# changelog

author: Li Nan <linan122@huawei.com> - 6.6.0-99.0.0.91
changelog:
  - !16556 [OLK-6.6] PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - !16559 mm: mincore: use pte_batch_hint() to batch process large folios
  - !16689 mm/madvise: batch tlb flushes for MADV_DONTNEED and MADV_FREE
  - !16426 FIX CVE-2025-40014
  - !16601 add virtcca capability and kae vf interface
  - !16866 v2  mempolicy: optimize queue_folios_pte_range by PTE batching
  - !16865  pci:vga fix race condition in vga_arb_write
  - !16770 [OLK-6.6] Intel: Backport to fix QuickAssist Technology(QAT) in-tree driver from v6.10 to v6.16
  - !16773  mm:userswap: change VM_USWAP_BIT to bit 61
  - !16820 v2  Fix some smmu bugs
  - !16803  CVE-2025-38060
  - !16828  orangefs: Do not truncate file size
  - !16812 perf hisi-ptt: Fix memory leak in lseek failure handling
  - !16827  btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  - !16775 [OLK-6.6]fix enfs bug
  - !16861  arm64: kaslr: fix nokaslr cmdline parsing
  - mempolicy: optimize queue_folios_pte_range by PTE batching
  - !16804  HID: uclogic: Add NULL check in uclogic_input_configured()
  - !16806  vhost-scsi: protect vq->log_used with vq->mutex
  - !14552 [OLK-6.6]Arm64:KVM: Auto get the virtual_dev irq bypass's devid
  - !16573  Backport 6.6.64-6.6.72 LTS
  - !16757  objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  - !16756  mm: pcp: increase pcp->free_count threshold to trigger free_high
  - pci:vga fix race condition in vga_arb_write
  - !16656  merge CVE patches into OLK-6.6
  - !16512  perf/x86/intel: Only check the group flag for X86 leader
  - !16617  SELinux: Add check for the user data passed to kcalloc in hashtab_init
  - !16748  arm64: xcall: Fix GPR touch as the original step
  - !16778  drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
  - !16848  tracing: probes: Fix a possible race in trace_probe_log APIs
  - !16842  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - !16837  ftrace: Fix preemption accounting for stacktrace filter command
  - !16845  bpf: Avoid __bpf_prog_ret0_warn when jit fails
  - !16652 v2  CVE-2025-37948
  - !16791  ALSA: pcm: Fix race of buffer access at PCM OSS layer
  - arm64: kaslr: fix nokaslr cmdline parsing
  - !16851  drm/amd/display: Increase block_sequence array size
  - drm/amd/display: Increase block_sequence array size
  - tracing: probes: Fix a possible race in trace_probe_log APIs
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled
  - ftrace: Fix preemption accounting for stacktrace filter command
  - orangefs: Do not truncate file size
  - btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  - iommu/arm-smmu-v3: Fix the problematic platform detection logic
  - iommu/arm-smmu-v3: Fix the extra atc tlb flush
  - fix review issue
  - vhost-scsi: protect vq->log_used with vq->mutex
  - perf hisi-ptt: Fix memory leak in lseek failure handling
  - HID: uclogic: Add NULL check in uclogic_input_configured()
  - bpf: abort verification if env->cur_state->loop_entry != NULL
  - bpf: copy_verifier_state() should copy 'loop_entry' field
  - ALSA: pcm: Fix race of buffer access at PCM OSS layer
  - fix enfs bug
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
  - mm:userswap: change VM_USWAP_BIT to bit 61
  - crypto: qat - switch to standard pattern for PCI IDs
  - crypto: qat - remove BITS_IN_DWORD()
  - crypto: qat - remove initialization in device class
  - crypto: qat - add shutdown handler to qat_c3xxx
  - crypto: qat - remove redundant prototypes in qat_c3xxx
  - crypto: qat - add shutdown handler to qat_c62x
  - crypto: qat - remove redundant prototypes in qat_c62x
  - crypto: qat - add shutdown handler to qat_dh895xcc
  - crypto: qat - remove redundant prototypes in qat_dh895xcc
  - crypto: qat - add shutdown handler to qat_420xx
  - crypto: qat - add shutdown handler to qat_4xxx
  - crypto: qat - Remove dst_null support
  - crypto: qat - remove access to parity register for QAT GEN4
  - crypto: qat - set parity error mask for qat_420xx
  - crypto: qat - optimize allocations for fw authentication
  - crypto: qat - remove redundant FW image size check
  - crypto: qat - remove unused members in suof structure
  - crypto: qat - introduce fuse array
  - crypto: qat - add macro to write 64-bit values to registers
  - crypto: qat - refactor service parsing logic
  - crypto: qat - do not export adf_cfg_services
  - crypto: qat - reorder objects in qat_common Makefile
  - crypto: qat - fix object goals in Makefiles
  - crypto: qat - set command ids as reserved
  - crypto: drivers - Use str_enable_disable-like helpers
  - vfio/qat: fix overflow check in qat_vf_resume_write()
  - crypto: qat - Fix missing destroy_workqueue in adf_init_aer()
  - crypto: qat - Fix typo "accelaration"
  - crypto: qat - Constify struct pm_status_row
  - crypto: qat - remove unused adf_devmgr_get_first
  - lib/string_choices: Add str_up_down() helper
  - crypto: qat - Remove trailing space after 
  - crypto: qat - fix "Full Going True" macro definition
  - crypto: qat - Use static_assert() to check struct sizes
  - crypto: qat - allow disabling SR-IOV VFs
  - crypto: qat - ensure correct order in VF restarting handler
  - crypto: qat - fix recovery flow for VFs
  - crypto: qat - disable IOV in adf_dev_stop()
  - crypto: qat - preserve ADF_GENERAL_SEC
  - crypto: qat - initialize user_input.lock for rate_limiting
  - crypto: qat - make adf_ctl_class constant
  - crypto: qat - Fix typo
  - crypto: qat - fix linking errors when PCI_IOV is disabled
  - objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  - mm: pcp: increase pcp->free_count threshold to trigger free_high
  - mm: page_alloc: remove redundant READ_ONCE
  - arm64: xcall: Fix GPR touch as the original step
  - mm/madvise: handle madvise_lock() failure during race unwinding
  - mm/madvise: batch tlb flushes for MADV_DONTNEED[_LOCKED]
  - mm/memory: split non-tlb flushing part from zap_page_range_single()
  - mm/madvise: batch tlb flushes for MADV_FREE
  - mm/madvise: define and use madvise_behavior struct for madvise_do_behavior()
  - mm/madvise: remove len parameter of madvise_do_behavior()
  - mm/madvise: remove redundant mmap_lock operations from process_madvise()
  - mm/madvise: split out madvise() behavior execution
  - mm/madvise: split out madvise input validity check
  - mm/madvise: split out mmap locking operations for madvise()
  - mm/madvise: unrestrict process_madvise() for current process
  - mm/madvise: don't perform madvise VMA walk for MADV_POPULATE_(READ|WRITE)
  - crypto: iaa - Fix potential use after free bug
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
  - mm: migrate_device: use more folio in migrate_device_finalize()
  - Revert "remoteproc: core: Clear table_sz when rproc_shutdown"
  - remoteproc: core: Clear table_sz when rproc_shutdown
  - jfs: fix slab-out-of-bounds read in ea_get()
  - tpm: do not start chip while suspended
  - KVM: arm64: Tear down vGIC on failed vCPU creation
  - drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
  - arm64: proton-pack: Expose whether the branchy loop k value
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware
  - arm64: insn: Add support for encoding DSB
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
  - arm64: cputype: Add MIDR_CORTEX_A76AE
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
  - add virtcca capability and kae vf interface
  - SELinux: Add check for the user data passed to kcalloc in hashtab_init
  - PCI: Supplement ACS quirk for more Zhaoxin Root Ports
  - seq_buf: Make DECLARE_SEQ_BUF() usable
  - seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str()
  - mm: mincore: use pte_batch_hint() to batch process large folios
  - perf/x86/intel: Only check the group flag for X86 leader
  - objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()
  - irqchip/gic-v3-its: Init reserved rsv_devid_pools use pci bus info
  - irqchip/gic-v3-its: Move build_devid_pools from its to acpi iort init
  - irqchip/gic-v3-its: Add ACPI_IORT as VIRT_PLAT_DEV's dependency
  - acpi/iort: Add func to get used deviceid bitmap

   newline


author: Li Nan <linan122@huawei.com> - 6.6.0-100.0.0.92
changelog:
  - !17003  net_sched: red: fix a race in __red_change()
  - !16747  LoongArch: Fix bugs in huge_pte_offset/__alloc_pages_slowpath/iommu
  - !17026  CVE-2025-37842
  - !17022  spi-rockchip: Fix register out of bounds access
  - !17039  iio: light: opt3001: fix deadlock due to concurrent flag access
  - !17036  parisc: Fix double SIGFPE crash
  - !17001  Fix CVE-2025-38182
  - !17034  fix CVE-2025-38118
  - !17033  LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
  - !17035  drm/amdkfd: Fix mode1 reset crash issue
  - !16792 v3  Support CCA Guest
  - iio: light: opt3001: fix deadlock due to concurrent flag access
  - !17023  bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
  - parisc: Fix double SIGFPE crash
  - drm/amdkfd: Fix mode1 reset crash issue
  - Bluetooth: MGMT: Fix sparse errors
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
  - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
  - spi: fsl-qspi: Fix double cleanup in probe error path
  - spi: fsl-qspi: use devm function instead of driver remove
  - !16991  hwmon: (asus-ec-sensors) check sensor index in read_string()
  - !17014 v2  CVE-2025-38099
  - !17013  crypto: null - Use spin lock instead of mutex
  - bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
  - spi-rockchip: Fix register out of bounds access
  - !16983  crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
  - !16982  KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
  - !16957  f2fs: fix to do sanity check on sbi->total_valid_block_count
  - !16999  octeon_ep: Fix host hang issue during device reboot
  - !16995  f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
  - !17000 v2  mm: respect mmap hint address when aligning for THP
  - !17006  drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  - Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
  - Bluetooth: Add quirk for broken READ_PAGE_SCAN_TYPE
  - Bluetooth: Add quirk for broken READ_VOICE_SETTING
  - crypto: null - Use spin lock instead of mutex
  - !16467 drm/virtio: implement virtio_gpu_shutdown
  - !16565 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y
  - !16743 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - !16902  cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter()
  - !16994  net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
  - !16996  wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
  - drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  - net_sched: red: fix a race in __red_change()
  - ublk: santizize the arguments from userspace when adding a device
  - mm: respect mmap hint address when aligning for THP
  - octeon_ep: Fix host hang issue during device reboot
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
  - f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
  - net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
  - !16988  Fix compile problem for psi_grained
  - hwmon: (asus-ec-sensors) check sensor index in read_string()
  - Fix compile problem for psi_grained
  - crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
  - !16969  Fix CVE-2025-38170
  - !16967  net: openvswitch: Fix the dead loop of MPLS parse
  - !16964  dma-buf: insert memory barrier before updating num_fences
  - arm64/fpsimd: Discard stale CPU state when handling SME traps
  - !16891 fix some build errors of enfs
  - net: openvswitch: Fix the dead loop of MPLS parse
  - dma-buf: insert memory barrier before updating num_fences
  - !16557 [OLK-6.6] PCI/P2PDMA: Add Zhaoxin Zhaoxin bridges to the whitelist
  - !16919  Backport mainline patches
  - f2fs: fix to do sanity check on sbi->total_valid_block_count
  - !16567 [OLK-6.6]:update patches for sw64 architecture
  - !16897  CVE-2025-37784
  - !16922 v2  irqchip/gic-v3: Fix xint sleeping function called from invalid context
  - !16926  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  - !16912 Unbinding VF drivers in virtCCA CoDA SR-IOV scenarios.
