoid RCU context warning when unpinning htab with internal structs
  - !18830  mm: swap: check for stable address space before operating on the VMA
  - init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
  - !19165 Documentation: Add opensource document for ubase&unic&ubl
  - !19243 Revert "net: hns3: add support for queue bonding mode of flow director"
  - !19115  nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
  - !19222  sctp: Fix MAC comparison to be constant-time
  - !19223  net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
  - !19224  bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
  - !19226  sunrpc: fix null pointer dereference on zero-length checksum
  - Revert "net: hns3: add support for queue bonding mode of flow director"
  - Revert "net: hns3: add queue bonding mode support for VF"
  - Revert "net: hns3: refactor the debugfs for dumping FD tcam"
  - Revert "net: hns3: correct the logic of hclge_sync_vf_qb_mode()"
  - Revert "net: hns3: allocate fd counter for queue bonding"
  - !19166 [OLK-6.6][linux-6.6.y sync] Backport 6.6.89-6.6.90 LTS Patches
  - !19116 Fix SPI registration failure logging level
  - !19216  net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
  - Fix SPI registration failure logging level
  - !19072 [OLK-6.6] Fix CVE-2025-39827
  - !18647 [OLK-6.6] Fix CVE-2025-38729
  - !19117 [OLK-6.6] Fix CVE-2025-40088
  - !19114 [OLK-6.6] Fix CVE-2025-40084
  - !19048 [OLK-6.6] Fix CVE-2025-39839
  - !18615 [OLK-6.6] Fix CVE-2025-39737
  - !18791 【OLK-6.6】fix CVE-2025-39736
  - !18644 [OLK-6.6] Fix CVE-2025-38717
  - !18653 [OLK-6.6] Fix CVE-2025-38705
  - !18780 【OLK-6.6】fix  CVE-2025-38712
  - !18613 [OLK-6.6] Fix CVE-2025-38713
  - !18632 [OLK-6.6] Fix CVE-2025-38714
  - !18861 [OLK-6.6] Fix CVE-2025-38697
  - !18345 [OLK-6.6] Fix CVE-2025-38663
  - !18948 [OLK-6.6] Fix CVE-2025-38105
  - !18661 [OLK-6.6] Fix CVE-2025-39790
  - !18867 [OLK-6.6] Fix CVE-2025-39766
  - !18636 [OLK-6.6]Fix CVE-2025-39751
  - !19110  CVE-2025-40198
  - !19212  CVE-2025-40179
  - !19057  blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
  - !19213  Fix CVE-2025-39964
  - !19189  KVM: arm64: ipiv: change declaration argument
  - bpf: Avoid RCU context warning when unpinning htab with internal structs
  - sunrpc: fix null pointer dereference on zero-length checksum
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
  - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
  - sctp: Fix MAC comparison to be constant-time
  - !19214 ub: udma: recent bugfix for udma.
  - !19209  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  - !19193  crypto: af_alg - Set merge to zero early in af_alg_sendmsg
  - !19206  net: dlink: handle copy_thresh allocation failure
  - !19207  net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
  - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
  - ub: ubase: Introduces the functions and data structures exposed by the ubase driver
  - ub: ubase: Add ubase opensource document
  - net: unic: Add a doc for unic driver
  - ub: udma: Resolve issues related to stream logout and interrupt lock.
  - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
  - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
  - ext4: align max orphan file size with e2fsprogs limit
  - ext4: free orphan info with kvfree
  - ext4: verify orphan file size is not too big
  - ext4: use kmalloc_array() for array space allocation
  - ub: udma: reset and segment permission issues are resolved.
  - !19203  Fix CVE-2025-40202
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
  - net: dlink: handle copy_thresh allocation failure
  - spi: tegra114: Use value to check for invalid delays
  - platform/x86/amd: pmc: Clear metrics table at start of cycle
  - dm: fix copying after src array boundaries
  - iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids
  - drivers: base: handle module_kobject creation
  - kernel: globalize lookup_or_create_module_kobject()
  - kernel: param: rename locate_module_kobject
  - xhci: split free interrupter into separate remove and free parts
  - xhci: Clean up stale comment on ERST_SIZE macro
  - xhci: Use more than one Event Ring segment
  - xhci: Set DESI bits in ERDP register correctly
  - Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
  - arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs
  - arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs
  - ARM: dts: opos6ul: add ksz8081 phy properties
  - firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
  - firmware: arm_scmi: Balance device refcount when destroying devices
  - sch_htb: make htb_qlen_notify() idempotent
  - ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties
  - ASoC: Use of_property_read_bool()
  - net: vertexcom: mse102x: Fix RX error handling
  - net: vertexcom: mse102x: Add range check for CMD_RTS
  - net: vertexcom: mse102x: Fix LEN_MASK
  - net: vertexcom: mse102x: Fix possible stuck of SPI interrupt
  - net: fec: ERR007885 Workaround for conventional TX
  - net: ipv6: fix UDPv6 GSO segmentation with NAT
  - net: dsa: felix: fix broken taprio gate states after clock jump
  - net: mdio: mux-meson-gxl: set reversed bit when using internal phy
  - net: dlink: Correct endianness handling of led_mode
  - nvme-pci: fix queue unquiesce check on slot_reset
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
  - pds_core: make pdsc_auxbus_dev_del() void
  - pds_core: delete VF dev on reset
  - pds_core: check health in devcmd wait
  - net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised
  - net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
  - net: mscc: ocelot: treat 802.1ad tagged traffic as 802.1Q-untagged
  - !19190  Revert "ipmi: fix msg stack when IPMI is disconnected"
  - !19167  drm/vmwgfx: Fix a null-ptr access in the cursor snooper
  - ipmi: Fix handling of messages with provided receive message pointer
  - ipmi: Rework user message limit handling
  - !19134  Bluetooth: ISO: Fix possible UAF on iso_conn_free
  - !19119  dm: fix NULL pointer dereference in __dm_suspend()
  - !19137  ext4: guard against EA inode refcount underflow in xattr update
  - iommu/vt-d: debugfs: Fix legacy mode page table dump logic
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
  - net/mlx5: E-switch, Fix error handling for enabling roce
  - net/mlx5: E-Switch, Initialize MAC Address for Default GID
  - powerpc/boot: Fix dash warning
  - drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions'
  - powerpc/boot: Check for ld-option support
  - ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
  - Squashfs: reject negative file sizes in squashfs_read_inode()
  - Squashfs: add additional inode sanity checking
  - Revert "ipmi: fix msg stack when IPMI is disconnected"
  - KVM: arm64: ipiv: change declaration argument
  - !19030  cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
  - !19045 net: fix the compile problem introduced by AF_UB
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  - ACPICA: fix acpi parse and parseext cache leaks
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  - net: appletalk: Fix use-after-free in AARP proxy probe
  - net: ubl: Add a doc for ubl module
  - !19161 uburma: add tp_type in urma ioctl operation.
  - drm/vmwgfx: Fix a null-ptr access in the cursor snooper
  - PCI: imx6: Skip controller_id generation logic for i.MX7D
  - Revert "PCI: imx6: Skip controller_id generation logic for i.MX7D"
  - selftests/bpf: extend changes_pkt_data with cases w/o subprograms
  - selftests/bpf: validate that tail call invalidates packet pointers
  - selftests/bpf: freplace tests for tracking of changes_packet_data
  - cpufreq: Fix setting policy limits when frequency tables are used
  - cpufreq: Avoid using inconsistent policy->min and policy->max
  - smb: client: fix zero length for mkdir POSIX create context
  - platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug
  - platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles
  - iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
  - dm: always update the array size in realloc_argv on success
  - dm-integrity: fix a warning on invalid table line
  - dm-bufio: don't schedule in atomic context
  - tracing: Do not take trace_event_sem in print_event_fields()
  - spi: tegra114: Don't fail set_cs_timing when delays are zero
  - mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
  - mm/memblock: repeat setting reserved region nid if array is doubled
  - mm/memblock: pass size instead of end to memblock_set_node()
  - amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
  - i2c: imx-lpi2c: Fix clock count when probe defers
  - EDAC/altera: Set DDR and SDMMC interrupt mask before registration
  - EDAC/altera: Test the correct error reg offset
  - drm/fdinfo: Protect against driver unbind
  - btrfs: fix COW handling in run_delalloc_nocow()
  - ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
  - ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
  - !19143 [OLK-6.6][linux-6.6.y sync] Backport 6.6.88-6.6.89 LTS Patches
  - uburma: add tp_type in urma ioctl operation.
  - !19132  IPIV: fix bug in live migration
  - ocfs2: fix double free in user_cluster_connect()
  - !17056 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.68-6.6.69 LTS Conflicts Patches
  - !18479 [OLK-6.6] xhci: fix memory leak regression when freeing xhci vdev devices depth first
  - !19007  uio_hv_generic: Let userspace take care of interrupt mask
  - ACPI: PPTT: Fix processor subtable walk
  - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
  - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points
  - dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
  - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
  - ata: libata-scsi: Fix CDL control
  - net: fix the compile problem introduced by AF_UB
  - objtool: Silence more KCOV warnings, part 2
  - objtool: Ignore end-of-section jumps for KCOV/GCOV
  - nvme: fixup scan failure for non-ANA multipath controllers
  - MIPS: cm: Fix warning if MIPS_CM is disabled
  - net: dsa: mv88e6xxx: enable STU methods for 6320 family
  - net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
  - net: dsa: mv88e6xxx: enable PVT for 6321 switch
  - net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
  - comedi: jr3_pci: Fix synchronous deletion of timer
  - driver core: introduce device_set_driver() helper
  - x86/pvh: Call C code via the kernel virtual mapping
  - md/raid1: Add check for missing source disk in process_checks()
  - x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores
  - ubsan: Fix panic from test_ubsan_out_of_bounds
  - spi: tegra210-quad: add rate limiting and simplify timeout error message
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts
  - loop: aio inherit the ioprio of original request
  - riscv: Provide all alternative macros all the time
  - iomap: skip unnecessary ifs_block_is_uptodate check
  - x86/i8253: Call clockevent_i8253_disable() with interrupts disabled
  - scsi: pm80xx: Set phy_attached to zero when device is gone
  - scsi: ufs: exynos: Ensure pre_link() executes before exynos_ufs_phy_init()
  - ext4: make block validity check resistent to sb bh corruption
  - cifs: Fix querying of WSL CHR and BLK reparse points over SMB1
  - timekeeping: Add a lockdep override in tick_freeze()
  - cifs: Fix encoding of SMB1 Session Setup Kerberos Request in non-UNICODE mode
  - nvmet-fc: put ref when assoc->del_work is already scheduled
  - nvmet-fc: take tgtport reference only once
  - x86/bugs: Don't fill RSB on context switch with eIBRS
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
  - x86/bugs: Use SBPB in write_ibpb() if applicable
  - selftests/mincore: Allow read-ahead pages to reach the end of the file
  - gpiolib: of: Move Atmel HSMCI quirk up out of the regulator comment
  - objtool: Stop UNRET validation on UD2
  - nvme: multipath: fix return value of nvme_available_path
  - nvme: re-read ANA log page after ns scan completes
  - ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
  - ACPI: EC: Set ec_no_wakeup for Lenovo Go S
  - nvme: requeue namespace scan on missed AENs
  - xen: Change xen-acpi-processor dom0 dependency
  - selftests: ublk: fix test_stripe_04
  - udmabuf: fix a buf size overflow issue during udmabuf creation
  - KVM: s390: Don't use %pK through debug printing
  - KVM: s390: Don't use %pK through tracepoints
  - sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
  - io_uring: always do atomic put from iowq
  - rtc: pcf85063: do a SW reset if POR failed
  - ntb_hw_amd: Add NTB PCI ID for new gen CPU
  - ntb: reduce stack usage in idt_scan_mws
  - objtool, lkdtm: Obfuscate the do_nothing() pointer
  - objtool, regulator: rk808: Remove potential undefined behavior in rk806_set_mode_dcdc()
  - objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler()
  - objtool, panic: Disable SMAP in __stack_chk_fail()
  - objtool: Silence more KCOV warnings
  - thunderbolt: Scan retimers after device router has been enumerated
  - usb: host: xhci-plat: mvebu: use ->quirks instead of ->init_quirk() func
  - usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
  - usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
  - dmaengine: dmatest: Fix dmatest waiting less when interrupted
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
  - usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
  - usb: dwc3: gadget: Refactor loop to avoid NULL endpoints
  - fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
  - usb: host: max3421-hcd: Add missing spi_device_id table
  - bpf: Reject attaching fexit/fmod_ret to __noreturn functions
  - bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage
  - bpf: bpftool: Setting error code in do_loader()
  - s390/tty: Fix a potential memory leak bug
  - s390/sclp: Add check for get_zeroed_page()
  - parisc: PDT: Fix missing prototype warning
  - clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
  - crypto: ccp - Add support for PCI device 0x1134
  - MIPS: cm: Detect CM quirks from device tree
  - pinctrl: renesas: rza2: Fix potential NULL pointer dereference
  - USB: wdm: add annotation
  - USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop
  - USB: wdm: handle IO errors in wdm_wwan_port_start
  - USB: VLI disk crashes if LPM is used
  - usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
  - usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
  - usb: dwc3: xilinx: Prevent spike in reset signal
  - USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
  - usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
  - usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
  - usb: cdns3: Fix deadlock when using NCM gadget
  - USB: serial: simple: add OWON HDS200 series oscilloscope support
  - USB: serial: option: add Sierra Wireless EM9291
  - USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
  - serial: sifive: lock port in startup()/shutdown() callbacks
  - serial: msm: Configure correct working mode before starting earlycon
  - misc: microchip: pci1xxxx: Fix incorrect IRQ status handling during ack
  - misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration
  - char: misc: register chrdev region with all possible minors
  - KVM: x86: Explicitly treat routing entry type changes as changes
  - mei: me: add panther lake H DID
  - scsi: Improve CDL control
  - USB: storage: quirk for ADATA Portable HDD CH94
  - ata: libata-scsi: Fix ata_msense_control_ata_feature()
  - ata: libata-scsi: Fix ata_mselect_control_ata_feature() return type
  - ata: libata-scsi: Improve CDL control
  - cxl/core/regs.c: Skip Memory Space Enable check for RCD and RCH Ports
  - KVM: SVM: Allocate IR data using atomic allocation
  - io_uring: fix 'sync' handling of io_fallback_tw()
  - LoongArch: Remove a bogus reference to ZONE_DMA
  - drm/amd/display: Force full update in gpu reset
  - drm/amd/display: Fix gpu reset in multidisplay config
  - net: phy: microchip: force IRQ polling mode for lan88xx
  - net: selftests: initialize TCP header and skb payload with zero
  - crypto: atmel-sha204a - Set hwrng quality to lowest possible
  - virtio_console: fix missing byte order handling for cols and rows
  - LoongArch: Make do_xyz() exception handlers more robust
  - LoongArch: Make regs_irqs_disabled() more clear
  - LoongArch: Select ARCH_USE_MEMTEST
  - splice: remove duplicate noinline from pipe_clear_nowait
  - iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
  - pds_core: Remove unnecessary check in pds_client_adminq_cmd()
  - net: dsa: mt7530: sync driver-specific behavior of MT7531 variants
  - net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration
  - scsi: core: Clear flags for scsi_cmnd that did not complete
  - btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()
  - cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
  - dma/contiguous: avoid warning about unused size_bytes
  - ceph: Fix incorrect flush end position calculation
  - scsi: ufs: qcom: fix dev reference leaked through of_qcom_ice_get
  - of: resolver: Fix device node refcount leakage in of_resolve_phandles()
  - of: resolver: Simplify of_resolve_phandles() using __free()
  - clk: renesas: r9a07g043: Fix HP clock source for RZ/Five
  - clk: renesas: r9a07g04[34]: Fix typo for sel_shdi variable
  - clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration for SD1 mux
  - clk: renesas: rzg2l: Refactor SD mux driver
  - clk: renesas: rzg2l: Remove CPG_SDHI_DSEL from generic header
  - clk: renesas: rzg2l: Add struct clk_hw_data
  - clk: renesas: rzg2l: Use u32 for flag and mux_flags
  - arm64: tegra: Remove the Orin NX/Nano suspend key
  - iio: adc: ad7768-1: Fix conversion result sign
  - iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
  - ASoC: q6apm-dai: make use of q6apm_get_hw_pointer
  - ASoC: qcom: Fix trivial code style issues
  - ASoC: qcom: lpass: Make asoc_qcom_lpass_cpu_platform_remove() return void
  - ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
  - ASoC: qcom: q6apm-dai: drop unused 'q6apm_dai_rtd' fields
  - net: dsa: mv88e6xxx: fix VTU methods for 6320 family
  - net: dsa: mv88e6xxx: fix internal PHYs for 6320 family
  - auxdisplay: hd44780: Fix an API misuse in hd44780.c
  - auxdisplay: hd44780: Convert to platform remove callback returning void
  - mmc: sdhci-msm: fix dev reference leaked through of_qcom_ice_get
  - soc: qcom: ice: introduce devm_of_qcom_ice_get
  - module: sign with sha512 instead of sha1 by default
  - !18797 [OLK-6.6] Fix CVE-2025-38331
  - !18978 [OLK-6.6][linux-6.6.y sync] Backport 6.6.87-6.6.88 LTS Patches
  - !19141  crash: fix crashkernel resource shrink
  - !19136  ext4: detect invalid INLINE_DATA + EXTENTS flag combination
  - !18976 ubagg: implement ubagg module with ioctl interface and topology management
  - crash: fix crashkernel resource shrink
  - !19139 ub: ubase: Fix CTRLQ init process
  - !18998 uburma: implement jetty linking features.
  - ub: ubase: Fix CTRLQ init process
  - ext4: guard against EA inode refcount underflow in xattr update
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination
  - !19123 ub: udma: Support udma basic transaction operations and advanced features.
  - !19122  crypto: rng - Ensure set_ent is always present
  - !19121 ub: ubase: Do some bugfix about cmdq/ctrlq message and debugfs
  - net: rose: fix a typo in rose_clear_routes()
  - urma: add ubagg ioctl interface and topology management
  - ub: udma: jetty and rct support the hugepage buffer.
  - ub: udma: Support 2M hugepage function.
  - ub: udma: Support query ub memory info.
  - ub: udma: Support query resource ratio.
  - ub: udma: Support query entity information.
  - ub: udma: Support create and destroy stars jfc.
  - ub: udma: Support create and destroy stars jfs.
  - ub: udma: Support tp context inquiry.
  - ub: udma: Support entity index inquiry.
  - ub: udma: Support device status inquiry.
  - ub: udma: Support flush jfs and jetty.
  - ub: udma: Support destroy jfs and jetty batch.
  - ub: udma: Support bind and unbind jetty.
  - ub: udma: Support dump ce aux info.
  - ub: udma: Support dump ae aux info.
  - ub: udma: Support query NPU info.
  - ub: udma: Support deactivate tp.
  - ub: udma: Support active tp.
  - ub: udma: Support get tp list.
  - ub: udma: Support rearm jfc and clean jfc.
  - ub: udma: Support poll jfc.
  - ub: udma: Support post jetty work request.
  - ub: udma: Support post jfr work request.
  - ub: udma: Support post jfs work request.
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free
  - net: nfc: nci: Add parameter validation for packet data
  - !19103  Fix CVE-2025-40123
  - !19082 ub:ubus: call ub_host_probe inside register_ub_manage_subsystem_ops
  - KVM: arm64: ipiv: fix bug in live migration
  - KVM: arm64: ipiv: Change parameter from vcpu to kvm
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  - uburma: implement comprehensive jetty linking and transport features
  - uburma: implement jetty resource control and command structures
  - uburma: add uburma command and user object framework headers
  - uburma: introduce uburma basic types and helper functions
  - !19120  KVM: arm64: Fix access_actlr() build warning
  - !18952 ubcore: implement memory and netlink features.
  - ub: ubase: Fix the lose of HIMAC reset.
  - ub: ubase: flush the work queue.
  - net: unic: Fix lose vport_ctx and vport_buf information query in debugfs
  - !19091 ub: ub_fwctl: Release rpc_out when kernel state return error
  - net/smc: fix warning in smc_rx_splice() when calling get_page()
  - ub: ubase: Fix link status timestamp information
  - net: unic: Fix configure coal parameters without deactivate
  - ub: ubase: Fix CTRLQ white list
  - ub: ubase: Optimization of ubase_ctrlq_send_msg interface parameters
  - ub: ubase: Fix verification to ctrlq message seq
  - net: unic: Fix the ethtool stats and basic capability information query interface
  - ub: ubase: add CMDQ&CTRLQ compatibility code
  - ub: ubase: Fix priqos infomaton interface functions to query and check sl_bitmap
  - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
  - s390/sclp: Fix SCCB present check
  - net: rose: include node references in rose_neigh refcount
  - net: rose: convert 'use' field to refcount_t
  - !19058 ub: udma: udma driver TA layer resource control operation.
  - net: rose: split remove and free operations in rose_remove_neigh()
  - crypto: rng - Ensure set_ent is always present
  - KVM: arm64: Fix access_actlr() build warning
  - dm: fix NULL pointer dereference in __dm_suspend()
  - net, hsr: reject HSR frame if skb can't hold tag
  - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
  - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
  - ksmbd: transport_ipc: validate payload size before reading handle
  - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
  - ext4: fix string copying in parse_apply_sb_mount_options()
  - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
  - !19081 ub:ubus: Fix X86 build error
  - ub: ub_fwctl: Release rpc_out when kernel state return error
  - fwctl:Change the CONFIG_FWCTL in the config options to m
  - selftests/bpf: Add test case for different expected_attach_type
  - bpf: Enforce expected_attach_type for tailcall compatibility
  - ubagg: implement ubagg basic infrastructure components
  - !19093  some minor bugfix about zcopy
  - !19087 v2  Fix bugs
  - !19064 iommu/ummu:  Bugfix of ummu
  - zcopy: Remove the dump_pagetable interface
  - zcopy: Fix the incorrect mapping size passed in attach_pte_range
  - ub: udma: Add and remove jetty to jetty group.
  - ub: udma: Support import and unimport jfr and jetty.
  - iommu/ummu: Fix builds under different kconfigs
  - xcall2.0: Fix stack-out-of-bounds bug in xcall_write()
  - xcall2.0: Fix the semantic changes in xcall_enable
  - xcall2.0: Fix module unload issue by fixing refcount
  - !19071 net:nebula-matrix:fix compile err
  - !19080  KVM: arm64: ipiv: Fix compilation warning
  - !19070  xsched: XCU Partition
  - !18995  CVE-2025-40169
  - !19028 mm/slab: make __free(kfree) accept error pointers
  - ub:ubus: call ub_host_probe inside register_ub_manage_subsystem_ops
  - ub:ubus: Fix X86 build error
  - KVM: arm64: ipiv: Fix compilation warning
  - !19069  mm: hugetlb: avoid soft lockup when mprotect to large memory area
  - !19066  arch_numa: make node_reclaim_distance_setup static
  - !19053  blk-ioinf: fix default weight being reset to 0 for non-root cgroups
  - ubcore: add ubcore_umem and ubcore_tp implementations
  - net:nebula-matrix:fix compile err
  - xsched: Add support for CFS quota for cgroups
  - xsched: Add XCU control group implementation and its backend in xsched CFS
  - xsched: Add xsched CFS class
  - xsched: Add xsched RT class
  - xsched: Add basic scheduler core support
  - xsched: Introduce vstream management
  - xcu: Add base NPU driver support
  - xsched: Add base vstream support
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area
  - ubcore: add ubcore_umem and ubcore_tp implementations
  - ubcore: implement ubcore connection management and messaging feature.
  - ubcore: add segment management support to ubcore module.
  - ubcore: add genl, netlink and vtp support to ubcore module.
  - arch_numa: make node_reclaim_distance_setup static
  - ub: udma: Support modify jfc.
  - ub: udma: Support modify jfr.
  - ub: udma: Support modify jetty.
  - ub: udma: Support modify jfs.
  - ub: udma: Support destroy jetty group.
  - ub: udma: Support create jetty group.
  - ub: udma: Support destroy jetty.
  - ub: udma: Support create jetty.
  - ub: udma: Support destroy jfc.
  - ub: udma: Support create jfc.
  - ub: udma: Support destroy jfr.
  - ub: udma: Support create jfr.
  - ub: udma: Support destroy jfs.
  - ub: udma: Support create jfs.
  - ub: udma: Support query table item from hw.
  - ub: udma: Support query jfr context from hw.
  - ub: udma: Support query jfs and jetty context from hw.
  - iommu/ummu: Fix 2P virtualization error
  - iommu/ummu: Fix ubmem unmap return value error
  - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
  - blk-ioinf: fix default weight being reset to 0 for non-root cgroups
  - arm64/mpam: Add build dependencies for CONFIG_RESCTRL_IOMMU
  - batman-adv: fix OOB read/write in network-coding decode
  - mm/slab: make __free(kfree) accept error pointers
  - Revert "mm/slab: make __free(kfree) accept error pointers"
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
  - md/md-bitmap: fix GPF in bitmap_get_stats()
  - igc: fix lock order in igc_ptp_reset
  - Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  - xen/x86: fix initial memory balloon target
  - pwm: mediatek: Ensure to disable clocks in error path
  - ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model
  - drm/tests: Build KMS helpers when DRM_KUNIT_TEST_HELPERS is enabled
  - btrfs: fix the length of reserved qgroup to free
  - MIPS: ds1287: Match ds1287_set_base_clock() function types
  - MIPS: cevt-ds1287: Add missing ds1287.h include
  - MIPS: dec: Declare which_prom() as static
  - sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
  - sign-file,extract-cert: avoid using deprecated ERR_get_error_line()
  - sign-file,extract-cert: move common SSL helper functions to a header
  - nvmet-fc: Remove unused functions
  - landlock: Add the errata interface
  - wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
  - wifi: rtw89: pci: add pre_deinit to be called after probe complete
  - LoongArch: Eliminate superfluous get_numa_distances_cnt()
  - x86/split_lock: Fix the delayed detection logic
  - x86/xen: fix memblock_reserve() usage on PVH
  - x86/xen: move xen_reserve_extra_memory()
  - Fix mmu notifiers for range-based invalidates
  - misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
  - misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
  - kbuild: Add '-fno-builtin-wcslen'
  - cpufreq: Reference count policy in cpufreq_update_limits()
  - io_uring/net: fix accept multishot handling
  - drm/i915/gvt: fix unterminated-string-initialization warning
  - drm/sti: remove duplicate object names
  - drm/amdgpu/dma_buf: fix page_link check
  - drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
  - drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
  - drm/amd/pm/smu11: Prevent division by zero
  - drm/amd/pm/powerplay: Prevent division by zero
  - drm/amd/pm: Prevent division by zero
  - drm/amd: Handle being compiled without SI or CIK support better
  - drm/msm/a6xx: Fix stale rpmh votes from GPU
  - drm/repaper: fix integer overflows in repeat functions
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
  - perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
  - perf/x86/intel: Allow to update user space GPRs from PEBS records
  - scsi: ufs: exynos: Ensure consistent phy reference counts
  - scsi: megaraid_sas: Block zero-length ATA VPD inquiry
  - x86/boot/sev: Avoid shared GHCB page for early memory acceptance
  - x86/cpu/amd: Fix workaround for erratum 1054
  - x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches
  - string: Add load_unaligned_zeropad() code path to sized_strscpy()
  - smb3 client: fix open hardlink on deferred close file error
  - selftests/mm: generate a temporary mountpoint for cgroup filesystem
  - riscv: Avoid fortify warning in syscall_get_arguments()
  - ksmbd: fix the warning from __kernel_write_iter
  - ksmbd: Prevent integer overflow in calculation of deadtime
  - ksmbd: fix use-after-free in smb_break_all_levII_oplock()
  - ovl: don't allow datadir only
  - mm: fix apply_to_existing_page_range()
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
  - loop: LOOP_SET_FD: send uevents for partitions
  - loop: properly send KOBJ_CHANGED uevent for disk device
  - crypto: caam/qi - Fix drv_ctx refcount bug
  - btrfs: correctly escape subvol in btrfs_show_options()
  - Bluetooth: vhci: Avoid needless snprintf() calls
  - Bluetooth: l2cap: Process valid commands in too long frame
  - ftrace: fix incorrect hash size in register_ftrace_direct()
  - i2c: atr: Fix wrong include
  - nfs: add missing selections of CONFIG_CRC32
  - asus-laptop: Fix an uninitialized variable
  - ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
  - ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
  - writeback: fix false warning in inode_to_wb()
  - cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
  - riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
  - riscv: KGDB: Do not inline arch_kgdb_breakpoint()
  - kunit: qemu_configs: SH: Respect kunit cmdline
  - riscv: Properly export reserved regions in /proc/iomem
  - net: ethernet: mtk_eth_soc: revise QDMA packet scheduler settings
  - net: ethernet: mtk_eth_soc: correct the max weight of the queue limit for 100Mbps
  - ptp: ocp: fix start time alignment in ptp_ocp_signal_set
  - net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
  - net: bridge: switchdev: do not notify new brentries as changed
  - net: b53: enable BPDU reception for management port
  - netlink: specs: rt-link: adjust mctp attribute naming
  - netlink: specs: rt-link: add an attr layer around alt-ifname
  - ata: libata-sata: Save all fields from sense data descriptor
  - net: ethernet: ti: am65-cpsw: fix port_np reference counting
  - net: ethernet: ti: am65-cpsw-nuss: rename phy_node -> port_np
  - pds_core: fix memory leak in pdsc_debugfs_add_qcq()
  - test suite: use %zu to print size_t
  - igc: add lock preventing multiple simultaneous PTM transactions
  - igc: cleanup PTP module if probe fails
  - igc: handle the IGC_PTP_ENABLED flag correctly
  - igc: move ktime snapshot into PTM retry loop
  - igc: increase wait time before retrying PTM
  - Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  - Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
  - ASoC: cs42l43: Reset clamp override on jack removal
  - RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
  - ovl: remove unused forward declaration
  - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
  - ASoC: dwc: always enable/disable i2s irqs
  - md/md-bitmap: fix stats collection for external bitmaps
  - md/raid10: fix missing discard IO accounting
  - scsi: iscsi: Fix missing scsi_host_put() in error path
  - wifi: wl1251: fix memory leak in wl1251_tx_work
  - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
  - Bluetooth: hci_uart: Fix another race during initialization
  - media: mediatek: vcodec: mark vdec_vp9_slice_map_counts_eob_coef noinline
  - x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
  - ACPI: platform-profile: Fix CFI violation when accessing sysfs files
  - selftests: mptcp: fix incorrect fd checks in main_loop
  - selftests: mptcp: close fd_in before returning in main_loop
  - pinctrl: qcom: Clear latched interrupt status when changing IRQ type
  - phy: freescale: imx8m-pcie: assert phy reset and perst in power off
  - PCI: Fix reference leak in pci_alloc_child_bus()
  - PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
  - of/irq: Fix device node refcount leakages in of_irq_init()
  - of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
  - of/irq: Fix device node refcount leakages in of_irq_count()
  - of/irq: Fix device node refcount leakage in API of_irq_parse_raw()
  - of/irq: Fix device node refcount leakage in API of_irq_parse_one()
  - ntb: use 64-bit arithmetic for the MSI doorbell mask
  - KVM: x86: Explicitly zero-initialize on-stack CPUID unions
  - gve: handle overflow when reporting TX consumed descriptors
  - gpio: zynq: Fix wakeup source leaks on device unbind
  - gpio: tegra186: fix resource handling in ACPI probe path
  - dt-bindings: coresight: qcom,coresight-tpdm: Fix too many 'reg'
  - dt-bindings: coresight: qcom,coresight-tpda: Fix too many 'reg'
  - dm-verity: fix prefetch-vs-suspend race
  - dm-integrity: set ti->error on memory allocation failure
  - dm-ebs: fix prefetch-vs-suspend race
  - crypto: ccp - Fix check for the primary ASP device
  - clk: qcom: gdsc: Set retain_ff before moving to HW CTRL
  - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
  - clk: qcom: gdsc: Release pm subdomains in reverse add order
  - clk: qcom: clk-branch: Fix invert halt status bit check for votable clocks
  - cifs: fix integer overflow in match_server()
  - cifs: avoid NULL pointer dereference in dbg call
  - thermal/drivers/rockchip: Add missing rk3328 mapping entry
  - x86/xen: fix balloon target initialization for PVH dom0
  - mm/hugetlb: move hugetlb_sysctl_init() to the __init section
  - mm/userfaultfd: fix release hang over concurrent GUP
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free
  - ALSA: usb-audio: Kill timer properly at removal
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  - uio_hv_generic: Let userspace take care of interrupt mask
  - mm/mremap: correctly handle partial mremap() of VMA starting at 0
  - mm: fix lazy mmu docs and usage
  - mm: make page_mapped_in_vma() hugetlb walk aware
  - mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
  - sparc/mm: avoid calling arch_enter/leave_lazy_mmu() in set_ptes
  - sparc/mm: disable preemption in lazy mmu mode
  - iommufd: Fix uninitialized rc in iommufd_access_rw()
  - btrfs: zoned: fix zone finishing with missing devices
  - btrfs: zoned: fix zone activation with missing devices
  - btrfs: fix non-empty delayed iputs list on unmount due to compressed write workers
  - arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
  - arm64: mm: Correct the update of max_pfn
  - mtd: rawnand: Add status chack in r852_ready()
  - mtd: inftlcore: Add error check for inftl_read_oob()
  - mptcp: only inc MPJoinAckHMacFailure for HMAC failures
  - lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
  - locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
  - mailbox: tegra-hsp: Define dimensioning masks in SoC data
  - leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs
  - leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs
  - jbd2: remove wrong sb->s_sequence check
  - i3c: Add NULL pointer check in i3c_master_queue_ibi()
  - i3c: master: svc: Use readsb helper for reading MDB
  - smb311 client: fix missing tcon check when mounting with linux/posix extensions
  - udf: Fix inode_getblk() return value
  - vdpa/mlx5: Fix oversized null mkey longer than 32bit
  - f2fs: fix to avoid atomicity corruption of atomic file
  - ext4: fix off-by-one error in do_split
  - ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
  - ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns.
  - ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment.
  - ASoC: q6apm: add q6apm_get_hw_pointer helper
  - io_uring/kbuf: reject zero sized provided buffers
  - wifi: mac80211: fix integer overflow in hwmp_route_info_get()
  - wifi: mt76: Add check for devm_kstrdup()
  - clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
  - mtd: Replace kcalloc() with devm_kcalloc()
  - net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
  - mtd: Add check for devm_kcalloc()
  - mptcp: sockopt: fix getting IPV6_V6ONLY
  - media: i2c: imx219: Rectify runtime PM handling in probe and remove
  - media: venus: hfi_parser: add check to avoid out of bound access
  - media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
  - media: i2c: ov7251: Set enable GPIO low in probe
  - media: i2c: ccs: Set the device's runtime PM status correctly in probe
  - media: i2c: ccs: Set the device's runtime PM status correctly in remove
  - media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
  - media: platform: stm32: Add check for clk_enable()
  - media: visl: Fix ERANGE error when setting enum controls
  - media: streamzap: prevent processing IR data on URB failure
  - tpm, tpm_tis: Fix timeout handling when waiting for TPM status
  - spi: cadence-qspi: Fix probe on AM62A LP SK
  - xenfs/xensyms: respect hypervisor's "next" indication
  - media: siano: Fix error handling in smsdvb_module_init()
  - media: vim2m: print device name after registering device
  - media: venus: hfi: add check to handle incorrect queue size
  - media: venus: hfi: add a check to handle OOB in sfr region
  - media: i2c: adv748x: Fix test pattern selection mask
  - media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
  - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
  - dt-bindings: media: st,stmipid02: correct lane-polarities maxItems
  - ext4: don't treat fhandle lookup of ea_inode as FS corruption
  - bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
  - pwm: fsl-ftm: Handle clk_get_rate() returning 0
  - pwm: rcar: Improve register calculation
  - pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
  - tpm, tpm_tis: Workaround failed command reception on Infineon devices
  - ktest: Fix Test Failures Due to Missing LOG_FILE Directories
  - drm/amdgpu: grab an additional reference on the gang fence v2
  - drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
  - drm/mediatek: mtk_dpi: Move the input_2p_en bit to platform data
  - drm/amdkfd: debugfs hang_hws skip GPU with MES
  - drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
  - drm/amdkfd: clamp queue size to minimum
  - drivers: base: devres: Allow to release group on device release
  - drm/bridge: panel: forbid initializing a panel with unknown connector type
  - drm: panel-orientation-quirks: Add quirk for OneXPlayer Mini (Intel)
  - drm: panel-orientation-quirks: Add new quirk for GPD Win 2
  - drm: panel-orientation-quirks: Add quirk for AYA NEO Slide
  - drm: panel-orientation-quirks: Add quirks for AYA NEO Flip DS and KB
  - drm: panel-orientation-quirks: Add support for AYANEO 2S
  - drm/amd/display: add workaround flag to link to force FFE preset
  - drm/amd/display: Update Cursor request mode to the beginning prefetch always
  - drm: allow encoder mode_set even when connectors change for crtc
  - Bluetooth: qca: simplify WCN399x NVM loading
  - Bluetooth: hci_uart: fix race during initialization
  - tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
  - net: vlan: don't propagate flags on open
  - wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
  - cdc_ether|r8152: ThinkPad Hybrid USB-C/A Dock quirk
  - Revert "f2fs: rebuild nat_bits during umount"
  - ext4: protect ext4_release_dquot against freezing
  - ahci: add PCI ID for Marvell 88SE9215 SATA Controller
  - net: sfp: add quirk for 2.5G OEM BX SFP
  - ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
  - jfs: add sanity check for agwidth in dbMount
  - fs/jfs: cast inactags to s64 to prevent potential overflow
  - net: usb: asix_devices: add FiberGecko DeviceID
  - scsi: target: spc: Fix RSOC parameter data header size
  - f2fs: don't retry IO for corrupted data scenario
  - wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
  - ASoC: amd: yc: update quirk data for new Lenovo model
  - ASoC: amd: Add DMI quirk for ACP6X mic support
  - ALSA: usb-audio: Fix CME quirk for UF series keyboards
  - mmc: dw_mmc: add a quirk for accessing 64-bit FIFOs in two halves
  - media: uvcvideo: Add quirk for Actions UVC05
  - ASoC: fsl_audmix: register card device depends on 'dais' property
  - ALSA: hda: intel: Add Lenovo IdeaPad Z570 to probe denylist
  - ALSA: hda: intel: Fix Optimus when GPU has no sound
  - selftests/bpf: Add tests for rejection of ALU ops with negative offsets
  - bpf: Reject negative offsets for ALU ops
  - HID: pidff: Add FIX_WHEEL_DIRECTION quirk
  - HID: pidff: Add hid_pidff_init_with_quirks and export as GPL symbol
  - HID: pidff: Add PERMISSIVE_CONTROL quirk
  - HID: pidff: Add MISSING_PBO quirk and its detection
  - HID: pidff: Add MISSING_DELAY quirk and its detection
  - HID: pidff: Do not send effect envelope if it's empty
  - HID: pidff: Convert infinite length from Linux API to PID standard
  - ASoC: SOF: topology: Use krealloc_array() to replace krealloc()
  - zstd: Increase DYNAMIC_BMI2 GCC version cutoff from 4.8 to 11.0 to work around compiler segfault
  - xen/mcelog: Add __nonstring annotations for unterminated strings
  - arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
  - x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
  - x86/ia32: Leave NULL selector values 0~3 unchanged
  - x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure
  - umount: Allow superblock owners to force umount
  - iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group
  - nft_set_pipapo: fix incorrect avx2 match of 5th field octet
  - nvmet-fcloop: swap list_add_tail arguments
  - ata: sata_sx4: Add error handling in pdc20621_i2c_read()
  - drm/tests: probe-helper: Fix drm_display_mode memory leak
  - drm/tests: modes: Fix drm_display_mode memory leak
  - drm/tests: cmdline: Fix drm_display_mode memory leak
  - drm/tests: helpers: Create kunit helper to destroy a drm_display_mode
  - drm/tests: helpers: Fix compiler warning
  - drm/tests: helpers: Add helper for drm_display_mode_from_cea_vic()
  - drm/tests: Add helper to create mock crtc
  - drm/tests: Add helper to create mock plane
  - drm/tests: helpers: Add atomic helpers
  - drm/tests: modeset: Fix drm_display_mode memory leak
  - net: ethtool: Don't call .cleanup_data when prepare_data fails
  - tc: Ensure we have enough buffer space when sending filter netlink notifications
  - net/sched: cls_api: conditional notification of events
  - rtnl: add helper to check if a notification is needed
  - rtnl: add helper to check if rtnl group has listeners
  - octeontx2-pf: qos: fix VF root node parent queue index
  - net: tls: explicitly disallow disconnect
  - objtool: Fix INSN_CONTEXT_SWITCH handling in validate_unret()
  - ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
  - drm/i915: Disable RPG during live selftest
  - drm/i915/dg2: wait for HuC load completion before running selftests
  - drm/i915/xelpg: Extend driver code of Xe_LPG to Xe_LPG+
  - drm/i915/mocs: use to_gt() instead of direct &i915->gt
  - selftests/futex: futex_waitv wouldblock test should fail
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
  - jfs: upper bound check of tree index in dbAllocAG
  - mm: swap: check for stable address space before operating on the VMA
  - net: ethernet: cortina: Use TOE/TSO on all TCP
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
  - hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
  - bus: mhi: host: Detect events pointing to unexpected TREs
  - drm/amd/pm: fix null pointer access
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  - net: kcm: Fix race condition in kcm_unattach()
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
  - hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  - xhci: fix memory leak regression when freeing xhci vdev devices depth first
  - usb: xhci: Fix slot_id resource race conflict
  - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
  - nilfs2: reject invalid file types when reading inodes
  - mtd: inftlcore: Add error check for inftl_read_oob()
  - freezer, sched: Report frozen tasks as 'D' instead of 'R'
  - io_uring/sqpoll: fix sqpoll error handling races
  - i2c: microchip-core: actually use repeated sends
  - PCI/MSI: Handle lack of irqdomain gracefully
  - i2c: imx: add imx7d compatible string for applying erratum ERR007805
  - i2c: microchip-core: fix "ghost" detections