  - !16908  OLK-6.6 Bperf
  - !16603 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.83-6.6.84 LTS Patches
  - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  - irqchip/gic-v3: Fix xint sleeping function called from invalid context
  - !16906  rseq: Fix segfault on registration when rseq_cs is non-zero
  - xfrm: Clear low order bits of ->flowi4_tos in decode_session4().
  - xfrm: policy: fix layer 4 flowi decoding
  - xfrm: policy: replace session decode with flow dissector
  - xfrm: move mark and oif flowi decode into common code
  - xfrm: pass struct net to xfrm_decode_session wrappers
  - !16898  libnvdimm/labels: Fix divide error in nd_label_data_init()
  - !16903  some optimization patches for inet_diag dump
  - Unbinding VF drivers in virtCCA CoDA SR-IOV scenarios.
  - !16895 virtCCA supports SR-IOV in CoDA scenarios.
  - perf stat: Fix incorrect display of bperf when event count is 0
  - perf stat: Increase perf_attr_map entries
  - perf test: Use sqrtloop workload to test bperf event
  - perf test stat_bpf_counter.sh: Stabilize the test results
  - perf test bpf-counters: Add test for BPF event modifier
  - perf stat: Support inherit events during fork() for bperf
  - !16896  drm/v3d: Add job to pending list if the reset was skipped
  - rseq: Fix segfault on registration when rseq_cs is non-zero
  - inet_diag: skip over empty buckets
  - sock_diag: remove sock_diag_mutex
  - inet_diag: allow concurrent operations
  - inet_diag: add module pointer to "struct inet_diag_handler"
  - cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter()
  - !16780 v2  mm/mem_sampling: add trace event for spe based damon record
  - !16781 v4  mm/mem_sampling: fix some mem sampling issues
  - libnvdimm/labels: Fix divide error in nd_label_data_init()
  - net: ti: icss-iep: Fix possible NULL pointer dereference for perout request
  - net: ti: icss-iep: Add phase offset configuration for perout signal
  - net: ti: icss-iep: Add pwidth configuration for perout signal
  - drm/v3d: Add job to pending list if the reset was skipped
  - !16753  nfs: handle failure of nfs_get_lock_context in unlock path
  - !16237  pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
  - virtCCA supports SR-IOV in CoDA scenarios.
  - sunrpc, nfs: CONFIG_ENFS should select CONFIG_SUNRPC_ENFS
  - sunrpc, nfs: fix build errors when CONFIG_SUNRPC_ENFS=m && CONFIG_ENFS=m && CONFIG_NFS=y
  - nfs: fix build errors when CONFIG_ENFS=m && CONFIG_NFS_FS=y
  - nfs: fix enfs mount failure when CONFIG_ENFS=y
  - sw64: adapt to the upstream changes in huge_ptep_get_and_clear
  - sw64: sort arch/sw64/Kconfig
  - sw64: iommu: implement map_pages/unmap_pages API
  - gicv3: add lpi support for virtcca cvm guest
  - MAINTAINERS: Add CCA and pKVM CoCO guest support to the ARM64 entry
  - configfs-tsm-report: Fix NULL dereference of tsm_ops
  - arm64: Document Arm Confidential Compute
  - virt: arm-cca-guest: TSM_REPORT support for realms
  - mm/slab: Add __free() support for kvfree
  - configfs-tsm: Introduce a shared ABI for attestation reports
  - virt: coco: Add a coco/Makefile and coco/Kconfig
  - arm64: realm: Use aliased addresses for device DMA to shared buffers
  - dma: Introduce generic dma_addr_*crypted helpers
  - dma: Fix encryption bit clearing for dma_to_phys
  - rme: make sure realm guest map memory in page granularity
  - arm64: realm: ioremap: Allow mapping memory as encrypted
  - parisc: Delay write-protection until mark_rodata_ro() call
  - jump_label,module: Don't alloc static_key_mod for __ro_after_init keys
  - irqchip/gic-v3-its: Rely on genpool alignment
  - irqchip/gic-v3-its: Fix over allocation in itt_alloc_pool()
  - irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor
  - arm64: Enable memory encrypt for Realms
  - arm64: mm: Avoid TLBI when marking pages as valid
  - arm64: Enforce bounce buffers for realm DMA
  - efi: arm64: Map Device with Prot Shared
  - arm64: rsi: Map unprotected MMIO as decrypted
  - arm64: rsi: Add support for checking whether an MMIO is protected
  - arm64: realm: Query IPA size from the RMM
  - arm64: Detect if in a realm and set RIPAS RAM
  - arm64: rsi: Add RSI definitions
  - arm64: mm: Add confidential computing hook to ioremap_prot()
  - arm64: mm: Add top-level dispatcher for internal mem_encrypt API
  - Revert "gicv3: add lpi support for cvm guest"
  - Revert "virtcca feature : disable swiotlb for passthrough device"
  - mm/mem_sampling: Fix inaccurate sampling for NUMA balancing and DAMON
  - mm/mem_sampling: Prevent mem_sampling from being enabled if SPE init failed
  - mm/mem_sampling: add trace event for spe based damon record
  - nfs: handle failure of nfs_get_lock_context in unlock path
  - iommu/loongarch: fix potential hung task when error occurred
  - LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race
  - LoongArch: Fix early_numa_add_cpu() usage for FDT systems
  - scsi: lpfc: Free phba irq in lpfc_sli4_enable_msi() when pci_irq_vector() fails
  - ksmbd: fix r_count dec/increment mismatch
  - Input: xpad - fix two controller table values
  - cifs: Ensure that all non-client-specific reparse points are processed by the server
  - nvme: unblock ctrl state transition for firmware update
  - vboxsf: Add __nonstring annotations for unterminated strings
  - netfilter: nf_tables: allow clone callbacks to sleep
  - netfilter: nf_tables: bail out if stateful expression provides no .clone
  - netfilter: nf_tables: use timestamp to check for set element timeout
  - rust: lockdep: Remove support for dynamically allocated LockClassKeys
  - HID: apple: disable Fn key handling on the Omoton KB066
  - nvme-fc: rely on state transitions to handle connectivity loss
  - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
  - smb: client: Fix match_session bug preventing session reuse
  - smb3: add support for IAKerb
  - i2c: sis630: Fix an error handling path in sis630_probe()
  - i2c: ali15x3: Fix an error handling path in ali15x3_probe()
  - i2c: ali1535: Fix an error handling path in ali1535_probe()
  - cifs: Throw -EOPNOTSUPP error on unsupported reparse point type from parse_reparse_point()
  - cifs: Validate content of WSL reparse point buffers
  - cifs: Fix integer overflow while processing closetimeo mount option
  - cifs: Fix integer overflow while processing actimeo mount option
  - scripts: generate_rust_analyzer: add missing macros deps
  - ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
  - ASoC: rt722-sdca: add missing readable registers
  - rust: init: add missing newline to pr_info! calls
  - ASoC: cs42l43: Fix maximum ADC Volume
  - drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
  - rust: error: add missing newline to pr_warn! calls
  - ASoC: ops: Consistently treat platform_max as control value
  - smb: client: fix regression with guest option
  - qlcnic: fix memory leak issues in qlcnic_sriov_common.c
  - arm64: mm: Populate vmemmap at the page level if not section aligned
  - ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model
  - clk: samsung: update PLL locktime for PLL142XX used on FSD platform
  - ksmbd: prevent connection release during oplock break notification
  - ksmbd: fix use-after-free in ksmbd_free_work_struct
  - drm/amd/display: Fix slab-use-after-free on hdcp_work
  - drm/amd/display: Assign normalized_pix_clk when color depth = 14
  - drm/amd/display: Restore correct backlight brightness after a GPU reset
  - drm/amd/display: Disable unneeded hpd interrupts during dm_init
  - drm/dp_mst: Fix locking when skipping CSN before topology probing
  - drm/atomic: Filter out redundant DPMS calls
  - drm/i915/cdclk: Do cdclk post plane programming later
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
  - USB: serial: option: match on interface class for Telit FN990B
  - USB: serial: option: fix Telit Cinterion FE990A name
  - USB: serial: option: add Telit Cinterion FE990B compositions
  - USB: serial: ftdi_sio: add support for Altera USB Blaster 3
  - Input: i8042 - swap old quirk combination with new quirk for more devices
  - Input: i8042 - swap old quirk combination with new quirk for several devices
  - Input: i8042 - add required quirks for missing old boardnames
  - Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ
  - Input: xpad - rename QH controller to Legion Go S
  - Input: xpad - add support for TECNO Pocket Go
  - Input: xpad - add support for ZOTAC Gaming Zone
  - Input: xpad - add multiple supported devices
  - Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers
  - Input: iqs7222 - preserve system status register
  - Input: ads7846 - fix gpiod allocation
  - io_uring: use unpin_user_pages() where appropriate
  - io_uring/kbuf: vmap pinned buffer ring
  - io_uring: use vmap() for ring mapping
  - io_uring: fix corner case forgetting to vunmap
  - io_uring: don't attempt to mmap larger than what the user asks for
  - io_uring: get rid of remap_pfn_range() for mapping rings/sqes
  - mm: add nommu variant of vm_insert_pages()
  - block: fix 'kmem_cache of name 'bio-108' already exists'
  - net: Handle napi_schedule() calls from non-interrupt
  - drm/nouveau: Do not override forced connector status
  - mptcp: safety check before fallback
  - x86/irq: Define trace events conditionally
  - perf/x86/intel: Use better start period for frequency mode
  - drm/vkms: Round fixp2int conversion in lerp_u16
  - fuse: don't truncate cached, mutated symlink
  - ASoC: tas2764: Set the SDOUT polarity correctly
  - ASoC: tas2764: Fix power control mask
  - ASoC: tas2770: Fix volume scale
  - nvme: only allow entering LIVE from CONNECTING state
  - sctp: Fix undefined behavior in left shift operation
  - cifs: Treat unhandled directory name surrogate reparse points as mount directory nodes
  - apple-nvme: Release power domains when probe fails
  - nvmet-rdma: recheck queue state is LIVE in state lock in recv done
  - nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
  - io-wq: backoff when retrying worker creation
  - net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
  - ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE
  - ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
  - ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
  - ASoC: rsnd: adjust convert rate limitation
  - ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
  - ASoC: rsnd: indicate unsupported clock rate
  - ALSA: hda/realtek: Limit mic boost on Positivo ARN50
  - ASoC: simple-card-utils.c: add missing dlc->of_node
  - selftests/bpf: Fix invalid flag of recv()
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
  - Xen/swiotlb: mark xen_swiotlb_fixup() __init
  - thermal/cpufreq_cooling: Remove structure member documentation
  - s390/cio: Fix CHPID "configure" attribute caching
  - platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
  - platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
  - sched: Clarify wake_up_q()'s write to task->wake_q.next
  - objtool: Ignore dangling jump table entries
  - HID: apple: fix up the F6 key on the Omoton KB066 keyboard
  - HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
  - HID: topre: Fix n-key rollover on Realforce R3S TKL boards
  - usb: phy: generic: Use proper helper for property detection
  - HID: ignore non-functional sensor in HP 5MP Camera
  - HID: intel-ish-hid: Send clock sync message immediately after reset
  - HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
  - vboxsf: fix building with GCC 15
  - alpha/elf: Fix misc/setarch test of util-linux by removing 32bit support
  - smb: client: fix noisy when tree connecting to DFS interlink targets
  - ACPI: resource: IRQ override for Eluktronics MECH-17
  - scsi: ufs: core: Fix error return with query response
  - scsi: core: Use GFP_NOIO to avoid circular locking dependency
  - platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show()
  - sched/debug: Provide slice length for fair tasks
  - powercap: call put_device() on an error path in powercap_register_control_type()
  - hrtimers: Mark is_migration_base() with __always_inline
  - nvme-fc: do not ignore connectivity loss during connecting
  - nvme-fc: go straight to connecting state when initializing
  - net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
  - net/mlx5: Bridge, fix the crash caused by LAG state check
  - net/mlx5: Lag, Check shared fdb before creating MultiPort E-Switch
  - net: openvswitch: remove misbehaving actions length check
  - netfilter: nft_exthdr: fix offset with ipv4_find_option()
  - net_sched: Prevent creation of classes with TC_H_ROOT
  - ipvs: prevent integer overflow in do_ip_vs_get_ctl()
  - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
  - bonding: fix incorrect MAC address setting to receive NS messages
  - net: switchdev: Convert blocking notification chain to a raw one
  - eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
  - net/mlx5: handle errors in mlx5_chains_create_table()
  - Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
  - netpoll: hold rcu read lock in __netpoll_send_skb()
  - net: mctp i2c: Copy headers if cloned
  - net: dsa: mv88e6xxx: Verify after ATU Load ops
  - net/mlx5: Fill out devlink dev info only for PFs
  - Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context"
  - Bluetooth: hci_event: Fix enabling passive scanning
  - sched: address a potential NULL pointer dereference in the GRED scheduler.
  - netfilter: nf_conncount: garbage collection is not skipped when jiffies wrap around
  - ice: fix memory leak in aRFS after reset
  - netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template.
  - pinctrl: bcm281xx: Fix incorrect regmap max_registers value
  - fbdev: hyperv_fb: iounmap() the correct memory when removing a device
  - tcp: fix forever orphan socket caused by tcp_abort
  - tcp: fix races in tcp_abort()
  - hrtimer: Use and report correct timerslack values for realtime tasks
  - zram: fix NULL pointer in comp_algorithm_show()
  - sched/isolation: Prevent boot crash when the boot CPU is nohz_full
  - clockevents/drivers/i8253: Fix stop sequence for timer 0
  - PCI/P2PDMA: Add Zhaoxin Zhaoxin bridges to the whitelist
  - sw64: disable EFFICIENT_UNALIGNED_ACCESS for C3B
  - sw64: optimize unaligned access
  - sw64: ftrace: Add direct call trampoline samples support
  - sw64: ftrace: Add direct call support
  - sw64: ftrace: No need to save original function's temporary registers
  - sw64: perf: fix perf test 'import perf' in python failed
  - sw64: add support for function error injection
  - sw64: add sw64 rethook implementation
  - sw64: emit fixed-length instructions for BPF_PSEUDO_FUNC
  - sw64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL
  - sw64: mm: adjust userspace memory layout
  - sw64: cpufreq: fix the frequency returned by cpufreq_driver->get()
  - sw64: ioremap: map some IO space with ioremap
  - sw64: ioremap: fix an overflow in pci_remap_cfgspace
  - sw64: ioremap: support generic ioremap for C4
  - nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable
  - drm/virtio: implement virtio_gpu_shutdown
  - virtgpu: don't reset on shutdown
  - virtio: break and reset virtio devices on device_shutdown()
  - LoongArch: sync kvm head file from upstream
  - LoongArch: fix migrate issue
  - LoongArch: Save and restore CSR.CNTC for hibernation
  - pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result


author: Li Nan <linan122@huawei.com> - 6.6.0-101.0.0.93
changelog:
  - !17041 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.70-6.6.72 LTS Conflicts Patches
  - !17126  EDAC/skx_common: Fix general protection fault
  - !17136  xcall xint 644
  - modify xcall proc file permissions to 640
  - modify xint proc file permissions to 640
  - !17070  arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - !17106  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !17120 v3  mm: batched unmap lazyfree large folios
  - EDAC/skx_common: Fix general protection fault
  - mm/rmap: fix potential out-of-bounds page table access during batched unmap
  - mm: avoid splitting pmd for lazyfree pmd-mapped THP in try_to_unmap
  - mm: support batched unmap for lazyfree large folios during reclamation
  - mm: support tlbbatch flush for a range of PTEs
  - mm: set folio swapbacked iff folios are dirty in try_to_unmap_one
  - !16998  arm64/mpam: Fix L2 monitor issue under CDP mode
  - !17107  CVE-2025-38322
  - !16947 [OLK-6.6] Fix patches for X2avic to backport for OLK-6.6
  - !17092  drm/amd/display: Fix && vs || typos
  - perf/x86/intel: Fix crash in icl_update_topdown_event()
  - perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
  - perf/x86/intel: Apply static call for drain_pebs
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  - !16884  fs: Backport four namespace fix patches
  - !17094  config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m
  - config: Set TSM_REPORTS=m and ARM_CCA_GUEST=m
  - drm/amd/display: Fix && vs || typos
  - !17071  usb: dwc3: gadget: check that event count does not exceed event buffer length
  - !17068  mcb: fix a double free bug in chameleon_parse_gdd()
  - !17062  bnxt_en: Mask the bd_cnt field in the TX BD properly
  - !16956 v3  config: Enable CONFIG_VIRT_DRIVERS
  - !16950 perf: Add support for SPE Data Source packet on HiSilicon HIP12
  - usb: dwc3: gadget: check that event count does not exceed event buffer length
  - arm64/mpam: Add quirk for MPAM MSMON_MBWU monitor NRDY bit
  - mcb: fix a double free bug in chameleon_parse_gdd()
  - bnxt_en: Mask the bd_cnt field in the TX BD properly
  - !17055  bpf lts backport
  - !17054  bpf verifier fixes
  - !17049  platform/x86: dell_rbu: Fix list usage
  - !17059  media: cxusb: no longer judge rbuf when the write fails
  - !16462 fix  CVE-2025-22101
  - media: cxusb: no longer judge rbuf when the write fails
  - bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
  - bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
  - selftests/bpf: Add tests with stack ptr register in conditional jmp
  - bpf: Do not include stack ptr register in precision backtracking bookkeeping
  - selftests/bpf: precision tracking test for BPF_NEG and BPF_END
  - platform/x86: dell_rbu: Fix list usage
  - fs/Kconfig: make hugetlbfs a menuconfig
  - workqueue: Update lock debugging code
  - memblock: use numa_valid_node() helper to check for invalid node ID
  - perf mem: Count L2 HITM for c2c statistic
  - perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12
  - arm64: cputype: Add cputype definition for HIP12
  - Revert "perf arm-spe: Add support for SPE Data Source packet on HiSilicon HIP12"
  - arm64/mpam: Fix L2 monitor issue under CDP mode
  - KVM: x86: Fix a comment inside __kvm_set_or_clear_apicv_inhibit()
  - config: Enable CONFIG_VIRT_DRIVERS
  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled
  - iommu/amd: Do not flush IRTE when only updating isRun and destination fields
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
  - do_change_type(): refuse to operate on unmounted/not ours mounts
  - fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
  - path_overmount(): avoid false negatives
  - net: libwx: fix Tx L4 checksum


author: Li Nan <linan122@huawei.com> - 6.6.0-102.0.0.94
changelog:
  - !17076  smb: client: fix use-after-free in crypt_message when using async crypto
  - !17102  smb: client: fix use-after-free in cifs_oplock_break
  - !17240  some fix for spe hotcold
  - !17159 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.72-6.6.75 LTS Conflicts Patches
  - !17206  driver core: Use kasprintf() instead of fixed buffer formatting
  - mm_monitor/mm_spe: Embed boost events within SPE packets
  - mm_monitor/mm_spe: Fix SPE boost enablement and continuation handling
  - !17161  olk-6.6-backport-bugfix-for-dynamic-affinity
  - !17150  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  - !17153  f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  - !17154  media: vivid: Change the siize of the composing
  - !17238 v2  net: Fix kabi breakage for defer_free_list in struct net
  - !17237 RDMA/hns: Fix HW configurations not cleared in error flow
  - net: Fix kabi breakage for defer_free_list in struct net
  - RDMA/hns: Fix HW configurations not cleared in error flow
  - RDMA/hns: Fix -Wframe-larger-than issue
  - RDMA/hns: Drop GFP_NOWARN
  - RDMA/hns: Fix accessing uninitialized resources
  - RDMA/hns: Remove redundant hnae3.h in bond and sysfs
  - RDMA/hns: Use __free_page() to free pages allocated with alloc_page()
  - RDMA/hns: Fix divide-by-zero error in dca debugfs
  - RDMA/hns: Add check between dca_min_size and dca_max_size
  - RDMA/hns: Get messgae length of ack_req from FW
  - !17229 net: hns3: fix spelling mistake "reg_um" -&gt; "reg_num"
  - !17032  fbcon: Make sure modelist not set on unregistered console
  - !16958  scsi: target: iscsi: Fix timeout on deleted connection
  - net: hns3: fix spelling mistake "reg_um" -> "reg_num"
  - net: hns3: add complete parentheses for some macros
  - net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer conversion
  - net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle layer conversion
  - net: hns3: delete redundant address before the array
  - net: hns3: clear hns alarm: comparison of integer expressions of different signedness
  - net: hns3: add 
  - Revert "net: hns3: add 
  - !17201 net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri()
  - !17215  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - !17214  netfilter: nf_set_pipapo_avx2: fix initial map fill
  - !17213  net: fix udp gso skb_segment after pull from frag_list
  - !17212  ice: fix Tx scheduler error handling in XDP callback
  - !17207  net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  - !17200  xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  - !17199  tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  - !17198  bpf: consider that tail calls invalidate packet pointers
  - !17197  net: stmmac: Fix accessing freed irq affinity_hint
  - !17196  mptcp: fix NULL pointer in can_accept_new_subflow
  - !17194  tipc: fix memory leak in tipc_link_xmit
  - !17193  net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
  - !17192  cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  - !17184  sctp: add mutual exclusion in proc_sctp_do_udp_port()
  - !17181  net: fix NULL pointer dereference in l3mdev_l3_rcv
  - !17101  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - !17191  net: mctp: Set SOCK_RCU_FREE
  - !17190  usbnet:fix NPE during rx_complete
  - !17189  net: ibmveth: make veth_pool_store stop hanging
  - !17188  arcnet: Add NULL check in com20020pci_probe()
  - !17187  net: fix geneve_opt length integer overflow
  - !17186  udp: Fix memory accounting leak.