author: Li Nan <linan122@huawei.com> - 6.6.0-125.0.0.124
changelog:
  - !17888 [OLK-6.6] Fix CVE-2025-37777
  - !19371  RDMA/rxe: Fix race in do_task() when draining
  - !19393  usb: typec: ucsi: displayport: Fix NULL pointer access
  - !19377 [OLK-6.6] Fix CVE-2025-23133
  - !18704 [OLK-6.6] Fix CVE-2024-58095
  - !19401  smb: client: fix crypto buffers in non-linear memory
  - !19323  nfsd: don't ignore the return code of svc_proc_register()
  - !19386  x86/mm: Check return value from memblock_phys_alloc_range()
  - !19433 urma: bugfix ubagg drivers refent error
  - urma: bugfix ubagg drivers refent error
  - !19391 urma: fixing ubcore hash table initialization failure.
  - !19263 [OLK-6.6]Fix CVE-2025-37861
  - !19253 [OLK-6.6] Fix CVE-2025-37973
  - !19252 [OLK-6.6] Fix CVE-2025-37972
  - !19251 [OLK-6.6] Fix CVE-2025-37956
  - !19374 [OLK-6.6] Fix CVE-2025-37899
  - !19402  sched: Fix incorrect cluster mask
  - !19414  xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled
  - !19398 v2  bugfix for xcall2.0
  - !19412  sunrpc: fix handling of server side tls alerts
  - !19409  smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
  - !19405 [OLK-6.6]:update patches for sw64 architecture
  - xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled
  - !19266  __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  - !19358  Fix CVE-2025-40016
  - sunrpc: fix handling of server side tls alerts
  - urma: fixing ubcore hash table initialization failure.
  - smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
  - !19365  net/mlx5e: Harden uplink netdev access against device unbind
  - sw64: config: add initial openeuler_defconfig for sw64
  - sw64: fix compile error of pte_pgprot()
  - sw64: add missing definition of MAP_PEER_SHARED
  - sched: Fix incorrect cluster mask
  - smb: client: fix crypto buffers in non-linear memory
  - !19392  Fixes and cleanup of page cache limit
  - !18760  CVE-2025-38501
  - !19390 v3  xsched: add xsched_{set,get}attr syscall
  - xcall2.0: fix panic while detaching xcall found in DT case
  - xcall2.0: prefetch: fix access NULL ptr in __do_sys_epoll_pwait()
  - xcall2.0: prefetch: get prefetch_mm_data once in get_pfi()
  - !19311  nbd: fix uaf in nbd_genl_connect() error path
  - !19310  fs: writeback: fix use-after-free in __mark_inode_dirty()
  - !19256  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  - !19237  nfsd: provide locking for v4_end_grace
  - !19247  dmaengine: ti: k3-udma: Add missing locking
  - !19220  NFSv4: Fix deadlock during the running of state manager
  - !19248  nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
  - usb: typec: ucsi: displayport: Fix NULL pointer access
  - !19378 net: hibmcge: add support for pagepool on rx
  - mm: Add page cache limit check before queueing shrink worker
  - mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()
  - mm: Replace deferrable timer with delay timer for shrink worker
  - !19388 [sync] PR-19363:  Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
  - !19368  net/sched: Fix backlog accounting in qdisc_dequeue_internal
  - !19367  net/sched: sch_qfq: Fix CVE-2025-38477
  - !19366  i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  - !19364  ixgbevf: Fix CVE-2025-40104
  - xsched: add xsched_{set,get}attr syscall
  - Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
  - x86/mm: Check return value from memblock_phys_alloc_range()
  - net: hibmcge: add support for pagepool on rx
  - net: hibmcge: reduce packet drop under stress testing
  - net: hibmcge: add support for tracepoint to dump some fields of rx_desc
  - Revert "net: hibmcge: reduce packet drop under stress testing"
  - Revert "net: hibmcge: support pagepool for rx"
  - wifi: ath11k: update channel list in reg notifier instead reg worker
  - !18451 RDMA/bnxt_re: Fix budget handling of notification queue
  - ksmbd: fix use-after-free in session logoff
  - !18837  CVE-2025-37997
  - !19361  media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
  - RDMA/rxe: Fix race in do_task() when draining
  - !19353 ubcore: fix query route list by eid pair.
  - ubcore: fix query route list by eid pair.
  - net/sched: Fix backlog accounting in qdisc_dequeue_internal
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  - net/mlx5e: Harden uplink netdev access against device unbind
  - ixgbevf: fix mailbox API compatibility by negotiating supported features
  - ixgbevf: fix getting link speed data for E610 devices
  - ixgbevf: Add support for Intel(R) E610 device
  - PCI: Add PCI_VDEVICE_SUB helper macro
  - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
  - !19152  Fix CVE-2025-39810 fix CVE-2025-39810
  - !19359 ub: hisi-ubus: Fix ub memory decoder create
  - !19346  sched: Fix race between yield_to() and try_to_wake_up()
  - ub: hisi-ubus: Fix ub memory decoder create
  - media: uvcvideo: Use heuristic to find stream entity
  - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID
  - !19341 v7  bugfix for xcall2.0
  - sched: Fix race between yield_to() and try_to_wake_up()
  - !17661 kvm: Only enable shadow mode for ioeventfd and Align the lifecycle of …
  - !19334  bpf: Sync pending IRQ work before freeing ring buffer
  - xcall2.0: prefetch: introduce struct prefetch_mm_data
  - xcall2.0: Fix mem leak in proc_xcall_command
  - xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall
  - xcall2.0: prefetch: keep prefetch module name same with file name
  - xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait
  - !19339  zcopy: Fix context switch within RCU read-side
  - !19300  Add Support for Disabling Hugetlb in soft_offline_page
  - !19327 ub: ub_fwctl: add ub_fwctl driver-api documentation description
  - !19338 iommu/ummu: Fix UMMU documentation error
  - !19287 net: unic: Add support for uboe and ethernet related tools
  - !19337 ub: udma: Support retrieving the migr field.
  - zcopy: Fix context switch within RCU read-side error
  - ub: ub_fwctl: add ub_fwctl driver-api documentation description
  - iommu/ummu: Fix UMMU documentation error
  - !19332 ub: udma: add requirement about document and tp attr.
  - !19330 iommu/ummu: Add UMMU documentation description
  - bpf: Sync pending IRQ work before freeing ring buffer
  - ub: udma: Support retrieving the migr field.
  - !18794 【OLK-6.6】fix CVE-2025-39801
  - ub: udma: Support eid and guid updates.
  - ub: udma: bugfix for set and get tp attr.
  - !18453 [OLK-6.6] ALSA: HDA: Add Zhaoxin HDMI Controller and Codec support
  - !18483 [OLK-6.6] x86/hpet: Set dynamic IRQ feature for HPET for KH-50000
  - iommu/ummu: Add UMMU-PMU devicetree file
  - iommu/ummu: Add UMMU devicetree file
  - iommu/ummu: Add UMMU documentation description
  - ub: udma: mask jetty context addr info.
  - ub: udma: add udma driver module doc.
  - ub: ubase: Remove non-cluster mode code
  - net: unic: Add support for uboe reset
  - net: unic: Add support for MAC statistics
  - net: unic: Add pause frame support.
  - net: unic: Add Priority Flow Control (PFC) support
  - net: unic: Add debugfs support for dumping MAC tables.
  - net: unic: Supports MAC filter, and allows users to add and delete MAC
  - net: unic: Add debugfs support for dumping vlan table
  - net: unic: Integrate valn filtering features with network device operations.
  - net: unic: Add valn filtering support.
  - net: unic: Add support for querying link diagnosis status
  - net: unic: Extend loopback test support to include external loopback modes
  - net: unic: Extend loopback test support to include serdes loopback modes.
  - net: unic: Add loopback test support.
  - net: unic: Add debugfs support for dumping hardware MAC tables.
  - net: unic: Add support for setting link speed, duplex, and autonegotiation via ethtool.
  - !19328 ub:hisi-ubus: Adding compatibility Interfaces for ub memory
  - !19264 ub: cdma: add CDMA userspace-api documentation description
  - ub:hisi-ubus: Adding compatibility Interfaces for ub memory
  - kvm: Only enable shadow mode for ioeventfd and Align the lifecycle of KVM shadow with KVM
  - ub: cdma: add CDMA userspace-api documentation description
  - ub: cdma: add CDMA kernel driver design document specification
  - ub: cdma: add CDMA driver-api documentation description
  - !19305 ub:ubus: Add ubus and ubfi opensource document
  - !19320 urma: added functions for getting and setting TP attribute fields.
  - nfsd: don't ignore the return code of svc_proc_register()
  - ub:ubus: Add ubus devicetree file
  - urma: added functions for getting and setting TP attribute fields.
  - ub:ubus: Add ubus and ubfi opensource document
  - !19317 ub: ubase: Remove useless character '+'
  - ub: ubase: Remove useless character '+'
  - !18870 add sentry kmod
  - drivers/ub/sentry: add sentry_remote_reporter module
  - drivers/ub/sentry: add sentry_uvb_comm module
  - drivers/ub/sentry: add sentry_urma_comm module
  - drivers/ub/sentry: add sentry_reporter and sentry_msg_help
  - !19306  net: Netdev use RCU protection
  - !19290 urma: bugfix the issue of urma stream generation failure
  - nbd: fix uaf in nbd_genl_connect() error path
  - fs: writeback: fix use-after-free in __mark_inode_dirty()
  - !19292  blk-ioinf: accumulate total latency properly across sampling periods
  - !19230  drm/vmwgfx: Fix Use-after-free in validation
  - net: use dst_dev_rcu() in sk_setup_caps()
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
  - ipv6: use RCU in ip6_output()
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
  - net: dst: Fix kabi-breakage for struct dst_entry
  - ipv6: use RCU in ip6_xmit()
  - ipv4: start using dst_dev_rcu()
  - tcp_metrics: use dst_dev_net_rcu()
  - net: dst: introduce dst->dev_rcu
  - net: Add locking to protect skb->dev access in ip_output
  - net: dst: add four helpers to annotate data-races around dst->dev
  - urma: bugfix the issue of urma stream generation failure
  - acpi: provides acpi power notifier chain
  - mm/memory-failure: support disabling soft offline for HugeTLB pages
  - mm/memory-failure: userspace controls soft-offlining pages
  - blk-ioinf: accumulate total latency properly across sampling periods
  - RDMA/bnxt_re: Remove unusable nq variable
  - RDMA/bnxt_re: Fix budget handling of notification queue
  - __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
  - Input: mtk-pmic-keys - fix possible null pointer dereference
  - ksmbd: prevent rename with empty string
  - ksmbd: move leading slash check to smb2_get_name()
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
  - dmaengine: ti: k3-udma: Add missing locking
  - nfsd: provide locking for v4_end_grace
  - drm/vmwgfx: Fix Use-after-free in validation
  - NFSv4: Fix deadlock during the running of state manager
  - bnxt_en: Fix memory corruption when FW resources change during ifdown
  - bnxt_en: Fix possible crash after creating sw mqprio TCs
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region
  - netfilter: ipset: fix region locking in hash types
  - usb: dwc3: Remove WARN_ON for device endpoint command timeouts
  - ksmbd: add max ip connections parameter
  - ksmbd: extend the connection limiting mechanism to support IPv6
  - ksmbd: limit repeated connections from clients with the same IP
  - jfs: add check read-only before txBeginAnon() call
  - ALSA: HDA: Add Zhaoxin HDMI Controller and Codec support
  - x86/hpet: Set dynamic IRQ feature for HPET for KH-50000
  - ALSA: HDA: Roll back the old version for consistency with the mainline
  - ksmbd: add free_transport ops in ksmbd connection
  - ksmbd: fix use-after-free in __smb2_lease_break_noti()