  - !17185  net: mvpp2: Prevent parser TCAM memory corruption
  - !17182  net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  - !17179  net: dsa: free routing table on probe failure
  - !17178  sctp: detect and prevent references to a freed transport in sendmsg
  - !17177  net_sched: hfsc: Fix a UAF vulnerability in class handling
  - !17176  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - !17175  net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
  - !17174  net: dsa: clean up FDB, MDB, VLAN entries on unbind
  - !17172  xsk: fix an integer overflow in xp_create_and_assign_umem()
  - !17171  net: atm: fix use after free in lec_send()
  - !17170  eth: bnxt: fix truesize for mb-xdp-pass case
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling
  - netfilter: nf_set_pipapo_avx2: fix initial map fill
  - net: fix udp gso skb_segment after pull from frag_list
  - ice: fix Tx scheduler error handling in XDP callback
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  - !17016 [OLK-6.6]:update patches for sw64 architecture
  - driver core: Use kasprintf() instead of fixed buffer formatting
  - !17074  ext4: only dirty folios when data journaling regular files
  - !16951  wifi: ath9k_htc: Abort software beacon handling if disabled
  - net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri()
  - net: hns3: Resolved the issue that the debugfs query result is inconsistent.
  - Revert "net: hns3: Resolved the issue that the debugfs query result is inconsistent."
  - net: hns3: initialize reset_timer before hclgevf_misc_irq_init()
  - Revert "net: hns3: initialize reset_timer before hclgevf_misc_irq_init()"
  - net: hns3: Use ARRAY_SIZE() to improve readability
  - Revert "net: hns3: fix spelling mistake "reg_um" -> "reg_num""
  - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  - bpf: consider that tail calls invalidate packet pointers
  - net: stmmac: Fix accessing freed irq affinity_hint
  - mptcp: fix NULL pointer in can_accept_new_subflow
  - tipc: fix memory leak in tipc_link_xmit
  - net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
  - net: mctp: Set SOCK_RCU_FREE
  - usbnet:fix NPE during rx_complete
  - net: ibmveth: make veth_pool_store stop hanging
  - arcnet: Add NULL check in com20020pci_probe()
  - net: fix geneve_opt length integer overflow
  - !16850 [OLK-6.6] Backport TDX HLT/SAFE-HLT fix
  - udp: Fix memory accounting leak.
  - net: mvpp2: Prevent parser TCAM memory corruption
  - sctp: add mutual exclusion in proc_sctp_do_udp_port()
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
  - net: fix NULL pointer dereference in l3mdev_l3_rcv
  - net: dsa: free routing table on probe failure
  - sctp: detect and prevent references to a freed transport in sendmsg
  - net_sched: hfsc: Fix a UAF vulnerability in class handling
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  - net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported
  - net: dsa: clean up FDB, MDB, VLAN entries on unbind
  - !17137 [olk 6.6] net: hibmcge: backport some feature patches
  - xsk: fix an integer overflow in xp_create_and_assign_umem()
  - net: atm: fix use after free in lec_send()
  - eth: bnxt: fix truesize for mb-xdp-pass case
  - !17156  v3:add perpcu stock for kmem
  - scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init()
  - libfs: Fix simple_offset_rename_exchange()
  - shmem: Fix shmem_rename2()
  - mac802154: check local interfaces before deleting sdata list
  - hfs: Sanity check the root record
  - !17109 efi: efi_get_memory_map -- increase map headroom
  - !17148  Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - sched/dynamic_affinity: Calculate cpu capacity in real time when realtime tasks are running on this cpu
  - sched/dynamic_affinity: fix CI test alway select prefer_cpu problem
  - sched/dynamic_affinity: fix preffered_cpu offline problem
  - sched/fair: reset idlest_cpu if not meet the conditions for preferred CPU
  - memcg: add stock for kmem [un]charging
  - memcg: add CONFIG_MEMCG_KMEM_STOCK
  - scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
  - selftests: tc-testing: reduce rshift value
  - media: vivid: Change the siize of the composing
  - f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  - !17124  crypto: algif_hash - fix double free in hash_accept
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock
  - net: hibmcge: configure FIFO thresholds according to the MAC controller documentation
  - net: hibmcge: adjust the burst len configuration of the MAC controller to improve TX performance.
  - net: hibmcge: support scenario without PHY
  - net: phy: fixed_phy: constify status argument where possible
  - net: phy: fixed_phy: remove irq argument from fixed_phy_register
  - efi/libstub: Bump up EFI_MMAP_NR_SLACK_SLOTS to 32
  - net: phy: fixed_phy: remove irq argument from fixed_phy_add
  - net: phy: fixed_phy: remove fixed_phy_register_with_gpiod
  - !17140 v2  Cgroup-Based Interference Statistics followup
  - interference: Add distribution histogram support
  - interference: Use hardware timer counter
  - interference: Add mutex interference track support
  - interference: Add spinlock interference track support
  - interference: Add cgroup_ifs_enter/leave_lock helper
  - interference: Disable irq track when irqtime disabled
  - sw64: delete useless I/O access in VM and emulator
  - sw64: kvm: fix perf kvm support
  - sw64: Kconfig: enable HAS_IOPORT by default
  - sw64: pci: remove zx200 dma mask reset
  - sw64: fix for executing syscall(-1)
  - sw64: acpi: select HAVE_ACPI_APEI when ACPI is set
  - sw64: pci: add base address of devmn
  - sw64: adjust the notrace in the code
  - crypto: algif_hash - fix double free in hash_accept
  - smb: client: fix use-after-free in cifs_oplock_break
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  - smb: client: fix use-after-free in crypt_message when using async crypto
  - ext4: only dirty folios when data journaling regular files
  - Fix kabi for TDX halt/safe-halt
  - fbcon: Make sure modelist not set on unregistered console
  - sw64: irqchip: update effective affinity for PINTC
  - sw64: irqchip: add support for PINTC on all NUMA nodes
  - sw64: cpufreq: optimize the granularity of cpufreq
  - sw64: ftrace: restore the register storing direct call address
  - sw64: kvm: fix undefined compile issues for kvm module
  - sw64: pintc: fix guest pintc init
  - sw64: set module region to the 2GB space below vmalloc area
  - scsi: target: iscsi: Fix timeout on deleted connection
  - wifi: ath9k_htc: Abort software beacon handling if disabled
  - x86/tdx: Fix arch_safe_halt() execution for TDX VMs
  - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT


author: Li Nan <linan122@huawei.com> - 6.6.0-103.0.0.95
changelog:
  - !17341 v7  arm64: Add hardware xcall framework support
  - !17336  fs/resctrl: Enqueue mon_event_count() forcefully for MPAM
  - !17308  arm64: Fix guest app segment fault when disable_sdei_nmi_watchdog
  - arm64: Add hardware xcall framework support
  - arm64: Reserve a kabi in task_struct exclusively for xcall
  - arm64: Refactor the xcall proc code
  - !17259  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - !17335 ROH: fix security issues and eliminate redundancies
  - ROH: fix security issues and eliminate redundancies
  - arm64/mpam: Ensure the err variable is initialized
  - fs/resctrl: Enqueue mon_event_count() forcefully for MPAM
  - !17261 Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - !17296  nvmet-tcp: don't restore null sk_state_change
  - !17299  dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  - !17310  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments
  - !17305  CVE-2025-38264
  - !17303  sched/fair: Only increment deadline once on yield
  - !17266 unify log function usage of enfs
  - arm64: Fix guest app segment fault when disable_sdei_nmi_watchdog
  - nvme-tcp: sanitize request list handling
  - llist: add interface to check if a node is on a list.