author: Li Nan <linan122@huawei.com> - 6.6.0-127.0.0.125
changelog:
  - !19620 iommufd: Prevent ALIGN() overflow
  - !19608 ub: ub_fwctl: Modify TP/TA/SCC register query process.
  - !18634 [OLK-6.6]Fix CVE-2025-38706
  - iommufd: Prevent ALIGN() overflow
  - !19400  smb: client: fix mid_q_entry memleak leak with per-mid locking
  - !19601  net/packet: fix a race in packet_set_ring() and packet_notifier()
  - !19598  ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  - !19597  ipv6: prevent infinite loop in rt6_nlmsg_size()
  - !19354 [OLK-6.6] Fix CVE-2025-37822
  - !19355 [OLK-6.6] Fix CVE-2025-38361
  - !19563 ub: cdma: fix the timing issue during flow-based deregistration.
  - !19585 crypto: hisilicon/trng - Fix the issue where TRNG cannot be used by multiple threads.
  - !19610 perf: Fix lastup for multi-CPU PG
  - !19609 urma: fixed process exiting uburma driver's private memory UAF
  - !19592  Fix incorrect use of cpuhp_remove_multi_state parameter
  - perf: Fix lastup for multi-CPU PG
  - urma: fixed process exiting uburma driver's private memory UAF
  - !19607 Revert "RDMA/hns: Fix mismatch exception rollback"
  - ub: cdma: modify the compatibility field according to the Linux KABI specification
  - ub: cdma: fix the timing issue during flow-based deregistration.
  - ub: cdma: fix kasan cdma jfae uaf
  - ub: cdma: modify log level about en information
  - ub: ub_fwctl: Modify TP/TA/SCC register query process.
  - Revert "RDMA/hns: Fix mismatch exception rollback"
  - !18664 [OLK-6.6] Fix CVE-2025-22039
  - net/packet: fix a race in packet_set_ring() and packet_notifier()
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  - ipv6: prevent infinite loop in rt6_nlmsg_size()
  - !19558 obmm: sync obmm default params value to sysfs.
  - !19560 obmm: set MAX Numa Distance to 255
  - !19589 ub:ubus: add active_mutex in ub_entity
  - soc cache: Add compilation config for hisi_soc_l3c
  - soc cache: Don't poll before removing all locks
  - soc cache: Drop redundant vm_pgoff
  - soc cache: fix walk page parameter and drop incorrect check
  - soc cache: Check address while walking pages
  - soc_cache: Fix component removal order to avoid race condition
  - soc cache: cleanup: Remove the redundant check of vm_pgoff
  - soc cache: cleanup: Change type of mnt_type
  - soc cache: cleanup: avoid tag addr from interfering range validation
  - soc cache: cleanup: move judgement of soc cache dev into lock protection
  - soc cache: cleanup: fix memory leakage on error path
  - soc_cache: Fix error code returning from hisi_soc_l3c_do_lock
  - soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter
  - soc cache: cleanup: replace dynamically allocated param with local variable
  - ub:ubus: add active_mutex in ub_entity
  - !19576  Bugfix for two issues
  - crypto: hisilicon/trng - support tfms sharing the device
  - crypto: hisilicon/trng - use DEFINE_MUTEX() and LIST_HEAD()
  - Revert "crypto: hisilicon/trng - support to obtain random numbers from soft algorithm"
  - Revert "crypto: hisilicon/trng - use DEFINE_MUTEX() for mutex lock"
  - !19557  Fix UAF issue for mfs
  - !19555 ub: bugfix of port, decoder and vfio
  - !19561 obmm: fix granu checking in mmap
  - zcopy: Fix softlockup while attach PUD-SIZE page
  - zcopy: Fix NULL pointer dereference while attach conflict with free
  - ub:unic Adaptation of the port reset interface
  - !19521 uvb: change dir name
  - !19532 net: hns3: add VLAN id validation before using
  - !19271  Squashfs: fix uninit-value in squashfs_get_parent
  - !19269  media: venus: Add a check for packet size after reading from shared memory
  - !19268  eventpoll: Fix semi-unbounded recursion
  - !19267  kernfs: Relax constraint in draining guard
  - !19552  KVM: arm64: Check the untrusted offset in FF-A memory share
  - !19551 add check ack_dono flag for reboot event
  - obmm: sync obmm default params value to module sysfs.
  - obmm: set MAX Numa Distance to 255
  - obmm: fix granu checking in mmap
  - ub:ubus adapt port local ras
  - vfio:ubus vfio-ub support ub entity enable
  - mfs: Fix UAF problem on event object when enable tracepoint
  - ub:ubus: fix bug of msg workqueue null
  - ub:hisi-ubus ub:hisi-ubus: Move the decoder's page table operations to hisi-ubus
  - add check ack_dono flag for reboot event
  - !19517 gmem: fix several issues
  - !19519  arm64/mpam: Reset mbwu_state while creating new monitor group
  - KVM: arm64: Check the untrusted offset in FF-A memory share
  - !19530  Fix unexpected behavior in resctrl mounting
  - !19520 ub: udma: bugfix related to init xa flags.
  - !19205 [OLK-6.6] Fix CVE-2025-39732
  - !19156 [OLK-6.6] Fix CVE-2025-39684
  - !19157 [OLK-6.6] Fix CVE-2025-39675
  - net: hns3: add VLAN id validation before using
  - !19526  mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark
  - fs/resctrl: Prevent mounting with unsupported options
  - fs/resctrl: Fix resctrl mount options display in mount list
  - ub: udma: bugfix related to init xa flags.
  - ub: udma: bugfix for rx close.
  - mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark
  - uvb: change dir name
  - !19507  Fix some memory policy bugfix
  - arm64/mpam: Need to reset MPAM component when umounting resctrl
  - arm64/mpam: Remove the redundant prev_val member variable
  - arm64/mpam: Reset mbwu_state while creating new monitor group
  - !19508 ub: ub_fwctl: Modify the problem of incorret data when querying entry
  - !19513  zcopy: fix two issues
  - zcopy: Fix Bad rss-counter state while non-mapping pages attach
  - zcopy: Fix null pointer dereference while attach transhugepage twice to same addr
  - ub: ub_fwctl: Modify the problem of incorret data when querying entry information
  - !19357 ubios_uvb: add msleep in poll thread
  - ubios_uvb: add check for uvb window buffer size
  - !19494  crypto: hisilicon - add reference counting to queues for tfm kernel reuse
  - !19475  task_work: Fix NMI race condition
  - mempolicy: restrict smart grid scheduling to vma_alloc_folio path
  - mempolicy: fix missing mmap_read_unlock() in error path
  - ubios_uvb: add check for cis message and senderid
  - !19486 [OLK-6.6] fix possible crash caused by null pointer when hct get page.
  - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable
  - crypto: hisilicon/hpre - support the hpre algorithm fallback
  - crypto: hisilicon/zip - support fallback for zip
  - crypto: hisilicon/qm - optimize device selection priority based on queue ref count and NUMA distance
  - crypto: hisilicon/qm - add reference counting to queues for tfm kernel reuse
  - crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node
  - crypto: hisilicon/qm - centralize the sending locks of each module into qm
  - crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes
  - Revert "crypto: hisilicon/hpre - support the hpre algorithm fallback"
  - crypto: hisilicon/hpre: extend tag field to 64 bits for better performance
  - crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback
  - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function
  - ubios_uvb: add msleep in poll thread
  - ccp/hct: fix possible crash caused by null pointer when hct get page.
  - task_work: Fix NMI race condition
  - !19468 urma: Bugfix for ubcore_get_route_list implement
  - urma: Bugfix for ubcore_get_route_list implement
  - !19329 hisi_acc_vfio_pci: adapt to new migration configuration
  - !19435 crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num()
  - !19383 [OLK-6.6] backport important bugfix for Broadcom NIC driver from upstream linux-6.6.y
  - !19460  xsched: XCU Partition
  - !19316  Fix cves CVE-2025-40040 & CVE-2025-40058
  - !19447 net: hns3: remove VF multi-TC compat bit
  - xsched: add throttling statistics for xsched groups
  - xsched: fix task stall when quota is disabled
  - xsched: suppress excessive error logs during cgroup file retry
  - xsched: fix shares misaccounting when multiple tasks run in one cgroup
  - xsched: switch xcu cgroup subsystem from domain mode to thread mode
  - !19439 obmm: remove redundant code and fix log issues
  - !18481 [OLK-6.6] Add platform-specific quirks for ZX-200 device
  - !19085 scsi: mpi3mr: Add support for status reply descriptor
  - !19078 scsi: mpi3mr: Split off bus_reset function from host_reset
  - !19416  kernfs: Fix UAF in polling when open file is released
  - !19415  smb: client: fix race with concurrent opens in rename(2)
  - !19446  net/mlx5: Fix ECVF vports unload on shutdown flow
  - obmm: remove redundant code and fix log issues
  - !19441  rv: Use strings in da monitors tracepoints
  - !19411  CVE-2025-39697
  - !19442  CVE-2025-22022
  - net: hns3: remove VF multi-TC compat bit
  - net/mlx5: Fix ECVF vports unload on shutdown flow
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints
  - usb: xhci: move link chain bit quirk checks into one helper function.
  - !19429  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - rv: Use strings in da monitors tracepoints
  - !19438  drm/scheduler: signal scheduled fence when kill job
  - !19410  Fix CVE-2025-39994
  - drm/scheduler: signal scheduled fence when kill job
  - obmm: set up default mem allocator granule
  - crypto: hisilicon/qm - fix incorrect judgment in qm_get_complete_eqe_num()
  - crypto: hisilicon/qm - add missing default in switch in qm_vft_data_cfg
  - crypto: hisilicon/sgl - remove unnecessary checks for curr_hw_sgl error
  - crypto: hisilicon/qm - add concurrency protection for variable err_threshold
  - crypto: hisilicon/qm - add the save operation of eqe and aeqe
  - crypto: hisilicon/qm - restore original qos values
  - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - kernfs: Fix UAF in polling when open file is released
  - smb: client: fix race with concurrent opens in rename(2)
  - NFS: Fix a race when updating an existing write
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
  - media: tuner: xc5000: Fix use-after-free in xc5000_release
  - media: tunner: xc5000: Refactor firmware load
  - smb: client: fix mid_q_entry memleak leak with per-mid locking
  - bnxt_en: Fix a possible memory leak in bnxt_ptp_init
  - drm/amd/display: Check dce_hwseq before dereferencing it
  - riscv: uprobes: Add missing fence.i after building the XOL buffer
  - hisi_acc_vfio_pci: adapt to new migration configuration
  - crypto: hisilicon - qm updates BAR configuration
  - hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_init
  - Revert "migration: update BAR space size"
  - Revert "migration: qm updates BAR configuration"
  - Revert "migration: adapt to new migration configuration"
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk
  - mm/ksm: fix flag-dropping behavior in ksm_madvise
  - Squashfs: fix uninit-value in squashfs_get_parent
  - media: venus: Add a check for packet size after reading from shared memory
  - eventpoll: Fix semi-unbounded recursion
  - kernfs: Relax constraint in draining guard
  - ksmbd: fix overflow in dacloffset bounds check
  - wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
  - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
  - comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()
  - comedi: Fix initialization of data for instructions that write to subdevice
  - scsi: mpi3mr: Add support for status reply descriptor
  - scsi: mpi3mr: Split off bus_reset function from host_reset
  - gmem: remove reduntant interfaces and use proper mmap flag
  - gmem: gmem_reserve_vma should use vma_flag_clear to remove flag
  - gmem: remove inpropre BUG_ON in do_peer_shared_anonymous_page
  - gmem: hmemcpy should use dma for phy addr
  - Add platform-specific quirks for ZX-200 device
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()


author: Li Nan <linan122@huawei.com> - 6.6.0-129.0.0.127
changelog:
  - !19657 xsched: simplify logging macros by removing redundant pr_fmt usage
  - !19702  XSched: List Corruption
  - !19617  Handling Kunpeng Chip ARM Spectre-BHB (CVE-2022-23960) Issue
  - xsched/cgroup: move list_del from css_free to css_offline to prevent corruption
  - xsched: protect group member list with xcu_lock to prevent corruption
  - !19696  i40e: remove read access to debugfs files
  - i40e: remove read access to debugfs files
  - !19674 obmm: bugfixes of log and race condition
  - !19644 obmm: suppport unaligned PMD mapping
  - !19683  xsched: prevent linked list corruption in RT priority updates
  - xsched: prevent linked list corruption in RT priority updates
  - obmm: Remove log pringts of physical address and kernelspace virtual address
  - obmm: Fix race condition between unexport and addr_query_by_pa
  - !19659 ubcore: fix route_list when no full match.
  - !19661 Packet throughput decreases with multiple jetty streams
  - xsched: simplify logging macros by removing redundant pr_fmt usage
  - xsched: Fix compilation by adding xsched_attr to syscalls.h
  - !19562 [OLK-6.6] virtcca: fix incorrect use of the percpu declare
  - ubcore: fix route_list when no full match.
  - obmm: display mmaped region's Pagesize
  - obmm: fix for PMD mapping
  - Packet throughput decreases with multiple jetty streams
  - virtcca: Add missing includes for DECLARE_PER_CPU
  - arm64: Add missing includes for mem_encrypt
  - !19647  fbdev: bitblit: bound-check glyph index in bit_putcs*
  - fbdev: bitblit: bound-check glyph index in bit_putcs*
  - !19097 scsi: mpi3mr: Clear ioctl blocking flag for an unresponsive controller
  - !19095 scsi: mpi3mr: Set MPI request flags appropriately
  - !19092 scsi: mpi3mr: Replace deprecated strncpy() with assignments
  - !19086 scsi: mpi3mr: Fetch correct device dev handle for status reply descriptor
  - !19636  Some bugfixes for interference
  - !19639 ub: ubase: Fix spell error of month
  - ub: ubase: Fix spell error of month
  - !19637 ub: udma: bugfix related to print location.
  - !19637 ub: udma: bugfix related to print location.
  - !19638 ub:ubus: bugfix port reset in cluster mode
  - !19623 iommu/ummu: Fix the issue of uninitialized resources in logic_ummu_viommu
  - ub:ubus: bugfix port reset in cluster mode
  - ub:ubus: add hotplug capability check
  - ub:ubus: bugfix calltrace of killing qemu when rmmod hisi_ubus
  - ub: udma: bugfix related to print location.
  - iommu/ummu: Remove redundant CONFIG_UB_UBRT_PLAT_DEV and code
  - interference: Add version compatibility check between subsystem and cgroup
  - interference: Fix missing interference.stat file in v1 hierarchy
  - interference: Add fallback to sched_clock when TSC is unavailable
  - interference: Add dependency on CONFIG_SCHED_INFO to avoid build error
  - interference: Resolve arm32 build error by restricting IFS to x86/arm64
  - interference: Avoid null pointer dereference in cgroup_ifs_add_files
  - iommu/ummu-core: Duplicate EID are not allowed
  - iommu/ummu: Move tid_type attr to logic ummu
  - iommu/ummu: Fixing the issue of uninitialized resources in logic_ummu_viommu
  - !19634 crypto: hisilicon - some bugfix
  - !19628 ub:ubfi: Fix UBFI memory leak issue
  - !19616 ub: ubase&unic: Fix some bug finding in running the driver
  - !19553 perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - crypto: hisilicon - lower priority for hisilicon crypto implementations
  - crypto: hisilicon/zip - remove redundant callback validation and invocation in crypto_wait_req
  - crypto: hisilicon/zip - add algorithm check before soft tfm allocation
  - crypto: hisilicon/zip - fix a callback problem
  - crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter
  - crypto: hisilicon/qm - increment PM usage counter when handling the aeq interrupt
  - crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue
  - crypto: hisilicon/hpre - support curve25519 fallback for hardware queue unavailable
  - crypto: hisilicon - mask all error type when uninit
  - net: unic: Fixed the call trace issue triggered internally by the completion event interrupt
  - !19624  xsched: XCU Partition
  - !19621 ubagg: fix mismatched spin unlock.
  - iommu/ummu: Optimize chip generational compatibility feature
  - iommu/ummu: Fix VM multi-instance problem
  - ubagg: fix mismatched spin unlock.
  - net: unic: Restore tx and rx stats when setting coalesce parameters
  - ub: ubase: obtain rc_max_cnt from MAMI
  - ub: ubase: fix a issue of udma device's eid deleted when stop rx stream and reset concurrently
  - ub: ubase: add opcode to query ub port_bitmap.
  - net: unic: Restore default queue count per tc when tc number changes.
  - ub: ubase: Fix the issue of mismatch between the ubase aeqe structure and the protocol.
  - ub: ubase: add ip_over_urma API for udma.
  - ub: ubase: optimize print format of fw_ver in debugfs.
  - ub: ubase: Fix the issue of deadlock by quantities of log in the ctrlq crq task.
  - ub: ubase: Remove non-cluster mode code.
  - net: unic: Resolve the bandwidth jitter problem
  - ub:ubfi: Fix UBFI memory leak issue
  - ub:ubus: Matt and MMIO judgments are not performed in cluster
  - ub:ubus: Delete ubc cfg0 config during cluster mode
  - ub:hisi-ubus: Fix ue reg/unreg without lock bug
  - xsched: fix infinite loop caused by invalid CFS group vruntime update
  - xsched: prevent race between enqueue_ctx and xsched_task_free
  - xsched: DEBUG log cleanup
  - xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation
  - xsched: prevent NULL deref by refcounting css and tracking offline state
  - xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock
  - xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class
  - xsched: fix NULL pointer risk on attach entry allocation
  - xsched: refactor CFS per-XCU rq init/deinit paths
  - iommu/ummu: NO plbi for grant, config permq need dma_wmb
  - iommu/ummu: Fix compilation option configuration about CONFIG_ACPI
  - iommu/ummu: UMMU doesn't send tect sync after delete eid
  - iommu/ummu: Delete unnecessary commands
  - config: Disable unprivileged BPF syscall by default
  - arm64: Add support for TSV110 Spectre-BHB mitigation
  - perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - perf arm-spe: Backport perf_cpu_map__new_online_cpus()
  - perf arm-spe: Save per CPU information in metadata
  - perf arm-spe: Calculate meta data size
  - perf arm-spe: Define metadata header version 2
  - perf arm-spe: Prepare for adding data source packet implementations for other cores
  - perf arm-spe: Use old behavior when opening old SPE files
  - perf arm-spe: Set sample.addr to target address for instruction sample
  - perf color: Add printf format checking and resolve issues
  - perf arm-spe: Add Cortex CPUs to common data source encoding list
  - perf arm-spe: Add Neoverse-V2 to common data source encoding list
  - perf arm-spe: Remove the unused 'midr' field
  - perf arm-spe: Use metadata to decide the data source feature
  - perf arm-spe: Introduce arm_spe__is_homogeneous()
  - perf arm-spe: Dump metadata with version 2
  - perf arm-spe: Support metadata version 2
  - perf arm-spe: Rename the common data source encoding
  - perf arm-spe: Rename arm_spe__synth_data_source_generic()
  - Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12"
  - scsi: mpi3mr: Clear ioctl blocking flag for an unresponsive controller
  - scsi: mpi3mr: Set MPI request flags appropriately
  - scsi: mpi3mr: Replace deprecated strncpy() with assignments
  - scsi: mpi3mr: Fetch correct device dev handle for status reply descriptor