  - !17255  inspector: hold module refcnt when cpu inspector is running
  - !17291  libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  - sched/fair: Only increment deadline once on yield
  - nfs/enfs: use enfs_log_error() instead of pr_err() in enfs
  - nfs/enfs: use enfs_log_info() instead of pr_info() in enfs
  - nfs/enfs: cleanups in enfs/shard_route.c
  - nfs/enfs: use enfs_log_debug() instead of pr_debug() to debug enfs
  - nfs/enfs: remove unused code in enfs/dns_internal.h
  - nfs/enfs: use enfs_log_debug() instead of dfprintk() to debug enfs
  - nfs: use dfprintk() to debug enfs
  - !17262 v2  ifs: Defer cgroup ifs enable
  - !17287  i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
  - nvmet-tcp: don't restore null sk_state_change
  - libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
  - !17275  fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  - !17273  atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  - !17246 MPTCP UPTREAM PART25
  - ifs: Defer cgroup ifs enable
  - Fixed the wrong debugfs node name in hisi_spi debugfs initialization
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  - inspector: hold module refcnt when cpu inspector is running
  - selftests: mptcp: join: validate event numbers(part 2)
  - selftests: mptcp: pm_nl_ctl: remove re-definition
  - selftests: mptcp: join: simplify checksum_tests
  - selftests: mptcp: join: mute errors when ran in the background
  - selftests: mptcp: join: specify host being checked
  - selftests: mptcp: join: more explicit check name
  - selftests: mptcp: join: validate MPJ SYN TX MIB counters
  - selftests: mptcp: join: one line for join check
  - selftests: mptcp: join: reduce join_nr params
  - mptcp: MIB counters for sent MP_JOIN
  - mptcp: pm: reduce entries iterations on connect
  - mptcp: pm: fix backup support in signal endpoints
  - mptcp: pm: rename helpers linked to 'flush'
  - mptcp: Remove unused declaration mptcp_sockopt_sync()
  - !17250  arm64/mpam: Fix incorrect CPU-to-partid binding under CDP mode
  - !17253  mm: fix uprobe pte be overwritten when expanding vma
  - !16602 【OLK-6.6】修复虚拟机下使用海光TKM功能可能返回TKM_UNSUPPORTED_CMD错误
  - !16797 【OLK-6.6】修复psp_mutex_lock_timeout超时触发soft lockup警告的问题
  - mm: fix uprobe pte be overwritten when expanding vma
  - arm64/mpam: Fix incorrect CPU-to-partid binding under CDP mode
  - arm64/mpam: Fix typo in resctrl_arch_set_cdp_enabled()
  - drivers/crypto/ccp: fix soft lockup warning in psp_mutex_lock_timeout()
  - crypto: ccp: fix The high priority queue changes cmd_id of the queued elements


author: Li Nan <linan122@huawei.com> - 6.6.0-104.0.0.96
changelog:
  - !17385 mptcp: pm: only set fullmesh for subflow endp
  - !17445  xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
  - !17444  Backport mainline patch
  - !17395  Squashfs: check return result of sb_min_blocksize
  - xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
  - bonding: check xdp prog when set bond mode
  - bonding: return detailed error when loading native XDP fails
  - !17436  i2c/designware: Fix an initialization issue
  - !17432  ACPICA: Refuse to evaluate a method if arguments are missing
  - !17421  ACPICA: fix acpi operand cache leak in dswstate.c
  - !17422  soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  - !17423  net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  - !17301  fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
  - !17304  nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  - !17331  dm-bufio: fix sched in atomic context
  - !17413  CVE-2025-37957
  - !17412 v3  livepatch: support for super-long symbol repositioning
  - !16933  virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
  - !16932  dm: fix unconditional IO throttle caused by REQ_PREFLUSH
  - !17430  drm/v3d: Disable interrupts before resetting the GPU
  - i2c/designware: Fix an initialization issue
  - !17254 irqchip/gic-v3-its: Remove DevID Pool's restriction
  - !17406  usb: net: sierra: check for no status endpoint
  - ACPICA: Refuse to evaluate a method if arguments are missing
  - drm/v3d: Disable interrupts before resetting the GPU
  - !17393  selftests/tracing: Fix false failure of subsystem event test
  - net: stmmac: make sure that ptp_rate is not 0 before configuring EST
  - soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  - ACPICA: fix acpi operand cache leak in dswstate.c
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
  - KVM: SVM: Update SEV-ES shutdown intercepts with more metadata
  - livepatch: support for super-long symbol repositioning
  - usb: net: sierra: check for no status endpoint
  - !17380  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  - mptcp: pm: only set fullmesh for subflow endp
  - !17115  xfs: fix attr inactive issue
  - Squashfs: check return result of sb_min_blocksize
  - selftests/tracing: Fix false failure of subsystem event test
  - !17390  ipvlan: Fix out-of-bound bugs in ipvlan_xmit_mode_l2e()
  - !17387  ipvlan: ensure network headers are in skb linear part
  - ipvlan: Fix out-of-bound bugs in ipvlan_xmit_mode_l2e()
  - !17205 fix some panic bugs and memory leak bugs of enfs
  - ipvlan: ensure network headers are in skb linear part
  - !17271 LoongArch: KVM: Solve the problem of starting up the upstream qemu
  - !17251 migration: update status after RAS error
  - !17278 nvme: update firmware version after commit
  - !17330  livepatch: fix insn length check
  - irqchip/gic-v3-its: Remove DevID Pool's restriction
  - !17372  drm/amd/display: Add null pointer check for get_first_active_display()
  - !17349  bnxt: properly flush XDP redirect lists
  - !17375  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  - !17367  fd/proc: modify xcall proc file permissions to 640
  - !17346  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - !17222  fs: Add additional checks for block devices during mount
  - !17168  xfrm: state: fix out-of-bounds read during lookup
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  - !17141 CVE-2025-37992：net_sched: Flush gso_skb list too during -&gt;change()
  - !17364  net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
  - !17167  eth: bnxt: always recalculate features after XDP clearing, fix null-deref
  - !17371  ext4: inline: fix len overflow in ext4_prepare_inline_data
  - !17362  ucounts: fix mq_perf test error.
  - drm/amd/display: Add null pointer check for get_first_active_display()
  - ext4: inline: fix len overflow in ext4_prepare_inline_data
  - fd/proc: modify xcall proc file permissions to 640
  - !17361  scsi: lpfc: Use memcpy() for BIOS version
  - !17360  net: Fix CVE-2025-21884
  - !17356  serial: jsm: fix NPE during jsm_uart_port_init
  - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
  - ucounts: fix mq_perf test error.
  - scsi: lpfc: Use memcpy() for BIOS version
  - net: better track kernel sockets lifetime
  - net: Add net_passive_inc() and net_passive_dec().
  - !17269 MPTCP UPTREAM PART26
  - !17358  serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
  - !17322  Fix CVE-2025-38424
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs
  - !17342  tls: always refresh the queue when reading sock
  - !17343  Fix WARN in perf_cgroup_switch()
  - !17080  serial: Fix potential null-ptr-deref in mlb_usio_probe()
  - !17351  mm/dynamic_pool: Fix free_huge_pages undefflow problem
  - !17319  mm/dpool: do not use uninitialized variable
  - serial: jsm: fix NPE during jsm_uart_port_init
  - nfs/enfs: remove unnecessary shard_should_stop in shard_route.c
  - mm/dynamic_pool: Fix free_huge_pages undefflow problem
  - !17345 net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs
  - bnxt: properly flush XDP redirect lists
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  - net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs
  - net: hns3: use seq_file for files in common/ of hclge layer
  - net: hns3: use seq_file for files in fd/ in debugfs
  - !17328  perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  - perf/core: Fix the WARN_ON_ONCE is out of lock protected region
  - perf/core: Fix WARN in perf_cgroup_switch()
  - !17324  video: screen_info: Relocate framebuffers behind PCI bridges
  - tls: always refresh the queue when reading sock
  - nvme-host: fix the updating of the firmware version
  - nvme: update firmware version after commit
  - net: hns3: use seq_file for files in reg/ in debugfs
  - net: hns3: use seq_file for files in mac_list/ in debugfs
  - net: hns3: use seq_file for files in tm/ in debugfs
  - net: hns3: use seq_file for files in common/ of hns3 layer
  - net: hns3: use seq_file for files in queue/ in debugfs
  - net: hns3: clean up the build warning in debugfs by use seq file
  - net: hns3: remove tx spare info from debugfs.
  - net: hns3: use string choices helper
  - dm-bufio: fix sched in atomic context
  - livepatch: fix insn length check
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes
  - video: screen_info: Relocate framebuffers behind PCI bridges
  - LoongArch: KVM: Enhance the robustness of extioi
  - perf/core: Fix WARN in perf_sigtrap()
  - perf: Fix sample vs do_exit()
  - mm/dpool: do not use uninitialized variable
  - mptcp: sysctl: blackhole timeout: avoid using current->nsproxy
  - mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
  - doc: mptcp: sysctl: blackhole_timeout is per-netns
  - mptcp: sysctl: avail sched: remove write access
  - mptcp: remove unneeded lock when listing scheds
  - nfs/enfs: remove enfs_uuid_debug in shard_route.c
  - nfs/enfs: remove usage of list_entry_is_head() in shard_route.c
  - sunrpc: remove redundant rpc_task_release_xprt() of enfs
  - nfs/enfs: remove judgement about enfs_option in nfs_multipath_client_info_init()
  - nfs/enfs: remove nfs_multipath_client_info_free_work()
  - nfs/enfs: fix typos in shard_route.c
  - nfs/enfs: remove unused functions in shard_route.c
  - nfs/enfs: make some functions static in shard_route.c
  - nfs/enfs: introduce DEFINE_PARSE_FH_FUNC to define parse_fh()
  - nfs/enfs: fix memory leak when free view_table
  - nfs/enfs: use DEFINE_CLEAR_LIST_FUNC to define enfs_clear_shard_view()
  - nfs/enfs: introduce DEFINE_CLEAR_LIST_FUNC to define enfs_clear_fs_info()
  - nfs/enfs: fix memory leak in enfs_delete_fs_info()
  - nfs/enfs: fix double free of multipath_client_info
  - nfs/enfs: fix null-ptr-deref in shard_update_work()
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  - fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
  - LoongArch: KVM: Solve the problem of starting up the upstream qemu
  - drivers/iommu: Fix the initialization failure issue of the iommu module
  - LoongArch: KVM: Fix the extioi simulation error
  - netlink: specs: mptcp: fix port endianness
  - mptcp: disable active MPTCP in case of blackhole
  - mptcp: include inet_common in mib.h
  - mptcp: move mptcp_pm_gen.h's include
  - mptcp: remove unnecessary else statements
  - mptcp: prefer strscpy over strcpy
  - mptcp: add net.mptcp.available_schedulers
  - mptcp: sockopt: info: stop early if no buffer
  - mptcp: fallback to TCP after SYN+MPC drops
  - mptcp: export mptcp_subflow_early_fallback()
  - selftests: mptcp: connect: remove duplicated spaces in TAP output
  - selftests: mptcp: diag: remove trailing whitespace
  - selftests: mptcp: test last time mptcp_info
  - mptcp: add last time fields in mptcp_info
  - selftests: mptcp: reset the last TS before the first test
  - selftests: mptcp: netlink: drop disable=SC2086
  - selftests: mptcp: ip_mptcp option for more scripts
  - selftests: mptcp: use pm_nl endpoint ops
  - selftests: mptcp: export pm_nl endpoint ops
  - selftests: mptcp: join: update endpoint ops
  - selftests: mptcp: netlink: add change_address helper
  - selftests: mptcp: add {get,format}_endpoint(s) helpers
  - selftests: mptcp: netlink: add 'limits' helpers
  - selftests: mptcp: add tc check for check_tools
  - selftests: mptcp: connect: remote time in TAP output
  - selftests: mptcp: lib: add time per subtests in TAP output
  - migration: update status after RAS error
  - Revert "migration: update status after RAS error"
  - fs: Add additional checks for block devices during mount
  - xfrm: state: fix out-of-bounds read during lookup
  - eth: bnxt: always recalculate features after XDP clearing, fix null-deref
  - net_sched: Flush gso_skb list too during ->change()
  - xfs: handle attr node/leaf blocks atomically during inactive
  - xfs: factor out xfs_attr3_leaf_init
  - xfs: factor out xfs_da3_node_entry_remove
  - Revert "xfs: factor out __xfs_da3_node_read()"
  - Revert "xfs: atomic drop extent entries when inactiving attr"
  - serial: Fix potential null-ptr-deref in mlb_usio_probe()
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH


author: Li Nan <linan122@huawei.com> - 6.6.0-105.0.0.97
changelog:
  - !17513  sched-ebpf-add-for-exec-init
  - !17487  arm64/mpam: Support partial-core boot for MPAM
  - !16844  LeapIOraid: add device and support fw log
  - sched/bpf: Fix kabi breakage for including sched bpf header file
  - sched/ebpf: Add kfunc to set the preferred NUMA node for the task
  - sched/ebpf: Add bpf_sched_cfs_exec_set_cpumask hook
  - !17512  CVE-2025-21868
  - !17498  sched: Support NUMA parallel scheduling for multiple processes
  - !17508  Huawei iBMA: Added support for Hi1712 Chip
  - hv_netvsc: Preserve contiguous PFN grouping in the page buffer array
  - net: use __GENKSYMS__ to revert the kabi change
  - net: allow small head cache usage with large MAX_SKB_FRAGS values
  - Huawei iBMA: Added support for Hi1712 Chip
  - !17501 net: hibmcge: fix rtnl deadlock issue
  - net: hibmcge: fix rtnl deadlock issue
  - net: hibmcge: fix the division by zero issue
  - net: hibmcge: fix the np_link_fail error reporting issue
  - !17459 ROH: fix variable type inconsistency issue
  - sched: Support NUMA parallel scheduling for multiple processes
  - !17183  rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - !17180  atm: Fix NULL pointer dereference
  - !16807 Support RME feature for CCA host
  - !17488  arm64/mpam: Set 1 as the minimum setting value for CMAX
  - arm64/mpam: Set 1 as the minimum setting value for CMAX
  - arm64/mpam: Support partial-core boot for MPAM
  - !17440  sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
  - VirtCCA: Compatible with virtcca macro definitions
  - CCA: Fix cca kabi conflict
  - VirtCCA: Modify openeuler_defconfig
  - Reapply "VirtCCA: cvm support UEFI boot"
  - VirtCCA: Adapt virtcca operations by cca_base.