author: Li Nan <linan122@huawei.com> - 6.6.0-134.0.0.128
changelog:
  - !20054 merge topo_kernel_merge_1_1 into OLK-6.6
  - !19916 merge OLK-6.6_new into OLK-6.6
  - !20030 merge topo_kernel_merge into OLK-6.6
  - urma: ubcore support expose/unexpose dev and eid set commands.
  - urma: support uvs query chip_id.
  - urma: add create, delete agg_dev and get name of agg_dev.
  - urma: adapt to new topo info for ubcore/ubagg.
  - !19992 merge patch-1767753584 into OLK-6.6
  - !19763 merge patch-1766378735 into OLK-6.6
  - Revert "NFS: fix up nfs_release_folio() to try to release the page"
  - !19697 merge refs/pull/19697/head into OLK-6.6
  - !19844 merge patch-1766802317 into OLK-6.6
  - !19712 merge refs/pull/19712/head into OLK-6.6
  - !19653 merge refs/pull/19653/head into OLK-6.6
  - !19650 merge refs/pull/19650/head into OLK-6.6
  - !19809 merge patch-1766626818 into OLK-6.6
  - !19839 merge patch-1766740817 into OLK-6.6
  - !19924 merge patch-1767513707 into OLK-6.6
  - !19925 merge patch-1767513733 into OLK-6.6
  - !18476 merge refs/pull/18476/head into OLK-6.6
  - !19871 merge patch-1766998564 into OLK-6.6
  - !19870 merge patch-1766998524 into OLK-6.6
  - !19868 merge patch-1766998223 into OLK-6.6
  - !19831 merge patch-1766714417 into OLK-6.6
  - !19830 merge patch-1766713816 into OLK-6.6
  - !19829 merge patch-1766713004 into OLK-6.6
  - !19828 merge patch-1766712979 into OLK-6.6
  - !19827 merge patch-1766712955 into OLK-6.6
  - !19826 merge patch-1766712919 into OLK-6.6
  - !19711 merge refs/pull/19711/head into OLK-6.6
  - !19810 merge patch-1766626870 into OLK-6.6
  - !19843 merge patch-1766799391 into OLK-6.6
  - !19909 merge patch-1767491328 into OLK-6.6
  - !19799 merge patch-1766495417 into OLK-6.6
  - !19807 merge patch-1766567019 into OLK-6.6
  - !19895 merge patch-1767085921 into OLK-6.6
  - !19926 merge patch-1767515451 into OLK-6.6
  - !19656 merge refs/pull/19656/head into OLK-6.6
  - !19923 merge patch-1767513671 into OLK-6.6
  - !19928 merge patch-1767515719 into OLK-6.6
  - !19859 merge patch-1766977633 into OLK-6.6
  - !19860 merge patch-1766977668 into OLK-6.6
  - !19884 merge patch-1767076134 into OLK-6.6
  - !19913 merge patch-1767493335 into OLK-6.6
  - !19914 merge patch-1767493378 into OLK-6.6
  - !19915 merge patch-1767493397 into OLK-6.6
  - mfs: Avoid UAF on cache object when anon_file is release
  - mfs: avoid deadlock when the cache layer is modified
  - mfs: remove FAROUND event to avoid context switch during map_pages
  - !19612 merge refs/pull/19612/head into OLK-6.6
  - !19733 merge refs/pull/19733/head into OLK-6.6
  - !19729 merge refs/pull/19729/head into OLK-6.6
  - !19720 merge refs/pull/19720/head into OLK-6.6
  - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
  - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
  - bpf: Free special fields when update [lru_,]percpu_hash maps
  - !19846 merge patch-1766818825 into OLK-6.6
  - !19904 merge patch-1767162173 into OLK-6.6
  - !19845 merge patch-1766818524 into OLK-6.6
  - !19797 merge patch-1766494034 into OLK-6.6
  - !19796 merge patch-1766494001 into OLK-6.6
  - !19800 merge patch-1766541023 into OLK-6.6
  - !19847 merge patch-1766820323 into OLK-6.6
  - !19875 merge patch-1767010708 into OLK-6.6
  - !19761 merge patch-1766371001 into OLK-6.6
  - !19619 merge refs/pull/19619/head into OLK-6.6
  - !19912 merge patch-1767493281 into OLK-6.6
  - net_sched: prio: fix a race in prio_tune()
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
  - can: j1939: implement NETDEV_UNREGISTER notification handler
  - Bluetooth: hci_core: Disable works on hci_unregister_dev
  - iomap: fix dirty range tracking in iomap_folio_mkwrite_iter
  - mm: mem_reliable: prevent excessive direct reclaim loops
  - mm: mem_reliable: use percise count during limit check
  - mm: mem_reliable: fix task reliable counter during fork
  - !19793 merge patch-1766492701 into OLK-6.6
  - !19823 merge tmp into OLK-6.6
  - !19888 merge ubase into OLK-6.6
  - !19898 merge OLK_6.6_velinux_1 into OLK-6.6
  - !19901 merge OLK-6.6 into OLK-6.6
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
  - obmm: Register resource for every memdev
  - !19822 merge master into OLK-6.6
  - !19811 merge OLK-6.6 into OLK-6.6
  - !19818 merge OLK-6.6 into OLK-6.6
  - !19854 merge OLK-6.6 into OLK-6.6
  - !19886 merge OLK-6.6 into OLK-6.6
  - ub: ubase: fix ubase activate/deactivate resp timeout
  - urma inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/ID3WJX
  - bpf: Fix stackmap overflow check in __bpf_get_stackid()
  - bpf: Refactor stack map trace depth calculation into helper function
  - net: unic: Fix ethtool configuration error issue.
  - ub: ubase: Resolve mailbox timeout issue.
  - scsi: qla2xxx: Clear cmds after chip reset
  - ub: udma: bugfix related to rx close.
  - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
  - futex: Don't leak robust_list pointer on exec race
  - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
  - Bluetooth: hci_event: validate skb length for unknown CC opcode
  - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()
  - tracing: Fix memory leaks in create_field_var()
  - ub: udma: Bugfix related to 2M hugepage.
  - ppp: fix race conditions in ppp_fill_forward_path
  - scsi: qla2xxx: Fix improper freeing of purex item
  - coresight: ETR: Fix ETR buffer use-after-free issue
  - arm-spe: Fix typos in the arm_spe_to_htpg()
  - mm/shmem: Fix order passing error in the shmem_alloc_folio()
  - arm64/mpam: Synchronize MPAM Partid to kernel mode
  - ext4: xattr: fix null pointer deref in ext4_raw_inode()
  - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
  - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
  - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
  - ext4: refresh inline data size before write operations
  - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
  - ub:ubfi:skipped address of subtable 0 in ubrt
  - ub:ubus delete undefined class code
  - ub: cdma: add ioctl logs and error codes
  - ub:ubus: fix ub_get_bus_controller getting null
  - ub:ubus: Move the decoder's queue operations to hisi-ubus
  - ub:ubus: hi_msg_sync_wait first pull cq
  - perf/x86/intel: Fix KASAN global-out-of-bounds warning
  - mm: migrate: add dma copy offloading for hugetlb
  - nvmet-fc: avoid scheduling association deletion twice
  - bpf: Fix invalid prog->stats access when update_effective_progs fails
  - ftrace: Fix softlockup in ftrace_module_enable
  - bpf: account for current allocated stack depth in widen_imprecise_scalars()
  - bpf: Add bpf_prog_run_data_pointers()
  - iommu: set the default iommu-dma mode as non-strict
  - timers: Fix NULL function pointer race in timer_shutdown_sync()
  - x86/fpu: Ensure XFD state on signal delivery
  - !19680 LoongArch: Mask all interrupts during kexec/kdump
  - !19682 Loongarch: Enable CONFIG_RANDOMIZE_BASE default
  - !19738  xsched: move xsched types to user-accessible headers
  - !19717 obmm: Race condition fix, mmap rollback fix and export_user flag check.
  - xsched: move xsched types to user-accessible headers
  - obmm: Add FAST flag check for obmm_export_from_user
  - obmm: Rollback mmap_granu when mmap failed
  - !19735 add check ack msg and do sleep
  - add check ack msg and do sleep
  - usb: storage: Fix memory leak in USB bulk transport
  - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
  - !18003 [OLK-6.6] PCI: phytium: Add hotplug and hotreset workaround patch for phytium SoCs
  - Loongarch: Enable CONFIG_RANDOMIZE_BASE default
  - LoongArch: Mask all interrupts during kexec/kdump
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
  - !19714 drm/hisilicon/hibmc: fix PCIe 64-bit bar support
  - obmm: Fix race condition of region release and device release
  - !19688 ub: ubase: CtrlQ retry message uses the same seq
  - !19687 ub: udma: Bugfix related to crq event unregister.
  - !19641 ub:hisi-ubus: fix MUE unreg msg rsp time
  - !19677 ub: libcdma: add eid upi update response
  - drm/hisilicon/hibmc: fix PCIe 64-bit bar support
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
  - !19709  mm: try skipping pinned page before unmapping in migration
  - usb: storage: sddr55: Reject out-of-bound new_pba
  - mm: try skipping pinned page before unmapping in migration
  - iomap: fix dirty range tracking in iomap_folio_mkwrite_iter
  - ub: udma: Bugfix related to crq event unregister.
  - ub:ubus: Change create device irq domain debug info
  - ub: ubase: CtrlQ retry message uses the same seq
  - net: unic: Fix the calltrace caused by modifying queue parameters in the MUE scenario
  - ub: cdma: add eid upi update response
  - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
  - be2net: pass wrb_params in case of OS2BMC
  - ub:hisi-ubus: fix MUE unreg msg rsp time
  - driver/coda: Fix possible NULL pointer dereference error.
  - VirtCCA supports Ascend 310P in CoDA scenarios
  - NFSD: Fix crash in nfsd4_read_release()
  - configs: Add bus lock detect config in openeuler_config
  - x86/split_lock: Add support for Zhaoxin
  - x86/split_lock: Simplify reenabling
  - x86/split_lock: Fix the delayed detection logic
  - x86/split_lock: Move Split and Bus lock code to a dedicated file
  - PCI: phytium: Add hotplug and hotreset workaround patch for phytium SoCs


author: Li Nan <linan122@huawei.com> - 6.6.0-135.0.0.129
changelog:
  - !19710 [OLK-6.6] Batch BAR sizing operations
  - !19952  mfs: Add prefetch demo
  - !20138 net:nebula-matrix:add protection of consecutive write regs
  - !20033  ceph: fix crash in process_v2_sparse_read() for encrypted directories
  - !20032  net: atlantic: fix fragment overflow handling in RX path
  - !20031  Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
  - !20014  xfs: do not propagate ENODATA disk errors into xattr code
  - !20015  Fix CVE-2025-40242
  - !19960  wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
  - !20005  cifs: Fix establishing NetBIOS session for SMB2+ connection
  - !20009  ftrace: Fix BPF fexit with livepatch
  - !19983  regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
  - !19968  EEVDF null pointer
  - !19773  bpf, arm64: Do not audit capability check in do_jit()
  - !19997  mfs: remove FAROUND event for mfsd demo
  - !19942 [virtCCA Live Migration 1]virtcca secure cvm supports live migration
  - !20160 v3  CVE-2025-68304
  - !20141 urma: Fix the bug of exposing devices fails for host network
  - !20148 ubcore: fix route query for container loopback.
  - !20120 urma: fix urma_admin agg del eid failed.
  - !20028 release urma source when the ub device is removed
  - !20017  kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir().
  - !20115  KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
  - !20109 uvb: change cis call default poll timeout
  - urma: fix the bug for container.
  - !20154 merge fix_is_err into OLK-6.6
  - Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
  - Bluetooth: ISO: don't leak skb in ISO_CONT RX
  - Bluetooth: ISO: free rx_skb if not consumed
  - Bluetooth: ISO: Use kref to track lifetime of iso_conn
  - Bluetooth: SCO: fix sco_conn refcounting on sco_conn_ready
  - Bluetooth: SCO: remove the redundant sco_conn_put
  - Bluetooth: SCO: Use kref to track lifetime of sco_conn
  - Bluetooth: hci_core: Fix not checking skb length on hci_scodata_packet
  - urma: fix ubcore_cock NULL pointer check.
  - ubcore: fix route query for container loopback.
  - net:nebula-matrix:add protection of consecutive write regs
  - urma: fix urma_admin agg del eid failed.
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer
  - !20100 merge OLK-6.6-v6.6.92-backport into OLK-6.6
  - uvb: change cis call default poll timeout
  - dmaengine: idxd: Fix double free in idxd_setup_wqs()
  - dmaengine: idxd: Fix refcount underflow on module unload
  - dmaengine: idxd: Remove improper idxd_free
  - fs/xattr.c: fix simple_xattr_list()
  - firmware: arm_scmi: Account for failed debug initialization
  - drm/amdgpu: fix pm notifier handling
  - LoongArch: Explicitly specify code model in Makefile
  - usb: typec: ucsi: displayport: Fix deadlock
  - mm/page_alloc: fix race condition in unaccepted memory handling
  - dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
  - dmaengine: idxd: fix memory leak in error handling path of idxd_pci_probe
  - dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call
  - dmaengine: idxd: Add missing cleanups in cleanup internals
  - dmaengine: idxd: Add missing cleanup for early error out in idxd_setup_internals
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_engines
  - dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs
  - dmaengine: ti: k3-udma: Use cap_mask directly from dma_device structure instead of a local copy
  - net: qede: Initialize qede_ll_ops with designated initializer
  - smb: client: fix memory leak during error handling for POSIX mkdir
  - scsi: sd_zbc: block: Respect bio vector limits for REPORT ZONES buffer
  - phy: renesas: rcar-gen3-usb2: Set timing registers only once
  - phy: renesas: rcar-gen3-usb2: Fix role detection on unbind/bind
  - phy: Fix error handling in tegra_xusb_port_init
  - phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
  - tracing: samples: Initialize trace_array_printk() with the correct function
  - Drivers: hv: vmbus: Remove vmbus_sendpacket_pagebuffer()
  - Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges
  - hv_netvsc: Remove rmsg_pgcnt
  - hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages
  - ALSA: usb-audio: Add sample rate quirk for Microdia JP001 USB Camera
  - ALSA: usb-audio: Add sample rate quirk for Audioengine D1
  - ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  - drm/amd/display: Avoid flooding unnecessary info messages
  - drm/amd/display: Correct the reply value when AUX write incomplete
  - LoongArch: Fix MAX_REG_OFFSET calculation
  - udf: Make sure i_lenExtents is uptodate on inode eviction
  - NFSv4/pnfs: Reset the layout state after a layoutreturn
  - tsnep: fix timestamping with a stacked DSA driver
  - tsnep: Inline small fragments within TX descriptor
  - octeontx2-af: Fix CGX Receive counters
  - net: ethernet: mtk_eth_soc: fix typo for declaration MT7988 ESW capability
  - octeontx2-pf: macsec: Fix incorrect max transmit size in TX secy
  - qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
  - ALSA: sh: SND_AICA should depend on SH_DMA_API
  - nvme-pci: make nvme_pci_npages_prp() __always_inline
  - net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
  - ALSA: ump: Fix a typo of snd_ump_stream_msg_device_info
  - ALSA: seq: Fix delivery of UMP events to group ports
  - net: mctp: Ensure keys maintain only one ref to corresponding dev
  - tools/net/ynl: ethtool: fix crash when Hardware Clock info is missing
  - tools: ynl: ethtool.py: Output timestamping statistics from tsinfo-get operation
  - Bluetooth: MGMT: Fix MGMT_OP_ADD_DEVICE invalid device flags
  - spi: loopback-test: Do not split 1024-byte hexdumps
  - HID: thrustmaster: fix memory leak in thrustmaster_interrupts()
  - iio: chemical: sps30: use aligned_s64 for timestamp
  - iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
  - Revert "drm/amd: Stop evicting resources on APUs in suspend"
  - drm/amd: Add Suspend/Hibernate notification callback support
  - drm/amdgpu: trigger flr_work if reading pf2vf data failed
  - drm/amdgpu: Fix the runtime resume failure issue
  - drm/amd: Stop evicting resources on APUs in suspend
  - iio: adc: ad7266: Fix potential timestamp alignment issue.
  - firmware: arm_scmi: Fix timeout checks on polling path
  - firmware: arm_scmi: Track basic SCMI communication debug metrics
  - firmware: arm_scmi: Add support for debug metrics at the interface
  - firmware: arm_scmi: Add message dump traces for bad and unexpected replies
  - firmware: arm_scmi: Add helper to trace bad messages
  - tpm: tis: Double the timeout B to 4s
  - cgroup/cpuset: Extend kthread_is_per_cpu() check to all PF_NO_SETAFFINITY tasks
  - platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
  - platform/x86/amd/pmc: Declare quirk_spurious_8042 for MECHREVO Wujie 14XA (GX4HRXL)
  - binfmt_elf: Move brk for static PIE even if ASLR disabled
  - binfmt_elf: Honor PT_LOAD alignment for static PIE
  - binfmt_elf: Calculate total_size earlier
  - selftests/exec: Build both static and non-static load_address tests
  - binfmt_elf: Leave a gap between .bss and brk
  - selftests/exec: load_address: conform test to TAP format output
  - binfmt_elf: elf_bss no longer used by load_elf_binary()
  - binfmt_elf: Support segments with 0 filesz and misaligned starts
  - fs/xattr.c: fix simple_xattr_list to always include security.* xattrs
  - !20080 merge OLK-6.6 into OLK-6.6
  - ubcore: fix netdev size limit error.
  - !19254 merge refs/pull/19254/head into OLK-6.6
  - drivers/ub/sentry: release urma source when the ub device is removed
  - ceph: fix crash in process_v2_sparse_read() for encrypted directories
  - net: atlantic: fix fragment overflow handling in RX path
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
  - kernfs: Don't re-lock kernfs_root::kernfs_rwsem in kernfs_fop_readdir().
  - gfs2: Fix unlikely race in gdlm_put_lock
  - gfs2: Add proper lockspace locking
  - xfs: do not propagate ENODATA disk errors into xattr code
  - ftrace: Fix BPF fexit with livepatch
  - cifs: Fix establishing NetBIOS session for SMB2+ connection
  - mfs: remove FAROUND event for mfsd demo
  - [virtCCA Live Migration 1]virtcca secure cvm supports live migration
  - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
  - sched: Fix kabi breakage of struct cfs_rq for zero_vruntime
  - sched/eevdf: Fix min_vruntime vs avg_vruntime
  - sched/core: Add comment explaining force-idle vruntime snapshots
  - sched/fair: Forfeit vruntime on yield
  - Revert "sched/fair: Only increment deadline once on yield"
  - sched: Fix kabi breakage of struct cfs_rq for min_vruntime_copy
  - sched/eevdf: Remove min_vruntime_copy
  - sched: Fix kabi breakage of struct sched_entity for on_rq and rel_deadline
  - sched/fair: Avoid re-setting virtual deadline on 'migrations'
  - sched/balancing: Change comment formatting to not overlap Git conflict marker lines
  - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
  - mfs: Add prefetch demo
  - bpf, arm64: Do not audit capability check in do_jit()
  - PCI: Batch BAR sizing operations
  - bpf: Do not audit capability check in do_jit()
  - usb: usbtmc: Fix read_stb function and get_stb ioctl
  - staging: axis-fifo: fix TX handling on copy_from_user() failure
  - staging: axis-fifo: flush RX FIFO on read errors
  - staging: axis-fifo: fix maximum TX packet length check
  - ksmbd: fix stream write failure
  - netfilter: ipset: Remove unused htable_bits in macro ahash_region
  - Documentation: x86/bugs/its: Add ITS documentation
  - x86/speculation: Remove the extra #ifdef around CALL_NOSPEC
  - x86/speculation: Add a conditional CS prefix to CALL_NOSPEC
  - x86/speculation: Simplify and make CALL_NOSPEC consistent
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode
  - x86/bpf: Add IBHF call at end of classic BPF
  - x86/bpf: Call branch history clearing sequence on exit
  - io_uring: ensure deferred completions are posted for multishot
  - io_uring: always arm linked timeouts prior to issue
  - do_umount(): add missing barrier before refcount checks in sync case
  - drm/panel: simple: Update timings for AUO G101EVN010
  - MIPS: Fix MAX_REG_OFFSET
  - iio: adc: dln2: Use aligned_s64 for timestamp
  - iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
  - types: Complement the aligned types with signed 64-bit one
  - iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
  - iio: accel: adxl367: fix setting odr for activity time update
  - usb: usbtmc: Fix erroneous generic_read ioctl return
  - usb: usbtmc: Fix erroneous wait_srq ioctl return
  - usb: usbtmc: Fix erroneous get_stb ioctl error returns
  - USB: usbtmc: use interruptible sleep in usbtmc_read
  - usb: typec: ucsi: displayport: Fix NULL pointer access
  - usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
  - usb: host: tegra: Prevent host controller crash when OTG port is used
  - usb: gadget: Use get_status callback to set remote wakeup capability
  - usb: gadget: tegra-xudc: ACK ST_RC after clearing CTRL_RUN
  - usb: gadget: f_ecm: Add get_status callback
  - usb: cdnsp: fix L1 resume issue for RTL_REVISION_NEW_LPM version
  - usb: cdnsp: Fix issue with resuming from L1
  - ocfs2: stop quota recovery before disabling quotas
  - ocfs2: implement handshaking with ocfs2 recovery thread
  - ocfs2: switch osb->disable_recovery to enum
  - clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
  - xenbus: Use kref to track req lifetime
  - xen: swiotlb: Use swiotlb bouncing if kmalloc allocation demands it
  - smb: client: Avoid race in open_cached_dir with lease breaks
  - usb: uhci-platform: Make the clock really optional
  - drm/amdgpu/hdp6: use memcfg register to post the write for HDP flush
  - drm/amdgpu/hdp5: use memcfg register to post the write for HDP flush
  - drm/amdgpu/hdp5.2: use memcfg register to post the write for HDP flush
  - drm/amdgpu/hdp4: use memcfg register to post the write for HDP flush
  - drm/amd/display: Copy AUX read reply data whenever length > 0
  - drm/amd/display: Fix wrong handling for AUX_DEFER case
  - drm/amd/display: Remove incorrect checking in dmub aux handler
  - drm/amd/display: Fix the checking condition in dmub aux handling
  - iio: adis16201: Correct inclinometer channel resolution
  - iio: adc: rockchip: Fix clock initialization sequence
  - iio: adc: ad7606: fix serial register access
  - drm/amd/display: Shift DMUB AUX reply command if necessary
  - staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
  - staging: axis-fifo: Remove hardware resets for user errors
  - staging: iio: adc: ad7816: Correct conditional logic for store mode
  - Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
  - Input: synaptics - enable SMBus for HP Elitebook 850 G1
  - Input: synaptics - enable InterTouch on Dell Precision M3800
  - Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
  - Input: synaptics - enable InterTouch on Dynabook Portege X30-D
  - Input: xpad - add support for 8BitDo Ultimate 2 Wireless Controller
  - Input: xpad - fix Share button on Xbox One controllers
  - Input: mtk-pmic-keys - fix possible null pointer dereference
  - Input: cyttsp5 - fix power control issue on wakeup
  - Input: cyttsp5 - ensure minimum reset pulse width
  - net: dsa: b53: fix learning on VLAN unaware bridges
  - net: dsa: b53: always rejoin default untagged VLAN on bridge leave
  - net: dsa: b53: fix VLAN ID for untagged vlan on bridge leave
  - net: dsa: b53: fix flushing old pvid VLAN on pvid change
  - net: dsa: b53: fix clearing PVID of a port
  - net: dsa: b53: allow leaky reserved multicast
  - netfilter: ipset: fix region locking in hash types
  - can: gw: fix RCU/BH usage in cgw_create_job()
  - can: mcp251xfd: fix TDC setting for low data bit rates
  - net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
  - netdevice: add netdev_tx_reset_subqueue() shorthand
  - sch_htb: make htb_deactivate() idempotent
  - ksmbd: prevent out-of-bounds stream writes by validating *pos
  - can: mcp251xfd: mcp251xfd_remove(): fix order of unregistration calls
  - wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
  - can: mcan: m_can_class_unregister(): fix order of unregistration calls
  - arm64: dts: imx8mm-verdin: Link reg_usdhc2_vqmmc to usdhc2
  - dm: add missing unlock on in dm_keyslot_evict()