  - VirtCCA: Adapt realm operations by cca_base.
  - VirtCCA: Add CCA base operations.
  - [v8-43-43]KVM: arm64: Allow activating realms
  - [v8-42-43]KVM: arm64: Expose KVM_ARM_VCPU_REC to user space
  - [v8-40-43]arm64: RME: Provide accurate register list
  - [v8-39-43]arm64: RME: Provide register list for unfinalized RME RECs
  - [v8-38-43]rm64: RME: Configure max SVE vector length for a Realm
  - [v8-37-43]arm64: RME: Propagate max SVE vector length from RMM
  - [v8-36-43]arm64: RME: Initialize PMCR.N with number counter supported by RMM
  - [v8-35-43]arm64: RME: Set breakpoint parameters through  SET_ONE_REG
  - [v8-34-43]arm64: RME: Propagate number of breakpoints and watchpoints to userspace
  - [v8-33-43]arm64: RME: Hide KVM_CAP_READONLY_MEM for realm guests
  - [v8-32-43]arm64: rme: Enable PMU support with a realm guest
  - [backport]KVM: arm64: PMU: Introduce helpers to set the guest's PMU
  - [backport]KVM: arm64: PMU: Allow userspace to limit PMCR_EL0.N for the guest
  - !17463  crypto: hisilicon/qm - clear the memory before enabling the device
  - [backport]KVM: arm64: PMU: Set PMCR_EL0.N for vCPU  based  on the  associated PMU
  - [v8-31-43]arm_pmu: Provide a mechanism for disabling the physical  IRQ
  - [v8-30-43]arm64: RME: Prevent Device mappings for Realms
  - [v8-29-43]arm64: RME: Always use 4k pages for realms
  - [v8-28-43]arm64: RME: Allow checking SVE on VM instance
  - [v8-27-43]arm64: RME: support RSI_HOST_CALL
  - [v8-26-43]arm64: RME: allow userspace to inject aborts
  - [v8-25-43]arm64: Don't expose stolen time for realm guests
  - [v8-24-43]KVM: arm64: WARN on injected undef exceptions
  - [v8-23-43]KVM: arm64: Handle Realm PSCI requests
  - [v8-22-43]KVM: arm64: Validate register access for a Realm VM
  - [v8-21-43]KVM: arm64: Handle realm VCPU load
  - [v8-20-43]arm64: RME: Runtime faulting of memory
  - [backport]KVM: arm64: Move pagetable definitions to common header
  - [backport]rme: populate guest memory region without guest_memfd
  - [v8-19-43]arm64: RME: Allow populating initial contents
  - [v8-18-43]KVM: arm64: Handle realm MMIO emulation
  - [v8-17-43]arm64: RME: Handle RMI_EXIT_RIPAS_CHANGE
  - [v8-16-43]arm64: RME: Handle realm enter/exit
  - [v8-15-43]arm64: RME: Allow VMM to set RIPAS
  - [backport]KVM: Add member to struct kvm_gfn_range to indicate private/shared
  - [v8-14-43]KVM: arm64: Support timers in realm RECs
  - [v8-13-43]arm64: RME: Support for the VGIC in realms
  - [backport]KVM: arm64: Force GICv3 trap activation when no irqchip  is configured on VHE
  - [v8-12-43]KVM: arm64: vgic: Provide helper for number of list registers
  - [v8-11-43]arm64: RME: Allocate/free RECs to match vCPUs
  - [backport]KVM: arm64: Add generic check for system-supported vCPU features
  - !17467  arm-smmu-v3: adjust ecmdq log level
  - arm-smmu-v3: adjust ecmdq log level
  - crypto: hisilicon/qm - clear the memory before enabling the device
  - [v8-10-43]arm64: RME: RTT tear down
  - [v8-09-43]KVM: arm64: Allow passing machine type in KVM creation
  - [v8-08-43]kvm: arm64: Don't expose debug capabilities for realm  guests
  - [v8-07-43]arm64: RME: ioctls to create and configure  realms
  - [v8-06-43]arm64: RME: Define the user ABI
  - [v8-05-43]arm64: RME: Check for RME support at KVM init
  - [v8-04-43]arm64: RME: Add wrappers for RMI calls
  - [v8-03-43]arm64: RME: Add SMC definitions for calling the RMM
  - [v8-02-43]arm64: RME: Handle Granule Protection Faults (GPFs)
  - [v8-01-43]kvm: arm64: Include kvm_emulate.h in kvm/arm_psci.h
  - Revert "kvm: add virtcca cvm host feature"
  - Revert "VirtCCA: cvm support UEFI boot"
  - Revert "pmu: enable pmu phys irq inject for cvm"
  - !16720 [OLK-6.6] Not print information of SMMU 0x10 event and add phytium PS24080 SoC platform judgement
  - !17458 v2  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - ROH: fix variable type inconsistency issue
  - !17441 net: hibmcge: support for statistics of reset failures
  - !17435 arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  - net: hibmcge: support for statistics of reset failures
  - sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
  - arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported
  - atm: Fix NULL pointer dereference
  - LeapIOraid: add device and support fw log
  - iommu: smmuv3: Not print information of SMMU 0x10 event


author: Li Nan <linan122@huawei.com> - 6.6.0-106.0.0.98
changelog:
  - !17565  Enhance soft hwpoison handling and injection
  - !17569  drm/vkms: Fix use after free and double free on init error
  - drm/vkms: Fix use after free and double free on init error
  - !17564  bpf: Reject %p% format string in bprintf-like helpers
  - !17510 PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - !17547  net_sched: drr: Fix double list add in class with netem as child qdisc
  - !17556  filemap: move prefaulting out of hot write path
  - mm/memory-failure: send SIGBUS in the event of thp split fail
  - mm/memory-failure: move hwpoison_filter() higher up
  - mm/memory-failure: improve memory failure action_result messages
  - mm/madvise: add MF_ACTION_REQUIRED to madvise(MADV_HWPOISON)
  - mm/memory-failure: try to send SIGBUS even if unmap failed
  - PM / devfreq: Add HiSilicon uncore frequency scaling driver
  - !17529 mm: optimize mremap() by PTE batching
  - !17481  HID: core: fix __hid_request when no report ID is used
  - bpf: Reject %p% format string in bprintf-like helpers
  - !17495 v2  mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
  - !17546  net_sched: qfq: Fix double list add in class with netem as child qdisc
  - !17542  net: sch: Fix CVE-2025-37798
  - !17538  wifi: at76c50x: fix use after free access in at76_disconnect
  - !17537  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - !17553 RDMA/hns: Fix dip entries leak on devices newer than hip09
  - filemap: move prefaulting out of hot write path
  - RDMA/hns: Fix dip entries leak on devices newer than hip09
  - RDMA/hns: Fix querying wrong SCC context for DIP algorithm
  - !17479 fix some bugs of enfs
  - !17530  sched/psi: change permissions of /proc/pressure/stat
  - net_sched: drr: Fix double list add in class with netem as child qdisc
  - net_sched: qfq: Fix double list add in class with netem as child qdisc
  - mm/mremap: avoid expensive folio lookup on mremap folio pte batch
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  - sch_htb: make htb_deactivate() idempotent
  - sch_htb: make htb_qlen_notify() idempotent
  - sch_drr: make drr_qlen_notify() idempotent
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - sch_qfq: make qfq_qlen_notify() idempotent
  - sch_ets: make est_qlen_notify() idempotent
  - wifi: at76c50x: fix use after free access in at76_disconnect
  - net: vlan: Fix kabi breakage of struct vlan_info
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  - sched/psi: change permissions of /proc/pressure/stat
  - mm: optimize mremap() by PTE batching
  - !17526 v7  High Performance Container Resource View Isolation -- Stage 2
  - !17515 gpiolib: Get rid of never false gpio_is_valid() calls
  - mm: call pointers to ptes as ptep
  - !17519  CVE-2025-38473
  - !17524  CVE-2025-38375
  - !17517  CVE-2025-38251
  - !17523  CVE-2025-38211
  - samples/bpf: Add iterator program for meminfo
  - bpf-rvi: Add bpf_x86_direct_pages kfunc
  - bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc
  - bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc
  - bpf-rvi: Add bpf_mem_percpu kfunc
  - bpf-rvi: Add bpf_mem_failure kfunc
  - bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc
  - bpf-rvi: Add bpf_mem_{total,free}cma kfunc
  - bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc
  - samples/bpf: Add iterator program for stat
  - bpf-rvi: stat: Add stat iterator target
  - bpf-rvi: Add kstat_ & kcpustat_ kfuncs
  - bpf-rvi: Add cpu runqueue related kfuncs
  - bpf-rvi: Add stat-related misc kfuncs
  - bpf-rvi: Add bpf_seq_file_append() kfunc
  - samples/bpf: Add iterator program for swaps
  - bpf-rvi: Add bpf_page_counter_read() kfunc
  - bpf-rvi: Add bpf_si_memswinfo() kfunc
  - samples/bpf: Add iterator program for uptime
  - bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc
  - samples/bpf: Add iterator program for loadavg
  - bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs
  - bpf-rvi: pidns: Calculate loadavg for each pid namespace
  - samples/bpf: Add iterator program for partitions
  - bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions
  - bpf-rvi: block: Add partitions iterator target
  - samples/bpf: Add iterator program for diskstats
  - bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc
  - bpf-rvi: block: Add diskstats iterator target
  - samples/bpf: Add iterator program for cpuinfo_arm64
  - bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64
  - bpf-rvi: arm64: Add cpuinfo_arm64 iterator target
  - bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc
  - bpf-rvi: cpuacct: Add task_cpuacct()
  - bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc
  - bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc
  - bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc
  - bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc
  - bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask()
  - virtio-net: ensure the received length does not exceed allocated size
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  - nfs/enfs: make some functions static in enfs_multipath_client.c
  - nfs/enfs: remove enfs_init() and enfs_fini()
  - nfs/enfs: format get_ip_to_str() in shard_route.c
  - nfs/enfs: unlock uniformly at the end of function in shard_route.c
  - nfs/enfs: support debugging ip and dns list
  - nfs/enfs: fix error when showing dns list
  - nfs/enfs: fix alignment between struct rpc_clnt and rpc_clnt_reserve
  - nfs/enfs: set CONFIG_SUNRPC_ENFS=y by default
  - nfs/enfs: fix memory leak of shard_view_ctrl when removing nfs module
  - atm: clip: prevent NULL deref in clip_push()
  - gpiolib: Get rid of never false gpio_is_valid() calls
  - Revert "PM / devfreq: Add HiSilicon uncore frequency scaling driver"
  - mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
  - HID: core: do not bypass hid_hw_raw_request
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID


author: Li Nan <linan122@huawei.com> - 6.6.0-107.0.0.99
changelog:
  - !17744  trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17737 soc cache: Fix incorrect error path of ioctl
  - !17660  cgroup/cpuset: Support dynamic affinity feature
  - !17293 [OLK-6.6] backport important bugfix for Broadcom BCM57414 nic driver from upstream linux-6.6.y
  - !17747  fix some CVE
  - !17751  iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
  - !17730  arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  - !16545  KVM: arm64: fix memory leak in TLBI
  - iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
  - !17716  hrtimers: Update new CPU's next event in hrtimers_cpu_dying()
  - !17669  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - !17674  ftrace: Also allocate and copy hash for reading of filter files
  - !17725  perf/core: Don't leak AUX buffer refcount on allocation failure
  - usb: xhci: Fix invalid pointer dereference in Etron workaround
  - thunderbolt: Do not double dequeue a configuration request
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
  - mm: memory-failure: update ttu flag inside unmap_poisoned_folio
  - Bluetooth: btnxpuart: Fix kernel panic during FW release
  - !17592  ice: add NULL check in eswitch lag check
  - trace/fgraph: Fix the warning caused by missing unregister notifier
  - !17720  crypto: lzo - Fix compression buffer overrun
  - !17719  spi: spi-imx: Add check for spi_imx_setupxfer()
  - !17687  ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  - soc cache: Fix incorrect error path of ioctl
  - soc cache: Fix incorrect size validation
  - soc cache: Enforce maintain type check
  - !17683 v2  Fix for bpf samples and selftests
  - !17724  mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
  - !17438 [OLK-6.6]:update patches for sw64 architecture
  - !17652  wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
  - !17728  CVE-2025-38006
  - !17677 v2  Fix static check warning reported by coccinelle
  - !17633  dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
  - !17455  raid10: cleanup memleak at raid10_make_request
  - !17453  md/raid1: Fix stack memory use after return in raid1_reshape
  - arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
  - net: mctp: Don't access ifa_index when missing
  - mctp: no longer rely on net->dev_index_head[]
  - perf/core: Don't leak AUX buffer refcount on allocation failure
  - mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
  - !17606  drm/sched: Increment job count before swapping tail spsc queue
  - !17671  bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks
  - crypto: lzo - Fix compression buffer overrun
  - spi: spi-imx: Add check for spi_imx_setupxfer()
  - hrtimers: Update new CPU's next event in hrtimers_cpu_dying()
  - !17632  perf/core: Exit early on perf_mmap() fail
  - ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  - samples/bpf: Move bpf_rvi_* progs to bpf_rvi directory
  - selftests/bpf: fix perf_event link info name_len assertion
  - Revert "selftests/bpf: Use bpf_link__destroy in fill_link_info tests"
  - Revert "selftests/bpf: Add cookies check for perf_event fill_link_info test"
  - Revert "selftests/bpf: fix perf_event link info name_len assertion"
  - !17650 net: phy: motorcomm: Add support for PHY LEDs on YT8521
  - !17634  HID: pidff: Fix null pointer dereference in pidff_find_fields
  - ACPI / MPAM: Fix wrong IS_ERR() check in _parse_table()
  - hiroce3: Use IS_ERR() to check the return value of kthread_run()
  - ftrace: Also allocate and copy hash for reading of filter files
  - bpf-rvi: pidns: fix null-pointer-derefence in pidns_update_load_tasks
  - !17642  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - !17641  net: clear the dst when changing skb protocol
  - !17653  wifi: iwlwifi: fix debug actions order
  - !17651  wifi: mt76: disable napi on driver removal
  - !17647  CVE-2025-38052
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  - cgroup/cpuset: Support dynamic affinity feature
  - !17646  sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  - !17648  CVE-2025-37920
  - !17643  net: Fix TOCTOU issue in sk_is_readable()
  - !17644  bridge: mcast: Fix use-after-free during router port configuration
  - !17645  CVE-2025-38465
  - !17600  two bugfix for arm64 support HVO
  - !17649  Fix CVE-2025-21839
  - !17628  Fix CVE-2025-37780
  - !17629  Fix CVE-2025-37767
  - !17637  netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  - !17638  tcp: Correct signedness in skb remaining space calculation
  - !17639  tipc: Fix use-after-free in tipc_conn_close().
  - !17640  seg6: Fix validation of nexthop addresses
  - wifi: iwlwifi: fix debug actions order
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
  - wifi: mt76: disable napi on driver removal
  - net: phy: motorcomm: Add support for PHY LEDs on YT8521
  - !17608  mm/util: make memdup_user_nul() similar to memdup_user()
  - net: hns3: change the function return type from int to bool
  - KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
  - xsk: Fix kabi broken
  - xsk: Fix race condition in AF_XDP generic RX path
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  - netlink: avoid infinite retry looping in netlink_unicast()
  - netlink: make sure we allow at least one dump skb
  - netlink: Fix rmem check in netlink_broadcast_deliver().
  - netlink: Fix wraparounds of sk->sk_rmem_alloc.
  - bridge: mcast: Fix use-after-free during router port configuration
  - net: Fix TOCTOU issue in sk_is_readable()
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  - net: clear the dst when changing skb protocol
  - seg6: Fix validation of nexthop addresses
  - tipc: Fix use-after-free in tipc_conn_close().
  - tcp: Correct signedness in skb remaining space calculation
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
  - HID: pidff: Fix null pointer dereference in pidff_find_fields
  - dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
  - !17597 Delete PHYTIUM_CPU_PART_FTC862 macro
  - perf/core: Exit early on perf_mmap() fail
  - drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
  - isofs: Prevent the use of too small fid
  - !17307  scsi: megaraid_sas: Fix invalid node index
  - !17309  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  - mm/util: make memdup_user_nul() similar to memdup_user()
  - drm/sched: Increment job count before swapping tail spsc queue
  - !17575  net/sched: Fix CVE-2025-37890
  - arm64: mm: HVO: fix deadlock in split vmemmap pmd
  - mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86
  - cputype: phytium: Delete PHYTIUM_CPU_PART_FTC862 macro
  - ice: add NULL check in eswitch lag check
  - !16528 [OLK-6.6] dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - !17570  tracing: Add down_write(trace_event_sem) when adding trace event
  - net/sched: ets: use old 'nbands' while purging unused classes
  - net/sched: Always pass notifications when child class becomes empty
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  - tracing: Add down_write(trace_event_sem) when adding trace event
  - sw64: ptrace: return -EIO in invalid PEEKUSR/POKEUSR requests
  - sw64: kvm: fix missing kvm_unregister_perf_callbacks
  - sw64: kvm: fix compile error of kvm.ko
  - sw64: kvm: remove the duplicated Kconfig selection of KVM
  - sw64: cpuidle: add dedicated driver
  - sw64: fix missing characters for sw64_rrk
  - sw64: selftests/net: add sw64 support for io_uring_zerocopy_tx
  - sw64: crypto: implement crc32 assembly optimization
  - sw64: efi: remove meaningless code from asm/efi.h
  - sw64: fix incorrect macro definitions for sw64 in bpf_tracing.h
  - sw64: cpufreq: using PLL0 to provide clock for idle cores
  - sw64: kvm: save the virtual address of irqs_pending in vcpucb
  - sw64: kvm: fix undefined error with ftrace disabled
  - raid10: cleanup memleak at raid10_make_request
  - md/raid1: Fix stack memory use after return in raid1_reshape
  - sw64: kvm: enable dirty log gradually in small chunks for core4
  - sw64: fix guest kdump function
  - sw64: ftrace: add HAVE_DYNAMIC_FTRACE_WITH_ARGS support
  - sw64: use wait/complete for smp boot
  - sw64: fix sw64_rrk_store() wrap handling
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  - scsi: megaraid_sas: Fix invalid node index
  - bnxt: properly flush XDP redirect lists
  - dma: phyitum: enable CONFIG_PHYTIUM_ERRATUM_FT3386
  - dma: Fix kabi breakage due to "dma: pswiotlb: Move platform-identification to cpu errata"
  - dma: pswiotlb: Move platform-identification to cpu errata
  - dma: pswiotlb: Move pswiotlb dma functions behind dma_map_ops
  - dma: phyitum: enable CONFIG_PSWIOTLB
  - dma: Fix kabi breakage due to "dma: phytium: Add PSWIOTLB mechanism to improve DMA performance"
  - dma: phytium: Add PSWIOTLB mechanism to improve DMA performance
  - KVM: arm64: fix memory leak in TLBI


author: Li Nan <linan122@huawei.com> - 6.6.0-108.0.0.100
changelog:
  - !17835 v2  perf/aux: Fix pending disable flow when the AUX ring buffer overruns
  - !17856  sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
  - !17635 mm: madvise: use per_vma lock for MADV_FREE
  - sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
  - !17841  fs/resctrl: Fix max_threshold_occupancy write operation
  - !17844  CVE-2025-37752
  - !17845  xfrm: interface: fix use-after-free after changing collect_md xfrm interface
  - !17733  proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
  - !17834  cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface
  - net_sched: sch_sfq: move the limit validation
  - net_sched: sch_sfq: use a temporary work area for validating configuration
  - !17840  arm64/mpam: Fix num_rmids when enable CDP mode
  - fs/resctrl: Fix max_threshold_occupancy write operation
  - arm64/mpam: Fix num_rmids when enable CDP mode
  - !17838  mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
  - mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
  - !17587 CVE-2025-38406: wifi: ath6kl: remove WARN on bad firmware input
  - !17585 CVE-2025-38408： genirq/irq_sim: Initialize work context pointers properly
  - !17586 CVE-2025-38409: drm/msm: Fix another leak in the submit error path
  - !17584 CVE-2025-38410: drm/msm: Fix a fence leak in submit error path
  - !17582 NFC: nci: uart: Set tty-&gt;disc_data only in success path
  - !17590 wifi: carl9170: do not ping device which has failed to load firmware
  - !17593 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  - !17594 CVE-2025-38425: i2c: tegra: check msg length in SMBUS block read
  - !17595 Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  - !17596 usb: gadget: u_serial: Fix race condition in TTY wakeup
  - !17583 CVE-2025-38467：drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  - perf/aux: Fix pending disable flow when the AUX ring buffer overruns
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  - !17789  bpf, sockmap: Fix CVE-2025-38154
  - !17712  wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  - !17790  page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - !17788  netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  - !17786  net: xfrm: Fix CVE-2025-38097
  - !17784  bpf, sockmap: Fix panic when calling skb_linearize
  - !17785  bpf: fix ktls panic with sockmap
  - !17783  net/sched: fix use-after-free in taprio_dev_notifier
  - !17781  mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  - !17782  net/mlx5e: Disable MACsec offload for uplink representor profile
  - !17780  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
  - !17779  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - !17778  phy: tegra: xusb: remove a stray unlock
  - !17777  net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
  - !17776  dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
  - !17775  espintcp: fix skb leaks