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: xinghe <xinghe2@h-partners.com> - 2:1.6.40-2
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: wangkai <13474090681@163.com> - 8.0.38-1
changelog:
  - Update to 8.0.38 for fix CVEs(CVE-2024-21125,CVE-2024-21142,CVE-2024-21179,
    CVE-2024-21171,CVE-2024-21130,CVE-2024-21162,CVE-2024-21177,CVE-2024-20996,
    CVE-2024-21134,CVE-2024-21165,CVE-2024-21173,CVE-2024-21129,CVE-2024-21127,
    CVE-2024-21163)


author: wangkai <13474090681@163.com> - 8.0.40-1
changelog:
  - Update to 8.0.40 for fix CVEs(CVE-2024-21218,CVE-2024-21196,CVE-2024-21207,
    CVE-2024-21198,CVE-2024-21203,CVE-2024-21213,CVE-2024-21239,CVE-2024-21199,
    CVE-2024-21197,CVE-2024-21247,CVE-2024-21193,CVE-2024-21212,CVE-2024-21241,
    CVE-2024-21230,CVE-2024-21236,CVE-2024-21194,CVE-2024-21238,CVE-2024-21237,
    CVE-2024-21201,CVE-2024-21231,CVE-2024-21219,CVE-2024-21185)


author: yaoxin <1024769339@qq.com> - 8.0.41-1
changelog:
  - Update to 8.0.41 for fix CVEs(CVE-2025-21490,CVE-2025-21491,CVE-2025-21495,
    CVE-2025-21497,CVE-2025-21500,CVE-2025-21501,CVE-2025-21503,CVE-2025-21505,
    CVE-2025-21518,CVE-2025-21519,CVE-2025-21520,CVE-2025-21522,CVE-2025-21523,
    CVE-2025-21529,CVE-2025-21531,CVE-2025-21540,CVE-2025-21543,CVE-2025-21546,
    CVE-2025-21555,CVE-2025-21559)


author: yaoxin <1024769339@qq.com> - 8.0.42-1
changelog:
  - Update to 8.0.42 for fix CVEs(CVE-2025-21574,CVE-2025-21575,CVE-2025-21577,
    CVE-2025-21580,CVE-2025-21581,CVE-2025-21584,CVE-2025-21585,CVE-2025-30681,
    CVE-2025-30682,CVE-2025-30683,CVE-2025-30684,CVE-2025-30685,CVE-2025-30687,
    CVE-2025-30688,CVE-2025-30689,CVE-2025-30693,CVE-2025-30695,CVE-2025-30696,
    CVE-2025-30699,CVE-2025-30703,CVE-2025-30704,CVE-2025-30705,CVE-2025-30710,
    CVE-2025-30715,CVE-2025-30721,CVE-2025-30722


author: yaoxin <1024769339@qq.com> - 8.0.43-1
changelog:
  - Update to 8.4.6 for fix CVEs (CVE-2025-50068,CVE-2025-50077,CVE-2025-50078,
    CVE-2025-50079,CVE-2025-50080,CVE-2025-50081,CVE-2025-50082,CVE-2025-50083,
    CVE-2025-50084,CVE-2025-50085,CVE-2025-50086,CVE-2025-50087,CVE-2025-50091,
    CVE-2025-50092,CVE-2025-50093,CVE-2025-50094,CVE-2025-50096,CVE-2025-50097,
    CVE-2025-50098,CVE-2025-50099,CVE-2025-50100,CVE-2025-50101,CVE-2025-50102,
    CVE-2025-50104,CVE-2025-53023)


author: wangkai <13474090681@163.com> - 8.0.44-1
changelog:
  - Update to 8.0.44 for fix CVEs (CVE-2025-53069,CVE-2025-53062,CVE-2025-53054,
    CVE-2025-53053,CVE-2025-53045,CVE-2025-53044,CVE-2025-53042,CVE-2025-53040)


author: yaoxin <1024769339@qq.com> - 8.0.45-1
changelog:
  - Update to 8.0.45 for fix CVEs (CVE-2026-21936,CVE-2026-21937,
    CVE-2026-21941,CVE-2026-21948,CVE-2026-21964,CVE-2026-21968)


author: yaoxin <yao_xin001@hoperun.com> - 1:20.12.1-1
changelog:
  - Update to 20.12.1:
    * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
      leads to HTTP/2 server crash- (High)
    * CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)
    * llhttp version 9.2.1
    * undici version 5.28.4


author: jchzhou <zhoujiacheng@iscas.ac.cn> - 1:20.12.1-2
changelog:
  - fix building w/ clang: only apply '-fno-ipa-icf' for gcc && disable LTO for clang + ld.bfd
  - improve the handling of trilling whitespaces in C/CXXFLAGS


author: Ge Wang <wang__ge@126.com> - 1:20.12.1-3
changelog:
  - CVE-2023-45853 - Reject overflows of zip header fields in minizip
  - CVE-2024-5274 - Using FunctionParsingScope for parsing class static
  - CVE-2024-5535 - Fix SSL_select_next_proto
  - CVE-2024-7971 - Spill all loop inputs before entering loop


author: wangkai <13474090681@163.com> - 1:20.18.2-1
changelog:
  - Update to 20.18.2
  - Fix CVE-2025-23083 CVE-2025-23085 CVE-2025-23084 CVE-2024-36137
    CVE-2024-22018 CVE-2024-22020


author: wangkai <13474090681@163.com> - 1:20.18.2-5
changelog:
  - Fix CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
    CVE-2025-59465, CVE-2025-59466, CVE-2026-21637


author: chengyechun <chengyechun1@huawei.com> - 1.26.18-2
changelog:
  - Type:CVE
  - CVE:CVE-2024-37891
  - SUG:NA
  - DESC:fix CVE-2024-37891 Strip Proxy-Authorizatioin header on redirects