  - !17774  can: bcm: add locking for bcm_op runtime updates
  - !17711  net: lan743x: Fix memleak issue when GSO enabled
  - !17708  net: phy: Fix CVE-2025-37945
  - !17707  bpf: Scrub packet on bpf_redirect_peer
  - !17703  9p/net: fix improper handling of bogus negative read/write replies
  - !17699  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  - !17685  gtp: Fix CVE-2025-21678
  - !17816  vmci: Prevent the dispatching of uninitialized payloads
  - !17824  tracing/probes: Avoid using params uninitialized in parse_btf_arg()
  - !17609 cpufreq: Exit governor when failed to start old governor
  - !17823  arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize
  - tracing/probes: Avoid using params uninitialized in parse_btf_arg()
  - !17821  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - arm64/mpam: Fix the logic that determines whether an MPAM MSC should initialize
  - mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  - !17818  fix some CVEs
  - !17798  benet: fix BUG when creating VFs
  - mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
  - mm/vmscan: don't try to reclaim hwpoison folio
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
  - memblock: Accept allocated memory before use in memblock_double_array()
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails
  - Input: synaptics - use guard notation when pausing serio port
  - vmci: Prevent the dispatching of uninitialized payloads
  - !17804  pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17800  gic: increase the arch_timer
  - !17794  perf/core: Prevent VMA split of buffer mappings
  - !17574 ROH: Add crc_err_cnt and retry_cnt mib statistics
  - pinmux: fix race causing mux_owner NULL with active mux_usecount
  - !17337 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.64-6.6.66 LTS Conflicts Patches
  - !17797 v3  HiSock Redirect Framework
  - gic: increase the arch_timer priority to avoid hardlockup
  - benet: fix BUG when creating VFs
  - !17768  net/oenetcls: introduce oenetcls for network optimization
  - ROH: Add crc_err_cnt and retry_cnt mib statistics
  - samples/bpf: Add HiSock Redirect sample
  - openeuler_defconfig: Enable CONFIG_HISOCK
  - bpf: Add bpf_*_change_dev kfunc
  - bpf: Add bpf_xdp_set_ingress_dst kfunc
  - bpf: Add hisock_xdp_buff wrapper for xdp_buff
  - bpf: Add bpf_skops_get_ingress_dst kfunc
  - bpf: Enable generic kfuncs for BPF_CGROUP_* programs
  - bpf: Add HISOCK_EGRESS hook on network egress path
  - bpf: Add BPF_PROG_TYPE_HISOCK prog type
  - bpf: Add XDP_HISOCK_REDIRECT action
  - bpf: Add CONFIG_HISOCK
  - !17470  fix CVE-2025-38351
  - !17766 RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - !17772  two CVE fix
  - perf/core: Prevent VMA split of buffer mappings
  - !17659 v2  sched: More flexible use of CPU quota when CPU is idle
  - !17748  fix bug in hdbss
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring
  - bpf, sockmap: Avoid using sk_socket after free when sending
  - bpf, sockmap: fix duplicated data transmission
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
  - net: xfrm: Fix kabi breakage of struct xfrm_state
  - espintcp: remove encap socket caching to avoid reference leak
  - !17294 [OLK-6.6] backport important bugfix for lpfc driver from upstream linux-6.6.y
  - !17714  can: bcm: add missing rcu read protection for procfs content
  - !17713  net: phy: leds: fix memory leak
  - !17717  ipvs: fix uninit-value for saddr in do_output_route4
  - !17706  RDMA/cma: Fix CVE-2025-37772
  - !17709  bnxt_en: Fix CVE-2025-37911
  - !17705  igc: fix PTM cycle trigger logic
  - !17718  ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  - !17701  net: openvswitch: fix nested key length validation in the set() action
  - !17702  net: ppp: Add bound checking for skb data on ppp_sync_txmung
  - !17704  page_pool: avoid infinite loop to schedule delayed worker
  - !17700  wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  - !17697  netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - !17715  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  - !17696  net: decrease cached dst counters in dst_release
  - !17695  netfilter: nf_tables: don't unregister hook when table is dormant
  - !17694  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  - !17693  drm/connector: Fix CVE-2025-22089
  - !17692  vmxnet3: unregister xdp rxq info in the reset path
  - !17690  Bluetooth: Fix error code in chan_alloc_skb_cb()
  - !17689  tcp: Fix CVE-2025-21864
  - !17741  Fix trace may OOB when trace_get_user failed
  - !17742  i2c: qup: jump out of the loop in case of timeout
  - !17678  dm cache: prevent BUG_ON by blocking retries on failed device resumes
  - !17679  media: cx231xx: set device_caps for 417
  - bpf: fix ktls panic with sockmap
  - bpf, sockmap: Fix panic when calling skb_linearize
  - net/sched: fix use-after-free in taprio_dev_notifier
  - net/mlx5e: Disable MACsec offload for uplink representor profile
  - mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  - phy: tegra: xusb: remove a stray unlock
  - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled
  - dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
  - espintcp: fix skb leaks
  - can: bcm: add locking for bcm_op runtime updates
  - net: libwx: fix the using of Rx buffer DMA
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  - !9218 [OLK-6.6] i2c/zhaoxin: I2C controller driver enhancement and optimization
  - !17755  arm64: perf: Add support for HIP12 hw metric
  - !17763  mm/smaps: fix race between smaps_hugetlb_range and migration
  - net/oenetcls: introduce oenetcls for network optimization
  - RDMA/hns: Fix bond not cleared when the configuration becomes invalid
  - mm/smaps: fix race between smaps_hugetlb_range and migration
  - fs/proc/task_mmu: convert smaps_hugetlb_range() to work on folios
  - i2c: zhaoxin: Add support for Zhaoxin I2C controller
  - arm64: perf: Add support for HIP12 hw metric
  - KVM: arm64: fix memory leak in HDBSS
  - KVM: arm64: do not support hdbss in nvhe
  - i2c: qup: jump out of the loop in case of timeout
  - tracing: Limit access to parser->buffer when trace_get_user failed
  - tracing: Remove unneeded goto out logic
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
  - ipvs: fix uninit-value for saddr in do_output_route4
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  - can: bcm: add missing rcu read protection for procfs content
  - net: phy: leds: fix memory leak
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  - net: lan743x: Fix memleak issue when GSO enabled
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w
  - bnxt_en: Fix coredump logic to free allocated buffer
  - genirq/irq_sim: Initialize work context pointers properly
  - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
  - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend()
  - bpf: Scrub packet on bpf_redirect_peer
  - RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
  - RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
  - igc: fix PTM cycle trigger logic
  - page_pool: avoid infinite loop to schedule delayed worker
  - 9p/net: fix improper handling of bogus negative read/write replies
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung
  - net: openvswitch: fix nested key length validation in the set() action
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  - netfilter: socket: Lookup orig tuple for IPv6 SNAT
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition
  - net: decrease cached dst counters in dst_release
  - netfilter: nf_tables: don't unregister hook when table is dormant
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  - drm/connector: fix kabi broken in struct ib_device
  - RDMA/core: Don't expose hw_counters outside of init net namespace
  - vmxnet3: unregister xdp rxq info in the reset path
  - Bluetooth: Fix error code in chan_alloc_skb_cb()
  - net: use __GENKSYMS__ to revert the kabi change
  - tcp: drop secpath at the same time as we currently drop dst
  - gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
  - gtp: Destroy device along with udp socket's netns dismantle.
  - media: cx231xx: set device_caps for 417
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes
  - sched: More flexible use of CPU quota when CPU is idle
  - mm: fix the race between collapse and PT_RECLAIM under per-vma lock
  - mm: madvise: use per_vma lock for MADV_FREE
  - mm: use per_vma lock for MADV_DONTNEED
  - mm: madvise: use walk_page_range_vma() instead of walk_page_range()
  - cpufreq: Exit governor when failed to start old governor
  - cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq()
  - cpufreq: Init policy->rwsem before it may be possibly used
  - cpufreq: Initialize cpufreq-based frequency-invariance later
  - cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost
  - cpufreq: Remove duplicate check in __cpufreq_offline()
  - cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs
  - cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em()
  - cpufreq: CPPC: Do not return a value from populate_efficiency_class()
  - cpufreq: CPPC: Remove cpu_data_list
  - cpufreq: CPPC: Remove forward declaration of hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in hisi_cppc_cpufreq_get_rate()
  - cpufreq: cppc: Fix invalid return value in .get() callback
  - i2c: tegra: check msg length in SMBUS block read
  - drm/msm: Fix another leak in the submit error path
  - wifi: ath6kl: remove WARN on bad firmware input
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
  - KVM: x86: model canonical checks more precisely
  - KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks
  - KVM: x86: Route non-canonical checks in emulator through emulate_ops
  - KVM: x86: drop x86.h include from cpuid.h
  - KVM: x86: Bury guest_cpuid_is_amd_or_hygon() in cpuid.c
  - KVM: SVM: Emulate SYSENTER RIP/RSP behavior for all Intel compat vCPUs
  - KVM: x86: Inhibit code #DBs in MOV-SS shadow for all Intel compat vCPUs
  - KVM: x86: Apply Intel's TSC_AUX reserved-bit behavior to Intel compat vCPUs
  - KVM: x86/pmu: Squash period for checkpointed events based on host HLE/RTM
  - ALSA: hda: Fix build error without CONFIG_SND_DEBUG
  - ALSA: hda/conexant: Use the new codec SSID matching
  - ALSA: hda: Use own quirk lookup helper
  - scsi: lpfc: Use memcpy() for BIOS version
  - Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  - usb: gadget: u_serial: Fix race condition in TTY wakeup
  - net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
  - wifi: carl9170: do not ping device which has failed to load firmware
  - drm/msm: Fix a fence leak in submit error path
  - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  - NFC: nci: uart: Set tty->disc_data only in success path


author: renmingshuai <renmingshuai@huawei.com> - 0.10.5-2
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
  - SUG:NA
  - DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
changelog:
  - Type:CVE
  - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372


